某音乐sign分析

2023-09-17 51

版权

本文内容由阿里云实名注册用户自发贡献，版权归原作者所有，阿里云开发者社区不拥有其著作权，亦不承担相应法律责任。具体规则请查看《阿里云开发者社区用户服务协议》和《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容，填写侵权投诉表单进行举报，一经查实，本社区将立刻删除涉嫌侵权内容。

简介： 某音乐sign分析

目标网址:aHR0cHM6Ly95LnFxLmNvbS9uL3J5cXEvdG9wbGlzdC80

观前提示：

本文章仅供学习交流,切勿用于非法通途,如有侵犯贵司请及时联系删除

0x1 加密点位置

首先来到排行榜页面刷新

F12抓包过滤sign字段即可

全局搜索sign 得出的结果并不多

随便找找下下断就能找到正确加密位置

0x2 扣代码

进入o方法看到一些奇怪的代码

根据我的经验所得这是一个jsvmp

不管那么多先找到头和尾扣出来放node里面运行先

要注意的是这里的n(110)其实就是window 手动赋值即可

微改完运行根据node运行的报错来补环境

补window

补完window运行发现没有多的报错此时我眉头稍微一紧发现事情并不简单

方法运行完后即可运行_getSecuritySign来计算sign

先跑个值和网页对比看看

node

web

果然 tx就是狡猾不过这样才好玩

0x3 找坑

通过单步调试观察代码的运行逻辑可以找到循环位置

在这个位置插桩是最适合不过的了然后继续往上看

在解释代码里面大量出现i字眼想必这里就是模拟堆栈的知道了这些信息我们手动把循环位置魔改一下

for (var h = !1; !h;){
  var xxx=n[t++]; 
  console.log(i)
  h = d[xxx]();
}

然后运行看输出即可

输出内容很多耐心观察

window

navigator

这里拿到了navigator.userAgemt

而上面还出现了/Headless/i和test字眼

可以确定这里是判断你的ua是否为无头浏览器

location

这里拿了location.host

而后面出现了indexOf和qq.com

可以判断这里是判断host是否为qq.com

再往后就没有看到其他环境检测的输出了

根据上述信息简单补个环境

window=global;
navigator={
    userAgent:'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36'
}
location={
    host:'y.qq.com'
}

补完对比一下输出值

node

web

一模一样了是不是很简单

对比一下从jsvmp还原的代码

(function () {
  var v0, v1, v2, v3, v4, v5, v6, v7;
  v0 = [window];
  v1 = [{}];
  v2 = [];
  v3 = [];
  v4 = [];
  v5 = [];
  v6 = [];
  v7 = [];
  function func_17() {
    var v0, v1, v2, v3, v4, v5, v6, v7, v8;
    v0 = [window];
    v1 = [arguments];
    v2 = [func_17];
    v3 = [func_135];
    v4 = [];
    v5 = [];
    v6 = [];
    v7 = [];
    v8 = [];
    v9 = window["define"];
    v9 = typeof v9;
    v9 = v9 === "function";
    if (v9) {
      v9 = window["define"]["amd"];
      if (v9) {
        v9 = window["define"](v3[0]);
        return void 0;
      }
      v9 = v3[0]([]);
      return void 0;
    }
    if (v9) {
      v9 = window["define"](v3[0]);
      return void 0;
    }
    v9 = v3[0]([]);
    return void 0;
  }
  function func_135() {
    var v0, v1, v2, v3, v4, v5, v6, v7, v8, v9;
    v0 = [window];
    v1 = [arguments];
    v2 = [func_135];
    v3 = [];
    v4 = [];
    v5 = [];
    v6 = [];
    v7 = [];
    v8 = [];
    v9 = [];
    function func_158() {
      var v0, v1, v2, v3, v4, v5, v6, v7;
      v0 = [window];
      v1 = [arguments];
      v2 = [func_158];
      v3 = [];
      v4 = [];
      v5 = [];
      v6 = [];
      v7 = [];
      v8 = window["global"];
      v8 = typeof v8;
      v8 = v8 === "undefined";
      v8 = !v8;
      if (v8) {
        v8 = window["global"];
        return v8;
      }
      v8 = window["window"];
      v8 = typeof v8;
      v8 = v8 === "undefined";
      v8 = !v8;
      if (v8) {
        v8 = window["window"];
        return v8;
      }
      v8 = window["self"];
      v8 = typeof v8;
      v8 = v8 === "undefined";
      v8 = !v8;
      if (v8) {
        v8 = window["self"];
        return v8;
      }
      return void 0;
    }
    v11 = func_158([]);
    v8[0] = v11;
    function func_354() {
      var v354_0, v354_1, v354_2, v354_3, v354_4, v354_5, v354_6, v354_7, v354_8, v354_9, v354_10, v354_11, v354_12, v354_13, v354_14, v354_15, v354_16, v354_17, v354_18, v354_19, v354_20, v354_21, v354_22, v354_23, v354_24, v354_25, v354_26, v354_27, v354_28, v354_29, v354_30, v354_31, v354_32, v354_33;
      v354_0 = [window];
      v354_1 = [arguments];
      v354_2 = [func_354];
      v354_3 = [arguments[0]];
      v354_33 = [window];
      v354_4 = [];
      v354_5 = [];
      v354_6 = [];
      v354_7 = [];
      v354_8 = [];
      v354_9 = [];
      v354_10 = [];
      v354_11 = [];
      v354_12 = [];
      v354_13 = [];
      v354_14 = [];
      v354_15 = [];
      v354_16 = [];
      v354_17 = [];
      v354_18 = [];
      v354_19 = [];
      v354_20 = [];
      v354_21 = [];
      v354_22 = [];
      v354_23 = [];
      v354_24 = [];
      v354_25 = [];
      v354_26 = [];
      v354_27 = [];
      v354_28 = [];
      v354_29 = [];
      v354_30 = [];
      v354_31 = [];
      v354_32 = [];
      v354_35 = window["Object"];
      v354_35 = new (Function["bind"]["apply"](v354_35, null))();
      v354_35["0"] = 0;
      v354_35["1"] = 1;
      v354_35["2"] = 2;
      v354_35["3"] = 3;
      v354_35["4"] = 4;
      v354_35["5"] = 5;
      v354_35["6"] = 6;
      v354_35["7"] = 7;
      v354_35["8"] = 8;
      v354_35["9"] = 9;
      v354_35["A"] = 10;
      v354_35["B"] = 11;
      v354_35["C"] = 12;
      v354_35["D"] = 13;
      v354_35["E"] = 14;
      v354_35["F"] = 15;
      v354_9[0] = v354_35;
      v354_10[0] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
      v354_35 = window["__sign_hash_20200305"];
      if (v354_35) {
        v354_36 = window["__sign_hash_20200305"](v354_3[0]);
        v354_35 = v354_36["toUpperCase"]([]);
        v354_11[0] = v354_35;
        v354_35 = window["window"];
        v354_35 = typeof v354_35;
        v354_35 = v354_35 === "object";
        if (v354_35) {
          v354_35 = window["navigator"];
          v354_35 = typeof v354_35;
          v354_35 = v354_35 === "object";
          if (v354_35) {
            v354_35 = window["location"];
            v354_35 = typeof v354_35;
            v354_35 = v354_35 === "object";
            v354_12[0] = v354_35;
            if (v354_12[0]) {
              v354_35 = window["RegExp"];
              v354_35 = v354_35("Headless", "i");
              v354_36 = window["navigator"]["userAgent"];
              v354_35 = v354_35["test"](v354_36);
              v354_13[0] = v354_35;
              /*后面计算代码省略*/
            }
          }
        }
      }
    }
    v9[0] = func_354;
    v11["_getSecuritySign"] = v9[0];
    return void 0;
  }
  v8 = func_17(func_135);
  console.log(window._getSecuritySign)
})()

从代码中可以清晰的见到检测环境的代码但是并不参与计算但是为什么会计算出来的结果不一样呢？

在继续观察了还原出来的代码后可以看到

function func_1338() {
  var v1338_0, v1338_1, v1338_2, v1338_3, v1338_4, v1338_5, v1338_6, v1338_7, v1338_8, v1338_9, v1338_10;
  v1338_0 = [window];
  v1338_1 = [arguments];
  v1338_2 = [func_1338];
  v1338_3 = [arguments[0]];
  v1338_9 = [v354_11[0]];
  v1338_10 = [v354_14[0]];
  v1338_4 = [];
  v1338_5 = [];
  v1338_6 = [];
  v1338_7 = [];
  v1338_8 = [];
  if (v1338_10[0]) {
    v1338_11 = v354_11[0][v1338_3[0]];
    return v1338_11;
  }
  v1338_12 = v1338_3[0] + 1;
  v1338_11 = v354_11[0][v1338_12];
  return v1338_11;
}