JS逆向:破解 sojson 混淆後的 setInterval 無限反 debugger 策略 1. setInterval 計時器 2. 跟棧分析

1. setInterval 計時器

  • setInterval 這個是 JS 語言當中的 定時器,它有兩個參數:第一個是要執行的代碼,第二個執行時間。
  • 下方是 sojson 混淆後的一段代碼,其中使用了 setInterval 定時器進行了反 debugger 操作。
/*
 * 加密工具已經升級了一個版本,目前爲 jsjiami.com.v5 ,主要加強了算法,以及防破解【絕對不可逆】配置,耶穌也無法100%還原,我說的。;
 * 已經打算把這個工具基礎功能一直免費下去。還希望支持我。
 * 另外 jsjiami.com.v5 已經強制加入校驗,註釋可以去掉,但是 jsjiami.com.v5 不能去掉(如果你開通了VIP,可以手動去掉),其他都沒有任何綁定。
 * 誓死不會加入任何後門,jsjiami.com JS 加密的使命就是爲了保護你們的Javascript 。
 * 警告:如果您惡意去掉 jsjiami.com.v5 那麼我們將不會保護您的JavaScript代碼。請遵守規則
 * 新版本: https://www.jsjiami.com/ 支持批量加密,支持大文件加密,擁有更多加密。 */

;var encode_version = 'jsjiami.com.v5'
  , umybf = '__0xd3090'
  , __0xd3090 = ['w6fDkMOEAsO3', 'wqfCqCfDp8Kw', 'w6oUYWNH', 'wrp2cMKUFg==', 'w57DvcOzP8OC', 'w5nCq8O0w7Jl', 'W8OnwrfDtsKu', 'w69uHMKcfQ==', 'wos8w7nDvk0=', 'WCsXd04=', 'SyR2', 'VsOlcT4/w6I=', 'w4zCrcOxNMKew5Q=', 'KlDCgQ==', 'W8KIwrI=', 'VsOeUA==', 'wpt2fw==', 'w7AoFw==', 'w64Ewos=', '5Yin6ZmC54q05p2w5Yy677ynEhrkvZblrJHmnZ/lvY/nq5I=', 'w6dYSRgo', 'wq/CvQ7DqsKW', 'w7PCn8OyPsKN', 'wo58bgHDlg==', 'w5IfwrLDvMKK', 'acOEXsO5wpQ=', 'wpchwqEjLw==', 'eSYtWE8=', 'MBooNUs=', 'PRrCrRDCjA==', 'w53CmcOXw7Vq', 'JsOcSsKYw50=', 'w4bDn8OAPsOW', 'YsOSWDjCoQ==', 'w5RqwpFRw7U=', 'Y8O8wo3Dj8K1', 'w5tNYQ8S', 'RQdSwqEa', 'WMOFWD3Cmg==', 'woVOecK3HA==', 'w7cdwrHCksKS', 'e8OCTcORwos=', 'dMOnwq/DmsKX', 'w7BFRTYt', 'w4sHwrPCi8KG', 'w7sJPsK9Lw==', 'wqAVw4fDjnI=', 'aDpWwrQQ', 'w7Z7PsKDeg==', 'ERXCpTDDhw==', 'wovCuCTDucKx', 'w7xVPsKBRg==', 'wphww4lUwrwVeMOuXybDrQ==', '5aa+5p+u5oOy55qmc8K66YWW5beb5aWF5Lq1D0DDge++giMew6/moIznrKDvvavnrKjnrrrlhJ/kuq7pn6DCi3MCN8KtMXEJwo1X55m25Luj56C6772T6K+85o2Z5Yy15YSw5pyR5YWG5Ymw5ayK44Cl6L2d5Lq35bW45Yeb5Lid6IO75Ym45a2VHsO9w7TjgrMuw5Jn562k5qqP54qs5Ya95ayo', '5pye5bSc5YSY55e/w7HDrMKXA8O4w6XCqWvDhMOMdcORCMKiwqfCrsOD5o2P5L225o605Y+X44G5', '6L6P5pmL5LiR5LiY5Lm757GM5Yuzw4hb5pGx5L2I44CE', 'w7kqDsKcBA==', 'IHPDvHfDpQ==', 'worDh8Kxw5go', 'KcKLZQ==', 'GVXDvw==', 'GcKUQMKDOMKsw7gfw51ew4JNw5YXwqwD', 'w6grUlBBwrXDncOswpTCuBfCjsOPD8K8OGVTAMO/YB9vwo3Cg1Epw4zCmsKfwrQcw5/DsW8tw5QYwrnCkcKQLsKaVEdhwrALFMONwqRuBCvDt8OrAlnCpcKyw7PCow==', 'CsKDVG4=', 'JjTCng7Dnw==', 'w51ufg4V', 'GcKlfg==', 'X8OSwrfDusKv', 'wrLDuMK5w4sw', 'G8O1w4cNdw==', 'w6N2azgI', 'e8O0VsOSwqM=', 'wrfCixDDmcKs', 'ScOufCE3', 'wqYQwqUt', 'fMOBCMOWYg==', 'RlPCnTXCgQ==', 'QcKuwrXDkg==', 'YsOPUhbCow==', 'w7hWwqNjw70=', 'GnDDhsOaw7I=', 'woQPwqIPHw==', 'ZMKDG8KYwpc=', 'w6d5wpZZw4o=', 'wovCiBfDrMKT', 'IynCkQTDhcOBN8OFR8Ocw7bDocO6w77CgGA=', 'w7pkwqzCuMOJwqDDrsO7dUx2wql5w6PDrsKqEsOLUcOOWMKEDgoxEMKfwrRSXsKywrjDrsOhTsOzw5U/wrrDggdOGjg9wpHChMO0VsOcfcOfZWA2dMO0AsOkwoJbCg==', 'UMOiFFQ=', 'w4PCoMO+OsKE', 'Om3DoGvDpQ==', 'w4AawrHDqcKR', 'w5kUcFpc', 'UMOeYQYZ', 'RUbCtsKcwr8=', 'TcOpDlQ=', 'YsObFzHDqA==', 'AwPCmQ3Cpg==', 'w40PwrrCsA==', 'YcOHciTCpw==', 'SsOeYBUp', 'Q8OrwpzDscKo', 'ZcOPWcOlwq8=', 'w5pUwotcw4E=', 'V8OUwo7DjMKZ', 'w5Mrwq7CkcKcwqRk', 'w6N4di8A', 'w48hwoTDocKG', 'P1jCuiFA', 'w4nCpcOY', 'wqTCowo=', 'f8O4dDwi', 'w4drwptcw4c=', 'XcODwp/DlMKr', 'KVfDmEnDgw==', 'ccO2NMOsWQ==', 'XhJcwpk0', 'DivCkTHCrA==', 'FGrDlE7Dog==', 'aUDCmMK8', 'cMOENUVs', 'dsOJdTk0', 'U8OWwoo=', 'WcO4f8O2wqYYJit8', 'w7sJEsKmPBDChSQxS3Arwp8M', '54u+5p6F5Y29772aw6rCveS/oOWut+acjeW8u+erk++/s+i9v+iti+aWv+aOreaIkOS7rOeblOW1p+S9oQ==', 'w55MVw==', 'CX0H', '5YiF6Zu154mL5p275Y6m776JQATkv6Hlr6nmnqrlvKXnqZM=', 'Ogt1fBY=', 'cMONXMOEDQ==', 'XMOwaivCkg==', 'LXfDjMOIw5c=', 'PhYAJHk=', 'F2nDh1vDgQ==', 'G8K4Y8K1Ow==', 'EDJ4dAk='];
(function(_0x36edf2, _0x4d221d) {
    var _0x413e20 = function(_0x29b3b1) {
        while (--_0x29b3b1) {
            _0x36edf2['push'](_0x36edf2['shift']());
        }
    };
    _0x413e20(++_0x4d221d);
}(__0xd3090, 0xbc));
var _0x448a = function(_0x110b07, _0x557b00) {
    _0x110b07 = _0x110b07 - 0x0;
    var _0x1bf0bb = __0xd3090[_0x110b07];
    if (_0x448a['initialized'] === undefined) {
        (function() {
            var _0x5ed5b9 = typeof window !== 'undefined' ? window : typeof process === 'object' && typeof require === 'function' && typeof global === 'object' ? global : this;
            var _0xbbbf01 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
            _0x5ed5b9['atob'] || (_0x5ed5b9['atob'] = function(_0x49d80e) {
                var _0x4e7fa7 = String(_0x49d80e)['replace'](/=+$/, '');
                for (var _0x2e3070 = 0x0, _0x1c7606, _0x32d1d7, _0x18c665 = 0x0, _0xa4dcf5 = ''; _0x32d1d7 = _0x4e7fa7['charAt'](_0x18c665++); ~_0x32d1d7 && (_0x1c7606 = _0x2e3070 % 0x4 ? _0x1c7606 * 0x40 + _0x32d1d7 : _0x32d1d7,
                _0x2e3070++ % 0x4) ? _0xa4dcf5 += String['fromCharCode'](0xff & _0x1c7606 >> (-0x2 * _0x2e3070 & 0x6)) : 0x0) {
                    _0x32d1d7 = _0xbbbf01['indexOf'](_0x32d1d7);
                }
                return _0xa4dcf5;
            }
            );
        }());
        var _0x2fcfed = function(_0x15b99f, _0x540736) {
            var _0x449d55 = [], _0x5013c2 = 0x0, _0x5e23d4, _0xa4280c = '', _0x3761c1 = '';
            _0x15b99f = atob(_0x15b99f);
            for (var _0xcc4097 = 0x0, _0xc86f04 = _0x15b99f['length']; _0xcc4097 < _0xc86f04; _0xcc4097++) {
                _0x3761c1 += '%' + ('00' + _0x15b99f['charCodeAt'](_0xcc4097)['toString'](0x10))['slice'](-0x2);
            }
            _0x15b99f = decodeURIComponent(_0x3761c1);
            for (var _0x5da823 = 0x0; _0x5da823 < 0x100; _0x5da823++) {
                _0x449d55[_0x5da823] = _0x5da823;
            }
            for (_0x5da823 = 0x0; _0x5da823 < 0x100; _0x5da823++) {
                _0x5013c2 = (_0x5013c2 + _0x449d55[_0x5da823] + _0x540736['charCodeAt'](_0x5da823 % _0x540736['length'])) % 0x100;
                _0x5e23d4 = _0x449d55[_0x5da823];
                _0x449d55[_0x5da823] = _0x449d55[_0x5013c2];
                _0x449d55[_0x5013c2] = _0x5e23d4;
            }
            _0x5da823 = 0x0;
            _0x5013c2 = 0x0;
            for (var _0x22668b = 0x0; _0x22668b < _0x15b99f['length']; _0x22668b++) {
                _0x5da823 = (_0x5da823 + 0x1) % 0x100;
                _0x5013c2 = (_0x5013c2 + _0x449d55[_0x5da823]) % 0x100;
                _0x5e23d4 = _0x449d55[_0x5da823];
                _0x449d55[_0x5da823] = _0x449d55[_0x5013c2];
                _0x449d55[_0x5013c2] = _0x5e23d4;
                _0xa4280c += String['fromCharCode'](_0x15b99f['charCodeAt'](_0x22668b) ^ _0x449d55[(_0x449d55[_0x5da823] + _0x449d55[_0x5013c2]) % 0x100]);
            }
            return _0xa4280c;
        };
        _0x448a['rc4'] = _0x2fcfed;
        _0x448a['data'] = {};
        _0x448a['initialized'] = !![];
    }
    var _0x177342 = _0x448a['data'][_0x110b07];
    if (_0x177342 === undefined) {
        if (_0x448a['once'] === undefined) {
            _0x448a['once'] = !![];
        }
        _0x1bf0bb = _0x448a['rc4'](_0x1bf0bb, _0x557b00);
        _0x448a['data'][_0x110b07] = _0x1bf0bb;
    } else {
        _0x1bf0bb = _0x177342;
    }
    return _0x1bf0bb;
};
var a = {}
  , b = {};
(function(_0x9058b6, _0x31ba6a) {
    var _0x553ac7 = {
        'hPvSY': _0x448a('0x0', 'HbTy'),
        'WxxTa': _0x448a('0x1', 'A8)4'),
        'YhJeo': _0x448a('0x2', '8ghG'),
        'GiDPs': function _0x270e8f(_0x28d90, _0x170b55, _0x403717) {
            return _0x28d90(_0x170b55, _0x403717);
        },
        'IHHee': _0x448a('0x3', 'ad$x')
    };
    var _0xe70c28 = _0x553ac7[_0x448a('0x4', 'LwSx')][_0x448a('0x5', '^t^m')]('|')
      , _0x10ce56 = 0x0;
    while (!![]) {
        switch (_0xe70c28[_0x10ce56++]) {
        case '0':
            (function() {
                _0x377041[_0x448a('0x6', 'TgxR')](_0x338b4d, this, function() {
                    var _0x5a8a82 = {
                        'ivIZO': function _0x2fb3ea(_0x682013, _0x5057b2) {
                            return _0x682013 !== _0x5057b2;
                        },
                        'LsIXy': _0x448a('0x7', '9y%('),
                        'nlxWl': _0x448a('0x8', 'nR*P'),
                        'WveCi': _0x448a('0x9', 'X84F'),
                        'WbMAc': _0x448a('0xa', '%DCh'),
                        'hznwk': function _0x2cecb2(_0x38065f, _0x4ece64) {
                            return _0x38065f(_0x4ece64);
                        },
                        'mCYEC': _0x448a('0xb', '9y%('),
                        'AquQY': function _0x282e19(_0x4aa189, _0x55084b) {
                            return _0x4aa189 + _0x55084b;
                        },
                        'AuaiL': _0x448a('0xc', 'xDIT'),
                        'mYMxu': function _0x598479(_0x319618, _0x5ed09d) {
                            return _0x319618 + _0x5ed09d;
                        },
                        'TZYKq': _0x448a('0xd', '%DCh'),
                        'ZDCDk': function _0x50d261(_0x9c684d, _0x19b3cd) {
                            return _0x9c684d === _0x19b3cd;
                        },
                        'VztVF': _0x448a('0xe', 'X84F'),
                        'KulqF': function _0x35ad77(_0x394496, _0xc1f168) {
                            return _0x394496(_0xc1f168);
                        },
                        'TyiBT': function _0x36cd8f(_0x39e28d, _0x3202cb, _0x5ea78c) {
                            return _0x39e28d(_0x3202cb, _0x5ea78c);
                        },
                        'vXqtM': function _0x22e761(_0x14dcc4) {
                            return _0x14dcc4();
                        }
                    };
                    if (_0x5a8a82[_0x448a('0xf', '!YzN')](_0x5a8a82[_0x448a('0x10', 'TgxR')], _0x5a8a82[_0x448a('0x11', 'K7XM')])) {
                        var _0x1314ba = new RegExp(_0x5a8a82[_0x448a('0x12', '%DCh')]);
                        var _0x45819c = new RegExp(_0x5a8a82[_0x448a('0x13', '2P[6')],'i');
                        var _0x52b969 = _0x5a8a82[_0x448a('0x14', '6ZEZ')](_0x1d04ab, _0x5a8a82[_0x448a('0x15', '3T44')]);
                        if (!_0x1314ba[_0x448a('0x16', ')BG9')](_0x5a8a82[_0x448a('0x17', 'm!Pa')](_0x52b969, _0x5a8a82[_0x448a('0x18', 'Ic)]')])) || !_0x45819c[_0x448a('0x19', '08H@')](_0x5a8a82[_0x448a('0x1a', '09r0')](_0x52b969, _0x5a8a82[_0x448a('0x1b', 'HbTy')]))) {
                            if (_0x5a8a82[_0x448a('0x1c', 'nR*P')](_0x5a8a82[_0x448a('0x1d', ')BG9')], _0x5a8a82[_0x448a('0x1e', '8ghG')])) {
                                _0x5a8a82[_0x448a('0x1f', 'HbTy')](_0x52b969, '0');
                            } else {
                                _0x5a8a82[_0x448a('0x20', '6ZEZ')](_0x338b4d, this, function() {
                                    var ksoKJH = {
                                        'fUAzx': _0x448a('0x21', 'xDIT'),
                                        'VYbJj': _0x448a('0x22', '5ir0'),
                                        'uObQH': function _0xc65e9(_0x4ee1e4, _0x13378f) {
                                            return _0x4ee1e4(_0x13378f);
                                        },
                                        'EhHOp': _0x448a('0x23', '85$R'),
                                        'nQmJq': function _0x41e2d6(_0x4d343c, _0x57be03) {
                                            return _0x4d343c + _0x57be03;
                                        },
                                        'lXxPs': _0x448a('0x24', 'ojO6'),
                                        'oOcBx': _0x448a('0x25', '^t^m'),
                                        'IYBvo': function _0x350dd8(_0x360097) {
                                            return _0x360097();
                                        }
                                    };
                                    var _0x7201f9 = new RegExp(ksoKJH[_0x448a('0x26', '5ir0')]);
                                    var _0xdcda27 = new RegExp(ksoKJH[_0x448a('0x27', '&bRm')],'i');
                                    var _0x2f33e2 = ksoKJH[_0x448a('0x28', '6Q1X')](_0x1d04ab, ksoKJH[_0x448a('0x29', '(NG@')]);
                                    if (!_0x7201f9[_0x448a('0x2a', '85$R')](ksoKJH[_0x448a('0x2b', 'Ji5f')](_0x2f33e2, ksoKJH[_0x448a('0x2c', 'Pg%P')])) || !_0xdcda27[_0x448a('0x2d', '%nP9')](ksoKJH[_0x448a('0x2e', '09r0')](_0x2f33e2, ksoKJH[_0x448a('0x2f', '6Q1X')]))) {
                                        ksoKJH[_0x448a('0x30', '!YzN')](_0x2f33e2, '0');
                                    } else {
                                        ksoKJH[_0x448a('0x31', '2P[6')](_0x1d04ab);
                                    }
                                })();
                            }
                        } else {
                            _0x5a8a82[_0x448a('0x32', 'HbTy')](_0x1d04ab);
                        }
                    } else {
                        if (fn) {
                            var _0x23405d = fn[_0x448a('0x33', '!YzN')](context, arguments);
                            fn = null;
                            return _0x23405d;
                        }
                    }
                })();
            }());
            continue;
        case '1':
            _0x31ba6a[_0x448a('0x34', 'sid3')] = _0x553ac7[_0x448a('0x35', '%DCh')];
            continue;
        case '2':
            _0x31ba6a[_0x448a('0x36', '5ir0')] = _0x553ac7[_0x448a('0x37', '0&Y9')];
            continue;
        case '3':
            var _0x338b4d = function() {
                var _0x5166c6 = !![];
                return function(_0x3367d7, _0x1e1428) {
                    var _0x2427e6 = _0x5166c6 ? function() {
                        var _0x20f543 = {
                            'Ziwks': function _0x2b543d(_0x48db39, _0x4a3c96) {
                                return _0x48db39 !== _0x4a3c96;
                            },
                            'kgatK': _0x448a('0x38', ']JMS'),
                            'zTHWR': function _0x440715(_0x4fa4dd, _0x37e4d2) {
                                return _0x4fa4dd === _0x37e4d2;
                            },
                            'LFIkb': _0x448a('0x39', 'ma]h')
                        };
                        if (_0x20f543[_0x448a('0x3a', '6Q1X')](_0x20f543[_0x448a('0x3b', 'HbTy')], _0x20f543[_0x448a('0x3c', '!YzN')])) {
                            while (!![]) {}
                        } else {
                            if (_0x1e1428) {
                                if (_0x20f543[_0x448a('0x3d', '^t^m')](_0x20f543[_0x448a('0x3e', 'm!Pa')], _0x20f543[_0x448a('0x3f', 'iLz*')])) {
                                    var _0x42c693 = _0x1e1428[_0x448a('0x40', 'Pg%P')](_0x3367d7, arguments);
                                    _0x1e1428 = null;
                                    return _0x42c693;
                                } else {}
                            }
                        }
                    }
                    : function() {}
                    ;
                    _0x5166c6 = ![];
                    return _0x2427e6;
                }
                ;
            }();
            continue;
        case '4':
            var _0x377041 = {
                'tLAKa': function _0x333b8d(_0x5acf03, _0x310cbe, _0x1ad06c) {
                    return _0x553ac7[_0x448a('0x41', '^t^m')](_0x5acf03, _0x310cbe, _0x1ad06c);
                }
            };
            continue;
        case '5':
            _0x9058b6[_0x448a('0x42', '(NG@')] = _0x553ac7[_0x448a('0x43', '85$R')];
            continue;
        }
        break;
    }
}(a, b));
setInterval(function() {
    var _0x31165f = {
        'SXvne': function _0x31fd86(_0xc617ef) {
            return _0xc617ef();
        }
    };
    _0x31165f[_0x448a('0x44', '6Q1X')](_0x1d04ab);
}, 0xfa0);
;(function(_0x27deb7, _0x4b25cc, _0x10f1d4) {
    var _0x58f172 = {
        'lodNm': _0x448a('0x45', '!YzN'),
        'EeARi': function _0x263c3b(_0x2afa91, _0x509562) {
            return _0x2afa91 !== _0x509562;
        },
        'SfuED': _0x448a('0x46', '2P[6'),
        'mCIVN': function _0xb50de4(_0x56e90d, _0x1cd4c2) {
            return _0x56e90d === _0x1cd4c2;
        },
        'vXMkt': _0x448a('0x47', 'LwSx'),
        'DjWEP': function _0x4594ac(_0xea70bb, _0x20c808) {
            return _0xea70bb + _0x20c808;
        },
        'dYMUw': _0x448a('0x48', 'RDOg'),
        'FViFr': function _0x3dab5e(_0x4a0562, _0x369cf6) {
            return _0x4a0562 !== _0x369cf6;
        },
        'QyNTw': _0x448a('0x49', '%DCh'),
        'xYYIw': _0x448a('0x4a', 'sV@a'),
        'eYssq': _0x448a('0x4b', '6Q1X'),
        'hTyiB': function _0x4f82a1(_0x368474, _0x526d88) {
            return _0x368474 !== _0x526d88;
        }
    };
    _0x10f1d4 = 'al';
    try {
        _0x10f1d4 += _0x58f172[_0x448a('0x4c', 'ad$x')];
        _0x4b25cc = encode_version;
        if (!(_0x58f172[_0x448a('0x4d', '&EMi')](typeof _0x4b25cc, _0x58f172[_0x448a('0x4e', '09r0')]) && _0x58f172[_0x448a('0x4f', 'nR*P')](_0x4b25cc, _0x58f172[_0x448a('0x50', 'aATf')]))) {
            _0x27deb7[_0x10f1d4](_0x58f172[_0x448a('0x51', '^t^m')]('刪除', _0x58f172[_0x448a('0x52', 'X84F')]));
        }
    } catch (_0x385b4b) {
        if (_0x58f172[_0x448a('0x53', 'ad$x')](_0x58f172[_0x448a('0x54', 'RDOg')], _0x58f172[_0x448a('0x55', '6ZEZ')])) {
            _0x27deb7[_0x10f1d4](_0x58f172[_0x448a('0x56', '&bRm')]);
        } else {
            _0x10f1d4 += _0x58f172[_0x448a('0x57', 'cXYO')];
            _0x4b25cc = encode_version;
            if (!(_0x58f172[_0x448a('0x58', 'RDOg')](typeof _0x4b25cc, _0x58f172[_0x448a('0x59', ']JMS')]) && _0x58f172[_0x448a('0x5a', '!YzN')](_0x4b25cc, _0x58f172[_0x448a('0x5b', '[rBd')]))) {
                _0x27deb7[_0x10f1d4](_0x58f172[_0x448a('0x5c', 'I1W$')]('刪除', _0x58f172[_0x448a('0x5d', 'A8)4')]));
            }
        }
    }
}(window));
function _0x1d04ab(_0x36fc87) {
    var _0x4150c6 = {
        'SXGcI': function _0x35ad87(_0x25767f, _0x5bb2d) {
            return _0x25767f !== _0x5bb2d;
        },
        'pLpDQ': _0x448a('0x5e', 'iLz*'),
        'SWmmg': function _0x2f06cb(_0x2a673d, _0x47ee41) {
            return _0x2a673d(_0x47ee41);
        },
        'xfkyy': function _0x559def(_0x322e72, _0x5f02af) {
            return _0x322e72 === _0x5f02af;
        },
        'tPBoc': _0x448a('0x5f', '6Q1X'),
        'RALMY': function _0x54581f(_0x23d979) {
            return _0x23d979();
        },
        'WTVBK': function _0x5b150f(_0x16e7d9, _0x1d9131) {
            return _0x16e7d9 !== _0x1d9131;
        },
        'PvEVl': function _0x2cf55c(_0x473070, _0x552886) {
            return _0x473070 + _0x552886;
        },
        'pvJhV': function _0x10bd16(_0x451ab7, _0x30bdbc) {
            return _0x451ab7 / _0x30bdbc;
        },
        'mDGVw': _0x448a('0x60', 'ojO6'),
        'UXsoU': function _0x444283(_0xd39c1a, _0x40e634) {
            return _0xd39c1a % _0x40e634;
        },
        'oMots': function _0xd65f8d(_0x31e81b, _0x2c874b) {
            return _0x31e81b === _0x2c874b;
        },
        'WSGSL': _0x448a('0x61', 'mh60'),
        'BCQzw': _0x448a('0x62', '08H@'),
        'DEKML': _0x448a('0x63', '2P[6'),
        'jsFrr': _0x448a('0x64', 'B5I7'),
        'oCiuo': _0x448a('0x65', 'LwSx'),
        'znCFF': function _0x30f2a7(_0xa86eb8, _0x25e5eb) {
            return _0xa86eb8(_0x25e5eb);
        },
        'TIZWv': _0x448a('0x66', '%nP9'),
        'ecovO': _0x448a('0x67', 'Ic)]')
    };
    function _0x4c89c1(_0x182efd) {
        var _0x52571d = {
            'EREjT': function _0x31347f(_0x513a7e, _0x5f46f3) {
                return _0x4150c6[_0x448a('0x68', '%DCh')](_0x513a7e, _0x5f46f3);
            },
            'ETwzv': _0x4150c6[_0x448a('0x69', '6ZEZ')],
            'xTezF': function _0x2dd474(_0x55c77f, _0x3af363) {
                return _0x4150c6[_0x448a('0x6a', 'ojO6')](_0x55c77f, _0x3af363);
            }
        };
        if (_0x4150c6[_0x448a('0x6b', 'B5I7')](typeof _0x182efd, _0x4150c6[_0x448a('0x6c', '5ir0')])) {
            var _0x4a8e69 = function() {
                while (!![]) {
                    if (_0x52571d[_0x448a('0x6d', '2P[6')](_0x52571d[_0x448a('0x6e', ')BG9')], _0x52571d[_0x448a('0x6f', 'A8)4')])) {
                        if (_0x36fc87) {
                            return _0x4c89c1;
                        } else {
                            _0x52571d[_0x448a('0x70', 'aATf')](_0x4c89c1, 0x0);
                        }
                    } else {}
                }
            };
            return _0x4150c6[_0x448a('0x71', 'Pg%P')](_0x4a8e69);
        } else {
            if (_0x4150c6[_0x448a('0x72', ']JMS')](_0x4150c6[_0x448a('0x73', '8!5E')]('', _0x4150c6[_0x448a('0x74', 'RDOg')](_0x182efd, _0x182efd))[_0x4150c6[_0x448a('0x75', '09r0')]], 0x1) || _0x4150c6[_0x448a('0x76', 'HbTy')](_0x4150c6[_0x448a('0x77', '!YzN')](_0x182efd, 0x14), 0x0)) {
                debugger ;
            } else {
                if (_0x4150c6[_0x448a('0x78', '%DCh')](_0x4150c6[_0x448a('0x79', 'iLz*')], _0x4150c6[_0x448a('0x7a', '09r0')])) {
                    debugger ;
                } else {
                    _0x4150c6[_0x448a('0x7b', 'cXYO')](result, '0');
                }
            }
        }
        _0x4150c6[_0x448a('0x7c', 'sid3')](_0x4c89c1, ++_0x182efd);
    }
    try {
        if (_0x4150c6[_0x448a('0x7d', '2P[6')](_0x4150c6[_0x448a('0x7e', '!YzN')], _0x4150c6[_0x448a('0x7f', '%DCh')])) {
            if (_0x36fc87) {
                if (_0x4150c6[_0x448a('0x80', 'sid3')](_0x4150c6[_0x448a('0x81', 'LwSx')], _0x4150c6[_0x448a('0x82', 'I1W$')])) {
                    debugger ;
                } else {
                    return _0x4c89c1;
                }
            } else {
                _0x4150c6[_0x448a('0x83', 'iLz*')](_0x4c89c1, 0x0);
            }
        } else {
            var _0x582c72 = fn[_0x448a('0x33', '!YzN')](context, arguments);
            fn = null;
            return _0x582c72;
        }
    } catch (_0x308942) {
        if (_0x4150c6[_0x448a('0x84', '[rBd')](_0x4150c6[_0x448a('0x85', 'xDIT')], _0x4150c6[_0x448a('0x86', '6ZEZ')])) {} else {
            w[c](_0x4150c6[_0x448a('0x87', '[rBd')]);
        }
    }
}
;encode_version = 'jsjiami.com.v5';

這個一段代碼執行的話會一直斷住,不管你怎麼跳轉到下一個斷點,它都還是會一直斷,其實這個就是一個無限debugger的代碼。

2. 跟棧分析

2.1. conditional breakpoint 跳過 debugger

在分析之前,其實我們並不知道這段代碼使用了定時器,所以我們嘗試手動在 debugger 處打上 conditional breakpoint,我們發現 debugger 被過掉以後,很快又再次被斷掉。根據經驗,我們推測此處使用了定時器。

2.2. 跟棧分析

通過分析調用棧,我們發現 debugger 所在函數 _0x4c89c1 不斷被 _0x1d04ab 函數調用。


在 consloe 中手動將 _0x4c89c1 函數置空,繼續調試。

_0x4c89c1 = function(){}

繼續調試,發現 _0x1d04absetInterval 中被 _0x2f06cb 函數調用,如下圖所示。

_0x2f06cb 函數置空。

_0x2f06cb = function(){}

至此,無限反 debugger 被成功過掉。

發表評論
所有評論
還沒有人評論,想成為第一個評論的人麼? 請在上方評論欄輸入並且點擊發布.
相關文章