麻牛人帮我解密下这段JS代码

Question

eval(function(p,a,c,k,e,d){e=function(c){return(c<a?"":e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)d[e(c)]=k[c]||e(c);k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1;};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p;}('X d$=["",\'\',\'\\\\\\Z\\Y\',\'\\\\\\C\',\'\\\\\\C\',\'\\T\',\'\\a\\z\\B\\W\\M\\S\\O\\\\\\x\\\\\\G\\\\\\D\\\\\\I\\\\\\D\\\\\\j\\\\\\J\\\\\\r\\\\\\r\\\\\\w\\\\\\N\\\\\\r\\\\\\q\\\\\\w\\\\\\w\\O\\H\\10\\f\\z\\C\\14\\15\\16\\k\\M\\z\\B\\W\\S\\12\\H\\13\',\'\\9\\c\\j\\B\\9\\c\\r\\q\\9\\c\\j\\I\\9\\11\\9\\c\\D\\f\\9\\c\\j\\a\\9\\c\\x\\x\\9\\c\\j\\J\\9\\c\\x\\G\\9\\q\\1h\\m\\k\\l\\y\\h\\m\\9\\h\\m\\a\\1g\\a\\1f\\9\\n\\h\\k\\f\\l\\y\\h\\m\\9\\c\\j\\k\\9\\F\\f\\g\\9\\c\\j\\w\',\'\\9\'];E["\\a\\F\\f\\n"](s(u,p,b,o,e,A){e=s(i){t(i<p? d$[0]:e(E["\\v\\f\\g\\Q\\a\\1k\\m\\l"](i/p)))+((i=i%p)>1i?V["\\q\\g\\h\\1j\\K\\1e\\f\\g\\K\\h\\N\\a"](i+18):i["\\l\\h\\17\\l\\g\\y\\m\\T"](1a))};U(! d$[1]["\\g\\a\\v\\n\\f\\k\\a"](/^/,V)){L(b--)A[e(b)]=o[b]||e(b);o=[s(R){t A[R]}];e=s(){t d$[2]};b=1d};L(b--)U(o[b])u=u["\\g\\a\\v\\n\\f\\k\\a"](1c 1b( d$[3]+e(b)+ d$[4], d$[5]),o[b]);t u}( d$[6],P,P, d$[7]["\\Q\\v\\n\\y\\l"]( d$[8]),19,{}))',62,83,'|||||||||x7c|x65|O1e|x78|_||x61|x72|x6f|O25|x36|x63|x74|x6e|x6c|O27|a5f|x66|x32|function|return|O2b|x70|x31|x37|x69|x20|O7f|x34|x62|x33|window|x76|x38|x5d|x39|x35|x43|while|x3d|x64|x22|0x10|x73|a42|x5b|x67|if|String|x24|var|x2b|x77|x3b|x5f|x30|x7d|x28|x29|x7b|x53|0x1d|0x0|0x24|RegExp|new|0x1|x68|x79|x6b|x75|0x23|x6d|x49'.split('|'),0,{}))

Answer 1

JS解密的特点就是见eval就去掉, 除非用了更特别的手段

本例中去eval并执行得到

var _$=["",'','\\\x77\x2b','\\\x62','\\\x62','\x67','\x65\x20\x34\x24\x3d\x5b\x22\\\x37\\\x38\\\x33\\\x39\\\x33\\\x36\\\x35\\\x32\\\x32\\\x31\\\x64\\\x32\\\x66\\\x31\\\x31\x22\x5d\x3b\x61\x20\x62\x28\x29\x7b\x63\x3d\x20\x34\x24\x5b\x30\x5d\x7d','\x7c\x78\x36\x34\x7c\x78\x32\x66\x7c\x78\x36\x39\x7c\x5f\x7c\x78\x33\x61\x7c\x78\x36\x65\x7c\x78\x37\x37\x7c\x78\x36\x35\x7c\x78\x37\x38\x7c\x66\x75\x6e\x63\x74\x69\x6f\x6e\x7c\x6f\x6e\x65\x6b\x65\x79\x7c\x6c\x6f\x63\x61\x74\x69\x6f\x6e\x7c\x78\x36\x63\x7c\x76\x61\x72\x7c\x78\x36\x31','\x7c'];window["\x65\x76\x61\x6c"](function(O2b,a5f,O1e,O27,e,O7f){e=function(O25){return(O25<a5f? _$[0]:e(window["\x70\x61\x72\x73\x65\x49\x6e\x74"](O25/a5f)))+((O25=O25%a5f)>0x23?String["\x66\x72\x6f\x6d\x43\x68\x61\x72\x43\x6f\x64\x65"](O25+0x1d):O25["\x74\x6f\x53\x74\x72\x69\x6e\x67"](0x24))};if(! _$[1]["\x72\x65\x70\x6c\x61\x63\x65"](/^/,String)){while(O1e--)O7f[e(O1e)]=O27[O1e]||e(O1e);O27=[function(a42){return O7f[a42]}];e=function(){return _$[2]};O1e=0x1};while(O1e--)if(O27[O1e])O2b=O2b["\x72\x65\x70\x6c\x61\x63\x65"](new RegExp( _$[3]+e(O1e)+ _$[4], _$[5]),O27[O1e]);return O2b}( _$[6],0x10,0x10, _$[7]["\x73\x70\x6c\x69\x74"]( _$[8]),0x0,{}))

显然是又一道加密

观察到window["\x65\x76\x61\x6c"]

就是window.eval

去掉它执行得到

var _$=["\x77\x65\x69\x78\x69\x6e\x3a\x2f\x2f\x64\x6c\x2f\x61\x64\x64"];function onekey(){location= _$[0]}

格式化後得到

var _$=["weixin://dl/add"];

function onekey(){location=_$[0]}

追问

打下 能否留个联系方式 ~~你简直是我的偶像~~~想多向您学习