JavaScript加密破解

        var a = prompt("尝试输入测试密码","");
        var b = "56ab34c15b73a457069c58a43fcfc640";
        var c = /.+_.+_.+/gi;
        var d = 0x0;

        // e字符串为a的第九位到第十三位
        var e = a.substr(0x8, 0x5);

        // var b = b.replace(/3/ig, ++d+1).replace(/8/ig, 'e')
        // console.log(b,'利用正则取正确e值') 
        // F12控制台调试上面两条,输出得e的md5为56ab24c15b72a457069c5ea42fcfc640,然后解开得e=happy
        if ($.md5(e) == b.replace(/3/ig, ++d+1).replace(/8/ig, 'e')) {

                // f字符串为a的第一位到第七位
                var f = a.substr(0x0 / d, 0x7);

                // 第一个判断:f字符串第六七位为lb
                // 第二个判断:解开下面md5得crcr,为f字符串的第一到第四位
                // 结果f=crcr lb,第五位未知
                if (f.substr(0x5, 0x2) == "lb" && $.md5(f.substr(0x0 / d, d + 0x3)) == "2481efd7de867935fe8fb3fde500c4a2") {

                        // r字符串为a的第十四位到结束,a总个数未知,此处d十六进制转十等于13,因为从0开始,所以+1为十四
                        r = a.substr(0xd);

                        // 第一个判断:r字符串的第二位跟第三位,两个值相同
                        // 第二个判断:r字符串的第一位unicode码加0x19的十进制,也就是加25,等于第二位的unicode码
                        // 重点:下面的if出现四个d,第一个为1,第二个++d为2,第三个--d为1,第四个--d为0,d是d每访问一次就+1或者-1
                        if (r.charCodeAt(d) - 0x19 == r.charCodeAt(++d) - 0x19 && r.charCodeAt(--d) - 0x19 == r.charCodeAt(--d)) {

                                // console.log(g,'直接输出查看g值')
                                // g = oo
                                var g = String.fromCharCode(0x4f);
                                g = g.toLowerCase() + g.toLowerCase();

                                // 第一个判断:r字符串第七位到十二位为oosoft,concat函数将g值oo与soft拼接起来
                                // 第二个判断:正则匹配a,猜测a的格式为xxxxxxx_xxxxx_xxxxx,a里面存在两个下划线
                                if (r.substr((++d) * 0x3, 0x6) == g.concat("soft") && c.test(a)) {

                                        // 通过下面的a.substr(0x16, 0x1)猜测a长度可能为23,0x16的10进制为22,从0算起22是第23位,然后d值拼接0x01等于123
                                        d = String(0x1) + String(a.length)
                                }
                        }
                }
        };

        /**
         * 到此,我们先将上面的信息集合起来。
         * f = crcr lb 第1-7位
         * e = happy 第9-13位
         * r =  00oosoft 第14位到结束
         * 组合得
         * a = crcr lb happy 00oosoft
         * 空格代表未知字符,其中里面两个00代表此处两个字符是相同的
         */
        
        // 第一个判断:将上面的d=123代入得a的第五位是{符号
        // 第二个判断:a第23个字符解得}符号
        if (a.substr(0x4, 0x1) == String.fromCharCode(d) && a.substr(0x16, 0x1) == String.fromCharCode(0x7D)) {
                alert("恭喜,输入过关key: "+a);
        }
        else{
                alert('再想想~');
        }

        /**
         * 到这里,看似结束,其实还有几个字符没解开
         * a = crcr{lb happy 00oosoft}
         * 中间两个空格,回想刚刚的正则匹配,可猜得对应的两个_下划线
         * a = crcr{lb_happy_00oosoft}
         * 倒回去看第230行备注
         * 0的值为_下划线unicode码加25
         * var r = '_'
         * console.log(r.charCodeAt(0),'查询下划线unicode码')
         * console.log(String.fromCharCode(95+25),'取得00为字符串xx')
         * 最终获得a值,也就是我们的key:crcr{lb_happy_xxoosoft}
         */

1
2

下面是完整源码

<!doctype html>
<html lang="en">
<head>
	<meta charset="UTF-8" />
	<title>Js破解测试</title>
	<link rel="stylesheet" href="http://apps.bdimg.com/libs/bootstrap/3.3.4/css/bootstrap.css">
</head>
<body>
<div class="container">
		<h2>Js破解测试</h2>
		
	</div>
	<!-- jQuery文件。务必在bootstrap.min.js 之前引入-->
	<script src="http://apps.bdimg.com/libs/jquery/2.1.4/jquery.min.js"></script>
	<!-- 最新的 Bootstrap 核心 JavaScript 文件 -->
	<script src="http://apps.bdimg.com/libs/bootstrap/3.3.4/js/bootstrap.min.js"></script>
	
	<script>
	(function($){
		var rotateLeft = function(lValue, iShiftBits) {
			return (lValue << iShiftBits) | (lValue >>> (32 - iShiftBits));
		}
		var addUnsigned = function(lX, lY) {
			var lX4, lY4, lX8, lY8, lResult;
			lX8 = (lX & 0x80000000);
			lY8 = (lY & 0x80000000);
			lX4 = (lX & 0x40000000);
			lY4 = (lY & 0x40000000);
			lResult = (lX & 0x3FFFFFFF) + (lY & 0x3FFFFFFF);
			if (lX4 & lY4) return (lResult ^ 0x80000000 ^ lX8 ^ lY8);
			if (lX4 | lY4) {
				if (lResult & 0x40000000) return (lResult ^ 0xC0000000 ^ lX8 ^ lY8);
				else return (lResult ^ 0x40000000 ^ lX8 ^ lY8);
			} else {
				return (lResult ^ lX8 ^ lY8);
			}
		}
		var F = function(x, y, z) {
			return (x & y) | ((~ x) & z);
		}
		var G = function(x, y, z) {
			return (x & z) | (y & (~ z));
		}
		var H = function(x, y, z) {
			return (x ^ y ^ z);
		}
		var I = function(x, y, z) {
			return (y ^ (x | (~ z)));
		}
		var FF = function(a, b, c, d, x, s, ac) {
			a = addUnsigned(a, addUnsigned(addUnsigned(F(b, c, d), x), ac));
			return addUnsigned(rotateLeft(a, s), b);
		};
		var GG = function(a, b, c, d, x, s, ac) {
			a = addUnsigned(a, addUnsigned(addUnsigned(G(b, c, d), x), ac));
			return addUnsigned(rotateLeft(a, s), b);
		};
		var HH = function(a, b, c, d, x, s, ac) {
			a = addUnsigned(a, addUnsigned(addUnsigned(H(b, c, d), x), ac));
			return addUnsigned(rotateLeft(a, s), b);
		};
		var II = function(a, b, c, d, x, s, ac) {
			a = addUnsigned(a, addUnsigned(addUnsigned(I(b, c, d), x), ac));
			return addUnsigned(rotateLeft(a, s), b);
		};
		var convertToWordArray = function(string) {
			var lWordCount;
			var lMessageLength = string.length;
			var lNumberOfWordsTempOne = lMessageLength + 8;
			var lNumberOfWordsTempTwo = (lNumberOfWordsTempOne - (lNumberOfWordsTempOne % 64)) / 64;
			var lNumberOfWords = (lNumberOfWordsTempTwo + 1) * 16;
			var lWordArray = Array(lNumberOfWords - 1);
			var lBytePosition = 0;
			var lByteCount = 0;
			while (lByteCount < lMessageLength) {
				lWordCount = (lByteCount - (lByteCount % 4)) / 4;
				lBytePosition = (lByteCount % 4) * 8;
				lWordArray[lWordCount] = (lWordArray[lWordCount] | (string.charCodeAt(lByteCount) << lBytePosition));
				lByteCount++;
			}
			lWordCount = (lByteCount - (lByteCount % 4)) / 4;
			lBytePosition = (lByteCount % 4) * 8;
			lWordArray[lWordCount] = lWordArray[lWordCount] | (0x80 << lBytePosition);
			lWordArray[lNumberOfWords - 2] = lMessageLength << 3;
			lWordArray[lNumberOfWords - 1] = lMessageLength >>> 29;
			return lWordArray;
		};
		var wordToHex = function(lValue) {
			var WordToHexValue = "", WordToHexValueTemp = "", lByte, lCount;
			for (lCount = 0; lCount <= 3; lCount++) {
				lByte = (lValue >>> (lCount * 8)) & 255;
				WordToHexValueTemp = "0" + lByte.toString(16);
				WordToHexValue = WordToHexValue + WordToHexValueTemp.substr(WordToHexValueTemp.length - 2, 2);
			}
			return WordToHexValue;
		};
		var uTF8Encode = function(string) {
			string = string.replace(/\x0d\x0a/g, "\x0a");
			var output = "";
			for (var n = 0; n < string.length; n++) {
				var c = string.charCodeAt(n);
				if (c < 128) {
					output += String.fromCharCode(c);
				} else if ((c > 127) && (c < 2048)) {
					output += String.fromCharCode((c >> 6) | 192);
					output += String.fromCharCode((c & 63) | 128);
				} else {
					output += String.fromCharCode((c >> 12) | 224);
					output += String.fromCharCode(((c >> 6) & 63) | 128);
					output += String.fromCharCode((c & 63) | 128);
				}
			}
			return output;
		};
		$.extend({
			md5: function(string) {
				var x = Array();
				var k, AA, BB, CC, DD, a, b, c, d;
				var S11=7, S12=12, S13=17, S14=22;
				var S21=5, S22=9 , S23=14, S24=20;
				var S31=4, S32=11, S33=16, S34=23;
				var S41=6, S42=10, S43=15, S44=21;
				string = uTF8Encode(string);
				x = convertToWordArray(string);
				a = 0x67452301; b = 0xEFCDAB89; c = 0x98BADCFE; d = 0x10325476;
				for (k = 0; k < x.length; k += 16) {
					AA = a; BB = b; CC = c; DD = d;
					a = FF(a, b, c, d, x[k+0],  S11, 0xD76AA478);
					d = FF(d, a, b, c, x[k+1],  S12, 0xE8C7B756);
					c = FF(c, d, a, b, x[k+2],  S13, 0x242070DB);
					b = FF(b, c, d, a, x[k+3],  S14, 0xC1BDCEEE);
					a = FF(a, b, c, d, x[k+4],  S11, 0xF57C0FAF);
					d = FF(d, a, b, c, x[k+5],  S12, 0x4787C62A);
					c = FF(c, d, a, b, x[k+6],  S13, 0xA8304613);
					b = FF(b, c, d, a, x[k+7],  S14, 0xFD469501);
					a = FF(a, b, c, d, x[k+8],  S11, 0x698098D8);
					d = FF(d, a, b, c, x[k+9],  S12, 0x8B44F7AF);
					c = FF(c, d, a, b, x[k+10], S13, 0xFFFF5BB1);
					b = FF(b, c, d, a, x[k+11], S14, 0x895CD7BE);
					a = FF(a, b, c, d, x[k+12], S11, 0x6B901122);
					d = FF(d, a, b, c, x[k+13], S12, 0xFD987193);
					c = FF(c, d, a, b, x[k+14], S13, 0xA679438E);
					b = FF(b, c, d, a, x[k+15], S14, 0x49B40821);
					a = GG(a, b, c, d, x[k+1],  S21, 0xF61E2562);
					d = GG(d, a, b, c, x[k+6],  S22, 0xC040B340);
					c = GG(c, d, a, b, x[k+11], S23, 0x265E5A51);
					b = GG(b, c, d, a, x[k+0],  S24, 0xE9B6C7AA);
					a = GG(a, b, c, d, x[k+5],  S21, 0xD62F105D);
					d = GG(d, a, b, c, x[k+10], S22, 0x2441453);
					c = GG(c, d, a, b, x[k+15], S23, 0xD8A1E681);
					b = GG(b, c, d, a, x[k+4],  S24, 0xE7D3FBC8);
					a = GG(a, b, c, d, x[k+9],  S21, 0x21E1CDE6);
					d = GG(d, a, b, c, x[k+14], S22, 0xC33707D6);
					c = GG(c, d, a, b, x[k+3],  S23, 0xF4D50D87);
					b = GG(b, c, d, a, x[k+8],  S24, 0x455A14ED);
					a = GG(a, b, c, d, x[k+13], S21, 0xA9E3E905);
					d = GG(d, a, b, c, x[k+2],  S22, 0xFCEFA3F8);
					c = GG(c, d, a, b, x[k+7],  S23, 0x676F02D9);
					b = GG(b, c, d, a, x[k+12], S24, 0x8D2A4C8A);
					a = HH(a, b, c, d, x[k+5],  S31, 0xFFFA3942);
					d = HH(d, a, b, c, x[k+8],  S32, 0x8771F681);
					c = HH(c, d, a, b, x[k+11], S33, 0x6D9D6122);
					b = HH(b, c, d, a, x[k+14], S34, 0xFDE5380C);
					a = HH(a, b, c, d, x[k+1],  S31, 0xA4BEEA44);
					d = HH(d, a, b, c, x[k+4],  S32, 0x4BDECFA9);
					c = HH(c, d, a, b, x[k+7],  S33, 0xF6BB4B60);
					b = HH(b, c, d, a, x[k+10], S34, 0xBEBFBC70);
					a = HH(a, b, c, d, x[k+13], S31, 0x289B7EC6);
					d = HH(d, a, b, c, x[k+0],  S32, 0xEAA127FA);
					c = HH(c, d, a, b, x[k+3],  S33, 0xD4EF3085);
					b = HH(b, c, d, a, x[k+6],  S34, 0x4881D05);
					a = HH(a, b, c, d, x[k+9],  S31, 0xD9D4D039);
					d = HH(d, a, b, c, x[k+12], S32, 0xE6DB99E5);
					c = HH(c, d, a, b, x[k+15], S33, 0x1FA27CF8);
					b = HH(b, c, d, a, x[k+2],  S34, 0xC4AC5665);
					a = II(a, b, c, d, x[k+0],  S41, 0xF4292244);
					d = II(d, a, b, c, x[k+7],  S42, 0x432AFF97);
					c = II(c, d, a, b, x[k+14], S43, 0xAB9423A7);
					b = II(b, c, d, a, x[k+5],  S44, 0xFC93A039);
					a = II(a, b, c, d, x[k+12], S41, 0x655B59C3);
					d = II(d, a, b, c, x[k+3],  S42, 0x8F0CCC92);
					c = II(c, d, a, b, x[k+10], S43, 0xFFEFF47D);
					b = II(b, c, d, a, x[k+1],  S44, 0x85845DD1);
					a = II(a, b, c, d, x[k+8],  S41, 0x6FA87E4F);
					d = II(d, a, b, c, x[k+15], S42, 0xFE2CE6E0);
					c = II(c, d, a, b, x[k+6],  S43, 0xA3014314);
					b = II(b, c, d, a, x[k+13], S44, 0x4E0811A1);
					a = II(a, b, c, d, x[k+4],  S41, 0xF7537E82);
					d = II(d, a, b, c, x[k+11], S42, 0xBD3AF235);
					c = II(c, d, a, b, x[k+2],  S43, 0x2AD7D2BB);
					b = II(b, c, d, a, x[k+9],  S44, 0xEB86D391);
					a = addUnsigned(a, AA);
					b = addUnsigned(b, BB);
					c = addUnsigned(c, CC);
					d = addUnsigned(d, DD);
				}
				var tempValue = wordToHex(a) + wordToHex(b) + wordToHex(c) + wordToHex(d);
				return tempValue.toLowerCase();
			}
		});
	})(jQuery);
	</script>
	
	<script>
	var a = prompt("尝试输入测试密码","");
	var b = "56ab34c15b73a457069c58a43fcfc640";
	var c = /.+_.+_.+/gi;
	var d = 0x0;

	// e字符串为a的第九位到第十三位
	var e = a.substr(0x8, 0x5);

	// var b = b.replace(/3/ig, ++d+1).replace(/8/ig, 'e')
	// console.log(b) 
	// F12控制台调试上面两条,输出得e的md5为56ab24c15b72a457069c5ea42fcfc640,然后解开得e=happy
	if ($.md5(e) == b.replace(/3/ig, ++d+1).replace(/8/ig, 'e')) {

		// f字符串为a的第一位到第七位
		var f = a.substr(0x0 / d, 0x7);

		// 第一个判断:f字符串第六七位为lb
		// 第二个判断:解开下面md5得crcr,为f字符串的第一到第四位
		// 结果f=crcr lb,第五位未知
		if (f.substr(0x5, 0x2) == "lb" && $.md5(f.substr(0x0 / d, d + 0x3)) == "2481efd7de867935fe8fb3fde500c4a2") {

			// r字符串为a的第十四位到结束,a总个数未知,此处d十六进制转十等于13,因为从0开始,所以+1为十四
			r = a.substr(0xd);

			// 第一个判断:r字符串的第二位跟第三位,两个值相同
			// 第二个判断:r字符串的第一位unicode码加0x19的十进制,也就是加25,等于第二位的unicode码
			// 重点:下面的if出现四个d,第一个为1,第二个++d为2,第三个--d为1,第四个--d为0,d是d每访问一次就+1或者-1
			if (r.charCodeAt(d) - 0x19 == r.charCodeAt(++d) - 0x19 && r.charCodeAt(--d) - 0x19 == r.charCodeAt(--d)) {

				var g = String.fromCharCode(0x4f);
				g = g.toLowerCase() + g.toLowerCase();
				// console.log(g)
				// g = oo

				// 第一个判断:r字符串第七位到十二位为oosoft,concat函数将g值oo与soft拼接起来
				// 第二个判断:正则匹配a,猜测a的格式为xxxxxxx_xxxxx_xxxxx,a里面存在两个下划线
				if (r.substr((++d) * 0x3, 0x6) == g.concat("soft") && c.test(a)) {

					// 通过下面的a.substr(0x16, 0x1)猜测a长度可能为23,0x16的10进制为22,从0算起22是第23位,然后d值拼接0x01等于123
					d = String(0x1) + String(a.length)
				}
			}
		}
	};

	/**
	 * 到此,我们先将上面的信息集合起来。
	 * f = crcr lb 第1-7位
	 * e = happy 第9-13位
	 * r =  00oosoft 第14位到结束
	 * 组合得
	 * a = crcr lb happy 00oosoft
	 * 空格代表未知字符,其中里面两个00代表此处两个字符是相同的
	 */
	
	// 第一个判断:将上面的d=123代入得a的第五位是{符号
	// 第二个判断:a第23个字符解得}符号
	if (a.substr(0x4, 0x1) == String.fromCharCode(d) && a.substr(0x16, 0x1) == String.fromCharCode(0x7D)) {
		alert("恭喜,输入过关key: "+a);
	}
	else{
		alert('再想想~');
	}

	/**
	 * 到这里,看似结束,其实还有几个字符没解开
	 * a = crcr{lb happy 00oosoft}
	 * 中间两个空格,回想刚刚的正则匹配,可猜得对应的两个_下划线
	 * a = crcr{lb_happy_00oosoft}
	 * 倒回去看第230行备注
	 * 0的值为_下划线unicode码加25
	 * var r = '_'
	 * console.log(r.charCodeAt(0))
	 * 查询得_下划线unicode值95
	 * 95+25=120
	 * console.log(String.fromCharCode(120))
	 * 查询得00为字符串xx
	 * 最终获得a值,也就是我们的key:crcr{lb_happy_xxoosoft}
	 */
	</script>
</body>
</html>
1 个赞