马上爬试题练习第18题

抓包

多次请求后发现只有m值为变化的加密点

同理找堆栈

断点后一直往下执行，从jquery-3.6.0.min.js跳到pagination18.js的位置就是加密点

实际上的代码加密流程

_0x2ef45b['ts'] = vmExecute(0x1, _0x2ef45b)
_0x2ef45b['crawler'] = vmExecute(0x2, _0x2ef45b)
_0x2ef45b[_0x38ae12(0x209)]['m'] = _0x2ef45b['crawler'] + vmExecute(0x3, {
            'input': _0x38ae12(0x1f8) + _0x2ef45b['ts']
        })

ts直接为时间戳、实际上的函数为分析vmExecute(0x2, _0x2ef45b)的生成

通过对当前函数的追踪和改写，可以拿到最后的代码

var B = function(_0x3f0d72) {
    return anti(0x4)({
        'serverTime': _0x3f0d72
    })['messagePack']();
};

function getCrawlerInfo(_0x2926eb) {
    return B(_0x2926eb);
}

const VM_OPS = {
    0x2: function(_0x4deae8) {
        return getCrawlerInfo(_0x4deae8['ts']);
    }
};

function vmExecute(_0x4d87c8, _0x32370b) {
    return VM_OPS[_0x4d87c8]["apply"](null, [_0x32370b]);
}


_0x2ef45b = {
    "headers": {},
    "ts": 1769515549614,
    "crawler": ""
}
vmExecute(0x2, _0x2ef45b)

最后分析的就是anti函数了，直接追进去

可以看到此webpack格式代码

在chrome环境中调用能得到值

将全部代码在pycharm中补环境、主要是document，下面是我简易补的

window = global;
document = {
    createElement: function(arg){
        console.log("对象：document =====>方法：createElement ===>参数：", arg)
        if(arg === "video"){
            return watch({"canPlayType": ""}, 'createElement->video')
        }
        return watch({}, 'createElement')
    },
    addEventListener: function(arg){
        console.log("对象：document =====>方法：addEventListener ===>参数：", arg)
        if(arg === "mousedown"){
            return {}
        }
        if(arg === "mousemove"){
            return {}
        }
        if(arg === "click"){
            return {}
        }
        if(arg === "scroll"){
            return {}
        }
        return watch({}, 'addEventListener')
    }
}
var Element = function Element() {

};
navigator = {
    userAgent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36"
}
location = {
    href: "https://www.mashangpa.com/problem-detail/18/",
    port: ""
}
localStorage = "https://www.mashangpa.com/problem-detail/18/"
screen = {
    availWidth: 1920,
    availHeight: 1080
}
history = {}