吾爱破解 - 52pojie.cn

 找回密码
 注册[Register]

QQ登录

只需一步,快速开始

查看: 11134|回复: 119
收起左侧

[Web逆向] 【JS逆向】纯异步JS逆向分析

    [复制链接]
littlewhite11 发表于 2025-1-1 03:38

逆向目标

  • 网址:aHR0cHM6Ly93d3cuYXBwbGUuY29tLw==
  • 目标:逆向登录

抓包分析

点击右上角购物袋,选择登录。

首先输入手机号或邮箱,点击箭头,会发起一个init请求,其中a参数需要逆向分析。

1.png

该请求的响应在后续请求参数的生成会用到。

2.png

然后输入密码进行登录,会发起一个complete请求,其中的m1和m2参数需要逆向。

3.png

闲话不多说,直接开整。

逆向分析

  • a参数逆向

a的跟栈就不多说了,直接从启动器往前看就可以看到

4.png

生成逻辑很清晰,跟着逻辑把代码都扣下来即可。

这里有一个很坑的地方:f = r.publicValue其实是会走publicValuegetter函数的,如果你F10是看不到具体生成逻辑的,必须得F9才可以。

然后publicValue属性也是一个对象,其中的bi、buffer、hex属性也是这种玩法,一定要细心,不要被坑了。

5.png

参数a细心耐心点就能搞出来。

  • m1、m2参数

还是从启动器进去,下断,发包,跟栈。一直往前跟,就会发现m1和m2是经过异步生成的。

下面就开始讲解这种特征异步的处理方式。

首先我们在异步之前找个地方下断,最好是能断住我们想要的一次请求。我就在下图这个地方下断了,重新请求。

6.png

然后就会进到本篇文章所描述的特征点相关的代码,一般是switch (r.prev = r.next),我们直接下断,然后F8,然后单步跟。

7.png

这里r.next = 4表明下一次控制流会进入case 4,同时e._getSRPValues的结果就是下一次控制流的r.sent,这个原理我也不太懂,有大佬路过的话可以指点指点,然后我们直接在下一次控制流下断,F8。

8.png

可以发现m1和m2已经生成了,那就是我们错过了以下异步逻辑,重新跟。

9.png

这一次我们直接跟进去e._getSRPValues,还是一样的特征,该下断的地方都下,然后之后就按照这个逻辑跟了。

由于异步特别容易跟丢,所以我就直接揭开谜底,函数该跟的地方直接说了,下一个需要跟的就是Et

10.png

还是一样的特征,下一次有点特别,直接在ze.postMessage下断。

11.png

跳到ze.postMessage断点,发现是Worker,这里是postMessage,那我们就找onmessage下断。

12.png

可以看到m1和m2已经生成了。

13.png

我们网上看一个栈,可以确定就是在这生成的。

按照之前的逻辑m1和m2b1中来,而b1其实就是r.getEvidenceMessage(m)的结果,我们直接清空所有断点,在r.getEvidenceMessage(m)下断,重新发包。

14.png

可以看到,参数还没生成,而且h也很熟悉,就是第一个请求的响应。

15.png

接下来就是多层Promise了,直接硬刚。

小技巧:我们怎么看哪些函数需要重点跟呢,就是你点进去发现是下面这种形式的,然后基本都会进入一个Promise,跟Promise记得F9,同时,记得在下一次控制流提前下断。

16.png

第一次,从r.getEvidenceMessage(m)

17.png

第二次,从this.getEvidenceData(r)

18.png

第三次,从I函数进

19.png

第四次,从e.getHash()

这个promise会进入很多次,后面就不赘述了。

20.png

第五次,从与I同层级的A函数进

21.png

第六次,从与I同层级的T函数进

22.png

第七次,从与I同层级的O函数进

23.png

最后,就是在这里生成的m1和m2

24.png

扣代码的话就不带着扣了,因为实在是太多了,按照前文所讲的逻辑一步一步跟着扣就可以。

注意点:记住xxx.sent就是上一次控制流的结果,还有就是之前碰到的有bi、buffer、hash属性的对象,要重点关注各自的getter函数

最后直接附上模拟请求结果

25.png

成功!!!

账号网址:aHR0cHM6Ly9hcHBzdG9yZS5wYW5iYWlkLmNvbS9zaGFyZS9NVQ==K哥提供

免费评分

参与人数 47威望 +2 吾爱币 +146 热心值 +40 收起 理由
PhiFever + 1 + 1 我很赞同!
geo1996 + 1 我很赞同!
KaliHt + 1 + 1 谢谢@Thanks!
junjia215 + 1 + 1 用心讨论,共获提升!
michiless + 1 + 1 我很赞同!
q2320069732 + 1 + 1 我很赞同!
Wyiyun777 + 1 + 1 用心讨论,共获提升!
beihai1314 + 1 + 1 我很赞同!
笙若 + 1 + 1 感谢发布原创作品,吾爱破解论坛因你更精彩!
p100200300 + 1 + 1 用心讨论,共获提升!
aquar + 1 + 1 谢谢@Thanks!
暮寒 + 1 谢谢@Thanks!
dandelion2sunny + 1 + 1 我很赞同!
tws2002 + 1 --------
Rockhat + 1 谢谢@Thanks!
jk998 + 1 + 1 我很赞同!
LuSterM + 1 我很赞同!
melooon + 1 + 1 我很赞同!
SunGao + 1 我很赞同!
Flytom + 1 热心回复!
yixi + 1 + 1 谢谢@Thanks!
mengshj + 1 + 1 用心讨论,共获提升!
lihongzhou123 + 1 + 1 用心讨论,共获提升!
zhaoleji + 1 我很赞同!
wocuole + 1 + 1 谢谢@Thanks!
CYTuo0601 + 1 + 1 谢谢@Thanks!
evill + 1 + 1 谢谢@Thanks!
pales1gh + 1 + 1 谢谢@Thanks!
yjn866y + 1 + 1 感谢发布原创作品,吾爱破解论坛因你更精彩!
allspark + 1 + 1 用心讨论,共获提升!
zzyzy + 1 + 1 谢谢@Thanks!
degas8888 + 1 + 1 我很赞同!
lx230313 + 1 + 1 热心回复!
sbi188 + 1 + 1 我很赞同!
wonder2018 + 1 + 1 用心讨论,共获提升!
aa20221101 + 1 + 1 热心回复!
lingyun011 + 1 + 1 热心回复!
SVIP9大会员 + 1 + 1 我很赞同!
crizquan + 1 + 1 用心讨论,共获提升!
wangxiaoqiqiqi + 1 + 1 用心讨论,共获提升!
fengbolee + 2 + 1 欢迎分析讨论交流,吾爱破解论坛有你更精彩!
liuxuming3303 + 1 + 1 谢谢@Thanks!
PastorBonus + 1 + 1 谢谢@Thanks!
ytfh1131 + 1 + 1 谢谢@Thanks!
jonathan329 + 1 + 1 感谢发布原创作品,吾爱破解论坛因你更精彩!
laozhang4201 + 1 + 1 热心回复!
涛之雨 + 2 + 100 + 1 感谢发布原创作品,吾爱破解论坛因你更精彩!

查看全部评分

发帖前要善用论坛搜索功能,那里可能会有你要找的答案或者已经有人发布过相同内容了,请勿重复发帖。

zglhappy 发表于 2025-1-9 08:32
publicValue 的 getter 函数会隐藏生成逻辑,如果开发者故意将关键逻辑封装在 getter 或 Proxy 中,逆向怎么定位和还原这些关键逻辑?

KaliHt 发表于 2025-3-17 08:52
[JavaScript] 纯文本查看 复制代码
 function o(t) {
            return function(t) {
                if (Array.isArray(t))
                    return i(t)
            }(t) || function(t) {
                if ("undefined" != typeof Symbol && null != t[Symbol.iterator] || null != t["@@iterator"])
                    return Array.from(t)
            }(t) || function(t, r) {
                if (!t)
                    return;
                if ("string" == typeof t)
                    return i(t, r);
                var e = Object.prototype.toString.call(t).slice(8, -1);
                "Object" === e && t.constructor && (e = t.constructor.name);
                if ("Map" === e || "Set" === e)
                    return Array.from(t);
                if ("Arguments" === e || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(e))
                    return i(t, r)
            }(t) || function() {
                throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")
            }()
        }
var jzq;
!function(t) {
    var r = {};
    function e(n) {
        if (r[n])
            return r[n].exports;
        var o = r[n] = {
            i: n,
            l: !1,
            exports: {}
        };
      console.log("在加载--->",n);
        return t[n].call(o.exports, o, o.exports, e),
        o.l = !0,
        o.exports
    }
    jzq=e;
    e.m = t,
    e.c = r,
    e.d = function(t, r, n) {
        e.o(t, r) || Object.defineProperty(t, r, {
            enumerable: !0,
            get: n
        })
    }
    ,
    e.r = function(t) {
        "undefined" != typeof Symbol && Symbol.toStringTag && Object.defineProperty(t, Symbol.toStringTag, {
            value: "Module"
        }),
        Object.defineProperty(t, "__esModule", {
            value: !0
        })
    }
    ,
    e.t = function(t, r) {
        if (1 & r && (t = e(t)),
        8 & r)
            return t;
        if (4 & r && "object" == typeof t && t && t.__esModule)
            return t;
        var n = Object.create(null);
        if (e.r(n),
        Object.defineProperty(n, "default", {
            enumerable: !0,
            value: t
        }),
        2 & r && "string" != typeof t)
            for (var o in t)
                e.d(n, o, function(r) {
                    return t[r]
                }
                .bind(null, o));
        return n
    }
    ,
    e.n = function(t) {
        var r = t && t.__esModule ? function() {
            return t.default
        }
        : function() {
            return t
        }
        ;
        return e.d(r, "a", r),
        r
    }
    ,
    e.o = function(t, r) {
        return Object.prototype.hasOwnProperty.call(t, r)
    }
    ,
    e.p = ""
    //e(e.s = 850)
}({849:function(t, r, e) {
    "use strict";
    function n(t, r) {
        var e = "undefined" != typeof Symbol && t[Symbol.iterator] || t["@@iterator"];
        if (!e) {
            if (Array.isArray(t) || (e = function(t, r) {
                if (!t)
                    return;
                if ("string" == typeof t)
                    return o(t, r);
                var e = Object.prototype.toString.call(t).slice(8, -1);
                "Object" === e && t.constructor && (e = t.constructor.name);
                if ("Map" === e || "Set" === e)
                    return Array.from(t);
                if ("Arguments" === e || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(e))
                    return o(t, r)
            }(t)) || r && t && "number" == typeof t.length) {
                e && (t = e);
                var n = 0
                  , i = function() {};
                return {
                    s: i,
                    n: function() {
                        return n >= t.length ? {
                            done: !0
                        } : {
                            done: !1,
                            value: t[n++]
                        }
                    },
                    e: function(t) {
                        throw t
                    },
                    f: i
                }
            }
            throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")
        }
        var a, u = !0, c = !1;
        return {
            s: function() {
                e = e.call(t)
            },
            n: function() {
                var t = e.next();
                return u = t.done,
                t
            },
            e: function(t) {
                c = !0,
                a = t
            },
            f: function() {
                try {
                    u || null == e.return || e.return()
                } finally {
                    if (c)
                        throw a
                }
            }
        }
    }
    function o(t, r) {
        (null == r || r > t.length) && (r = t.length);
        for (var e = 0, n = new Array(r); e < r; e++)
            n[e] = t[e];
        return n
    }
    var i = function(t) {
        return new TextEncoder("utf-8").encode(t)
    }
      , a = function() {
        for (var t = arguments.length, r = new Array(t), e = 0; e < t; e++)
            r[e] = arguments[e];
        var o = r.reduce((function(t, r) {
            return t + r.length
        }
        ), 0)
          , i = 0;
        return r.reduce((function(t, r) {
            var e, o = n(r);
            try {
                for (o.s(); !(e = o.n()).done; ) {
                    var a = e.value;
                    t[i++] = a
                }
            } catch (t) {
                o.e(t)
            } finally {
                o.f()
            }
            return t
        }
        ), new Uint8Array(o))
    }
      , u = function(t, r) {
        return t * r
    }
      , c = function(t, r) {
        return t + r
    }
      , s = function(t, r) {
        var e = function(t, r) {
            return t % r
        }(t, r);
        return function(t) {
            return t < BigInt(0)
        }(e) && (e = c(e, r)),
        e
    }
      , f = function(t, r, e) {
        return function(t, r, e) {
            if (e === BigInt(1))
                return BigInt(0);
            var n = BigInt(1);
            for (t %= e; r > BigInt(0); )
                r % BigInt(2) === BigInt(1) && (n = n * t % e),
                r >>= BigInt(1),
                t = t * t % e;
            return n
        }(t, r, e)
    }
      , h = e(176)
      , l = e.n(h);
    function p(t) {
        return function(t) {
            if (Array.isArray(t))
                return v(t)
        }(t) || function(t) {
            if ("undefined" != typeof Symbol && null != t[Symbol.iterator] || null != t["@@iterator"])
                return Array.from(t)
        }(t) || function(t, r) {
            if (!t)
                return;
            if ("string" == typeof t)
                return v(t, r);
            var e = Object.prototype.toString.call(t).slice(8, -1);
            "Object" === e && t.constructor && (e = t.constructor.name);
            if ("Map" === e || "Set" === e)
                return Array.from(t);
            if ("Arguments" === e || /^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(e))
                return v(t, r)
        }(t) || function() {
            throw new TypeError("Invalid attempt to spread non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")
        }()
    }
    function v(t, r) {
        (null == r || r > t.length) && (r = t.length);
        for (var e = 0, n = new Array(r); e < r; e++)
            n[e] = t[e];
        return n
    }
    function d(t, r, e, n, o, i, a) {
        try {
            var u = t[i](a)
              , c = u.value
        } catch (t) {
            return void e(t)
        }
        u.done ? r(c) : Promise.resolve(c).then(n, o)
    }
    function g(t, r) {
        for (var e = 0; e < r.length; e++) {
            var n = r[e];
            n.enumerable = n.enumerable || !1,
            n.configurable = !0,
            "value"in n && (n.writable = !0),
            Object.defineProperty(t, n.key, n)
        }
    }
    function y(t, r, e) {
        return r in t ? Object.defineProperty(t, r, {
            value: e,
            enumerable: !0,
            configurable: !0,
            writable: !0
        }) : t[r] = e,
        t
    }
    var m = function() {
        function t(r) {
            !function(t, r) {
                if (!(t instanceof r))
                    throw new TypeError("Cannot call a class as a function")
            }(this, t),
            y(this, "_bi", void 0),
            y(this, "_buffer", void 0),
            y(this, "_hex", void 0),
            y(this, "_hash", void 0),
            y(this, "_base64", void 0),
            "string" == typeof r ? this._hex = r : r instanceof ArrayBuffer ? this._buffer = new Uint8Array(r) : r instanceof Uint8Array ? this._buffer = r : this._bi = r
        }
        var r, e, n, o, i;
        return r = t,
        e = [{
            key: "bi",
            get: function() {
                var t;
                return void 0 === this._bi && (this._bi = (t = "0x" + this.hex,
                BigInt(t))),
                this._bi
            }
        }, {
            key: "buffer",
            get: function() {
                return void 0 === this._buffer && (this._buffer = function(t) {
                    t.length % 2 == 1 && (t = "0" + t);
                    var r, e, n, o = t.length / 2, i = new Uint8Array(o);
                    for (r = 0; r < o; r++) {
                        if (e = t.substr(2 * r, 2),
                        n = parseInt(e, 16),
                        isNaN(n))
                            throw new Error("String contains non hexadecimal value: '".concat(t, "'"));
                        i[r] = n
                    }
                    return i
                }(this.hex)),
                this._buffer
            }
        }, {
            key: "hex",
            get: function() {
                if (void 0 === this._hex)
                    if (void 0 !== this._bi) {
                        var t = this._bi.toString(16);
                        t.length % 2 != 0 && (t = "0" + t),
                        this._hex = t
                    } else
                        this._hex = this._buffer.reduce((function(t, r) {
                            return t + r.toString(16).padStart(2, "0")
                        }
                        ), "");
                return this._hex
            }
        }, {
            key: "getHash",
            value: (o = regeneratorRuntime.mark((function r() {
                return regeneratorRuntime.wrap((function(r) {
                    for (; ; )
                        switch (r.prev = r.next) {
                        case 0:
                            if (this._hash) {
                                r.next = 6;
                                break
                            }
                            return r.t0 = t,
                            r.next = 4,
                            l.a.crypto.subtle.digest("SHA-256", this.buffer);
                        case 4:
                            r.t1 = r.sent,
                            this._hash = new r.t0(r.t1);
                        case 6:
                            return r.abrupt("return", this._hash);
                        case 7:
                        case "end":
                            return r.stop()
                        }
                }
                ), r, this)
            }
            )),
            i = function() {
                var t = this
                  , r = arguments;
                return new Promise((function(e, n) {
                    var i = o.apply(t, r);
                    function a(t) {
                        d(i, e, n, a, u, "next", t)
                    }
                    function u(t) {
                        d(i, e, n, a, u, "throw", t)
                    }
                    a(void 0)
                }
                ))
            }
            ,
            function() {
                return i.apply(this, arguments)
            }
            )
        }, {
            key: "pad",
            value: function(r) {
                return new t(function(t, r) {
                    for (var e = new Uint8Array(r), n = r - t.length, o = 0; o < t.length; o++)
                        e[o + n] = t[o];
                    return e
                }(r.buffer, this.buffer.length))
            }
        }, {
            key: "getBase64",
            value: function() {
                return this._base64 || (this._base64 = btoa(String.fromCharCode.apply(String, p(new Uint8Array(this.buffer))))),
                this._base64
            }
        }],
        n = [{
            key: "concat",
            value: function() {
                for (var r = arguments.length, e = new Array(r), n = 0; n < r; n++)
                    e[n] = arguments[n];
                var o = e.map((function(t) {
                    return t.buffer
                }
                ));
                return new t(a.apply(void 0, p(o)))
            }
        }],
        e && g(r.prototype, e),
        n && g(r, n),
        Object.defineProperty(r, "prototype", {
            writable: !1
        }),
        t
    }();
    function b(t, r, e, n, o, i, a) {
        try {
            var u = t[i](a)
              , c = u.value
        } catch (t) {
            return void e(t)
        }
        u.done ? r(c) : Promise.resolve(c).then(n, o)
    }
    function w(t) {
        return function() {
            var r = this
              , e = arguments;
            return new Promise((function(n, o) {
                var i = t.apply(r, e);
                function a(t) {
                    b(i, n, o, a, u, "next", t)
                }
                function u(t) {
                    b(i, n, o, a, u, "throw", t)
                }
                a(void 0)
            }
            ))
        }
    }
    var x = function() {
        return new m((t = 256,
        l.a.crypto.getRandomValues(new Uint8Array(t))));
        var t
    }
      , E = function(t) {
        var r = t.A
          , e = t.B
          , n = t.N;
        return m.concat(n.pad(r), n.pad(e)).getHash()
    }
      , A = function() {
        var t = w(regeneratorRuntime.mark((function t(r) {
            var e, n, o, i, a, u, c;
            return regeneratorRuntime.wrap((function(t) {
                for (; ; )
                    switch (t.prev = t.next) {
                    case 0:
                        return e = r.s,
                        r.I,
                        o = r.P,
                        i = new m(new Uint8Array([":".charCodeAt(0)])),
                        n = new m(""),
                        a = m.concat(n, i, o),
                        t.next = 6,
                        a.getHash();
                    case 6:
                        return u = t.sent,
                        c = m.concat(e, u),
                        t.abrupt("return", c.getHash());
                    case 9:
                    case "end":
                        return t.stop()
                    }
            }
            ), t)
        }
        )));
        return function(r) {
            return t.apply(this, arguments)
        }
    }()
      , R = function(t) {
        var r = t.B
          , e = t.k
          , n = t.x
          , o = t.a
          , i = t.u
          , a = t.N
          , h = t.g
          , l = c(u(i.bi, n.bi), o.bi)
          , p = s(u(f(h.bi, n.bi, a.bi), e.bi), a.bi)
          , v = f(s(function(t, r) {
            return t - r
        }(r.bi, p), a.bi), l, a.bi);
        return new m(v)
    }
      , S = function(t) {
        var r = t.S;
        return t.N.pad(r).getHash()
    }
      , I = function() {
        var t = w(regeneratorRuntime.mark((function t(r) {
            var e, n, o, a, u, c, s, f;
            return regeneratorRuntime.wrap((function(t) {
                for (; ; )
                    switch (t.prev = t.next) {
                    case 0:
                        return e = r.password,
                        n = r.s,
                        o = r.i,
                        a = r.protocol,
                        u = void 0 === a ? "s2k" : a,
                        t.next = 3,
                        e.getHash();
                    case 3:
                        return c = t.sent,
                        t.next = 6,
                        l.a.crypto.subtle.importKey("raw", "s2k" === u ? c.buffer : i(c.hex), "PBKDF2", !1, ["deriveBits"]);
                    case 6:
                        return s = t.sent,
                        t.next = 9,
                        l.a.crypto.subtle.deriveBits({
                            name: "PBKDF2",
                            salt: n.buffer,
                            iterations: o,
                            hash: {
                                name: "SHA-256"
                            }
                        }, s, 256);
                    case 9:
                        return f = t.sent,
                        t.abrupt("return", new m(f));
                    case 11:
                    case "end":
                        return t.stop()
                    }
            }
            ), t)
        }
        )));
        return function(r) {
            return t.apply(this, arguments)
        }
    }()
      , T = function() {
        var t = w(regeneratorRuntime.mark((function t(r) {
            var e, n, o, i, a, u, c, s, f, h, l;
            return regeneratorRuntime.wrap((function(t) {
                for (; ; )
                    switch (t.prev = t.next) {
                    case 0:
                        return e = r.I,
                        n = r.s,
                        o = r.A,
                        i = r.B,
                        a = r.K,
                        u = r.N,
                        c = r.g,
                        t.next = 3,
                        u.pad(c).getHash();
                    case 3:
                        return s = t.sent,
                        t.next = 6,
                        u.getHash();
                    case 6:
                        return f = t.sent,
                        h = new m((p = f.bi,
                        v = s.bi,
                        p ^ v)),
                        t.next = 10,
                        e.getHash();
                    case 10:
                        return l = t.sent,
                        t.abrupt("return", m.concat(h, l, n, o, i, a).getHash());
                    case 12:
                    case "end":
                        return t.stop()
                    }
                var p, v
            }
            ), t)
        }
        )));
        return function(r) {
            return t.apply(this, arguments)
        }
    }()
      , O = function() {
        var t = w(regeneratorRuntime.mark((function t(r) {
            var e, n, o, i;
            return regeneratorRuntime.wrap((function(t) {
                for (; ; )
                    switch (t.prev = t.next) {
                    case 0:
                        return e = r.A,
                        n = r.M1,
                        o = r.K,
                        t.next = 3,
                        m.concat(e, n, o).getHash();
                    case 3:
                        return i = t.sent,
                        t.abrupt("return", i);
                    case 5:
                    case "end":
                        return t.stop()
                    }
            }
            ), t)
        }
        )));
        return function(r) {
            return t.apply(this, arguments)
        }
    }()
      , M = {
        2048: {
            N: "AC6BDB41 324A9A9B F166DE5E 1389582F AF72B665 1987EE07 FC319294 3DB56050 A37329CB B4A099ED 8193E075 7767A13D D52312AB 4B03310D CD7F48A9 DA04FD50 E8083969 EDB767B0 CF609517 9A163AB3 661A05FB D5FAAAE8 2918A996 2F0B93B8 55F97993 EC975EEA A80D740A DBF4FF74 7359D041 D5C33EA7 1D281E44 6B14773B CA97B43A 23FB8016 76BD207A 436C6481 F1D2B907 8717461A 5B9D32E6 88F87748 544523B5 24B0D57D 5EA77A27 75D2ECFA 032CFBDB F52FB378 61602790 04E57AE6 AF874E73 03CE5329 9CCC041C 7BC308D8 2A5698F3 A8D0C382 71AE35F8 E9DBFBB6 94B5C803 D89F7AE4 35DE236D 525F5475 9B65E372 FCD68EF2 0FA7111F 9E4AFF73",
            g: "02"
        }
    };
    function _(t, r, e, n, o, i, a) {
        try {
            var u = t[i](a)
              , c = u.value
        } catch (t) {
            return void e(t)
        }
        u.done ? r(c) : Promise.resolve(c).then(n, o)
    }
    function P(t) {
        return function() {
            var r = this
              , e = arguments;
            return new Promise((function(n, o) {
                var i = t.apply(r, e);
                function a(t) {
                    _(i, n, o, a, u, "next", t)
                }
                function u(t) {
                    _(i, n, o, a, u, "throw", t)
                }
                a(void 0)
            }
            ))
        }
    }
    function k(t, r) {
        for (var e = 0; e < r.length; e++) {
            var n = r[e];
            n.enumerable = n.enumerable || !1,
            n.configurable = !0,
            "value"in n && (n.writable = !0),
            Object.defineProperty(t, n.key, n)
        }
    }
    function N(t, r, e) {
        return r in t ? Object.defineProperty(t, r, {
            value: e,
            enumerable: !0,
            configurable: !0,
            writable: !0
        }) : t[r] = e,
        t
    }
    var j = function(t) {
        if (!M[t])
            throw new Error("group ".concat(t, " not supported."));
        var r, e = M[t], n = e.N, o = e.g;
        return {
            N: new m((r = n,
            r.split(/\s/).join(""))),
            g: new m(o)
        }
    }("2048")
      , D = j.N
      , U = j.g
      , C = function() {
        function t(r) {
            !function(t, r) {
                if (!(t instanceof r))
                    throw new TypeError("Cannot call a class as a function")
            }(this, t),
            N(this, "accountName", void 0),
            N(this, "_privateValue", void 0),
            N(this, "_publicValue", void 0),
            this.accountName = r
        }
        var r, e, n, o, a;
        return r = t,
        (e = [{
            key: "privateValue",
            get: function() {
                return this._privateValue || (this._privateValue = x()),
                this._privateValue
            }
        }, {
            key: "publicValue",
            get: function() {
                var t, r, e, n;
                return this._publicValue || (this._publicValue = (t = {
                    a: this.privateValue,
                    N: D,
                    g: U
                },
                r = t.a,
                e = t.g,
                (n = t.N).pad(new m(f(e.bi, r.bi, n.bi))))),
                this._publicValue
            }
        }, {
            key: "getEvidenceData",
            value: (a = P(regeneratorRuntime.mark((function t(r) {
                var e, n, o, a, u, c, s, f, h, l, p, v, d, g, y, b, w, x, M, _;
                return regeneratorRuntime.wrap((function(t) {
                    for (; ; )
                        switch (t.prev = t.next) {
                        case 0:
                            return e = r.iterations,
                            n = r.serverPublicValue,
                            o = r.salt,
                            a = r.password,
                            u = r.protocol,
                            c = void 0 === u ? "s2k" : u,
                            s = this.privateValue,
                            f = this.publicValue,
                            h = new m(n),
                            l = e,
                            p = new m(o),
                            v = new m(i(this.accountName.toLowerCase())),
                            t.next = 9,
                            I({
                                password: new m(i(a)),
                                s: p,
                                i: l,
                                protocol: c
                            });
                        case 9:
                            return d = t.sent,
                            t.next = 12,
                            k = void 0,
                            N = void 0,
                            k = (P = {
                                N: D,
                                g: U
                            }).N,
                            N = P.g,
                            m.concat(k, k.pad(N)).getHash();
                        case 12:
                            return g = t.sent,
                            t.next = 15,
                            A({
                                s: p,
                                I: v,
                                P: d
                            });
                        case 15:
                            return y = t.sent,
                            t.next = 18,
                            E({
                                A: f,
                                B: h,
                                N: D
                            });
                        case 18:
                            return b = t.sent,
                            w = R({
                                B: h,
                                k: g,
                                x: y,
                                a: s,
                                u: b,
                                N: D,
                                g: U
                            }),
                            t.next = 22,
                            S({
                                S: w,
                                N: D
                            });
                        case 22:
                            return x = t.sent,
                            t.next = 25,
                            T({
                                I: v,
                                s: p,
                                A: f,
                                B: h,
                                K: x,
                                N: D,
                                g: U
                            });
                        case 25:
                            return M = t.sent,
                            t.next = 28,
                            O({
                                A: f,
                                M1: M,
                                K: x
                            });
                        case 28:
                            return _ = t.sent,
                            t.abrupt("return", {
                                M1: M.getBase64(),
                                M2: _.getBase64(),
                                K: x.getBase64()
                            });
                        case 30:
                        case "end":
                            return t.stop()
                        }
                    var P, k, N
                }
                ), t, this)
            }
            ))),
            function(t) {
                return a.apply(this, arguments)
            }
            )
        }, {
            key: "getEvidenceMessage",
            value: (o = P(regeneratorRuntime.mark((function t(r) {
                var e, n, o;
                return regeneratorRuntime.wrap((function(t) {
                    for (; ; )
                        switch (t.prev = t.next) {
                        case 0:
                            return t.next = 2,
                            this.getEvidenceData(r);
                        case 2:
                            return e = t.sent,
                            n = e.M1,
                            o = e.M2,
                            t.abrupt("return", {
                                M1: n,
                                M2: o
                            });
                        case 6:
                        case "end":
                            return t.stop()
                        }
                }
                ), t, this)
            }
            ))),
            function(t) {
                return o.apply(this, arguments)
            }
            )
        }]) && k(r.prototype, e),
        n && k(r, n),
        Object.defineProperty(r, "prototype", {
            writable: !1
        }),
        t
    }();
    e.d(r, "a", (function() {
        return C
    }
    ))
},
176:function(t, r, e) {
    "use strict";
    (function(r) {
        t.exports = "object" == typeof self && self.self === self && self || "object" == typeof r && r.global === r && r || this
    }
    ).call(this, e(91))
},
91:function(t, r) {
    var e;
    e = function() {
        return this
    }();
    try {
        e = e || new Function("return this")()
    } catch (t) {
        "object" == typeof window && (e = window)
    }
    t.exports = e
},}
)

n=jzq(849);


r = new n.a('19999999999');
f = r.publicValue;
a=btoa(String.fromCharCode.apply(String, o(new Uint8Array(f.buffer))));
console.log(a)
这是我扣的a参数生成,请大佬指点错误
idxinye 发表于 2025-1-1 03:46
SmileLoveSex 发表于 2025-1-1 06:09
学习到了,谢谢
zwtstc 发表于 2025-1-1 11:18
6,感谢分享
wendao_lx 发表于 2025-1-1 12:39
js逆向需要人头脑清醒,受教了,收藏了
nulla2011 发表于 2025-1-1 13:03
学习一下逆向
52pojie19 发表于 2025-1-1 13:12
厉害了大佬
52pojie19 发表于 2025-1-1 13:50
学习了 谢谢大佬呀
镇江小白123 发表于 2025-1-1 15:57
即便会,看着也太烦了,哈哈哈,真的要有耐心和细心才行
Memory2314 发表于 2025-1-1 18:16
感谢分享
您需要登录后才可以回帖 登录 | 注册[Register]

本版积分规则

返回列表

RSS订阅|小黑屋|处罚记录|联系我们|吾爱破解 - 52pojie.cn ( 京ICP备16042023号 | 京公网安备 11010502030087号 )

GMT+8, 2026-2-16 01:09

Powered by Discuz!

Copyright © 2001-2020, Tencent Cloud.

快速回复 返回顶部 返回列表