{"id":101354,"date":"2021-09-01T08:05:58","date_gmt":"2021-09-01T00:05:58","guid":{"rendered":"https:\/\/www.keaglegz.com\/101354.html"},"modified":"2021-09-01T08:05:58","modified_gmt":"2021-09-01T00:05:58","slug":"sojson-v5%e6%9c%80%e7%89%9b%e5%8a%a0%e5%af%86%e8%84%b1%e5%a3%b3%e8%a7%a3%e5%af%86%e7%a0%b4%e8%a7%a3%e5%8e%bb%e6%b7%b7%e6%b7%86","status":"publish","type":"post","link":"https:\/\/www.dongwubaike.cn\/fanhao\/101354.html","title":{"rendered":"sojson.v5\u6700\u725b\u52a0\u5bc6\u8131\u58f3\u89e3\u5bc6\u7834\u89e3\u53bb\u6df7\u6dc6"},"content":{"rendered":"\n<p>\u8fd9\u8fb9\u6587\u7ae0\u662f\u7f51\u4e0a\u770b\u5230\u7684\uff0c\u4ee5\u524d\u6709\u770b\u5230\u8fc7sojson.v4\u7684\u89e3\u5bc6\uff0c\u4f46\u662f\u73b0\u5728\u60f3\u53bb\u627e\u627e\u4e0d\u5230\u4e86\uff0c\u8fd9\u91cc\u5c31\u987a\u624b\u8bb0\u5f55\u4e0bsojson.v5\u7684\u8fc7\u7a0b\uff0c\u4ee5\u540e\u5728\u6162\u6162\u7814\u7a76<br \/> \u52a0\u5bc6\u5f88\u5178\u578b\uff0c\u5f00\u5934\u6709\u4e00\u4e2a<code>;var encode_version = 'sojson.v5'<\/code>\u636e\u7f51\u4e0a<a href=\"https:\/\/www.dongwubaike.cn\/fanhao\/tag\/da-niu\" title=\"View all posts in \u5927\u725b\" target=\"_blank\">\u5927\u725b<\/a>\u4eec\u8ba8\u8bbaJS\u662f\u4e0d\u53ef\u80fd\u6709\u771f\u6b63\u7684\u52a0\u5bc6\uff0c\u6700\u591a\u662f\u6df7\u6dc6\u3002<br \/> \u8fd9\u4e2a\u52a0\u5bc6\u628ajs\u7684\u53d8\u91cf\u540d\u4e4b\u7c7b\u7684\u5df2\u7ecf\u6253\u4e71\uff0c\u6240\u4ee5\u662f\u4e0d\u592a\u53ef\u80fd100%\u6062\u590d\u4e86\uff0c\u53ea\u80fd\u81ea\u5df1\u9605\u8bfb\u4ee3\u7801\u53bb\u8fd8\u539f\u4e86\u3002<br \/> <a href=\"https:\/\/tva1.sinaimg.cn\/large\/007X8olVly1g7z65yo1hkj327o0u0e67.jpg\" data-fancybox=\"images\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/tva1.sinaimg.cn\/large\/007X8olVly1g7z65yo1hkj327o0u0e67.jpg\" width=\"2868\" height=\"1080\" alt=\"sojson.v5\u6700\u725b\u52a0\u5bc6\u8131\u58f3\u89e3\u5bc6\u7834\u89e3\u53bb\u6df7\u6dc6\" \/><\/a><\/p>\n<h2>\u8131\u58f3\u89e3\u5bc6\u811a\u672c<\/h2>\n<pre>;(function (js_body) {      \/\/ \u8131\u58f3 &amp;&amp; \u89e3\u5bc6      let js_arr = js_body.split(\"n\").pop().split(';'),          fun_name = \/vars+(_0x[a-z0-9]+)=\/.exec(js_arr[6])[1],          reg_str = fun_name + '\\(' + \"'([^']+)',s*'([^']+)'\" + '\\)',          js_str = js_arr.slice(54, js_arr.length - 4).join(' ;'),          code_shell = js_arr.slice(0, 54).join(';'),          shell_obj = eval(\"(function(){\" + code_shell + \"return \" + fun_name + \"})()\");      js_str = js_str.replace(new RegExp(reg_str, 'g'), function (str, id, key) {          return '\"' + shell_obj(id, key) + '\"';      }).replace(\/([a-z0-9-_A-Z)]]+)s?[[\"']([^\"']+)[\"']]\/g, '$1.$2').replace(\/\\(? 0) {              for (const key in obj) {                  if (!obj.hasOwnProperty(key)) continue;                  if (typeof obj[key] == 'function') {                      let fun_info = \/function s*_0x[0-9a-z]+(([^)]*)){return s*([^;]+);}\/.exec(obj[key].toString());                      js_str = js_str.replace(new RegExp(name + '\\. ' + key + '\\(([^())]* )\\)', 'g'), function (string, args_str) {                          let args = args_str.split(','),                              fun_args = fun_info[1].split(','),                              fun_body = fun_info[2];                          fun_args.forEach(function (item, index) {                              fun_body = fun_body.replace(item, args[index]);                          });                          return fun_body;                      });                  } else if (typeof obj[key] == 'string ') {                      js_str = js_str.replace(name + '.' + key, '\"' + obj[key] + '\"');                  } else {                      js_str = js_str.replace(name + '.' + key, obj[key].toString());                  }              }          }      }      return js_str;  })($('#resultSource').val() || $('#jsdata').val());<\/pre>\n<h2>\u624b\u52a8\u89e3\u5bc6\u8fc7\u7a0b<\/h2>\n<p><strong>\u5148\u8bb2\u4e00\u4e0b\u6211\u6240\u77e5\u9053\u7684JS\u52a0\u5bc6\/\u6df7\u6dc6\u6709\u54ea\u4e9b<\/strong><br \/> \u5176\u5b9e\u6211\u4e2a\u4eba\u5e76\u4e0d\u8ba4\u4e3a\u4e0b\u9762\u8bb2\u7684\u8fd9\u4e9b\u662f\u52a0\u5bc6\uff0c\u9876\u591a\u662f\u6df7\u6dc6\u7f62\u4e86\uff0c\u6240\u4ee5\u672c\u6587\u540e\u7eed\u5c3d\u91cf\u4e0d\u7528\u52a0\u5bc6\u6765\u63cf\u8ff0\u3002<br \/> <strong>eval\u52a0\u5bc6<\/strong><br \/> \u6700\u5e38\u89c1\u7684\u5982packer\u7b49<br \/> <strong>\u5178\u578b\u7279\u5f81<\/strong><br \/> \u4ee3\u7801\u5185\u4f7f\u7528eval\u65b9\u6cd5\uff0c\u5927\u81f4\u539f\u7406\u662f\u5bf9\u4ee3\u7801\u8fdb\u884c\u6587\u672c\u7ea7\u522b\u7684\u62bd\u53d6\u53ef\u590d\u7528\u53c2\u6570\u8fdb\u884c\u538b\u7f29\u6df7\u6dc6\u3002<br \/> \u800c\u4f7f\u7528\u65f6\u5c06\u6df7\u6dc6\u4ee3\u7801\u8fd8\u539f\u4e3a\u5b57\u7b26\u4e32\uff0c\u7136\u540e\u4f7f\u7528eval\u8fd0\u884c\u4ee3\u7801\u3002<br \/> <strong>\u600e\u4e48\u7834\u89e3<\/strong><br \/> \u4e5f\u8bb8\u5728eval\u4e4b\u524d\u7684\u4ee3\u7801\u53ef\u80fd\u786e\u5b9e\u662f\u7528\u7b97\u6cd5\u52a0\u5bc6\u4e86\uff0c\u4f46\u6beb\u65e0\u610f\u4e49\uff0c\u56e0\u4e3a\u603b\u662f\u8981\u89e3\u5bc6\u3002<br \/> \u6211\u4eec\u8df3\u8fc7\u4ed6\u52a0\u89e3\u5bc6\u7684\u8fc7\u7a0b\uff0c\u76f4\u63a5\u5728\u4ed6\u6700\u7ec8\u6267\u884c\u4ee3\u7801\u7684\u5730\u65b9\u83b7\u53d6\u539f\u6587\u5373\u53ef\u3002<br \/> \u6bd4\u5982\u76f4\u63a5\u5c06eval\u6539\u4e3aconsole.log\u57fa\u672c\u53ef\u76f4\u63a5\u8f93\u51fa\u4ee3\u7801\u539f\u6587\uff0c<br \/> \u5982\u679c\u4e0d\u884c\u6216\u8005\u627e\u4e0d\u5230\uff0c\u5219\u624b\u52a8\u8986\u76d6eval\u65b9\u6cd5\uff0c\u7136\u540e\u6267\u884c\u4ee3\u7801\uff0c\u7136\u540e\u771f\u6b63\u7684\u4ee3\u7801\u5c31\u4f1a\u4ece\u53c2\u6570\u4f20\u8fdb\u6765\u3002<br \/> <strong>\u53d8\u91cf\u6df7\u6dc6<\/strong><br \/> \u4f8b\u5982\u63a5\u4e0b\u6765\u8981\u8bb2\u7684Obfuscator(\u672c\u6587\u9488\u5bf9\u7684sojson\u7684\u6df7\u6dc6\u5373\u7531\u6b64\u884d\u751f\uff0c\u6216\u8005\u662f\u6284\u88ad\uff1f)<br \/> \u8fd8\u6709\u6240\u8c13\u7684\u4e8c\u6b21\u5143\u52a0\u5bc6?<br \/> <strong>\u5178\u578b\u7279\u5f81<\/strong><br \/> \u6ca1\u6709\u7279\u5f81\uff0c\u5c31\u662f\u4e00\u5806\u770b\u4e0d\u61c2\u540d\u5b57\u7684\u4ee3\u7801\uff0c<br \/> \u539f\u7406\u76f4\u767d\u7684\u8bf4\uff0c\u5c31\u662f\u628a\u4f60\u7528\u7684\u53d8\u91cf\u540d\/\u65b9\u6cd5\u540d\u66ff\u6362\u6210\u65e0\u89c4\u5f8b\u7684\u540d\u79f0\u5b9e\u73b0\u5e72\u6270\u3002<br \/> \u4f8b\u5982\uff0c\u4f60\u53ef\u4ee5\u8ba4\u4e3a\u5f88\u591a\u4ee3\u7801\u538b\u7f29\u81ea\u5e26\u6df7\u6dc6\u529f\u80fd\uff0c\u56e0\u4e3a\u538b\u7f29\u4ee5\u540e\u4eba\u8089\u7406\u89e3\u6bd4\u8f83\u56f0\u96be\u3002<br \/> <strong>\u6b63\u5f0f\u5f00\u59cb<\/strong><br \/> \u9996\u5148\uff0c\u6211\u4eec\u9700\u8981\u51e0\u4e2a\u5de5\u5177\uff1a<br \/> \u4e00\u4e2a\u4ee3\u7801\u7f16\u8f91\u5668\uff0c\u5982\uff1aVS Code<br \/> Chrome \u6d4f\u89c8\u5668\uff0c\u7528\u6765\u8c03\u8bd5\u4ee3\u7801<br \/> \u9700\u8981\u89e3\u5bc6\u7684JS\u6587\u4ef6\uff0c\u6211\u4eec\u76f4\u63a5\u4ee5\u8fd9\u4e2asojson.v5\u4e3a\u51c6\u4e86<br \/> JS\u4ee3\u7801\u683c\u5f0f\u5316\u5de5\u5177\uff0c\u4f8b\u5982\uff1ahttps:\/\/tool.css-js.com\/\u3001http:\/\/www.bejson.com\/jshtml_format\/<br \/> \u4e00\u4e2a\u806a\u660e\u7684\u8111\u74dc\u5b50\uff0c\u4f8b\u5982\uff1a\u4f60<br \/> \u683c\u5f0f\u5316\u5e76\u6574\u7406\u4ee3\u7801<br \/> \u683c\u5f0f\u5b8c\u7684\u4ee3\u7801\uff0c\u6211\u4eec\u4f1a\u770b\u5230Unicode\u7f16\u7801\u7684\u6570\u636e\u5df2\u7ecf\u81ea\u52a8\u8f6c\u6362\u56de\u6765\u4e86\uff0c<br \/> \u5982\u679c\u6ca1\u6709\u8f6c\u6362\uff0c\u53ef\u4ee5\u81ea\u5df1\u8003\u8651\u5199\u4ee3\u7801\u8f6c\u6362\uff0c\u4f8b\u5982\uff1a<\/p>\n<pre>code_str.replace(\/\\x([a-f0-9]{2})\/g, function (match_str, group_1) {      return String.fromCharCode(parseInt(group_1, 16).toString(10));  });<\/pre>\n<p>\u73b0\u5728\u6211\u4eec\u5148\u9010\u6bb5\u5206\u6790\u6bcf\u4e00\u6bb5\u4ee3\u7801\uff0c\u6709\u4e9b\u4ee3\u7801\u53ef\u80fd\u592a\u957f\uff0c\u4f1a\u6709\u90e8\u5206\u622a\u65ad\u3002<br \/> \u6211\u4eec\u5728\u7ffb\u8bd1\u4ee3\u7801\u7684\u65f6\u5019\uff0c\u4f1a\u5c06\u4e00\u4e9b\u53d8\u91cf\u7ed9\u547d\u540d\uff0c\u5efa\u8bae\u4f7f\u7528\u524d\u7f00\u5c3d\u91cf\u4e0d\u8981\u548c\u540e\u9762\u7684\u4ee3\u7801\u6709\u53ef\u80fd\u76f8\u540c\u7684\u53d8\u91cf\u540d\uff0c<br \/> \u4e0d\u7136\u540e\u7eed\u5c31\u5f88\u86cb\u75bc\u4e86\uff0c\u5e76\u4e14\u91cd\u547d\u540d\u4ee5\u540e\u4e0d\u8981\u4e22\u5f03\u539f\u6765\u7684\u53d8\u91cf\u540d\uff0c\u6307\u4e0d\u5b9a\u4ec0\u4e48\u65f6\u5019\u53d1\u73b0\u8fd9\u4e2a\u53d8\u91cf\u6ca1\u66ff\u6362\u5230\uff0c<br \/> \u800c\u4f60\u53c8\u4e0d\u8bb0\u5f97\u662f\u4ec0\u4e48\u5730\u65b9\u6765\u7684\u3002<br \/> \u8fd9\u91cc\uff0c\u6211\u4eec\u628a\u53d8\u91cf\u540d\u524d\u7f00\u5b9a\u4e49\u4e3a<code>qs_<\/code><br \/> \u7136\u540e\u6211\u4eec\u6587\u7ae0\u5185\u6240\u6709\u7528\u5230\u884c\u6570\u7684\uff0c\u5747\u4ee5\u683c\u5f0f\u5316\u540e\u7684\u5b8c\u6574\u4ee3\u7801\u4e3a\u51c6(jiami_format.js)\u3002<br \/> <b>\u7b2c\u4e00\u6bb5(\u5b9a\u4e49\u4e86\u4e09\u4e2a\u53d8\u91cf)<\/b><\/p>\n<pre>var encode_version = \"sojson.v5\",      brfui = \"\",      _0x2c67 = [\"VHtkTcOA\", \"DcO<a href=\"https:\/\/www.dongwubaike.cn\/fanhao\/tag\/pve\" title=\"View all posts in PVE\" target=\"_blank\">PVE<\/a>B\/\", \"UMK...o9WPA==\"];<\/pre>\n<p>\u8fd9\u91cc\u5b9a\u4e49\u4e86\u4e09\u4e2a\u53d8\u91cf\uff0c\u7b2c\u4e00\u4e2a\u662f\u4f5c\u8005\u7684\u7248\u6743\uff0c\u7b2c\u4e8c\u4e2a\u6682\u65f6\u4e0d\u77e5\u9053\uff0c\u7b2c\u4e09\u4e2a\u662f\u4e00\u4e2a base64 \u7f16\u7801\u7684\u6570\u7ec4\uff1b<br \/> \u4e00\u822c\u8fd9\u79cd\u6570\u636e\u540e\u9762\u5f88\u6709\u53ef\u80fd\u7528\u5f97\u5230\uff0c\u53d8\u91cf\u540d\u6539\u6210qs_base_data\u7136\u540e\u5168\u5c40\u6279\u91cf\u66ff\u6362\u8fd9\u4e2a\u53d8\u91cf<br \/> \u7ed3\u679c\uff1a<\/p>\n<pre>var encode_version = \"sojson.v5\",      brfui = \"\",      qs_base_data \/* _0x2c67 *\/ = [\"VHtkTcOA\", \"DcOPVEB\/\", \"UMK...o9WPA==\"];<\/pre>\n<p>\u7136\u540e\u6d4f\u89c8\u5668\u6253\u5f00\u4e00\u4e2a\u7a7a\u767d\u9875\u9762\uff0c\u624b\u52a8\u590d\u5236\u8fd9\u6bb5\u4ee3\u7801\u5230\u63a7\u5236\u53f0\u8fdb\u53bb\uff0c\u6267\u884c\uff0c\u4e3a\u6211\u4eec\u63a5\u4e0b\u6765\u7684\u8c03\u8bd5\u505a\u51c6\u5907\u3002<br \/> \u6216\u8005\u521b\u5efa\u4e00\u4e2a\u7a7a\u767d\u9875\u9762\uff0c\u628a\u8fd9\u884c\u4ee3\u7801\u653e\u8fdb\u53bb\u51c6\u5907\u6267\u884c\u3002<\/p>\n<p><b>\u7b2c\u4e8c\u6bb5 (\u4e00\u4e2a\u533f\u540d\u51fd\u6570)<\/b><\/p>\n<pre>(function (_0x2ac5c, _0x3068dd) {      var _0xe9c838 = function (_0x23ef01) {          while (--_0x23ef01) {              _0x2ac5c[\"push\"](_0x2ac5c[\"shift\"]());          }      };      var _0x3421c5 = function () {          var _0x5d77e7 = {              data: {                  key: \"cookie\",                  value: \"timeout\"              },              set<a href=\"https:\/\/www.dongwubaike.cn\/fanhao\/tag\/ookie\" title=\"View all posts in Cookie\" target=\"_blank\">Cookie<\/a>: function (_0x3c4b91, _0x3bd290, _0x5a5c5a, _0x529726) {                  _0x529726 = _0x529726 || {};                  var _0xe0bed = _0x3bd290 + \"=\" + _0x5a5c5a;                  var _0x45867b = 0;                  for (var _0x45867b = 0, _0x568496 = _0x3c4b91[\"length\"]; _0x45867b &lt; _0x568496; _0x45867b++) {                      var _0x24edef = _0x3c4b91[_0x45867b];                      _0xe0bed += &quot;; &quot; + _0x24edef;                      var _0x35ae72 = _0x3c4b91[_0x24edef];                      _0x3c4b91[&quot;push&quot;](_0x35ae72);                      _0x568496 = _0x3c4b91[&quot;length&quot;];                      if (_0x35ae72 !== !![]) {                          _0xe0bed += &quot;=&quot; + _0x35ae72;                      }                  }                  _0x529726[&quot;cookie&quot;] = _0xe0bed;              },              removeCookie: function () {                  return &quot;dev&quot;;              },              getCookie: function (_0x475fb9, _0x248e39) {                  _0x475fb9 = _0x475fb9 || function (_0x34f7a4) {                      return _0x34f7a4;                  };                  var _0x202cdc = _0x475fb9(new RegExp(&quot;(?:^|; )&quot; + _0x248e39[&quot;replace&quot;](\/([.$?*|{}()[]\/+^])\/g, &quot;$1&quot;) + &quot;=([^;]*)&quot;));                  var _0x48a974 = function (_0x267c1a, _0x45329b) {                      _0x267c1a(++_0x45329b);                  };                  _0x48a974(_0xe9c838, _0x3068dd);                  return _0x202cdc ? decodeURIComponent(_0x202cdc[1]) : undefined;              }          };          var _0x1dbeed = function () {              var _0x4885e3 = new RegExp(&quot;\\w+ *\\(\\) *{\\w+ *[&#039;|&quot;].+[&#039;|&quot;];? *}&quot;);              return _0x4885e3[&quot;test&quot;](_0x5d77e7[&quot;removeCookie&quot;][&quot;toString&quot;]());          };          _0x5d77e7[&quot;updateCookie&quot;] = _0x1dbeed;          var _0x1cefc6 = &quot;&quot;;          var _0x170183 = _0x5d77e7[&quot;updateCookie&quot;]();          if (!_0x170183) {              _0x5d77e7[&quot;setCookie&quot;]([&quot;*&quot;], &quot;counter&quot;, 1);          } else if (_0x170183) {              _0x1cefc6 = _0x5d77e7[&quot;getCookie&quot;](null, &quot;counter&quot;);          } else {              _0x5d77e7[&quot;removeCookie&quot;]();          }      };      _0x3421c5();  })(qs_base_data, 202);<\/pre>\n<p>\u73b0\u770b\u8fd9\u4e2a\u533f\u540d\u51fd\u6570\u7684\u5165\u53e3\u70b9\uff0c\u4f20\u5165\u4e86\u4e24\u4e2a\u53c2\u6570\uff0c<code>qs_base_data, 202<\/code><br \/> \u6240\u4ee5\u53c2\u6570\u4e00\u7684\u540d\u5b57\u4e5f\u53ef\u4ee5\u66ff\u6362\u4e86\uff0c\u53c2\u6570\u4e8c\u683c\u5f0f\u5316\u524d\u5176\u5b9e\u662f\u4e00\u4e2a16\u8fdb\u5236<code>0xca<\/code>\uff0c\u8fd9\u91cc\u81ea\u52a8\u8f6c\u6362\u4e3a10\u8fdb\u5236\u4e86\u3002<br \/> \u6211\u4eec\u6682\u4e14\u628a\u53c2\u6570\u4e8c\u79f0\u4e3a<code>qs_arg_num<\/code>\uff0c\u518d\u6b21\u5168\u5c40\u66ff\u6362\u3002<br \/> \u7136\u540e\u770b\u65b9\u6cd5\u91cc\u9762\u7b2c\u4e00\u6bb5\uff0c\u5b9a\u4e49\u4e86\u4e00\u4e2a\u65b9\u6cd5\uff1a<\/p>\n<pre>    var _0xe9c838 = function (_0x23ef01) {          while (--_0x23ef01) {              qs_base_data[\"push\"](qs_base_data[\"shift\"]());          }      };<\/pre>\n<p>\u7136\u540e\u6211\u4eec\u4f1a\u770b\u5230<code>qs_base_data[\"push\"](qs_base_data[\"shift\"]());<\/code>\u8fd9\u4e00\u6bb5\uff0c<br \/> \u6211\u4eec\u8bb0\u5f97<code>qs_base_data<\/code>\u662f\u4e00\u4e2a\u6570\u7ec4\uff0c<code>[\"push\"]<\/code>\u5176\u5b9e\u5c31\u662f\u8c03\u7528\u8fd9\u4e2a\u6570\u7ec4\u7684\u65b9\u6cd5\u3002<br \/> \u6211\u4eec\u5148\u5168\u5c40\u5904\u7406\u4e00\u904d\uff0c\u628a<code>qs_base_data[\"push\"]<\/code>\u66ff\u6362\u4e3a<code>qs_base_data.push<\/code>\u8fd9\u6837\u66f4\u65b9\u4fbf\u6211\u4eec\u67e5\u770b\u3002<br \/> \u7f16\u8f91\u5668\u5185\u7528\u6b63\u5219\u8868\u8fbe\u5f0f\u66ff\u6362<code>([a-zA-z0-9_]+)[['\"]([^\"']+)['\"]]<\/code>\u66ff\u6362\u4e3a<code>$1.$2<\/code>\uff0c\u8bb0\u5f97\u52fe\u9009<code>.*<\/code>\u8868\u793a\u6b63\u5219\u66ff\u6362\u3002<br \/> \u66ff\u6362\u5b8c\u4ee5\u540e\u5982\u679c\u8fd8\u80fd\u627e\u5230\u5c31\u7ee7\u7eed\u66ff\u6362\uff0c\u4e00\u76f4\u5230\u627e\u4e0d\u5230\u5339\u914d\u9879\u4e3a\u6b62\u3002<br \/> \u867d\u7136\u6211\u4eec\u4e0d\u77e5\u9053\u8fd9\u6bb5\u4ee3\u7801\u662f\u4ec0\u4e48\u7528\u9014(\u5f53\u7136\uff0c\u901a\u8fc7\u9605\u8bfb\u4ee3\u7801\uff0c\u5927\u81f4\u53ef\u4ee5\u7406\u89e3\u662f\u628a\u6570\u7ec4\u540e\u9762\u7684\u4e00\u5b9a\u6570\u91cf\u79fb\u52a8\u5230\u6570\u7ec4\u524d\u9762)\uff0c<br \/> \u6211\u4eec\u53ef\u4ee5\u627e\u54ea\u91cc\u8c03\u7528\u4e86\u8fd9\u4e2a\u65b9\u6cd5<code>_0xe9c838<\/code>\uff0c\u597d\u77e5\u9053\u53c2\u6570\u4e00\u662f\u4ece\u54ea\u91cc\u6765\u7684\u3002<\/p>\n<p>\u6211\u4eec\u4f1a\u770b\u5230\uff0c\u5168\u5c40\u53ea\u6709\u4e00\u4e2a\u5730\u65b9\u7528\u5230\u4e86\u8fd9\u4e2a\u65b9\u6cd5(\u540d)\uff0c<code>_0x48a974(_0xe9c838, qs_arg_num);<\/code><br \/> \u5982\u679c\u6709\u591a\u4e2a\u5730\u65b9\u7528\u7684\uff0c\u90a3\u4e48\u5c31\u8981\u6328\u4e2a\u53bb\u6d4b\u8bd5\u54ea\u91cc\u771f\u6b63\u8c03\u7528\u7684\u3002<br \/> \u7ee7\u7eed\u627e<code>_0x48a974<\/code>\u53d1\u73b0\u524d\u4e00\u884c\u5b9a\u4e49\u4e86\u8fd9\u4e2a\u65b9\u6cd5\uff0c\u5185\u5bb9\u662f\u5c06\u53c2\u6570\u4e8c\u81ea\u589e\u540e\u4f20\u9012\u7ed9\u53c2\u6570\u4e00\u3002<\/p>\n<pre>var _0x48a974 = function (_0x267c1a, _0x45329b) {      _0x267c1a(++_0x45329b);  };<\/pre>\n<p>\u6211\u4eec\u5c31\u77e5\u9053\u53c2\u6570\u4e00\u662f\u6700\u5f00\u59cb\u5165\u53e3\u70b9\u7684<code>qs_arg_num<\/code>\uff0c\u7ed9\u5bf9\u5e94\u7684\u65b9\u6cd5\u8d77\u540d\u3002<br \/> \u6700\u7ec8\u76f8\u5173\u4ee3\u7801\u5e94\u8be5\u662f\u8fd9\u6837\u7684\u3002<\/p>\n<pre>var qs_arr_move \/* _0xe9c838 *\/ = function (qs_arg_num \/* _0x23ef01 *\/) {      while (--qs_arg_num) {          qs_base_data.push(qs_base_data.shift());      }  };  var call_fun \/* _0x48a974 *\/ = function (callback_fun \/* _0x267c1a *\/, qs_arg_num \/* _0x45329b *\/) {      callback_fun(++qs_arg_num);  };  call_fun(qs_arr_move, qs_arg_num);<\/pre>\n<p>\u5230\u4e86\u8fd9\u4e00\u6b65\uff0c\u6211\u73b0\u5728\u63a5\u4e0b\u6765\u7684\u52a8\u4f5c\u6709\u4e24\u4e2a\u4e0d\u540c\u7684\u65b9\u5411\uff1a<br \/> \u7ee7\u7eed\u5bfb\u627e\u8fd9\u4e2a\u65b9\u6cd5\u662f\u4ece\u54ea\u91cc\u8c03\u7528\u7684<br \/> \u56de\u5230\u6700\u5f00\u59cb\uff0c\u6309\u89e3\u91ca\u5668\u89d2\u5ea6\u7ee7\u7eed\u9605\u8bfb\u4ee3\u7801<br \/> \u6211\u8fd9\u91cc\u9009\u62e9\u6309\u89e3\u91ca\u5668\u6765\u6267\u884c\u4ee3\u7801\uff0c\u6211\u4eec\u56de\u5230\u6700\u5f00\u59cb\u7684<code>qs_arr_move<\/code>\u65b9\u6cd5\u540e\u9762\u3002<br \/> \u540e\u9762\u53c8\u5b9a\u4e49\u4e86\u4e00\u4e2a<code>_0x3421c5<\/code>\u7684\u65b9\u6cd5\uff0c\u5e76\u4e14\u7d27\u63a5\u7740\u6267\u884c\u4e86\u8fd9\u4e2a\u65b9\u6cd5\u3002<br \/> \u6240\u4ee5\uff0c\u6211\u4eec\u53ef\u4ee5\u770b\u4e0b\u8fd9\u4e2a\u65b9\u6cd5\u5185\u90e8\u505a\u4e86\u4ec0\u4e48\uff0c\u7531\u4e8e\u6ca1\u6709\u53c2\u6570\uff0c\u76f4\u63a5\u8fdb\u5165\u65b9\u6cd5\u7b2c\u4e00\u884c\u5f80\u4e0b\u770b\u3002<br \/> \u5728\u65b9\u6cd5\u5185\uff0c\u53c8\u5b9a\u4e49\u4e86\u4e00\u4e2a<code>_0x5d77e7<\/code>\u7684\u5bf9\u8c61\uff0c\u5e76\u4e14\u5b9a\u4e49\u4e86<code>data<\/code>\u3001<code>setCookie<\/code>\u3001<code>removeCookie<\/code>\u3001<code>getCookie<\/code>\u51e0\u4e2a\u65b9\u6cd5\uff0c<br \/> \u6211\u4eec\u5148\u7ed9\u8fd9\u4e2a\u5bf9\u8c61(<code>_0x5d77e7<\/code>)\u8d77\u540d\uff0c\u5c31\u53eb\u4ed6<code>qs_obj_cookie<\/code>\u5427\u3002<br \/> \u7531\u4e8e\u5e76\u6ca1\u6709\u6267\u884c\uff0c\u6211\u4eec\u5148\u4e0d\u7ba1\uff0c\u7ee7\u7eed\u5f80\u4e0b&#8230;<\/p>\n<pre>var _0x1dbeed = function () {      var _0x4885e3 = new RegExp(\"\\w+ *\\(\\) *{\\w+ *['|\"].+['|\"];? *}\");      return _0x4885e3.test(qs_obj_cookie.removeCookie.toString());  };  qs_obj_cookie.updateCookie = _0x1dbeed;  var _0x170183 = qs_obj_cookie.updateCookie();<\/pre>\n<p>\u540e\u9762\u5b9a\u4e49\u4e86<code>_0x1dbeed<\/code>\u8fd9\u4e2a\u65b9\u6cd5\uff0c\u5e76\u8d4b\u503c\u7ed9\u4e86<code>qs_obj_cookie.updateCookie<\/code>\uff0c\u6240\u4ee5\u6211\u4eec\u53eb\u4ed6<code>qs_updateCookie<\/code>\u5427\u3002<br \/> \u7136\u540e\u53ea\u5b9a\u4e49\u4e86\u4e00\u4e2a\u7a7a\u53d8\u91cf\u540e\uff0c\u5c31\u6267\u884c\u4e86\u8fd9\u4e2a\u65b9\u6cd5\u5e76\u4fdd\u5b58\u8fd4\u56de\u503c\u5230<code>_0x170183<\/code>\u3002<br \/> \u6211\u4eec\u56de\u8fc7\u5934\u9605\u8bfb\u4e0b\u8fd9\u4e2a<code>updateCookie<\/code>\u91cc\u9762\u5230\u5e95\u505a\u4e86\u5565\u3002<br \/> \u5b9a\u4e49\u4e00\u4e2a\u6b63\u5219\u8868\u8fbe\u5f0f\uff0c\u5e76\u628a<code>removeCookie<\/code>\u65b9\u6cd5\u8f6c\u6362\u4e3a\u5b57\u7b26\u4e32\u8fdb\u884c\u5339\u914d\u3002<br \/> \u4ee3\u7801\u62ff\u5230\u6d4f\u89c8\u5668\u63a7\u5236\u53f0\u6267\u884c\uff0c<\/p>\n<pre>var removeCookie = function () {      return \"dev\";  }  var _0x1dbeed = function () {      var _0x4885e3 = new RegExp(\"\\w+ *\\(\\) *{\\w+ *['|\"].+['|\"];? *}\");      return _0x4885e3.test(removeCookie.toString());  }  _0x1dbeed();<\/pre>\n<p>\u6211\u4eec\u770b\u5230\u6700\u7ec8\u6267\u884c\u7684\u662f\uff0c\u5e76\u8fd4\u56de\u4e86<code>false<\/code><\/p>\n<pre>\/w+ *() *{w+ *['|\"].+['|\"];? *}\/.test('function () {      return \"dev\";  }');<\/pre>\n<p>\u4f46\u662f\uff0c\u8fd9\u91cc\u6709\u4e00\u4e2a\u5751\uff0c\u5982\u679c\u719f\u6089\u6b63\u5219\u8868\u8fbe\u5f0f\u7684\u670b\u53cb\u5e94\u8be5\u4f1a\u53d1\u73b0\uff0c\u8fd9\u4e2a\u6b63\u5219\u8868\u8fbe\u5f0f\u4e0d\u5339\u914d\u6362\u884c\uff0c<br \/> \u800c\u6211\u4eec<code>toString<\/code>\u5f97\u5230\u7684\u65b9\u6cd5\u5b57\u7b26\u4e32\u662f\u5e26\u6709\u6362\u884c\u7684\uff0c\u56e0\u4e3a\u6211\u4eec\u683c\u5f0f\u5316\u8fc7\u4e86\uff0c<br \/> \u5982\u679c\u4e0d\u719f\u7684\u8bdd\uff0c\u4e5f\u5e94\u8be5\u6709\u4e00\u4e2a\u8b66\u89c9\uff0c<code>removeCookie<\/code>\u65b9\u6cd5\u672c\u8eab\u6ca1\u6709\u591a\u5927\u5b9e\u9645\u610f\u4e49\uff0c<br \/> \u7136\u540e\u8fd9\u91cc\u7528\u6b63\u5219\u8868\u8fbe\u5f0f\u53bb\u5339\u914d\u4e00\u4e2a\u65b9\u6cd5\u662f\u4ec0\u4e48\u76ee\u7684\uff1f<br \/> \u5176\u5b9e\uff0c\u8fd9\u4e2a\u4ee3\u7801\u5c31\u662f\u7528\u6765\u9632\u683c\u5f0f\u5316\u7684\uff0c\u56e0\u4e3a\u683c\u5f0f\u5316\u4ee5\u540e\u5c31\u4f1a\u8fd4\u56de<code>false<\/code>\uff0c\u6211\u4eec\u62ff\u672a\u683c\u5f0f\u5316\u7684\u4ee3\u7801\u8fdb\u53bb\u5c31\u4f1a\u8fd4\u56de<code>true<\/code>\u3002<br \/> \u5148\u4e0d\u7ba1\uff0c\u6211\u4eec\u77e5\u9053\u8fd9\u91cc\u5e94\u8be5\u4e3a<code>true<\/code>\u5c31\u597d\uff0c\u7ee7\u7eed\u5f80\u4e0b\u6267\u884c\uff0c<br \/> \u4e0b\u9762\u662f\u4e00\u4e2a<code>if<\/code>\u5224\u65ad\uff0c\u7528\u6765\u5224\u65ad\u521a\u624d\u8fd4\u56de\u7684\u662f<code>true<\/code>\u8fd8\u662f<code>false<\/code>\uff0c\u6211\u4eec\u5b9e\u9645\u662f<code>true<\/code>\uff0c\u76f4\u63a5\u8fdb\u5165\u5bf9\u5e94\u6761\u4ef6\u3002<br \/> <code>_0x1cefc6 = qs_obj_cookie.getCookie(null, \"counter\");<\/code><br \/> \u56de\u5230<code>getCookie<\/code>\u7684\u5b9a\u4e49\uff0c\u6211\u4eec\u770b\u4e0b\u90fd\u5e72\u4e86\u5565\u3002<\/p>\n<pre>getCookie: function (_0x475fb9, _0x248e39) {      _0x475fb9 = _0x475fb9 || function (_0x34f7a4) {          return _0x34f7a4;      };      var _0x202cdc = _0x475fb9(new RegExp(\"(?:^|; )\" + _0x248e39.replace(\/([.$?*|{}()[]\/+^])\/g, \"$1\") + \"=([^;]*)\"));      var call_fun \/* _0x48a974 *\/ = function (callback_fun \/* _0x267c1a *\/, qs_arg_num \/* _0x45329b *\/) {          callback_fun(++qs_arg_num);      };      call_fun(qs_arr_move, qs_arg_num);      return _0x202cdc ? decodeURIComponent(_0x202cdc[1]) : undefined;  }<\/pre>\n<p>\u5148\u7ed9\u53c2\u6570\u4e00\u8d4b\u503c\u4e00\u4e2a\u65b9\u6cd5\uff0c\u65b9\u6cd5\u76f4\u63a5\u628a\u53c2\u6570\u8fd4\u56de&#8230;<br \/> \u6240\u4ee5\uff0c\u53c2\u6570\u4e00\u7684\u540d\u5b57\u6709\u4e86\uff0c<code>qs_fun_back<\/code>\u771f\u7684\u5f88\u968f\u610f\u7684\u8d77\u4e86\u540d\u5b57&#8230;<br \/> \u53c2\u6570\u4e8c\u662f\u4e00\u4e2a\u5b57\u7b26\u4e32\uff0c\u5c31\u5148\u8d77\u540d\u53eb<code>qs_name_str<\/code>\u5427&#8230;<br \/> \u7d27\u63a5\u7740\u5f80\u4e0b\u9762\u770b\uff0c\u5b9a\u4e49\u4e86\u4e00\u4e2a<code>_0x202cdc<\/code>\u53d8\u91cf\u5e76\u8d4b\u503c\u4e86\u4e00\u4e2a\u6b63\u5219\u8868\u8fbe\u5f0f\u7136\u540e\u5728\u6700\u672b\u5c3e\u8fd4\u56de\u4e86\uff0c<br \/> \u800c\u6700\u5916\u9762\u8c03\u7528<code>getCookie<\/code>\u7684\u5730\u65b9\u867d\u7136\u4fdd\u5b58\u5230\u4e86<code>_0x1cefc6<\/code>\uff0c\u4f46\u5e76\u6ca1\u6709\u4efb\u4f55\u5730\u65b9\u4f7f\u7528\uff0c\u6682\u65f6\u5148\u5ffd\u7565\u8fd9\u91cc\u7684\u4ee3\u7801\uff0c\u7ee7\u7eed\u5f80\u4e0b\u770b\u3002<br \/> \u8fd9\u91cc\u5c31\u4f1a\u770b\u5230\u6211\u4eec\u6700\u5f00\u59cb\u8c03\u7528<code>qs_arr_move<\/code>\u7684\u5730\u65b9\u4e86\uff0c\u7136\u540e\u6574\u4e2a\u5927\u7684\u65b9\u6cd5\u5c31\u6267\u884c\u5b8c\u4e86\u3002<br \/> \u603b\u7ed3\u4e00\u4e0b\u8fd9\u4e2a\u65b9\u6cd5\u505a\u4e86\u4ec0\u4e48\uff1a<br \/> \u5c1d\u8bd5\u5224\u65ad\u4ee3\u7801\u662f\u5426\u88ab\u683c\u5f0f\u5316<br \/> \u5982\u679c\u6ca1\u6709\u683c\u5f0f\u5316\uff0c\u5c31\u53bb\u79fb\u52a8\u6570\u7ec4\u7684\u5143\u7d20\u3002<br \/> \u6211\u4eec\u76f4\u63a5\u5728\u6d4f\u89c8\u5668\u63a7\u5236\u53f0\u6267\u884c\u6700\u7ec8\u6709\u610f\u4e49\u7684\u4ee3\u7801\uff1a<\/p>\n<pre>var qs_arr_move \/* _0xe9c838 *\/ = function (qs_arg_num \/* _0x23ef01 *\/) {      while (--qs_arg_num) {          qs_base_data.push(qs_base_data.shift());      }  };  qs_arr_move(qs_base_data, 203 \/* ++qs_arg_num *\/);<\/pre>\n<p>\u5b9e\u9645\u7406\u89e3\u4ee3\u7801\uff0c\u5c31\u662f\u628a\u6570\u7ec4\u4ece\u67d0\u4e2a\u4f4d\u7f6e\u622a\u65ad\uff0c\u524d\u9762\u7684\u9644\u52a0\u5728\u540e\u9762\u3002<\/p>\n<pre>arr = [].concat(arr.splice(202 % arr.length, arr.length - (202 % arr.length)) arr);<\/pre>\n<p><\/b>\u7b2c\u4e09\u6bb5 (\u53c8\u4e00\u4e2a\u533f\u540d\u51fd\u6570)<\/b><br \/> \u7531\u4e8e\u4e0a\u9762\u5df2\u7ecf\u8bb2\u4e86\u4e00\u4e9b\u8c03\u8bd5\u7684\u65b9\u6cd5\uff0c\u6240\u4ee5\u8fd9\u91cc\u53ef\u80fd\u4f1a\u8df3\u8fc7\u4e00\u4e9b\u548c\u4e0a\u9762\u76f8\u4f3c\u4f46\u53ef\u80fd\u91cd\u8981\u7684\u6d41\u7a0b\u3002<br \/> \u7ee7\u7eed\u770b\uff0c\u5148\u5b9a\u4e49\u4e86\u4e00\u4e2a\u65b9\u6cd5\uff0c\u53eb<code>_0xdf0e<\/code>\uff0c\u7136\u540e\u5168\u5c40\u641c\u7d22\u8fd9\u4e2a\u65b9\u6cd5\u540d\uff0c\u53d1\u73b0\u6709\u5f88\u591a\u5904\u8c03\u7528\uff0c\u8fd9\u91cc\u5148\u627e\u5230\u7b2c\u4e00\u4e2a\u8c03\u7528\u4f5c\u4e3a\u7406\u89e3\u3002<br \/> \u662f\u5728\u4e00\u4e2a\u5b9a\u65f6\u5668\u91cc\u9762\u5faa\u73af\u8c03\u7528\u7684\uff0c\u5148\u4e0d\u7ba1\u5b9a\u65f6\u5668\u505a\u4e86\u5565\uff0c\u6211\u4eec\u5148\u62ff\u7740\u53c2\u6570\u56de\u5230\u65b9\u6cd5\u770b\u65b9\u6cd5\u8981\u5e72\u5565\u3002<\/p>\n<pre>setInterval(function () {      var _0x346bb8 = {          gHwtC: function _0x4f689e(_0x2f31c2) {              return _0x2f31c2();          }      };      _0x346bb8[_0xdf0e(\"0x0\", \"*naR\")](_0x10c488);  }, 4e3);<\/pre>\n<p>\u5728\u65b9\u6cd5\u4f53\u5185\u5bfb\u627e\u8fd9\u4e24\u4e2a\u53c2\u6570\u5728\u4ec0\u4e48\u5730\u65b9\u4f7f\u7528\uff0c\u76f8\u5173\u5173\u952e\u4ee3\u7801\u5982\u4e0b\uff1a<\/p>\n<pre>_0x532a72 = _0x532a72 - 0;  var _0x44d30c = qs_base_data[_0x532a72];    _0x44d30c = _0xdf0e.rc4(_0x44d30c, _0x422b57);<\/pre>\n<p>\u65b9\u6cd5\u6700\u5f00\u59cb\u5bf9\u53c2\u6570\u4e00<code>_0x532a72<\/code>(0x0) -0\u64cd\u4f5c\uff0c\u5b9e\u9645\u5c31\u662f\u5c0616\u8fdb\u5236\u7684\u5b57\u7b26\u4e32\u8f6c\u4e3a\u5341\u8fdb\u5236\u6570\u503c\u3002<br \/> \u7136\u540e\u53c8\u4ece<code>qs_base_data<\/code>\u53d6\u51fa\u4e00\u4e2a\u6210\u5458\uff0c\u6700\u540e\u653e\u8fdb<code>rc4<\/code>\u91cc\u9762\uff0c\u6839\u636e\u7406\u89e3\uff0c\u5e94\u8be5\u662f\u53d6\u51fa\u5bc6\u6587\u7528\u5bc6\u94a5\u89e3\u5bc6\u3002<br \/> \u90a3\u4e48\uff0c\u53c2\u6570\u5206\u522b\u5c31\u8d77\u540d<code>qs_arg_id<\/code>\uff0c<code>qs_arg_str<\/code>\uff0c\u76f8\u5173\u53d8\u91cf\u4e3a<code>qs_data_item<\/code>\u3002<br \/> \u4e3a\u4e86\u4fdd\u9669\u8d77\u89c1\uff0c\u6211\u4eec\u53ef\u4ee5\u7ee7\u7eed\u770b\u4e0b\u540e\u9762\u7684\u4ee3\u7801\u90fd\u505a\u4e86\u5565(\u5176\u5b9e\u4e0a\u9762\u7684\u4ee3\u7801\u5c31\u662f\u6240\u6709\u9700\u8981\u7684\u4e86\uff0c\u5176\u4ed6\u7684\u90fd\u662f\u591a\u4f59\u7684\u201c\u82b1\u6307\u4ee4\u201d)<br \/> \u9996\u5148\u5728\u5bf9\u8c61\u672a\u521d\u59cb\u5316\u65f6\uff0c\u83b7\u53d6\/\u521b\u5efa<code>window<\/code>\uff0c<code>atob(base64 decode)<\/code><br \/> \u7136\u540e\u521b\u5efa<code>_0x481c88<\/code>\u65b9\u6cd5\u8d4b\u503c\u7ed9<code>_0xdf0e.rc4 = _0x481c88<\/code>;<br \/> \u5c31\u662f\u6240\u8c13\u7684 rc4 \u89e3\u5bc6\u4e86\u3002<br \/> \u521d\u59cb\u5316\u540e\uff0c\u518d\u6b21\u83b7\u53d6\u4e86<code>var qs_data_item2 \/* _0x5597dd *\/ = _0xdf0e.data[qs_arg_id];<\/code><br \/> \u7136\u540e\uff0c\u5173\u952e\u4ee3\u7801\u6709\u8fd9\u6837\u4e00\u6bb5\uff08\u5df2\u7ecf\u6574\u7406\u540e\u7684\u4ee3\u7801\uff09<\/p>\n<pre>var qs_data_item2 \/* _0x5597dd *\/ = _0xdf0e.data[qs_arg_id];  if (qs_data_item2 === undefined) {      if (_0xdf0e.once === undefined) {          var qs_rc4_state \/* _0xccf703 *\/ = function (rc4Bytes \/* _0x499f89 *\/) {              this.rc4Bytes = rc4Bytes;              this.states = [1, 0, 0];              this.newState = function () {                  return \"newState\";              };              this.firstState = \"\\w+ *\\(\\) *{\\w+ *\";              this.secondState = \"['|\"].+['|\"];? *}\";          };          \/\/...          new qs_rc4_state(_0xdf0e).checkState();          _0xdf0e.once = !![];      }      qs_data_item = _0xdf0e.rc4(qs_data_item, qs_arg_str);      _0xdf0e.data[qs_arg_id] = qs_data_item;  } else {      qs_data_item = qs_data_item2;  }<\/pre>\n<p>\u4ed6\u628a\u81f3\u4eca\u6ca1\u6709\u5b9a\u4e49\u540d\u5b57\u7684<code>_0xdf0e<\/code>\u4f20\u9012\u7ed9<code>qs_rc4_state<\/code>\u5e76\u4fdd\u5b58\u5728\u4e86<code>rc4Bytes<\/code>\uff0c<br \/> \u6240\u4ee5\u6211\u4eec\u4e5f\u53ef\u4ee5\u628a\u8fd9\u4e2a\u53d8\u91cf<code>_0xdf0e<\/code>\u5b9a\u4e49\u4e3a<code>rc4Bytes<\/code>\u4e86\u3002<br \/> \u7ee7\u7eed\u8ddf\u4ee3\u7801\uff0c\u548c\u4e0a\u9762 cookies \u90a3\u4e00\u6bb5\u51e0\u4e4e\u4e00\u6837\u76ee\u7684\u7684\u4ee3\u7801\uff0c\u8fd8\u662f\u5224\u65ad\u4ee3\u7801\u662f\u5426\u683c\u5f0f\u5316\u3002<br \/> \u5982\u679c\u5f04\u4e0d\u6e05\u695a\u4ee3\u7801\u6267\u884c\u7ed3\u679c\uff0c\u5c31\u628a\u4ee3\u7801\u653e\u5230\u6d4f\u89c8\u5668\u6267\u884c\u4e00\u904d\u5c31\u53ef\u4ee5\u4e86\u3002<\/p>\n<pre>var reg_ex = new RegExp(\"\\w+ *\\(\\) *{\\w+ *\" + \"['|\"].+['|\"];? *}\");  var newState = function(){return'newState';}; \/\/ \u8fd9\u91cc\u4e0d\u8981\u683c\u5f0f\u5316\uff0c\u56e0\u4e3a\u5c31\u662f\u6d4b\u8bd5\u5979\u662f\u5426\u683c\u5f0f\u5316\u7684  var states = [1, 0, 0];  reg_ex.test(newState.toString()) ? --states[1] : --states[0];<\/pre>\n<p>\u8fd9\u4e2a\u4ee3\u7801\u6700\u540e\u4f1a\u8f93\u51fa-1\uff0c\u7136\u540e\u8fdb\u5165<code>runState<\/code>\u65b9\u6cd5<\/p>\n<pre>qs_rc4_state.prototype.runState = function (_0x24db9c) {      if (!Boolean(~_0x24db9c)) {          return _0x24db9c;      }      return this.getState(this.rc4Bytes);  };<\/pre>\n<p><code>!Boolean(~-1)<\/code>\u8fd4\u56de<code>true<\/code>\u6240\u4ee5\u8fd9\u91cc\u5c31\u8fd4\u56de\u4e86\uff0c\u6ca1\u6709\u540e\u7eed\u3002<br \/> \u800c\u5982\u679c\u4ee3\u7801\u88ab\u683c\u5f0f\u5316\u4e86\uff0c\u540e\u7eed\u7684\u4ee3\u7801\u5219\u662f\u8fdb\u5165\u6b7b\u5faa\u73af&#8230;<br \/> \u8df3\u51fa\u8fd9\u4e2a\u65b9\u6cd5\uff0c\u6211\u4eec\u770b\u540e\u7eed\u53c8\u505a\u4e86\u4ec0\u4e48\uff0c<\/p>\n<pre>var qs_data_item2 \/* _0x5597dd *\/ = qs_rc4Bytes.data[qs_arg_id];  if (qs_data_item2 === undefined) {      if (qs_rc4Bytes.once === undefined) {          \/\/ \u9632\u6b62\u4ee3\u7801\u683c\u5f0f\u5316\u7684\u4ee3\u7801      }      qs_data_item = qs_rc4Bytes.rc4(qs_data_item, qs_arg_str);      qs_rc4Bytes.data[qs_arg_id] = qs_data_item;  } else {      qs_data_item = qs_data_item2;  }  return qs_data_item;<\/pre>\n<p>\u6700\u7ec8\u6267\u884c\u7684\u610f\u601d\u5373\u662f\uff1a<br \/> \u4ece<code>qs_base_data<\/code>\u53d6\u51fa\u5bc6\u6587\u5e76\u6839\u636e\u8c03\u7528\u65f6\u7684\u5bc6\u94a5\u4f7f\u7528rc4\u89e3\u5bc6\uff0c<br \/> \u7136\u540e\u4fdd\u5b58\u5230\u81ea\u8eab\u7684\u89e3\u5bc6\u7ed3\u679c\u6570\u7ec4\u4e2d<br \/> \u4e0b\u6b21\u8fd9\u76f4\u63a5\u4f7f\u7528\u89e3\u5bc6\u540e\u7684\u7ed3\u679c<br \/> \u8fd4\u56de\u89e3\u5bc6\u7684\u7ed3\u679c<br \/> PS\uff1a\u5176\u5b9e\u8fd9\u4e5f\u662f\u4ed6\u7684\u4ee3\u7801\u4e2d\u6700\u6838\u5fc3\u7684\u4e00\u90e8\u5206\u4ee3\u7801\u4e86\uff0c\u5176\u4ed6\u7684\u90fd\u662f\u56f4\u7ed5\u8fd9\u4e2a\u529f\u80fd\u6253\u63a9\u62a4\u800c\u5df2\u3002<br \/> \u6211\u4eec\u5c06\u6700\u7ec8\u6574\u7406\u51fa\u6765\u7684\u6838\u5fc3\u4ee3\u7801\u653e\u5165\u6d4f\u89c8\u5668\u6267\u884c\uff0c\u7528\u4ee5\u540e\u7eed\u4ee3\u7801\u7684\u7406\u89e3\u3002<\/p>\n<pre>var qs_base_data = [\"VHtkTcOA\", \"DcOPVEB\/\", \"UMKdX8KJ\", \"SsOnD3DDtQ==\", \"wolyw6h7QA==\", \"DlVDwp0=\", \"w6LCvBIsw6U=\", \"a8OcBkHDng==\", \"V8OeWyjDvQ==\", \"woAMIcKxMg==\", \"MBVaGsO5\", \"wr98woZiw6s=\", \"bho7\", \"NMOJdivCu1nDmCHCg8KBw4HDqy0=\", \"YsOKwrvCpk3DqMOgwq1N\", \"wpVhDsKkw6ws\", \"JErDp8KOJcKLw7Fh\", \"DMO\/w6dSE0DDmk3CihTCmMKtw7g=\", \"6L+15pum5LuZ5LuI5Lqg57CV5Ym4B8Oc5pKR5L2h44Cs\", \"56qx6ZS45o6U6aqB57iwFOKBpmDDo+WLkOWsouKCicOX5ZCYw6nigKIpYeikhOWskOKDvMK7776t5L2T5Y6m5L+t55u3XsOlw67jgbE=\", \"5aaB5pyP5oKq55uuw6c36Yel5bev5aeL5LugdMK3WO+8pnY1DOahqeesne+9p+ethuetvuWGqeS6pOmciGQ1wrTDoBDCgMKiXMO\/I+eYveS7r+egtO+\/vOiup+aPl+WNsuWGpeafpeWHleWIreWvleODhOi8n+S7vOW3heWGu+S5tOiCheWIvuWunnDCsQ3jgrhzKMOX56+45quw54uK5Yah5ayU\", \"U8KCCSTCtw==\", \"SEB6ccOl\", \"dsOwwqrCi0c=\", \"ZcOXwq\/ClhA=\", \"bBtxw4DDjw==\", \"KcOhwr5Qwps=\", \"wolww5BvcA==\", \"w7\/Ds0TDhcOd\", \"Z8Kmw60Rw6Q=\", \"SsOvwrnCqiQ=\", \"E8OAdnZ6\", \"IVDDp8KePsKOw7s=\", \"wp3DnEzCoS3CrBk=\", \"JsOYw6vCvxzDvcK4wrQbw6Ekw6JrwpbDhMKdMQ==\", \"w6AmGMKMwqU=\", \"JMOGcEZt\", \"wrfCgHlh\", \"woHDv8OkQcKFJzcpw70=\", \"V19x\", \"S8OnwpFZw4M=\", \"woUbKcKqJQ==\", \"acKTw5oH\", \"w7N\/eHbCrQ==\", \"wqJgXQvCtw==\", \"wpfDt8OrTcKB\", \"w6Eqwp8AVU5H\", \"WMK7wrjCgcOF\", \"dMOLwrHCsETDrcOr\", \"w65jf3o=\", \"O8OQw5LChUvCtcOo\", \"wonDklDCvA==\", \"fcKdw4Yaw5rDtcK2\", \"w4TCmcOp\", \"TcO6wo1Fw57CmsOS\", \"YMONJzLDu1HCgjLDmQ==\", \"w7EEw4fDmMOh\", \"OMOuwrhhKitT\", \"M8OTflp+\", \"wplxw5lCUg==\", \"w5c9w5TDhcOp\", \"dsOTHiDDuA==\", \"wqloEcKKw6k=\", \"RcONM8Oow5U=\", \"S8KBw5gfw7E=\", \"wqYyH8KyMQ==\", \"w6vCoycLw78=\", \"McOgTX5f\", \"Ul5wdw==\", \"wqlNw7ZsVg==\", \"TcKtwrDCjMOGwoE=\", \"w7DCgcKpRRU=\", \"wo1iFsKvw6Y2Cg==\", \"w6HDi0LDqcOY\", \"wppyw6HDjznDqsKswooL\", \"w7nCvD0Uw6nCnQEVLw==\", \"dsOIwrrCsV8=\", \"5Lma6IGL5Yi86ZmLasKzcGATw7wbwpcp\", \"K8O6wq1Uwo8t\", \"wqFjw5RRZ8ON\", \"a8Otwptiw6A=\", \"EFdWwo\/CtA==\", \"AAVow4vDiQ==\", \"T8O2wqZcw4U=\", \"w51lQVbCvg==\", \"worDn8O2bMKx\", \"E8OYwpB+Ew==\", \"esO7wq16dA==\", \"c8OEOXzDjw==\", \"WcKrw5stw5Q=\", \"ecOVKMOgwoY=\", \"w7MmAcKCwrQ=\", \"wrLDo04Nw4M1w7XDt8KG\", \"CUBcwoDCkA==\", \"wqBpw5kYZsOBQMK0w5nCoHnCjsOHZw==\", \"w6luN3LCpsKcwqBBw7E4w4Y=\", \"e8OpwqPCkxvCiQ==\", \"cMOjbgPDmQ==\", \"w7LDuggUwoU6wqM=\", \"acO8awQ=\", \"Bi5hw5bDnEw=\", \"GiZfPcO4WQ==\", \"wpbCkMOOw63CtcOSKMKzw4TDssOSw7kmDxop\", \"V3ViwqbCqMKEXzXCrsOXwqbDuMOvQ3VDUn\/DtjXDnmN2H8Kawo0Ew5liEMOww63CqcOfL8K6CMObwqzCkcO5w53CiMKoAhzCh8KldD5QYVbDt3pVVQLCuGE0ew==\", \"R8O7wopC\", \"YMO7YwPDgw==\", \"w6PCvScSw7I=\", \"woAOO8KzOw==\", \"w5sNOMKVwp8=\", \"cyY4wqI4\", \"NMOlwo9WPA==\"];  var qs_arr_move = function (qs_arg_num) {      while (--qs_arg_num) {          qs_base_data.push(qs_base_data.shift());      }  };  qs_arr_move(203);  var qs_rc4Bytes = function (qs_arg_id, qs_arg_str) {      qs_arg_id = qs_arg_id - 0;      var qs_data_item  = qs_base_data[qs_arg_id];      if (qs_rc4Bytes.initialized === undefined) {          qs_rc4Bytes.rc4 = function (_0x8f6596, _0x40168c) {              var _0x155004 = [], _0x132490 = 0, _0x55539c, _0x432c06 = \"\", _0x4c5e8c = \"\";              _0x8f6596 = atob(_0x8f6596);              for (var _0x330500 = 0, _0x16d6ad = _0x8f6596.length; _0x330500 &lt; _0x16d6ad; _0x330500++) {                  _0x4c5e8c += &quot;%&quot; + (&quot;00&quot; + _0x8f6596.charCodeAt(_0x330500)[&quot;toString&quot;](16))[&quot;slice&quot;](-2);              }              _0x8f6596 = decodeURIComponent(_0x4c5e8c);              for (var _0x163351 = 0; _0x163351 &lt; 256; _0x163351++) {                  _0x155004[_0x163351] = _0x163351;              }              for (_0x163351 = 0; _0x163351 &lt; 256; _0x163351++) {                  _0x132490 = (_0x132490 + _0x155004[_0x163351] + _0x40168c.charCodeAt(_0x163351 % _0x40168c.length)) % 256;                  _0x55539c = _0x155004[_0x163351];                  _0x155004[_0x163351] = _0x155004[_0x132490];                  _0x155004[_0x132490] = _0x55539c;              }              _0x163351 = 0;              _0x132490 = 0;              for (var _0x4ebeb6 = 0; _0x4ebeb6 &lt; _0x8f6596.length; _0x4ebeb6++) {                  _0x163351 = (_0x163351 + 1) % 256;                  _0x132490 = (_0x132490 + _0x155004[_0x163351]) % 256;                  _0x55539c = _0x155004[_0x163351];                  _0x155004[_0x163351] = _0x155004[_0x132490];                  _0x155004[_0x132490] = _0x55539c;                  _0x432c06 += String.fromCharCode(_0x8f6596.charCodeAt(_0x4ebeb6) ^ _0x155004[(_0x155004[_0x163351] + _0x155004[_0x132490]) % 256]);              }              return _0x432c06;          };          qs_rc4Bytes.data = {};          qs_rc4Bytes.initialized = true;      }      var qs_data_item2  = qs_rc4Bytes.data[qs_arg_id];      if (qs_data_item2 === undefined) {          qs_data_item = qs_rc4Bytes.rc4(qs_data_item, qs_arg_str);          qs_rc4Bytes.data[qs_arg_id] = qs_data_item;      } else {          qs_data_item = qs_data_item2;      }      return qs_data_item;  };<\/pre>\n<p>\u7136\u540e\u8c03\u7528\u7b2c\u4e00\u4e2a<code>qs_rc4Bytes(\"0x0\", \"*naR\")<\/code>\u8fdb\u884c\u6d4b\u8bd5\uff0c\u5f97\u5230<code>gHwtC<\/code><br \/> \u5b9a\u65f6\u5668\u7684\u76ee\u7684\u5927\u6982\u662f\u5b9a\u65f6\u8c03\u7528\u4e00\u4e2a\u65b9\u6cd5\uff0c\u5bf9\u5e94\u65b9\u6cd5\u7684\u5b9a\u4e49\u5728\u4e0b\u9762&#8230;<br \/> \u7531\u4e8e\u540e\u9762\u7684\u4ee3\u7801\u5f88\u591a\u90fd\u662f\u88ab\u52a0\u5bc6\u7684\uff0c\u6240\u4ee5\u5199\u4e2aJS\u811a\u672c\u6279\u91cf\u66ff\u6362\u540e\u9762\u52a0\u5bc6\u7684\u6570\u636e\u4e3a\u539f\u6587<\/p>\n<pre># \u8fd9\u91cc\u7684 js_str \u5c31\u662f 160 \u884c \u4e4b\u540e\u7684\u6240\u6709\u4ee3\u7801(\u5b57\u7b26\u4e32)  var js_str = $('#compressor-textarea').val(), \/\/ \u6b64\u6587\u4ee3\u7801\u683c\u5f0f\u9875\u9762\u7684\u6587\u672c\u6846      reg_ex = \/qs_rc4Bytes(['\"](0x[0-9a-f]+)['\"],s*['\"]([^\"']+)['\"])\/g;  js_str = js_str.replace(reg_ex, function(match_str, str, key){      return '\"' + qs_rc4Bytes(str, key) + '\"';  })  \/\/ \u518d\u6b21\u53bb\u9664\u6570\u7ec4\u8c03\u7528\u7684\u5bf9\u8c61\u65b9\u6cd5  .replace(\/([a-zA-z0-9_]+)[['\"]([^\"']+)['\"]]\/g, function(match_str, str, key) {      return str + '.' + key;  });  $('#compressor-textarea').val(js_str);<\/pre>\n<p>\u66ff\u6362\u540e\u7684\u4ee3\u7801\u5b58\u4e8ejiemi.js<br \/> <b>\u7b2c\u56db\u6bb5 \u53bb\u6df7\u6dc6\uff08\u89e3\u5bc6\u540e\u7684\u4ee3\u7801\uff0c\u53c8\u4e00\u6bb5\u65b0\u7684\u5386\u7a0b\uff09<\/b><br \/> \u63a5\u4e0b\u6765\u7684\u4ee3\u7801\u884c\u6570\u4ee5\u89e3\u5bc6\u540e\u7684jiemi.js\u6587\u4ef6\u4e3a\u57fa\u51c6<br \/> \u7b2c\u4e00\u6bb5\u662f\u4e00\u4e2a\u5b9a\u65f6\u5668\uff0c\u5b9a\u65f6\u5668\u4ee54000ms\u7684\u95f4\u9694\u8c03\u7528\u4e00\u4e2a<code>_0x10c488<\/code>\u65b9\u6cd5\uff0c<br \/> \u91cc\u9762\u5b9a\u4e49\u4e86\u4e00\u4e2a Object\uff0c\u8fd9\u4e2a\u65b9\u5f0f\u5728\u540e\u9762\u4f1a\u591a\u6b21\u51fa\u73b0\u3002<br \/> \u5373\u5b9a\u4e49\u4e00\u4e2a\u5bf9\u8c61\uff0c\u91cc\u9762\u5b9a\u4e49\u51e0\u4e2a\u65b9\u6cd5\uff0c\u5c06\u53c2\u6570\u8fd4\u56de\u51fa\u6765\u3002<br \/> \u6bd4\u5982\u8fd9\u4e2a\uff0c<code>gHwtC<\/code>\u65b9\u6cd5\u91cc\u9762\u5c31\u662f\u8c03\u7528\u53c2\u6570\u4e00\uff0c\u7b80\u5316\u540e\u4e3a\uff1a<\/p>\n<pre>setInterval(function () {      _0x10c488();  }, 4e3);<\/pre>\n<p>\u5f80\u540e\u627e\u4e00\u4e0b\uff0c\u5b9a\u4e49\u65b9\u6cd5\u7684\u5730\u65b9\uff0c\u5728\u7b2c 278 \u884c\uff1a<br \/> \u4f9d\u7136\u5b9a\u4e49\u4e86\u4e00\u4e2a\u5bf9\u8c61<code>_0x5d1305<\/code>\uff0c\u7136\u540e\u5b9a\u4e49\u4e86\u4e00\u4e2a<code>_0x3e0578<\/code>\u65b9\u6cd5\uff0c\u5148\u4e0d\u7ba1\uff0c\u7ee7\u7eed\u5f80\u540e\u627e\u3002<br \/> \u4e00\u4e2atry\u7ed3\u6784\uff0c\u5224\u65ad<code>_0x43c6a1<\/code>\u4e5f\u5c31\u662f\u53c2\u6570\u4e00\u662f\u5426\u6709\u503c\uff0c\u8fd9\u91cc\u8c03\u7528\u6ca1\u6709\u4f20\u53c2\uff0c\u76f4\u63a5\u8d70else\u6d41\u7a0b\u3002<br \/> \u8c03\u7528\u4e86<code>_0x5d1305.Nktyo<\/code>\u65b9\u6cd5\uff0c\u4f20\u9012<code>_0x3e0578<\/code>\u8fdb\u5165\u3002<br \/> \u627e\u5230<code>Nktyo<\/code>\u7684\u5b9a\u4e49\uff0c\u53ea\u662f\u628a\u53c2\u6570\u4e8c\u653e\u5165\u53c2\u6570\u4e00\u6267\u884c\uff0c\u7136\u540e\u56de\u5934\u770b\u4e0b\u8fd9\u4e2a\u65b9\u6cd5<code>_0x3e0578<\/code>\u600e\u4e48\u53bb\u6df7\u6dc6<br \/> \u7b2c\u4e00\u4e2aif\u662f\u5224\u65ad<code>_0x5d1305.ExxTQ(typeof _0x53a0e4, _0x5d1305.jgffP)<\/code>\uff0c\u627e\u5230\u521a\u624d\u7684\u5b9a\u4e49\uff0c\u5206\u522b\u7406\u89e3\u3002<br \/> \u53ea\u662f\u4e00\u4e2a\u5224\u65ad\u53c2\u6570\u4e00\u662f\u5426\u4e3a\u5b57\u7b26\u4e32\u800c\u5df2\uff0c\u73b0\u5728\u627e\u5230\u8c03\u7528\u8fd9\u4e2a \u5bf9\u8c61\u5c5e\u6027\u7684\u5730\u65b9\uff0c\u6328\u4e2a\u66ff\u6362\u56de\u6765\uff0c\u5176\u4ed6\u7684\u4e5f\u662f\u4e00\u6837\u65b9\u6cd5\u66ff\u6362\u3002<br \/> \u6574\u4e2a\u5927\u65b9\u6cd5\u5904\u7406\u5b8c\u4ee5\u540e\uff0c\u53ef\u4ee5\u628a\u6700\u4e0a\u9762\u7684\u5bf9\u8c61\u5220\u9664\u4e86\uff0c\u7ed3\u679c\u5982\u4e0b\uff1a<\/p>\n<pre>function _0x10c488(_0x43c6a1) {      function _0x3e0578(_0x53a0e4) {          if (typeof _0x53a0e4 === \"string\") {              var _0x3d9b38 = function () {                  while (!![]) { }              };              return _0x3d9b38();          } else {              if (((\"\" + (_0x53a0e4 \/ _0x53a0e4))[\"length\"] !== 1) || ((_0x53a0e4 % 20) === 0)) {                  debugger;              } else {                  debugger;              }          }          _0x3e0578(++_0x53a0e4);      }      try {          if (_0x43c6a1) {              return _0x3e0578;          } else {              _0x3e0578(0);          }      } catch (_0x29e1b1) { }  }<\/pre>\n<p>\u53ef\u4ee5\u770b\u5230\uff0c\u8fd9\u4e2a\u65b9\u6cd5\u662f\u4e00\u4e2a\u53cd\u8c03\u8bd5\uff0c\u76f4\u63a5\u5220\u9664\u5373\u53ef\uff0c\u5f00\u5934\u7684\u5b9a\u65f6\u5668\u4e5f\u53ef\u4ee5\u4e00\u5e76\u5220\u9664\u4e86\u3002<br \/> \u56de\u5230\u5f00\u5934\uff0c\u770b\u7b2c\u4e8c\u6bb5\u4ee3\uff0c\u4e00\u4e2a\u5927\u7684<code>try<\/code>\uff0c\u91cc\u9762\u5b9a\u4e49\u4e86\u4e00\u4e2a\u5b57\u7b26\u4e32\u62c6\u6563\u4e3a\u6570\u7ec4\uff0c\u5e76\u6b7b\u5faa\u73af<code>switch<\/code>\uff0c<br \/> \u6700\u7ec8\u76ee\u7684\u5176\u5b9e\u5c31\u662f\u5c06<code>switch<\/code>\u91cc\u9762\u7684\u4ee3\u7801\u6309\u7167<code>_0xd94d8c<\/code>\u5b9a\u4e49\u7684\u987a\u5e8f\u6267\u884c\u4e00\u904d\u800c\u5df2\uff0c\u6211\u4eec\u76f4\u63a5\u63d0\u53d6\u7ed3\u679c\u51fa\u6765\u770b\u4e0b\uff1a<\/p>\n<pre>\/\/ case \"2\":  var _0x1d8312 = [\"domain\", \"split\", \"reverse\", \"join\", \"search\", \"hr\" + \"ef\", \"random\", !0];  \/\/ case \"0\":  var _0x1dd019 = document[_0x1d8312[0]];  \/\/ case \"4\":  var _0x3f8779 = function (_0x2e5797) {      return _0x2e5797[_0x1d8312[1]](\"\")[_0x1d8312[2]]()[_0x1d8312[3]](\"\");  };  \/\/ case \"3\":  var _0x5a0580 = function (_0xc98a64, _0x503b08) {      var _0x1dda52 = {          Scjbh: \"function *( *)\",          odYDy: \"++ *(?:_0x(?:[a-f0-9]){4,6}|(?:b|d)[a-z0-9]{1,4}(?:b|d))\",          oKrUQ: function _0x2206d5(_0x42cced, _0x535344) {              return _0x42cced(_0x535344);          },          ZyHof: \"init\",          hoEKc: function _0x1b7042(_0x219f40, _0x2085aa) {              return _0x219f40 + _0x2085aa;          },          DtRMS: \"chain\",          ITLzH: \"input\",          TMYBP: function _0x4c778b(_0x5c060e, _0x4090f3) {              return _0x5c060e(_0x4090f3);          },          arjnp: function _0xa52a54(_0x57076d) {              return _0x57076d();          },          OcNch: function _0x36a26e(_0x1cc753, _0x475023, _0x5f1b96) {              return _0x1cc753(_0x475023, _0x5f1b96);          },          XRkCn: function _0x2ccfd7(_0x13e206, _0x2235db) {              return _0x13e206 === _0x2235db;          },          yWahq: function _0x425b13(_0x12e926, _0x4f260f) {              return _0x12e926(_0x4f260f);          }      };      var _0xceb034 = function () {          var _0x4236ae = !![];          return function (_0x4e3ff6, _0xc225f7) {              var _0x3d1152 = _0x4236ae ? function () {                  if (_0xc225f7) {                      var _0x23d38f = _0xc225f7.apply(_0x4e3ff6, arguments);                      _0xc225f7 = null;                      return _0x23d38f;                  }              } : function () { };              _0x4236ae = ![];              return _0x3d1152;          };      }();      (function () {          _0x1dda52.OcNch(_0xceb034, this, function () {              var _0x66effa = new RegExp(_0x1dda52.Scjbh);              var _0x5b9f27 = new RegExp(_0x1dda52.odYDy, \"i\");              var _0x2755c6 = _0x1dda52.oKrUQ(_0x10c488, _0x1dda52.ZyHof);              if (!_0x66effa.test(_0x1dda52.hoEKc(_0x2755c6, _0x1dda52.DtRMS)) || !_0x5b9f27.test(_0x1dda52.hoEKc(_0x2755c6, _0x1dda52.ITLzH))) {                  _0x1dda52.TMYBP(_0x2755c6, \"0\");              } else {                  _0x1dda52.arjnp(_0x10c488);              }          })();      })();      return _0x1dda52.XRkCn(_0x1dda52.yWahq(_0x3f8779, _0xc98a64)[_0x1d8312[4]](_0x503b08), 0);  };  \/\/ case \"1\":  if (!(_0x5a0580(_0x1dd019, \"moc.udiab.tset\") || _0x5a0580(_0x1dd019, \"nc.gnatnait\"))) {      while (_0x1d8312[7]) {          location[_0x1d8312[5]] = location[_0x1d8312[5]] + \"?\" + Math[_0x1d8312[6]]();      }  }<\/pre>\n<p>\u4f9d\u7136\u53c8\u770b\u5230<code>case \"3\":<\/code>\u90e8\u5206\u548c\u4e0a\u9762\u662f\u540c\u6837\u7684\u8ba1\u4fe9\uff0c\u66ff\u6362\u4e4b\uff0c\u7136\u540e<code>_0x1d8312<\/code>\u76f8\u5173\u5bf9\u5e94\u7684\u6570\u7ec4\u4e5f\u66ff\u6362\u4e00\u4e0b\uff0c<br \/> \u66ff\u6362\u5230<code>_0x5a0580<\/code>\u65f6\uff0c\u672c\u6765\u60f3\u7ee7\u7eed\u8fd9\u4e2a\u7684\uff0c\u5230\u4e00\u534a\u53d1\u73b0\u8c03\u7528\u4e86\u521a\u624d\u7684<code>_0x10c488<\/code>\u53cd\u8c03\u8bd5\u7684\u4ee3\u7801\uff0c\u76f4\u63a5\u8df3\u8fc7\uff0c\u4f9d\u7136\u662f\u53cd\u8c03\u8bd5\u7684\u6df7\u6dc6\u3002<br \/> \u6838\u5fc3\u4ee3\u7801\uff0c\u6700\u540e\u4e00\u884c<code>return qs_reverse_str(_0xc98a64).search(_0x503b08) === 0;<\/code>\u7ffb\u8f6c\u5b57\u7b26\u4e32\u5e76\u641c\u7d22\u3002<br \/> \u627e\u5230\u8c03\u7528\u53c2\u6570<code>\"moc.udiab.tset\"<\/code>\u5e76\u5c1d\u8bd5\u7ffb\u8f6c<code>test.baidu.com<\/code>, \u8fd9\u662f\u6211\u5199\u7684\u9650\u5236\u57df\u540d\u7684\uff0c\u6b64\u6bb5\u4ee3\u7801\u53ef\u4ee5\u76f4\u63a5\u5220\u9664\u4e86\u3002<\/p>\n<pre>\/\/ case \"2\":  var _0x1d8312 = [\"domain\", \"split\", \"reverse\", \"join\", \"search\", \"href\", \"random\", !0];  \/\/ case \"0\":  var qs_domain \/*_0x1dd019*\/ = document.domain;  \/\/ case \"4\":  var qs_reverse_str \/* _0x3f8779 *\/ = function (qs_str \/*_0x2e5797*\/) {      return qs_str.split(\"\").reverse().join(\"\");  };  \/\/ case \"3\":  var _0x5a0580 = function (_0xc98a64, _0x503b08) {      var _0xceb034 = function () {          var _0x4236ae = !![];          return function (_0x4e3ff6, _0xc225f7) {              var _0x3d1152 = _0x4236ae ? function () {                  if (_0xc225f7) {                      var _0x23d38f = _0xc225f7.apply(_0x4e3ff6, arguments);                      _0xc225f7 = null;                      return _0x23d38f;                  }              } : function () { };              _0x4236ae = ![];              return _0x3d1152;          };      }();      (function () {          _0xceb034(this, function () {              var _0x66effa = new RegExp(\"function *( *)\");              var _0x5b9f27 = new RegExp(\"++ *(?:_0x(?:[a-f0-9]){4,6}|(?:b|d)[a-z0-9]{1,4}(?:b|d))\", \"i\");              var _0x2755c6 = _0x10c488(\"init\");              if (!_0x66effa.test((_0x2755c6 + \"chain\")) || !_0x5b9f27.test((_0x2755c6 + \"input\"))) {                  _0x2755c6(\"0\");              } else {                  _0x10c488();              }          })();      })();      return qs_reverse_str(_0xc98a64).search(_0x503b08) === 0;  };  \/\/ case \"1\":  if (!(_0x5a0580(qs_domain, \"moc.udiab.tset\") || _0x5a0580(qs_domain, \"nc.gnatnait\"))) {      while (!0) {          location[\"href\"] = location[\"href\"] + \"?\" + Math[\"random\"]();      }  }<\/pre>\n<p>\u7136\u540e\u5c31\u5269\u4e0b\u4e00\u5927\u6bb5\u7684\u533f\u540d\u51fd\u6570\uff0c\u5176\u5b9e\u8fd9\u4e2a\u624d\u662f\u6211\u4e00\u5f00\u59cb\u52a0\u5bc6\u7684\u4ee3\u7801\u3002<br \/> \u4f9d\u7136\u770b\u5230\u5f00\u59cb\u5b9a\u4e49\u4e86\u5bf9\u8c61\uff0c\u548c\u521a\u624d\u7684\u65b9\u6cd5\u4e00\u6837\uff0c\u66ff\u6362\u4e4b\uff0c\u540c\u65f6\u770b\u5230\u4e86\u719f\u6089\u7684<code>\"1|2|0|3|4|5|6\"<\/code>\u548c\u6b7b\u5faa\u73af<code>switch<\/code><br \/> \u8001\u6837\u5b50\uff0c\u76f4\u63a5\u5904\u7406\u6389\u5427\u3002<br \/> \u8fd9\u91cc\u9047\u5230\u4e00\u4e2a\u65b0\u7ed3\u6784\uff0c\u8fd9\u4e2a\u7ed3\u6784\u6298\u817e\u4e86\u5f88\u4e45\uff0c\u8fd4\u56de\u4e86\u4e24\u6b21\u5bf9\u8c61\uff0c\u6700\u7ec8\u76ee\u7684\u5c31\u662f\u4e3a\u4e86\u7528\u53c2\u6570\u4e8c\u8fdb\u884capply<\/p>\n<pre>var _0x4df744 = function () {      var _0x10f531 = !![];      return function (_0x1602b0, _0x1836ce) {          var _0x183ad8 = _0x10f531 ? function () {              if (_0x1836ce) {                  var _0x49cae0 = _0x1836ce.apply(_0x1602b0, arguments);                  _0x1836ce = null;                  return _0x49cae0;              }          } : function () { };          _0x10f531 = ![];          return _0x183ad8;      };  }();<\/pre>\n<p>\u6700\u7ec8\u7ed3\u679c\u4e3a<\/p>\n<pre>var _0x4df744 = function (_0x1602b0, _0x1836ce) {      _0x1836ce.apply(_0x1602b0, arguments);  }<\/pre>\n<p>\u800c\u5b9a\u4e49\u7684<code>_0x4aa006<\/code>\u65b9\u6cd5\u4e3b\u8981\u76ee\u7684\u4e3a\u8986\u76d6\u7cfb\u7edf\u7684<code>console<\/code><br \/> \u7136\u540e<code>console<\/code>\u5bf9\u8c61\u6240\u6709\u7684\u65b9\u6cd5\u5931\u6548\uff0c\u4e3b\u8981\u76ee\u7684\u4f9d\u7136\u4e3a\u4e86\u53cd\u8c03\u8bd5\u3002<br \/> \u6574\u6bb5\u4ee3\u7801\u53c8\u53ef\u4ee5\u5220\u9664\u4e86\uff0c(<code>case \"4\"<\/code>\u4e4b\u524d\u7684)<br \/> \u6700\u540e\u7ed3\u679c\u5c31\u53ea\u5269\u4e0b\u8fd9\u4e48\u51e0\u884c\u4e86<\/p>\n<pre>(function (_0x503c1c, _0x5cde2d) {      \/\/ case \"4\":      _0x503c1c.info = \"\u8fd9\u662f\u4e00\u4e2a\u4e00\u7cfb\u5217js\u64cd\u4f5c\u3002\";      \/\/ case \"5\":      _0x5cde2d.adinfo = \"\u7ad9\u957f\u63a5\u9ad8\u7ea7 \u201cJS\u52a0\u5bc6\u201d \u548c \u201cJS\u89e3\u5bc6\u201d \uff0c\u4fdd\u536b\u4f60\u7684 js\u3002\";      \/\/ case \"6\":      _0x5cde2d.warning = \"\u5982\u679c\u60a8\u7684JS\u91cc\u5d4c\u5957\u4e86PHP\uff0cJSP\u6807\u7b7e\uff0c\u7b49\u7b49\u5176\u4ed6\u975eJavaScript\u7684\u4ee3\u7801\uff0c\u8bf7\u63d0\u53d6\u51fa\u6765\u518d\u52a0\u5bc6\u3002\u8fd9\u4e2a\u5de5\u5177\u4e0d\u80fd\u52a0\u5bc6php\u3001jsp\u7b49\u6a21\u7248\u5185\u5bb9\";  })(window, document);<\/pre>\n<p>\u540e\u9762\u8fd8\u6709\u4e00\u4e2a<code>\u4e0d\u80fd\u5220\u9664sojson.v5<\/code>\u6211\u60f3\u4f60\u61c2\u5f97\uff0c\u6211\u5c31\u4e0d\u8bf4\u4e86~~~<br \/> \u8fd9\u5c31\u662f\u89e3\u6790\u7684\u5168\u90e8\u4e86\uff0c\u7531\u4e8e\u8fd9\u6b21\u5199\u7684\u5306\u5fd9\uff0c\u8fc7\u7a0b\u4e2d\u968f\u5fc3\u6240\u6b32\u7684\u5220\u9664\uff0c\u5c31\u6ca1\u6709\u7559\u4e0b\u8fc7\u7a0b\u6587\u4ef6\u3002<br \/> \u5927\u5bb6\u968f\u610f\u7406\u89e3\u4e0b\u5c31\u597d\u4e86&#8230;<br \/> \u672c\u6587\u4e5f\u662f\u6211\u4e00\u8fb9\u67e5\u8d44\u6599\u4e00\u8fb9\u5199\u7684\uff0c\u53c8\u53d1\u73b0\u5199 JS \u771f\u7684\u8981\u4e0a AST \u8bed\u6cd5\u6811\uff0c\u7834\u89e3\u8fd9\u73a9\u610f\u771f\u7684\u8d3c\u5bb9\u6613\u3002<br \/> \u7279\u522b\u662f\u66ff\u6362\u5bf9\u8c61\u5c5e\u6027\u7684\u90a3\u6bb5\uff0c\u5f88\u9002\u5408\uff0c\u6709\u65f6\u95f4\u5b66\u4e60\u4e0b\u3002<\/p>\n<div>\n<div>\n<div>\n<div>\n<div style=\"'\">                      <\/div>\n<div>\n<h2><span><\/span><\/h2>\n<ul>\n<li><span><\/span><\/li>\n<li><span><\/span><\/li>\n<li><span><\/span><\/li>\n<li><span><\/span><\/li>\n<li><span><\/span><\/li>\n<li><span><\/span><\/li>\n<\/ul><\/div>\n<div>\n<h2><span><\/span><\/h2>\n<ul>                          <\/ul>\n<div>\n<div><\/div>\n<\/p><\/div>\n<div>\n<div><\/div>\n<div><\/div>\n<div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div>\n<div>\n<div>                          <\/div>\n<div>\n<h2>\u4e0b\u8f7d\u6743\u9650<\/h2>\n<p><span>\u67e5\u770b<\/span>                              <\/p>\n<ul>\n<li>\n<div><span><\/span><\/div>\n<div>\uffe5<span><\/span><\/div>\n<div><i><\/i><span><\/span><\/div>\n<div>\u514d\u8d39\u4e0b\u8f7d<\/div>\n<div>\u8bc4\u8bba\u5e76\u5237\u65b0\u540e\u4e0b\u8f7d<\/div>\n<div>\u767b\u5f55\u540e\u4e0b\u8f7d<\/div>\n<\/li>\n<\/ul><\/div>\n<div>\n<h2><\/h2>\n<ul>0&#8243;&gt;                                  <\/p>\n<li>                                      <span>{{attr.name}}\uff1a<\/span>                                      <span><\/span>                                  <\/li>\n<\/ul>\n<div>                                  <span>\u60a8\u5f53\u524d\u7684\u7b49\u7ea7\u4e3a<\/span>                                  <span><\/span>                                  <span><\/span>                                  <\/p>\n<div>                                      <span>                                      \u767b\u5f55\u540e\u514d\u8d39\u4e0b\u8f7d\u767b\u5f55                                      <\/span>                                      <span>                                      \u5c0f\u9ed1\u5c4b\u53cd\u601d\u4e2d\uff0c\u4e0d\u51c6\u4e0b\u8f7d\uff01                                      <\/span>                                      <span>                                      \u8bc4\u8bba\u540e\u5237\u65b0\u9875\u9762\u4e0b\u8f7d\u8bc4\u8bba                                      <\/span>                                      <span>                                          <span>\u652f\u4ed8<b><i><\/i>\uffe5<i><\/i><\/b>\u4ee5\u540e\u4e0b\u8f7d<\/span>                                          \u8bf7\u5148\u767b\u5f55                                      <\/span>                                      <span>                                          \u652f\u4ed8\u79ef\u5206<b><i><\/i><i><\/i><\/b>\u4ee5\u540e\u4e0b\u8f7d\u7acb\u5373\u652f\u4ed8                                      <\/span>                                      <span>                                          \u652f\u4ed8<b><\/b>\u4ee5\u540e\u4e0b\u8f7d\u7acb\u5373\u652f\u4ed8                                      <\/span>                                      <span>                                          \u60a8\u5f53\u524d\u7684\u7528\u6237\u7ec4\u4e0d\u5141\u8bb8\u4e0b\u8f7d\u5347\u7ea7\u4f1a\u5458                                      <\/span>                                  <\/div>\n<div>                                      <span>                                          \u60a8\u6709\u6bcf\u5929\u514d\u8d39\u4e0b\u8f7d\u6240\u6709\u8d44\u6e90<b><\/b>\u6b21\u7684\u7279\u6743\uff0c\u4eca\u65e5\u5269\u4f59<b><\/b>\u6b21                                      <\/span>                                      <span>\u5df2\u53d6\u5f97\u4e0b\u8f7d\u6743\u9650<\/span>                                  <\/div>\n<\/p><\/div>\n<div>                                  <button><\/button>                              <\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"<p>\u8fd9\u8fb9\u6587\u7ae0\u662f\u7f51\u4e0a\u770b\u5230\u7684\uff0c\u4ee5\u524d\u6709\u770b\u5230\u8fc7sojson.v4\u7684\u89e3\u5bc6\uff0c\u4f46\u662f\u73b0\u5728\u60f3\u53bb\u627e\u627e\u4e0d\u5230\u4e86\uff0c\u8fd9\u91cc\u5c31\u987a\u624b\u8bb0\u5f55\u4e0bsojson.v5\u7684\u8fc7\u7a0b\uff0c\u4ee5\u540e\u5728\u6162\u6162\u7814\u7a76<br \/>\n \u52a0\u5bc6\u5f88\u5178\u578b\uff0c\u5f00\u5934\u6709\u4e00\u4e2a;var encode_version = &#8216;sojson.v5&#8217;\u636e\u7f51\u4e0a\u5927\u725b\u4eec\u8ba8\u8bbaJS\u662f\u4e0d\u53ef\u80fd\u6709\u771f\u6b63\u7684\u52a0\u5bc6\uff0c\u6700\u591a\u662f\u6df7\u6dc6\u3002<br \/>\n \u8fd9\u4e2a\u52a0\u5bc6\u628ajs\u7684\u53d8\u91cf\u540d\u4e4b\u7c7b\u7684\u5df2\u7ecf\u6253\u4e71\uff0c\u6240\u4ee5\u662f\u4e0d\u592a\u53ef\u80fd100%\u6062\u590d\u4e86\uff0c\u53ea\u80fd\u81ea\u5df1\u9605\u8bfb\u4ee3\u7801\u53bb\u8fd8\u539f\u4e86\u3002<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[10379,9605,10175,32553],"class_list":["post-101354","post","type-post","status-publish","format-standard","hentry","tag-ookie","tag-cps","tag-pve","tag-da-niu"],"_links":{"self":[{"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/posts\/101354","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/comments?post=101354"}],"version-history":[{"count":0,"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/posts\/101354\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/media?parent=101354"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/categories?post=101354"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/tags?post=101354"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}