JS 逆向 --- 过无限debugge、hook、js混淆还原、控制流混淆

╰+攻爆jí腚メ 2023-01-20 04:57 77阅读 0赞

访问这个网站的时候，cookie 里面会有一个 sign 值，这个sign 值是通过 JavaScript 代码生成的，JS 代码是用 ob 混淆的，

![20210511140653325.png][]

当打开 "开发者工具" 时，会直接进入 "无限 debugger" 模式，过无限debugger 模式这里有三种方法

*  **方法 1**.  直接 "**从不在此处断点**"
 *  **方法 2**.  查看调用堆栈，把进入无限 debugger 的那个函数在console中重新定义，把函数置空
 *  **方法 3**.  通过中间人攻击，替换 JavaScript 代码文件成本地文件，在本地文件中把 无限debugger 功能去掉（ 注释掉 ）。  
        这种方法可以进行本地断点调试，和实时验证逆向的代码逻辑

这里使用 **方法 3**，把网站返回的混淆后的JS代码拿下来，放到 demo.html 文件里面，并用 <script></script>  包括，同时，把 hook cookie 的代码和框架代码也放里面，并放在 混淆代码之前

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70][]

hook cookie 的代码：

hook 框架的代码：

*  **hook 和 AOP**：**Hooker JS**：**[https://gitee.com/HGJing/hooker-js][https_gitee.com_HGJing_hooker-js]**

demo.html 文件构造好后，打开 fiddler ---> AutoResponder，添加规则，

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70 1][]

chrome 打上 script 断点，然后访问目标网站，即可断下

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70 2][]

可以看到访问 JS 时，已经变成我们本地的 demo.html 文件了。然后去掉 script 断点，继续运行，会进入 无限debugger 模式，可以在本地文件中找到无限 debugger 的函数，直接注释掉，或者删除即可，也可以在console直接置空，更简单的是直接 "never pause here"，这里使用 "never pause here" 然后继续运行，等待一会会直接进入 hook cookie 的 set 函数中，查看调用堆栈，即可找到关键位置

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70 3][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70 4][]

关键 JS 代码：\_0x521302\[$\_0x5780('\\x30\\x78\\x37\\x38', '\\x4f\\x71\\x6c\\x44') + '\\x65\\x4c'\](\_0x30c194, \_0x521302\['\\x48\\x43\\x54' + '\\x65\\x4c'\](\_0x451a25, \_0x521302\['\\x55\\x64\\x79' + '\\x56\\x42'\](\_0x1af341)))

*  $\_0x5780('\\x30\\x78\\x37\\x38', '\\x4f\\x71\\x6c\\x44') + '\\x65\\x4c' 放到 console 里面执行得到 "HCTeL"
 *  '\\x48\\x43\\x54' + '\\x65\\x4c' 放到 console 里面执行得到 "HCTeL"
 *  '\\x55\\x64\\x79' + '\\x56\\x42' 放到 console 里面执行得到 "UdyVB"

所以关键代码可以还原为：\_0x521302\["HCTeL"\](\_0x30c194, \_0x521302\["HCTeL"\](\_0x451a25, \_0x521302\["UdyVB"\](**\_0x1af341**)))

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70 5][]

继续还原 **\_0x1af341**，在 console 中执行，可以发现 是一个函数，执行 toString() 方法，打印方法内容。

![20210511151220854.png][]

function \_0x1af341(\_0x250d81)\{return new Date()\[$\_0x5780('\\x30\\x78\\x37\\x65','\\x64\\x24\\x75\\x57')+$\_0x5780('\\x30\\x78\\x63\\x30','\\x69\\x7a\\x39\\x37')+'\\x66'\]();\}

上面函数继续进行还原：$\_0x5780('\\x30\\x78\\x37\\x65','\\x64\\x24\\x75\\x57')+$\_0x5780('\\x30\\x78\\x63\\x30','\\x69\\x7a\\x39\\x37')+'\\x66' 执行后得到 "valueOf"，

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70 6][]

所以上面方法可以还原为：function \_0x1af341(\_0x250d81)\{return new Date().valueOf();\}

现在还原 \_0x521302\["UdyVB"\] 方法：执行 \_0x521302\["UdyVB"\].toString()

![20210511151809488.png][]

可以看到这个函数传递了一个参数，这个参数执行了一个函数，函数体是返回函数执行后的结果。

所以 \_0x521302\["HCTeL"\](\_0x30c194, \_0x521302\["HCTeL"\](\_0x451a25, \_0x521302\["UdyVB"\](**\_0x1af341**)))

可以还原为  \_0x521302\["HCTeL"\](\_0x30c194, \_0x521302\["HCTeL"\](\_0x451a25, \_0x1af341()))

再进一步还原：\_0x521302\["HCTeL"\](\_0x30c194, \_0x521302\["HCTeL"\](\_0x451a25, new Date().valueOf()))  ，验证还原结果：

![20210511152215504.png][]

按照上面方法在进一步还原：\_0x30c194(\_0x451a25(new Date().valueOf()))

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70 7][]

现在只需要分析 \_0x30c194、\_0x451a25 ，先看下 \_0x451a25 函数的 toString() ：function \_0x451a25(\_0x787271)\{return \_0x521302\[$\_0x5780('\\x30\\x78\\x31\\x33\\x65','\\x52\\x5a\\x77\\x72')+'\\x66\\x4d'\](\_0x521302\[$\_0x5780('\\x30\\x78\\x34\\x35','\\x4b\\x73\\x48\\x58')+'\\x66\\x4d'\](\_0x521302\[$\_0x5780('\\x30\\x78\\x31\\x33\\x65','\\x52\\x5a\\x77\\x72')+'\\x66\\x4d'\](\_0x521302\[$\_0x5780('\\x30\\x78\\x61\\x31','\\x29\\x72\\x71\\x78')+'\\x72\\x6d'\],\_0x787271)+'\\x7e',\_0x521302\[$\_0x5780('\\x30\\x78\\x31\\x32','\\x71\\x75\\x31\\x47')+'\\x41\\x75'\](\_0x5b6292,\_0x787271)),\_0x521302\[$\_0x5780('\\x30\\x78\\x66\\x33','\\x30\\x33\\x4e\\x46')+'\\x45\\x71'\]);\}

按上面步骤还原：

function _0x451a25(_0x787271) {
        return "sign=" + _0x787271 + "~" + _0x5b6292(_0x787271) + "; path=/";
    }

所以整体逻辑可以变为

function _0x451a25(_0x787271) {
        return "sign=" + _0x787271 + "~" + _0x5b6292(_0x787271) + "; path=/";
    }
    
    var timestamp = new Date().valueOf()
    _0x30c194(_0x451a25(timestamp))
    
    //等价于
    _0x30c194("sign=" + timestamp + "~" + _0x5b6292(timestamp) + "; path=/")

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70 8][]

\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* 关键逻辑部分 \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

这里只需要 分析 **\_0x5b6292(timestamp)** 即可。

看下 \_0x5b6292 的 toString()：function \_0x5b6292(\_0x141932)\{return \_0x521302\[$\_0x5780('\\x30\\x78\\x62\\x34','\\x41\\x6f\\x23\\x33')+'\\x41\\x75'\](\_0x2e58ec,\_0x141932);\}

还原后等价于：**\_0x2e58ec(timestamp)**

![20210511155515933.png][]

再继续分析  **\_0x2e58ec** 。看下 **\_0x2e58ec** 的 toString()："function \_0x2e58ec(\_0x2dd05e,\_0x2bf8cf,\_0x597aa3)\{return \_0x2bf8cf?\_0x597aa3?\_0x521302\[$\_0x5780('\\x30\\x78\\x62\\x39','\\x4b\\x73\\x48\\x58')+'\\x6c\\x75'\](\_0x5b6292,\_0x2bf8cf,\_0x2dd05e):\_0x521302\[$\_0x5780('\\x30\\x78\\x31\\x31\\x30','\\x43\\x34\\x4e\\x62')+'\\x44\\x44'\](\_0x1af341,\_0x2bf8cf,\_0x2dd05e):\_0x597aa3?\_0x521302\[$\_0x5780('\\x30\\x78\\x63\\x32','\\x69\\x65\\x46\\x51')+'\\x4d\\x6d'\](\_0x1091df,\_0x2dd05e):\_0x521302\['\\x75\\x6d\\x74'+'\\x4e\\x65'\](\_0x289aa2,\_0x2dd05e);\}"

还原后等价于：\_0x289aa2(timestamp)

继续分析 **\_0x289aa2** 。看下 **\_0x289aa2** 的 toString()：function \_0x289aa2(\_0x22d83d)\{return \_0x521302\[$\_0x5780('\\x30\\x78\\x33\\x37','\\x5d\\x57\\x5a\\x62')+'\\x4d\\x6d'\](\_0x554ed6,\_0x1091df(\_0x22d83d));\}

还原后等价于：\_0x554ed6(\_0x1091df(timestamp))

总体逻辑等价于：\_0x554ed6(\_0x3f26c9(\_0x161382(timestamp)))

![20210511160922153.png][]

\_0x161382.toString()：function \_0x161382(\_0x3dad10)\{return unescape(\_0x521302\[$\_0x5780('\\x30\\x78\\x34\\x62','\\x52\\x5a\\x77\\x72')+'\\x4d\\x6d'\](encodeURIComponent,\_0x3dad10));\}

还原后等价于：function \_0x161382(timestamp)\{return unescape(encodeURIComponent(timestamp));\}

整体逻辑等价于：\_0x554ed6(\_0x3f26c9(unescape(encodeURIComponent(timestamp))))

![20210511161334405.png][]

var timestamp = new Date().valueOf()
    var encode_timestamp = unescape(encodeURIComponent(timestamp))
    _0x554ed6(_0x3f26c9(encode_timestamp))

\_0x3f26c9.toString()：function \_0x3f26c9(\_0x4b9199)\{return \_0x2b5e04(\_0x1cb205(\_0x17d11d(\_0x4b9199),\_0x521302\[$\_0x5780('\\x30\\x78\\x64\\x39','\\x5e\\x74\\x58\\x6a')+'\\x43\\x73'\](0x8,\_0x4b9199\[$\_0x5780('\\x30\\x78\\x65\\x30','\\x55\\x74\\x46\\x4b')+$\_0x5780('\\x30\\x78\\x35\\x30','\\x39\\x2a\\x79\\x29')\])));\}

还原后等价于：

后面就是 抠  \_0x554ed6  和 \_0x3f26c9 的代码，然后执行 js 即可得到。。。。。。

[20210511140653325.png]: /images/20221021/a6ca02ebd1e64f28ac6cac123823550c.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70]: /images/20221021/14f5577a7c31420fac64360079f63fb3.png
[https_gitee.com_HGJing_hooker-js]: https://gitee.com/HGJing/hooker-js
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70 1]: /images/20221021/91ef6be018264db387b830f7863de24f.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70 2]: /images/20221021/ae4f50601e184f56ab5dab8dddf3a9c5.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70 3]: /images/20221021/eb25daac14db4725b6aa3d08edad1682.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70 4]: /images/20221021/55620f84df83444a91624b6367c0ac86.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70 5]: /images/20221021/84678c0fa80445d9945bf1e45f361159.png
[20210511151220854.png]: /images/20221021/eab8479fa8c241a99563a6507bb3c665.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70 6]: /images/20221021/252330661d514449a21dedb8bb97155f.png
[20210511151809488.png]: /images/20221021/7e95ebfe138043db9713177c495e4d53.png
[20210511152215504.png]: /images/20221021/010788ec1fef48279cfe402b18e735a1.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70 7]: /images/20221021/e4b61c9be2b045e1b950dca3a46217b5.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2ZyZWVraW5nMTAx_size_16_color_FFFFFF_t_70 8]: /images/20221021/3c0d37f764934a7199be572f7a718708.png
[20210511155515933.png]: /images/20221021/e847b2160e97467da0a27a84653eb1d3.png
[20210511160922153.png]: /images/20221021/712af7556355407f8a29d4128d50add1.png
[20210511161334405.png]: /images/20221021/a4f079abd85a43fa8799d7b42c0483b9.png