猿人学第五题：js 混淆 - 乱码增强

题目链接：https://match.yuanrenxue.cn/match/5

第一步：常规操作，翻页看看请求⬇️

同样还是从Initiator入手，点req的js进去，往上翻翻找到script标签565行打上断点⬇️

 

 这里写明了指纹，说明后面会用到这个$_zw

 第二步：hook脚本获取下cookie中m⬇️

 

 

定位到_$Wa = _0x12eaf3();

定位到function _0x474032

 hook脚本获取下cookie中RM4hZBv0dDon443M⬇️

 定位到_0x4e96b4['_$ss']

 

 

第三步：找到关键代码，复制关键代码，开始缺什么function粘贴到本地，将缺的function补充完执行解决报错

先看cookie中m值的实现，实际hook完发现生成了5个m值放到了_$pr🀄，先跑通一个看看

 

第一个报错history is not defined⬇️

 浏览器同样位置断点try里面，看看op = _0x4e96b4['$_zw'][_$UH[0x6c]];这里会不会报错，不会的话补充$_zw这个数组⬇️

 补充完测试，与浏览器一致⬇️

 若不一致检测这些地方值有没有补充到：

增加了两处日志断点，可以观察下执行次数，以及几个盐值⬇️

 现在使用页面正常响应的请求参数m时间戳，验证下cookie中m生成值对不对⬇️

 

 至此cookie中m值可以复现出来。

同样的方式开始操作RM4hZBv0dDon443M

 定位到生成位置_$ss📍

 定位到_$ss的生成位置📍

这里_0x4e96b4['_$pr']是5次生成完的数组，观察日志断点输出：

• 第一次初始值：_$tT =  -172015004; _$Jy = 461512024; _$6_ =  8821003647；_$Wa = window.$_zw[23]
• 第二、三、四次：盐值不变，_$Wa不变
• 第五次最终值：_$tT = -660478335; _$Jy =-405537848; _$6_ =  -389564586；_$Wa=_0x2d5f5b()['toString']();

定位到 _$qF的生成📍

AI补一下btoa⬇️

// 模拟浏览器环境，将btoa()和atob()挂载到global对象上
global.btoa = function(str) {
  return Buffer.from(str, 'utf8').toString('base64');
};

global.atob = function(base64Str) {
  return Buffer.from(base64Str, 'base64').toString('utf8');
};

_0x4e96b4['_$is']或_$yw也就是上面请求体中参数m，可执行的在控制台执行，还原代码⬇️

 

 _$Ww = CryptoJS['enc']['Utf8']['parse'](_0x4e96b4['_$pr']['toString']()),
_0x29dd83 = CryptoJS['AES']['encrypt'](_$Ww, CryptoJS['enc']['Utf8']['parse'](btoa(_$yw)['slice'](0x0, 0x10)), {
    'mode': CryptoJS['mode']['ECB'],
    'padding': CryptoJS['pad']['Pkcs7']
}),
_0x4e96b4['_$ss'] = _0x29dd83['toString']();

 

现在使用页面正常响应的请求参数m时间戳，验证下cookie中RM4hZBv0dDon443M生成值对不对⬇️

因为_$pr中间三个是拿两个时间戳更新了盐值没法固定传m和f生成pr进行测试，这里将pr和_$yw（也就是请求参数m值）写死测试下📌

测试完，两个值可以复现出现，现在编写完整代码测试下⬇️

 

 附上代码：

js分段

const CryptoJS = require('crypto-js');
var window=global;
var document={};

// 模拟浏览器环境，将btoa()和atob()挂载到global对象上
global.btoa = function(str) {
  return Buffer.from(str, 'utf8').toString('base64');
};

global.atob = function(base64Str) {
  return Buffer.from(base64Str, 'base64').toString('utf8');
};


_$UH = [
    "name",
    "setAttribute",
    "type",
    "href",
   //省略
];

_0x4e96b4 = window;

d_script = {
   //省略
}

_0x4e96b4['$_zw'] = [
    24504,
    //省略
    2548,
    2548,
    true,
    "明说了，这个数组是指纹",
    Date,
    String,
    eval,
    window,
    document,
    setInterval,
    d_script,
    Error,
    Array,
    Object,
    unescape,
    parseInt,
    encodeURIComponent,
    Function,
    [],
    [],
    1779329776000,
    true,
    1779329778000,
    _$UH

]


function _0x12eaf3() {
    return Date['parse'](new Date());
}

function _0x2d5f5b() {
    return new Date()["valueOf"]();
}

function _0x12b47d(v0_) {
    var v1_, v2_ = "", v3_ = 32 * v0_[_$UH[108]];
    for (v1_ = 0; v1_ < v3_; v1_ += 8) v2_ += String[_$UH[276]](v0_[v1_ >> 5] >>> v1_ % 32 & 255);
    return v2_;
}

function _0x12e4a8(v0_, v1_) {
    var v2_ = (65535 & v0_) + (65535 & v1_);
    return (v0_ >> 16) + (v1_ >> 16) + (v2_ >> 16) << 16 | 65535 & v2_;
}

function _0x3634fc(v0_, v1_) {
    return v0_ << v1_ | v0_ >>> 32 - v1_;
}

function _0xaaef84(v0_, v1_, v2_, v3_, v4_, v5_) {
    return _0x12e4a8(_0x3634fc(_0x12e4a8(_0x12e4a8(v1_, v0_), _0x12e4a8(v3_, v5_)), v4_), v2_);
}

function _0x48d200(v0_, v1_, v2_, v3_, v4_, v5_, v6_) {
    return _0xaaef84(v1_ & v2_ | ~v1_ & v3_, v0_, v1_, v4_, v5_, v6_);
}

function _0x3180ec(v0_, v1_, v2_, v3_, v4_, v5_, v6_) {
    return _0xaaef84(v1_ & v3_ | v2_ & ~v3_, v0_, v1_, v4_, v5_, v6_);
}

function _0x32032f(v0_, v1_, v2_, v3_, v4_, v5_, v6_) {
    return _0xaaef84(v1_ ^ v2_ ^ v3_, v0_, v1_, v4_, v5_, v6_);
}

function _0x4b459d(v0_, v1_, v2_, v3_, v4_, v5_, v6_) {
    return _0xaaef84(v2_ ^ (v1_ | ~v3_), v0_, v1_, v4_, v5_, v6_);
}

var _0x1171c8 = 0x67452301;
var _0x4dae05 = -0x10325477;
var _0x183a1d = -0x67452302;
var _0xcfa373 = 0x10325476;
// _0x4e96b4["_$tT"] = -172015004;
// _0x4e96b4["_$Jy"] = 461512024;
_0x4e96b4["_$tT"] = -660478335;
_0x4e96b4["_$Jy"] = -405537848;
_0x4e96b4["_$6_"] = -389564586;


function _0x11a7a2(_0x193f00, _0x1cfe89) {
    _0x193f00[_0x1cfe89 >> 5] |= 128 << _0x1cfe89 % 32, _0x193f00[14 + (_0x1cfe89 + 64 >>> 9 << 4)] = _0x1cfe89;
    try {
        var _0x42fb36 = _0x4e96b4[_$UH[608]][_$UH[8]]["DONE"] * 4;
    } catch (v0_) {
        var _0x42fb36 = 16;
    }
    try {
        _0x4e96b4["$_z2"][0] = "Q";
    } catch (_0x4c574d) {
        try {
            op = _0x4e96b4["$_zw"][_$UH[108]];
        } catch (v0_) {
            var _0x3b7935 = 0;
            for (var _0x1badc3 = 0; _0x1badc3 < 1e6; _0x1badc3++) {
                _0x3b7935 = _0x3b7935 + _0x1badc3[_$UH[31]]();
                history["pushState"](0, 0, _0x3b7935);
            }
        }
        if (op > 20) {
            eval("b64pad = _0x4e96b4['$_zw'][9]['length'];");
        } else if (op < 10) {
            _0x4e96b4["$_zw"] = [ 1, 8, 2, 4, 23, 45, 8, 15, 81, 68, 13, 72, 70 ];
        }
    }

    var _0x1badc3, _0x38ca59, _0x431764, _0x43f1b4, _0x5722c0, _0x3e0c38 = _0x1171c8, _0xdb4d2c = _0x4dae05, _0x1724c5 = _0x183a1d, _0x257ec6 = _0xcfa373;
    try {
        if (_0x4e96b4["_$6_"]) {} else {
            _0x4e96b4["_$6_"] = 8821003647;
        }
    } catch (v0_) {
        _0x4e96b4["_$6_"] = 37885443;
    }


    for (_0x1badc3 = 0; _0x1badc3 < _0x193f00[_$UH[108]]; _0x1badc3 += _0x42fb36) _0x38ca59 = _0x3e0c38, 
    _0x431764 = _0xdb4d2c, _0x43f1b4 = _0x1724c5, _0x5722c0 = _0x257ec6, _0x3e0c38 = _0x48d200(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3], 7, 513548), 
    _0x257ec6 = _0x48d200(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 1], 12, _0x4e96b4["_$6_"]), 
    _0x1724c5 = _0x48d200(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 2], 17, 606105819), 
    _0xdb4d2c = _0x48d200(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 3], 22, -1044525330), 
    _0x3e0c38 = _0x48d200(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 4], 7, -176418897), 
    _0x257ec6 = _0x48d200(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 5], 12, 1200080426), 
    _0x1724c5 = _0x48d200(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 6], 17, -1473231341), 
    _0xdb4d2c = _0x48d200(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 7], 22, -45705983), 
    _0x3e0c38 = _0x48d200(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 8], 7, 1770035416), 
    _0x257ec6 = _0x48d200(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 9], 12, -1958414417), 
    _0x1724c5 = _0x48d200(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 10], 17, -42063), 
    _0xdb4d2c = _0x48d200(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 11], 22, -1990404162), 
    _0x3e0c38 = _0x48d200(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 12], 7, 1804603682), 
    _0x257ec6 = _0x48d200(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 13], 12, -40341101), 
    _0x1724c5 = _0x48d200(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 14], 17, -1502002290), 
    _0xdb4d2c = _0x48d200(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 15], 22, 1236535329), 
    _0x3e0c38 = _0x3180ec(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 1], 5, -165796510), 
    _0x257ec6 = _0x3180ec(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 6], 9, -1069501632), 
    _0x1724c5 = _0x3180ec(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 11], 14, 643717713), 
    _0xdb4d2c = _0x3180ec(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3], 20, -373897302), 
    _0x3e0c38 = _0x3180ec(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 5], 5, -701558691), 
    _0x257ec6 = _0x3180ec(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 10], 9, 38016083), 
    _0x1724c5 = _0x3180ec(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 15], 14, _0x4e96b4["_$tT"]), 
    _0xdb4d2c = _0x3180ec(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 4], 20, _0x4e96b4["_$Jy"]), 
    _0x3e0c38 = _0x3180ec(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 9], 5, 568446438), 
    _0x257ec6 = _0x3180ec(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 14], 9, -1019783690), 
    _0x1724c5 = _0x3180ec(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 3], 14, -187363961), 
    _0xdb4d2c = _0x3180ec(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 8], 20, 1163531501), 
    _0x3e0c38 = _0x3180ec(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 13], 5, -1554681467), 
    _0x257ec6 = _0x3180ec(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 2], 9, -51403784), 
    _0x1724c5 = _0x3180ec(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 7], 14, 1735328473), 
    _0xdb4d2c = _0x3180ec(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 12], 20, -1926607734), 
    _0x3e0c38 = _0x32032f(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 5], 4, -37824558), 
    _0x257ec6 = _0x32032f(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 8], 11, -2022574463), 
    _0x1724c5 = _0x32032f(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 11], 16, 1839030562), 
    _0xdb4d2c = _0x32032f(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 14], 23, -35309556), 
    _0x3e0c38 = _0x32032f(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 1], 4, -1530992060 * b64pad), 
    _0x257ec6 = _0x32032f(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 4], 11, 1272893353), 
    _0x1724c5 = _0x32032f(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 7], 16, -155497632), 
    _0xdb4d2c = _0x32032f(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 10], 23, -1094730640), 
    _0x3e0c38 = _0x32032f(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 13], 4, 681279174), 
    _0x257ec6 = _0x32032f(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3], 11, -358537222), 
    _0x1724c5 = _0x32032f(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 3], 16, -722521979), 
    _0xdb4d2c = _0x32032f(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 6], 23, 760291289), 
    _0x3e0c38 = _0x32032f(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 9], 4, -64036887), 
    _0x257ec6 = _0x32032f(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 12], 11, -421815835), 
    _0x1724c5 = _0x32032f(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 15], 16, 530742520), 
    _0xdb4d2c = _0x32032f(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 2], 23, -995338651), 
    _0x3e0c38 = _0x4b459d(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3], 6, -198630844), 
    _0x257ec6 = _0x4b459d(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 7], 10, 1126891415), 
    _0x1724c5 = _0x4b459d(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 14], 15, -1416354905), 
    _0xdb4d2c = _0x4b459d(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 5], 21, -57434055), 
    _0x3e0c38 = _0x4b459d(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 12], 6, 1700485571), 
    _0x257ec6 = _0x4b459d(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 3], 10, -1894746606), 
    _0x1724c5 = _0x4b459d(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 10], 15, -105181523), 
    _0xdb4d2c = _0x4b459d(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 1], 21, -2054922799), 
    _0x3e0c38 = _0x4b459d(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 8], 6, 1873313359), 
    _0x257ec6 = _0x4b459d(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 15], 10, -30611744), 
    _0x1724c5 = _0x4b459d(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 6], 15, -1560198380), 
    _0xdb4d2c = _0x4b459d(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 13], 21, 1309151649), 
    _0x3e0c38 = _0x4b459d(_0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6, _0x193f00[_0x1badc3 + 4], 6, -145523070), 
    _0x257ec6 = _0x4b459d(_0x257ec6, _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x193f00[_0x1badc3 + 11], 10, -1120211379), 
    _0x1724c5 = _0x4b459d(_0x1724c5, _0x257ec6, _0x3e0c38, _0xdb4d2c, _0x193f00[_0x1badc3 + 2], 15, 718787259), 
    _0xdb4d2c = _0x4b459d(_0xdb4d2c, _0x1724c5, _0x257ec6, _0x3e0c38, _0x193f00[_0x1badc3 + 9], 21, -343485441), 
    _0x3e0c38 = _0x12e4a8(_0x3e0c38, _0x38ca59), _0xdb4d2c = _0x12e4a8(_0xdb4d2c, _0x431764), 
    _0x1724c5 = _0x12e4a8(_0x1724c5, _0x43f1b4), _0x257ec6 = _0x12e4a8(_0x257ec6, _0x5722c0);
    return [ _0x3e0c38, _0xdb4d2c, _0x1724c5, _0x257ec6 ];
}



function _0x35f5f2(v0_) {
    var v1_, v2_ = [];
    for (v2_[(v0_[_$UH[108]] >> 2) - 1] = void 0, v1_ = 0; v1_ < v2_[_$UH[108]]; v1_ += 1) v2_[v1_] = 0;
    var v3_ = 8 * v0_[_$UH[108]];
    for (v1_ = 0; v1_ < v3_; v1_ += 8) v2_[v1_ >> 5] |= (255 & v0_[_$UH[15]](v1_ / 8)) << v1_ % 32;
    return v2_;
}

function _0x1ee7ec(v0_) {
    return _0x12b47d(_0x11a7a2(_0x35f5f2(v0_), 8 * v0_[_$UH[108]]));
}

function _0x2b8a17(v0_) {
    return unescape(encodeURIComponent(v0_));
}

function _0x41873d(v0_) {
    return _0x1ee7ec(_0x2b8a17(v0_));
}

function _0x499969(v0_) {
    var v1_, v2_, v3_ = "0123456789abcdef", v4_ = "";
    for (v2_ = 0; v2_ < v0_[_$UH[108]]; v2_ += 1) v1_ = v0_[_$UH[15]](v2_), v4_ += v3_["charAt"](v1_ >>> 4 & 15) + v3_["charAt"](15 & v1_);
    return v4_;
}

function _0x37614a(v0_) {
    return _0x499969(_0x41873d(v0_));
}

function _0x474032(v0_, v1_, v2_) {
    return v1_ ? v2_ ? v(v1_, v0_) : y(v1_, v0_) : v2_ ? _0x41873d(v0_) : _0x37614a(v0_);
}

var cookie_m;

_0x4e96b4['_$pr'] = new Array();

_0x4e96b4["_$tT"] = -172015004;
_0x4e96b4["_$Jy"] = 461512024;
_0x4e96b4["_$6_"] = 8821003647
var xx = _0x12eaf3();
// test
// xx = 1779437437000;
for (var i = 0x1; i < 5; i++) {
    xx_ = xx['toString']();
    _0x4e96b4['_$pr'].push(_0x474032(xx_))
    console.log(i,'------_$pr------xx-----_0x4e96b4["_$tT"]------_0x4e96b4["_$Jy"]-------_0x4e96b4["_$6_"]',_0x4e96b4['_$pr'],xx_,_0x4e96b4["_$tT"],_0x4e96b4["_$Jy"],_0x4e96b4["_$6_"])
}
_0x4e96b4["_$tT"] = -660478335;
_0x4e96b4["_$Jy"] = -405537848;
_0x4e96b4["_$6_"] = -389564586;
var _$Wa = _0x2d5f5b()['toString']();
// test
// _$Wa = '1779437441047';

_0x4e96b4['_$pr'].push(_0x474032(_$Wa))
console.log(i,'------_$pr------_$Wa-----_0x4e96b4["_$tT"]------_0x4e96b4["_$Jy"]-------_0x4e96b4["_$6_"]',_0x4e96b4['_$pr'],_$Wa,_0x4e96b4["_$tT"],_0x4e96b4["_$Jy"],_0x4e96b4["_$6_"])
cookie_m = 'm=' + _0x474032(_$Wa) + ';\x20path=/';

// console.log(_$Wa)
// console.log(_0x4e96b4['_$pr'])

//--------------------------------------------

// test 因为_$pr中间三个是拿两个时间戳更新了盐值没法固定传m和f生成pr进行测试 这里将pr和_$yw（也就是请求参数m值）写死测试下
// _0x4e96b4['_$pr'] = ['b0f213ec43b41cc4da3d90792adc2293', '2d43fccdea15f326e2727ac0ff9dc7a7', 'd647483704b7d66fde74179bd1c69429', 'd3324a9e97a363d1f6c376aa29363dcd', '7c2487365648ae3f2100d2bdb8cf2744']
// _$Wa = '1779437441047';

 _$Ww = CryptoJS['enc']['Utf8']['parse'](_0x4e96b4['_$pr']['toString']()),
_0x29dd83 = CryptoJS['AES']['encrypt'](_$Ww, CryptoJS['enc']['Utf8']['parse'](btoa(_$Wa)['slice'](0x0, 0x10)), {
    'mode': CryptoJS['mode']['ECB'],
    'padding': CryptoJS['pad']['Pkcs7']
}),
_0x4e96b4['_$ss'] = _0x29dd83['toString']();
var cookie_RM4hZBv0dDon443M;

 cookie_RM4hZBv0dDon443M = 'R' + 'M' + '4' + 'h' + 'Z' + 'B' + 'v' + '0' + 'd' + 'D' + 'o' + 'n' + '4' + '4' + '3' + 'M=' + _0x4e96b4['_$ss'] + ';\x20path=/';
 console.log(cookie_RM4hZBv0dDon443M)

 function get_target(){
    var xxx = {
        'cookie_m': cookie_m,
        'cookie_r': cookie_RM4hZBv0dDon443M,
        'req_m': _$Wa,
        'req_f': xx
    }
    return xxx
}
console.log('--------------------------------------------------------')
console.log(get_target())

import json
import time

import requests


def get_mrmf_5():
    # hook到关键代码 cookie中的m值需要补环境  其他值关键代码还原
    #  _$Ww = _$Tk[_$UH[0x2db]][_$UH[0x2dc]][_$UH[0xff]](_0x4e96b4['_$pr'][_$UH[0x1f]]()),
    # _0x29dd83 = _$Tk['A' + _$UH[0x32d]][_$UH[0x337] + _$UH[0x336]](_$Ww, _0x4e96b4[_0xc77418('0x6', 'OCbs')], {
    #     'mode': _$Tk[_$UH[0x339] + _$UH[0x33a]][_$UH[0x2e5]],
    #     'padding': _$Tk[_$UH[0x33b]][_$UH[0x33c] + _$UH[0x33d]]
    # }),
    # _0x4e96b4['_$' + _$UH[0x348][0x1] + _$UH[0x353][0x1]] = _0x29dd83[_$UH[0x1f]]();
    #
    # 时间戳：new Date()['valueOf']()
    # m生成5个  _0x474032(new Date()['valueOf']()) 执行5次放到列表
    # _0x4e96b4['_$pr'] --> ['fa0f42e2c98bf698fb988fc4bdf309a7', '2669b19a95cfc591bd432f16fe1d2728', '9f5958b0ab0542e38c692ce310208038', 'a5288c8f8981ee845fc8b75ad1df97d3', '2cf69e0e6e8997b7d940a9b84ddf5916']
    #
    # _0x4e96b4['_$is'] --> new Date()['valueOf']()['toString']()
    # _0x4e96b4['_$qF'] = CryptoJS['enc']['Utf8']['parse'](_0x4e96b4['btoa'](_0x4e96b4['_$is'])['slice'](0x0, 0x10));
    #
    # _0x4e96b4['_$qF'] --> {
    #     "words": [
    #         1297376051,
    #         1315597175,
    #         1330924851,
    #         1313100152
    #     ],
    #     "sigBytes": 16
    # }
    #
    #  _$Ww = _CryptoJS['enc']['Utf8']['parse'](_0x4e96b4['_$pr']['toString']()),
    # _0x29dd83 = CryptoJS['AES']['encrypt'](_$Ww, CryptoJS['enc']['Utf8']['parse'](_0x4e96b4['btoa'](new Date()['valueOf']()['toString']())['slice'](0x0, 0x10)), {
    #     'mode': CryptoJS['mode']['ECB'],
    #     'padding': CryptoJS['pad']['Pkcs7']
    # }),
    # _0x4e96b4['_$ss'] = _0x29dd83['toString']();

    with open('3333.js', 'r', encoding='utf-8', errors='ignore') as f:
        js_content = f.read()
    v = execjs.compile(js_content).call('get_target')
    return v

def get_question_5_result():
    """js混淆 乱码增强"""
    url = "https://match.yuanrenxue.cn/api/question/5"
    headers = {
        "accept": "application/json, text/javascript, */*; q=0.01",
        # "accept-encoding": "gzip, deflate, br, zstd",
        "accept-language": "zh-CN,zh;q=0.9",
        "cache-control": "no-cache",
        # "cookie": "Hm_lvt_f80b2b389f44bbfb3bfe1704817d44e0=1776316664; HMACCOUNT=3ADBE34EA00D9961; sessionid=qarkeoj53qh9hd1t0fj0vwgdvxkkki9b; Hm_lpvt_f80b2b389f44bbfb3bfe1704817d44e0=1776908557; m=ffe4a1009f9259442572fac584405992; RM4hZBv0dDon443M=vQIpkWJskOG8Ysll82quRF+fsQUZtvr6Vbl9iYoptGOh4Hcq+Tm5LzTkvetTwgAEdrrPKt8xy4H0RTjKobUP5C0mvhB+gh6FiFI91Al9uLWlcwr4NooVzwUcqck+IoRXMEC5HklZ3nVsiqtpHdGyXoHTqhGGiiNkTK+YG05Hqfpb3MofFgv7DvlNz7DgAx9ciVvqvMTwQjPHXwYXjGsDTlwlxjjX2Sf0dPbKZBNtFww=",
        "pragma": "no-cache",
        "priority": "u=1, i",
        "referer": "https://match.yuanrenxue.cn/match/5",
        "sec-ch-ua": "\"Chromium\";v=\"146\", \"Not-A.Brand\";v=\"24\", \"Google Chrome\";v=\"146\"",
        "sec-ch-ua-mobile": "?0",
        "sec-ch-ua-platform": "\"Windows\"",
        "sec-fetch-dest": "empty",
        "sec-fetch-mode": "cors",
        "sec-fetch-site": "same-origin",
        "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36",
        "x-requested-with": "XMLHttpRequest"
    }
    sum_data = 0
    s = requests.Session()
    s.headers.clear()
    s.headers.update(headers)
    for page in range(1, 6):
        v = get_mrmf_5()
        cookie = {
            'sessionid': 'qarkeoj53qh9hd1t0fj0vwgdvxkkki9b',
            'm': v['cookie_m'],
            'RM4hZBv0dDon443M': v['cookie_r'].replace('RM4hZBv0dDon443M=', '')
        }
        s.cookies.update(cookie)
        if page == 5:
            headers['user-agent'] = 'yuanrenxue'
            s.headers.update(headers)
        params = {
            "page": page,
            # "pageSize": "10",
            "m": v['req_m'],
            "f": v['req_f'],
        }
        print(f'v={v}')
        print(f'cookie={cookie}')
        print(f'param={params}')
        try:
            r = s.get(url=url, params=params, verify=False)
            if r.status_code == 200:
                data = r.json()['data']
                print(data)
                sum_data += sum(data)
                print(f"翻第{str(page)}页，累计求和:{sum_data}")
                time.sleep(5)
            else:
                print(f'error:{r.status_code}-----{r.text}')
        except Exception as e:
            raise ValueError(e)

def get_9m():
    url = f"https://match.yuanrenxue.cn/api/question/9"
    headers = {
        "accept": "*/*",
        # "accept-encoding": "gzip, deflate, br, zstd",
        "accept-language": "zh-CN,zh;q=0.9",
        "cookie": "sessionid=ov42dmmjf4zxah9ng631184pwiouzlmw; Hm_lvt_f80b2b389f44bbfb3bfe1704817d44e0=1776316664,1777258117,1778142192; HMACCOUNT=3ADBE34EA00D9961; Hm_lpvt_f80b2b389f44bbfb3bfe1704817d44e0=1778229890; ",
        "cache-control": "no-cache",
        "pragma": "no-cache",
        "priority": "u=1, i",
        "referer": "https://match.yuanrenxue.cn/match/9",
        "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36",
        "x-requested-with": "XMLHttpRequest"
    }
    r = requests.get(url=url, headers=headers, verify=False)
    if r.status_code == 200:
        data = r.json()['data']
        if isinstance(data, str):
            # ss = execjs.eval(data)
            m_num = re.findall(r';m<=(\d+);', data) or re.findall(r'\(m,(\d+)\);m\+\+', data)
            m_num = m_num[0]
            decry = re.findall("decrypt\('([0-9]{10})'\)", data) or re.findall("decrypt,'([0-9]{10})'", data)
            decry = decry[0]
            with open('9_decr_res.js', 'r', encoding='utf-8') as f:
                obj = f.read()
            # test
            # decry = '1778649927'
            # m_num = 5
            m = execjs.compile(obj).call('get_m', decry, m_num)
            # m = subprocess.run(
            #     ['node', '-e', f"const obj = require('./9_decr_res.js'); console.log(obj.get_m('{decry}', {m_num}))"],
            #     capture_output=True,
            #     encoding='utf-8',
            #     text=True,
            #     cwd='./'  # 指定工作目录
            # )

            print(decry, m_num, m)
            return m
    else:
        raise ValueError(r.status_code, r.text)

def get_question_9_result():
    """js混淆 动态cookie2"""
    url = "https://match.yuanrenxue.cn/api/question/9"
    headers = {
        "accept": "*/*",
        # "accept-encoding": "gzip, deflate, br, zstd",
        "accept-language": "zh-CN,zh;q=0.9",
        "cache-control": "no-cache",
        "pragma": "no-cache",
        "priority": "u=1, i",
        "referer": "https://match.yuanrenxue.cn/match/9",
        "sec-ch-ua": "\"Google Chrome\";v=\"147\", \"Not.A/Brand\";v=\"8\", \"Chromium\";v=\"147\"",
        "sec-ch-ua-mobile": "?0",
        "sec-ch-ua-platform": "\"Windows\"",
        "sec-fetch-dest": "empty",
        "sec-fetch-mode": "cors",
        "sec-fetch-site": "same-origin",
        "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36",
        "x-requested-with": "XMLHttpRequest"
    }
    sum_data = 0
    s = requests.Session()
    s.headers.clear()
    s.headers.update(headers)
    m = get_9m()
    for page in range(1, 6):
        params = {
            "page": page,
            "pageSize": "10",
            "kw": "",
        }
        if page == 5:
            headers['user-agent'] = 'yuanrenxue'
        try:
            headers['cookie'] = "sessionid=ov42dmmjf4zxah9ng631184pwiouzlmw;" + m
            s.headers.update(headers)
            r = s.get(url=url, params=params, verify=False)
            if r.status_code == 200:
                data = r.json()['data']
                if isinstance(data, list):
                    sum_data += sum(data)
                    print(f"翻第{str(page)}页，累计求和:{sum_data}")
                else:
                    raise ValueError(f'error:{r.status_code}-----{r.text}')
            else:
                print(f'error:{r.status_code}-----{r.text}')

        except Exception as e:
            raise ValueError(e)

if __name__ == '__main__':
    get_question_5_result()

完结~✿✿ヽ(°▽°)ノ✿