其他
一款炒茅台炒鞋抢购辅助软件Android版的逆向分析
本文为看雪论坛优秀文章
看雪论坛作者ID：wx_A.R
0x00 简介
0x01 逆向
<script type="text/javascript"> ;eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('3u(N).3v(A($){3 g=K;3 h="X";h=3w.3x("1K");4(!h||h==\'X\'){C.D(\'请前往官网Y://2g.2h更新最新版本\')}3 l;3 m;3 n=0;3 o=[];3 p=1;3 q="X";3 r;3 s;3 t=K;3 u=K;3 v=E;3 w=E;3 x=1L.2i.3y;4(x.B(\'3z.3A\')>-1||x.B(\'2g.2h\')>-1){v=E}H{v=K}$("#Z-10-1").L();$("#Z-10-2").F();$("#I-J-15").F();$("#I-J-G").F();$("#I-1d-G").F();$("#I-1y-O").F();z U=3B.U;4(U.B(\'3C\')>-1||U.B(\'1M\')>-1||U.B(\'3D\')>-1){g=E;4(U.B(\'1M 2j 3E\')>-1||U.B(\'3F\')>-1||U.B(\'1M 2j 3G\')>-1||U.B(\'3H\')>-1){g=K}}$(\'#2k\').1e(2l());3 y=3I(A(){2m()},3J);$("#1N-G").16(A(){4(!u){u=E;$("#1N-G").2n(\'2o\',\'3K\');C.D("已开启专业模式");$("#I-J-15").L();$("#2p-J-15").F();$("#I-1d-G").L();$("#I-J-G").L();$("#I-1y-O").L()}H{u=K;$("#1N-G").2n(\'2o\',\'3L\');C.D("已关闭专业模式");$("#I-J-15").F();$("#2p-J-15").L();$("#I-1d-G").F();$("#I-J-G").F();$("#I-1y-O").F()}});A 2m(){4(t){z 11=1f 1g();z 1m=r.1h()-11.1h();4(1m<=s){t=K;1O();$("#J-2q").P("开启跳转")}H{$("#J-2q").P("倒计时:"+1m+"1z")}}}A 1P(b){4(w){w=K}H{17}n=0;o=[];p=1;t=K;3 c=\'Y://3M.3N.3O/2r/2s?1K=\'+h+\'&2t=\'+b;4(v){c=\'Y://3P.3Q.1A/2r/2s?1K=\'+h+\'&2t=\'+b}$.2u({1n:"2v",2w:2x,1Q:\'18\',18:"2y",2z:\'18\',1B:c,2A:A(a){w=E;4(a.3R==0){l=a.19;1o();$("#Z-10-1").F();$("#Z-10-2").L();$("#1R").L();$("#1S").F()}H{4(a.2B.B(\'解析失败\')>-1){1T(b);w=E}H{C.D(a.2B)}}},2C:(1U,1n)=>{1T(b);w=E},})}A 1T(a){n=0;o=[];p=1;t=K;4(a.B(\'.1V.1A\')>-1){2D(a)}4(a.B(\'Q=\')>-1){3 b=a.R("Q=")[1];1W(b)}}A 2D(d){2E.2F("2G",{1B:d},A(a){4(a.B(\'3S\')==0){C.D("错误"+a);17}z S=a;3 b="X";4(S.B(\'&Q=\')>-1){3 c=S.R("&Q=")[1];b=c.R("&")[0]}H 4(S.B(\'M.V/i\')>-1){3 c=S.R("M.V/i")[1];b=c.R(".2H")[0]}H 4(S.B(\'2I.V/i\')>-1){3 c=S.R("2I.V/i")[1];b=c.R(".2H")[0]}4(b!=\'X\'){1W(b)}H{C.D("无法解析该淘口令")}})}A 1W(b){z 2J="3T";z 2K="3U";z 11=1f 1g();z 1X=11.1h()+"";3 c={"Q":b,"3V":b,"1p":b,"2L":{"Q":b},"3W":"8.0.0","3X":"1"};3 d=1Y.2M(c);d=2N(d);z 2O=2J+"&"+1X+"&2P&"+d;z 2Q=3Y(2O);z 2R="Y://3Z.m.M.V/1C/1Z.M.2S.2T/6.0/?"+"40=2.5.7&41=2P&t="+1X+"&42="+2Q+"&20=1Z.M.2S.2T&v=6.0&43=0&44=0&45=E&46=E&47=E&48=49@4a.9.9&1n=18&1Q=18&"+"19="+d;$.2u({1n:"2v",2w:2x,1Q:\'18\',18:"2y",2z:2K,1B:2R,2A:A(a){1q{z 2U={12:a.19.12,1a:a.19.1a};l=2U;1o();$("#Z-10-1").F();$("#Z-10-2").L();$("#1R").L();$("#1S").F()}1r(e){C.D("解析失败")}},2C:(1U,1n)=>{C.D(1U.4b+"网络错误，换个网络试试")},})}A 1o(){$("#21").P(l.12.4c);m=l.12.1p+"";3 a=\'\';3 b;3 c=\'\';1q{4(l.12.2V[0].1b>0){b=l.12.2V[0];4(b.B("1D")!=0){b="Y:"+b}22.23(b)}}1r(e){}1q{1i(3 i=0;i<l.1a.2W.1b;i++){z 1s=l.1a.2W[i];z 1E=1s.1c;z 1F=1s.1t;3 d=\'\';d=" <W 1j=\'12\' >\\n"+" <W 1j=\'21\' >"+1E+"</W>\\n"+" <O 1c=\'O\' 1j=\'2X\' 2Y=2Z("+1F+",24.30[24.30.4d].1k)>\\n";1i(3 j=0;j<1s.31.1b;j++){z 13=1s.31[j];z 1u=13.1v;3 f="X";4(13.32){f="Y:"+13.32}z 25=K;4(n==0&&j==0){4(i==0&&f!=\'X\'){b=f}c=c+1E+":"+13.1c;z 33={1t:1F,1v:1u};o.4e(33)}4(n!=0){1i(3 k=0;k<o.1b;k++){4(o[k].1t==1F&&o[k].1v==1u){c=c+1E+":"+13.1c;25=E;4(i==0&&f!=\'X\'){b=f}}}}4(25){d=d+" <1G 1k="+1u+" 34 = \'34\'>"+13.1c+"</1G>"}H{d=d+" <1G 1k="+1u+">"+13.1c+"</1G>"}}a=a+d+"</O></W>"}}1r(e){c=\'默认\'}a=a+" <W 1j=\'12\' >\\n"+"<W 1j=\'21\' >购买数量(谨慎输入)</W>\\n"+"<35 1c=\'O\' 1j=\'2X\' 2Y=36(24.1k) 1k=\'"+p+"\'>";a=a+"</W>";$("#4f").P(a);c="[下单确认]"+c+\' 购买数量:\'+p;$("#37").P(c);$("#4g").4h("4i",b);38();$("#39-3a").F()}A 38(){n=0;1q{1i(3 i=0;i<l.1a.26.1b;i++){z 27=l.1a.26[i].4j+\';\';3 a=E;1i(3 j=0;j<o.1b;j++){4(27.B(o[j].1t+\':\')==-1||27.B(o[j].1v+\';\')==-1){a=K}}4(a){n=l.1a.26[i].1w}}4(n==0){C.D("获取4k出错");$("#37").P("获取数据错误")}}1r(e){22.23("1w"+"---"+n)}};2Z=A(a,b){1i(3 i=0;i<o.1b;i++){4(o[i].1t==a){o[i].1v=b}}1o()};36=A(a){z 1H=3b(a);4(1H>0&&1H<3c){p=1H;22.23(p);1o()}};$("#4l-G").16(A(){z 1x=$("#4m").1e();4(1x.B(\'.1V.1A\')>-1){3 a=1x.R("1D")[1];a=a.R("?")[0];a=\'1D\'+a;1P(a)}H 4(1x.B(\'Q=\')>-1){3 a=1x.R("Q=")[1];a=\'Q=\'+a;1P(a)}H{C.D(\'确保口令内含有Y://m.1V.1A\')}});$("#I-J-G").16(A(){2E.2F("2G",{1B:"1D://20.m.M.V/4n/4o.4p?20=1Z.4q.4r"},A(a){1q{z 11=1f 1g();z 19=1Y.4s(a);z 3d=19.19.t;3 b=3d-11;3 c=28-b;4(b>0){C.D(\'淘宝时间比本地晚了【\'+b+\'1z】 , 时间偏移建议提前【\'+c+\'】（正负值已为您算好，数值仅供参考！实际视设备跳转速度自行调整！）\')}H{C.D(\'淘宝时间比本地早了【\'+(-b)+\'1z】 , 时间偏移建议设置【\'+c+\'】（正负值已为您算好，数值仅供参考！实际视设备跳转速度自行调整！）\')}}1r(e){}})});$("#4t-G").16(A(){t=K;$("#Z-10-1").L();$("#Z-10-2").F();$("#39-3a").L()});$("#4u-G").16(A(){z 3e=$("#2k").1e();r=1f 1g(3e);r.4v(0);4(g){r.4w(r.1h()-(3c*28*28*8))}q="M://1C.m.M.V/29/2a.P?1p="+m+"&3f=3g-8&2b=E&v=0&1w="+n+"&2c="+p;4(u){z 3h=3b($("#J-15-35").1e());s=3h;z 3i=$("#1y-O").1e();4(3i==\'2d\'){3 a={"Q":m,"4x":"2d","4y":"2d"};3 b=1Y.2M(a);b=2N(b);q=\'M://1C.m.M.V/29/2a.P?1w=\'+n+\'&2c=\'+p+\'&1p=\'+m+\'&2b=E&2L=\'+b}}H{s=$("#J-15-O").1e()}z 11=1f 1g();z 1m=r.1h()-11.1h();4(1m<=s){C.D("哎呀，开始时间不能比现在早");17}$("#1R").F();$("#1S").L();$("#J-4z").P("["+r.4A()+"(-"+s+"1z)] 自动下单");t=E});$("#4B-G").16(A(){1O()});$("#I-1d-G").16(A(){q="M://1C.m.M.V/29/2a.P?1p="+m+"&3f=3g-8&2b=E&v=0&1w="+n+"&2c="+p;3j(q.4C("M:","Y:"))});A 1O(){1L.2i.4D=q}A 3j(a){4(3k N.2e!=="A"){C.D(a);17}3 b=N.3l("4E");b.1k=a;b.3m(\'3n\',\'4F: 4G;4H: 1I;3o: 1I;\');N.S.3p(b);b.O();3 c=N.2e(\'1d\');N.S.4I(b);4(c){C.D(\'3q链接已经复制到剪切板中，请保存好使用【已有3q链接跳转 】\');17}4(3k N.3r!=="A"){C.D(a);17}3 d=N.3r();3 e=N.3l(\'W\');e.4J=a;e.3m(\'3n\',\'3o: 1I;4K: 1I;4L: 4M;\');N.S.3p(e);d.4N(e);4O 1J=1L.4P();4(1J.4Q>0){1J.4R()}1J.4S(d);N.2e(\'1d\');C.D(a)}A 2l(){z 14=1f 1g();z 2f="-";3 a=14.4T();3 b=14.4U()+1;3 c=14.4V();14.4W(14.3s()+1);z 3t=14.4X();z 1l=14.3s();4(b>=1&&b<=9){b="0"+b}4(c>=0&&c<=9){c="0"+c}4(1l>=0&&1l<=9){1l="0"+1l}3 d=a+2f+b+2f+c+\'T\'+3t+\':\'+1l;17 d}})',62,308,'|||var|if|||||||||||||||||||||||||||||||let|function|indexOf|weui|alert|true|hide|button|else|promode|time|false|show|taobao|document|select|html|id|split|body||userAgent|com|div|null|https|card|step|now|item|current_props_value|date|offset|click|return|jsonp|data|skuBase|length|name|copy|val|new|Date|getTime|for|class|value|strMinutes|timeDiff|type|reflashControlPad|itemId|try|catch|current_props|pid|current_props_vid|vid|skuId|_link|channel|ms|cn|url|h5|http|current_props_name|current_props_pid|option|_count|1px|selection|auth|window|iPhone|professional|startJump|queryItem|dataType|configPad|readyPad|queryItem2|err|tb|getTmallItemStyle|timeStramp|JSON|mtop|api|itemTitle|console|log|this|isSelect|skus|_propPath|60|cart|order|buyNow|quantity|bybtqdyh|execCommand|seperator1|SKRMAN|APP|location|OS|timeInput|getNowFormatDateTime|timeTask|css|color|basemode|count|aed0843961fb06dc|tmallBP|mlink|ajax|GET|timeout|5000|callback|jsonpCallback|success|errmsg|error|geiItemId|dsBridge|call|networkGet|htm|tmall|current_token|callbackString|exParams|stringify|encodeURIComponent|preSignStr|12574478|signStr|linkString|detail|getdetail|_result|images|props|itemSelect|onchange|onChange_Row|options|values|image|_mprops|selected|input|onChange_Count|itemStyle|findSkuId|tips|content|parseInt|1000|timestamp_tb|ready_time_str|_input_charset|utf|_ready_time_offset|buy_channel|copyTxt|typeof|createElement|setAttribute|style|height|appendChild|BP|createRange|getMinutes|hour|jQuery|ready|UrlParm|parm|host|skrman|app|navigator|AppleWebKit|iPad|4_3_3|SKRAND|7_0_1|IOS14|setInterval|50|red|black|bmobapi|hb174|top|cloud|bmob|errcode|errorjhandler|654a3a20023319a6dc4c755b151f082b|mtopjsonp|itemNumId|detail_v|utdid|hex_md5|h5api|jsv|appKey|sign|isSec|ecode|AntiFlood|AntiCreep|H5Request|ttid|2018|taobao_h5_9|statusText|title|selectedIndex|push|itemStylePad|itemPic|attr|src|propPath|skuid|query|link|rest|api3|do|common|getTimestamp|parse|reset|config|setSeconds|setTime|umpChannel|u_channel|confirm|toLocaleString|buy|replace|href|textarea|display|block|width|removeChild|innerHTML|fontSize|overflow|hidden|selectNode|const|getSelection|rangeCount|removeAllRanges|addRange|getFullYear|getMonth|getDate|setMinutes|getHours'.split('|'),0,{})); </script>0x02 抓包
0x03 讨论
0x04 声明
看雪ID：wx_A.R
https://bbs.pediy.com/user-887043.htm
*本文由看雪论坛 wx_A.R 原创，转载请注明来自看雪社区。
推荐文章++++
* 将FART和Youpk结合来做一次针对函数抽取壳的全面提升
好书推荐