59 lines
2.5 KiB
JavaScript
59 lines
2.5 KiB
JavaScript
// 多变体探测 $encrypt / $encode 的正确调用姿势
|
|
const fs = require("fs"), vm = require("vm"), path = require("path");
|
|
const src = fs.readFileSync(path.join("out/captcha_net", "js_07_rm_static_captcha_js_encrypt_ee7d2a41_js.js"), "utf-8");
|
|
const ctx = {
|
|
console, Uint8Array, ArrayBuffer, Uint32Array, Int32Array, Uint16Array, Float32Array, Float64Array, DataView, Buffer,
|
|
setTimeout, clearTimeout, setImmediate, Promise, Math, Date, JSON, Object, Array, String, Number, Boolean, RegExp, Error,
|
|
Function, Symbol, Reflect, Proxy, Map, Set, WeakMap, WeakSet, parseInt, parseFloat, isNaN, isFinite, undefined,
|
|
btoa: (s) => Buffer.from(s, "binary").toString("base64"),
|
|
atob: (s) => Buffer.from(s, "base64").toString("binary"),
|
|
};
|
|
vm.createContext(ctx);
|
|
ctx.global = ctx; ctx.window = ctx; ctx.self = ctx;
|
|
vm.runInContext(src, ctx, { filename: "encrypt.js" });
|
|
const f = ctx.webpackJsonp[0][1]["088e"];
|
|
const rq = (id) => id === "b639" ? { Buffer } : id === "dd40" ? (x) => x : {};
|
|
const m = { exports: {} };
|
|
f(m, m.exports, rq);
|
|
const Jose = ctx.Jose;
|
|
const j = (typeof Jose === "function") ? new Jose() : Jose;
|
|
console.log("Jose typeof:", typeof Jose, "| j has call:", typeof j.call);
|
|
const KEY = "c7b645db-65e8-401f-b38c-4c07c5fff247";
|
|
const JSON_STR = '{"a":1}';
|
|
const U8 = new Uint8Array(Buffer.from(JSON_STR, "utf-8"));
|
|
|
|
function tryCall(label, fnName, args) {
|
|
return new Promise((res) => {
|
|
let out, err;
|
|
const cb = { suc: (v) => { out = v; }, err: (e) => { err = e; } };
|
|
try {
|
|
j.call(fnName, [...args, cb]);
|
|
} catch (e) { err = e; }
|
|
setTimeout(() => res({ label, out, err }), 1500);
|
|
});
|
|
}
|
|
|
|
(async () => {
|
|
const variants = [
|
|
["$encrypt U8 key", "$encrypt", [U8, KEY]],
|
|
["$encrypt str key", "$encrypt", [JSON_STR, KEY]],
|
|
["$encode U8 key", "$encode", [U8, KEY]],
|
|
["$encode str key", "$encode", [JSON_STR, KEY]],
|
|
["$encrypt U8 only", "$encrypt", [U8]],
|
|
["$encrypt str only","$encrypt", [JSON_STR]],
|
|
];
|
|
for (const [label, fn, args] of variants) {
|
|
const r = await tryCall(label, fn, args);
|
|
if (r.out) {
|
|
const o = r.out;
|
|
let rep = o;
|
|
if (o && o.length !== undefined && typeof o !== "string") {
|
|
try { rep = "b64:" + Buffer.from(o).toString("base64").slice(0, 60); } catch (_) {}
|
|
}
|
|
console.log(`OK ${label} -> ${typeof o} len=${o && o.length} :: ${String(rep).slice(0, 70)}`);
|
|
} else {
|
|
console.log(`ERR ${label} -> ${(r.err && r.err.message) || r.err || "no-out"}`);
|
|
}
|
|
}
|
|
})();
|