ksjsb/tools/deobf_probe.py
2026-07-30 20:25:56 +08:00

21 lines
1015 B
Python

"""一次性普查 iframe bundle 的所有字符串表:解码器 / 数组 / 洗牌。"""
import re, sys
from pathlib import Path
fn = Path(sys.argv[1]) if len(sys.argv) > 1 else Path("js_08_atic_captcha_js_iframe_index_c9ae8c81_js.js")
s = fn.read_text(encoding="utf-8", errors="ignore")
print("=== decoders: var NAME=function(e,n){e-=K;var t=ARR[e]; ...} ===")
for m in re.finditer(r"var\s+(\w+)\s*=\s*function\(e,n\)\{e-=(\d+);var t=(\w+)\[e\];", s):
print(f" decoder={m.group(1)} offset={m.group(2)} array={m.group(3)} @ {m.start()}")
print("\n=== arrays: var NAME=[ 'b64', ... ] ===")
pat_arr = re.compile(r'var\s+(\w+)\s*=\s*\["[A-Za-z0-9+/=]{3,}",')
for m in pat_arr.finditer(s):
print(f" array={m.group(1)} @ {m.start()}")
print("\n=== shuffle calls: (function(e,n){...push...shift...})(ARR,N) ===")
pat_shuf = re.compile(r"\(function\(e,n\)\{[^}]*?push[^}]*?shift[^}]*?\}\)\((\w+),(\d+)\)")
for m in pat_shuf.finditer(s):
print(f" array={m.group(1)} rotate={m.group(2)} @ {m.start()}")