解码 Javascript 个数组

Question

所以我有这个 JavaScript 代码是我朋友给我的，我不知道它的作用，他想让我找出来。所以我通读了它然后发现了这个。

localStorage[_0xa5fd[8]] = JSON[_0xa5fd[14]](default_r_o)), !d[_0xa5fd[15]](localStorage[_0xa5fd[8]])) return;
                        r_o = JSON[_0xa5fd[11]](localStorage[_0xa5fd[8]]), jQuery[_0xa5fd[39]](r_o, function (_0xb434x1, _0xb434x2) {
                            void 0 == _0xb434x2 && _0xb434x1 == _0xa5fd[16] ? _0xb434x2 == _0xa5fd[12] : void 0 == _0xb434x2 && (_0xb434x2 = !1), typeof _0xb434x2 == _0xa5fd[17] ? (jQuery(_0xa5fd[5], jQuery(_0xa5fd[18] + _0xb434x1 + _0xa5fd[19])[_0xa5fd[6]]())[0][_0xa5fd[4]] = _0xb434x2, fnc = jQuery(_0xa5fd[5], jQuery(_0xa5fd[18] + _0xb434x1 + _0xa5fd[19])[_0xa5fd[6]]())[_0xa5fd[21]](_0xa5fd[20]), fnf = _0xb434x1 == _0xa5fd[22] || _0xb434x1 == _0xa5fd[23] ? _0xa5fd[24] : _0xa5fd[13], fnc = fnc[_0xa5fd[27]](0, fnc[_0xa5fd[26]](_0xa5fd[25])) + _0xa5fd[25] + fnf + _0xb434x2 + _0xa5fd[28], eval(_0xa5fd[29] + fnc)) : _0xb434x1 == _0xa5fd[30] ? jQuery(_0xa5fd[32])[_0xa5fd[31]](r_o[_0xa5fd[30]]) : _0xb434x1 == _0xa5fd[33] ? jQuery(_0xa5fd[34])[_0xa5fd[31]](r_o[_0xa5fd[33]]) : _0xb434x1 == _0xa5fd[16] && (r_o[_0xa5fd[16]] == _0xa5fd[35] ? (jQuery(_0xa5fd[37])[_0xa5fd[36]](_0xa5fd[4])

我问的是有没有办法扩展数组？比如把数组自动重新编码成单词？

Answer 1

这是此类脚本的 js 示例：

<script>

        var _0xa5fd = [ "failure", "onload", "responseXML", "responseText", "DOMParser", "text/xml", "parseFromString", "Microsoft.XMLDOM"];

        /**
         * @param {FileList} fileList
         */
        function handleFiles(fileList)
        {
            var reader = new FileReader();
            reader.onload = onReadFile;
            reader.readAsText(fileList.item(0));
        }

        function onReadFile(event)
        {
            var fileContent = event.target.result;
            var regex = /_0xa5fd\[(\d+)\]/ig;
            var itemList;
            var count = 0;

            while ((itemList = regex.exec(fileContent)) != null)
            {
                var realValueKey = itemList[1];
                var realValue = _0xa5fd[realValueKey];

                if(realValue !== undefined)
                {
                    var replaceRegex = new RegExp('_0xa5fd\[' + realValueKey + '\]', 'g');
                    fileContent = fileContent.replace(replaceRegex, "'" + realValue + "'");
                }

                count++;
            }

            console.log('finish: ' + count);
            document.getElementById('scriptContent').innerText = fileContent;
        }
    </script>

和 html 代码到 select 您的混淆文件：

<input type="file" id="input" onchange="handleFiles(this.files)">
<div id="scriptContent"></div>

解码 Javascript 个数组

Decoding Javascript Arrays

javascript

arrays

deobfuscation