var a = prompt("尝试输入测试密码","");
var b = "56ab34c15b73a457069c58a43fcfc640";
var c = /.+_.+_.+/gi;
var d = 0x0;
// e字符串为a的第九位到第十三位
var e = a.substr(0x8, 0x5);
// var b = b.replace(/3/ig, ++d+1).replace(/8/ig, 'e')
// console.log(b,'利用正则取正确e值')
// F12控制台调试上面两条,输出得e的md5为56ab24c15b72a457069c5ea42fcfc640,然后解开得e=happy
if ($.md5(e) == b.replace(/3/ig, ++d+1).replace(/8/ig, 'e')) {
// f字符串为a的第一位到第七位
var f = a.substr(0x0 / d, 0x7);
// 第一个判断:f字符串第六七位为lb
// 第二个判断:解开下面md5得crcr,为f字符串的第一到第四位
// 结果f=crcr lb,第五位未知
if (f.substr(0x5, 0x2) == "lb" && $.md5(f.substr(0x0 / d, d + 0x3)) == "2481efd7de867935fe8fb3fde500c4a2") {
// r字符串为a的第十四位到结束,a总个数未知,此处d十六进制转十等于13,因为从0开始,所以+1为十四
r = a.substr(0xd);
// 第一个判断:r字符串的第二位跟第三位,两个值相同
// 第二个判断:r字符串的第一位unicode码加0x19的十进制,也就是加25,等于第二位的unicode码
// 重点:下面的if出现四个d,第一个为1,第二个++d为2,第三个--d为1,第四个--d为0,d是d每访问一次就+1或者-1
if (r.charCodeAt(d) - 0x19 == r.charCodeAt(++d) - 0x19 && r.charCodeAt(--d) - 0x19 == r.charCodeAt(--d)) {
// console.log(g,'直接输出查看g值')
// g = oo
var g = String.fromCharCode(0x4f);
g = g.toLowerCase() + g.toLowerCase();
// 第一个判断:r字符串第七位到十二位为oosoft,concat函数将g值oo与soft拼接起来
// 第二个判断:正则匹配a,猜测a的格式为xxxxxxx_xxxxx_xxxxx,a里面存在两个下划线
if (r.substr((++d) * 0x3, 0x6) == g.concat("soft") && c.test(a)) {
// 通过下面的a.substr(0x16, 0x1)猜测a长度可能为23,0x16的10进制为22,从0算起22是第23位,然后d值拼接0x01等于123
d = String(0x1) + String(a.length)
}
}
}
};
/**
* 到此,我们先将上面的信息集合起来。
* f = crcr lb 第1-7位
* e = happy 第9-13位
* r = 00oosoft 第14位到结束
* 组合得
* a = crcr lb happy 00oosoft
* 空格代表未知字符,其中里面两个00代表此处两个字符是相同的
*/
// 第一个判断:将上面的d=123代入得a的第五位是{符号
// 第二个判断:a第23个字符解得}符号
if (a.substr(0x4, 0x1) == String.fromCharCode(d) && a.substr(0x16, 0x1) == String.fromCharCode(0x7D)) {
alert("恭喜,输入过关key: "+a);
}
else{
alert('再想想~');
}
/**
* 到这里,看似结束,其实还有几个字符没解开
* a = crcr{lb happy 00oosoft}
* 中间两个空格,回想刚刚的正则匹配,可猜得对应的两个_下划线
* a = crcr{lb_happy_00oosoft}
* 倒回去看第230行备注
* 0的值为_下划线unicode码加25
* var r = '_'
* console.log(r.charCodeAt(0),'查询下划线unicode码')
* console.log(String.fromCharCode(95+25),'取得00为字符串xx')
* 最终获得a值,也就是我们的key:crcr{lb_happy_xxoosoft}
*/
下面是完整源码
<!doctype html>
<html lang="en">
<head>
<meta charset="UTF-8" />
<title>Js破解测试</title>
<link rel="stylesheet" href="http://apps.bdimg.com/libs/bootstrap/3.3.4/css/bootstrap.css">
</head>
<body>
<div class="container">
<h2>Js破解测试</h2>
</div>
<!-- jQuery文件。务必在bootstrap.min.js 之前引入-->
<script src="http://apps.bdimg.com/libs/jquery/2.1.4/jquery.min.js"></script>
<!-- 最新的 Bootstrap 核心 JavaScript 文件 -->
<script src="http://apps.bdimg.com/libs/bootstrap/3.3.4/js/bootstrap.min.js"></script>
<script>
(function($){
var rotateLeft = function(lValue, iShiftBits) {
return (lValue << iShiftBits) | (lValue >>> (32 - iShiftBits));
}
var addUnsigned = function(lX, lY) {
var lX4, lY4, lX8, lY8, lResult;
lX8 = (lX & 0x80000000);
lY8 = (lY & 0x80000000);
lX4 = (lX & 0x40000000);
lY4 = (lY & 0x40000000);
lResult = (lX & 0x3FFFFFFF) + (lY & 0x3FFFFFFF);
if (lX4 & lY4) return (lResult ^ 0x80000000 ^ lX8 ^ lY8);
if (lX4 | lY4) {
if (lResult & 0x40000000) return (lResult ^ 0xC0000000 ^ lX8 ^ lY8);
else return (lResult ^ 0x40000000 ^ lX8 ^ lY8);
} else {
return (lResult ^ lX8 ^ lY8);
}
}
var F = function(x, y, z) {
return (x & y) | ((~ x) & z);
}
var G = function(x, y, z) {
return (x & z) | (y & (~ z));
}
var H = function(x, y, z) {
return (x ^ y ^ z);
}
var I = function(x, y, z) {
return (y ^ (x | (~ z)));
}
var FF = function(a, b, c, d, x, s, ac) {
a = addUnsigned(a, addUnsigned(addUnsigned(F(b, c, d), x), ac));
return addUnsigned(rotateLeft(a, s), b);
};
var GG = function(a, b, c, d, x, s, ac) {
a = addUnsigned(a, addUnsigned(addUnsigned(G(b, c, d), x), ac));
return addUnsigned(rotateLeft(a, s), b);
};
var HH = function(a, b, c, d, x, s, ac) {
a = addUnsigned(a, addUnsigned(addUnsigned(H(b, c, d), x), ac));
return addUnsigned(rotateLeft(a, s), b);
};
var II = function(a, b, c, d, x, s, ac) {
a = addUnsigned(a, addUnsigned(addUnsigned(I(b, c, d), x), ac));
return addUnsigned(rotateLeft(a, s), b);
};
var convertToWordArray = function(string) {
var lWordCount;
var lMessageLength = string.length;
var lNumberOfWordsTempOne = lMessageLength + 8;
var lNumberOfWordsTempTwo = (lNumberOfWordsTempOne - (lNumberOfWordsTempOne % 64)) / 64;
var lNumberOfWords = (lNumberOfWordsTempTwo + 1) * 16;
var lWordArray = Array(lNumberOfWords - 1);
var lBytePosition = 0;
var lByteCount = 0;
while (lByteCount < lMessageLength) {
lWordCount = (lByteCount - (lByteCount % 4)) / 4;
lBytePosition = (lByteCount % 4) * 8;
lWordArray[lWordCount] = (lWordArray[lWordCount] | (string.charCodeAt(lByteCount) << lBytePosition));
lByteCount++;
}
lWordCount = (lByteCount - (lByteCount % 4)) / 4;
lBytePosition = (lByteCount % 4) * 8;
lWordArray[lWordCount] = lWordArray[lWordCount] | (0x80 << lBytePosition);
lWordArray[lNumberOfWords - 2] = lMessageLength << 3;
lWordArray[lNumberOfWords - 1] = lMessageLength >>> 29;
return lWordArray;
};
var wordToHex = function(lValue) {
var WordToHexValue = "", WordToHexValueTemp = "", lByte, lCount;
for (lCount = 0; lCount <= 3; lCount++) {
lByte = (lValue >>> (lCount * 8)) & 255;
WordToHexValueTemp = "0" + lByte.toString(16);
WordToHexValue = WordToHexValue + WordToHexValueTemp.substr(WordToHexValueTemp.length - 2, 2);
}
return WordToHexValue;
};
var uTF8Encode = function(string) {
string = string.replace(/\x0d\x0a/g, "\x0a");
var output = "";
for (var n = 0; n < string.length; n++) {
var c = string.charCodeAt(n);
if (c < 128) {
output += String.fromCharCode(c);
} else if ((c > 127) && (c < 2048)) {
output += String.fromCharCode((c >> 6) | 192);
output += String.fromCharCode((c & 63) | 128);
} else {
output += String.fromCharCode((c >> 12) | 224);
output += String.fromCharCode(((c >> 6) & 63) | 128);
output += String.fromCharCode((c & 63) | 128);
}
}
return output;
};
$.extend({
md5: function(string) {
var x = Array();
var k, AA, BB, CC, DD, a, b, c, d;
var S11=7, S12=12, S13=17, S14=22;
var S21=5, S22=9 , S23=14, S24=20;
var S31=4, S32=11, S33=16, S34=23;
var S41=6, S42=10, S43=15, S44=21;
string = uTF8Encode(string);
x = convertToWordArray(string);
a = 0x67452301; b = 0xEFCDAB89; c = 0x98BADCFE; d = 0x10325476;
for (k = 0; k < x.length; k += 16) {
AA = a; BB = b; CC = c; DD = d;
a = FF(a, b, c, d, x[k+0], S11, 0xD76AA478);
d = FF(d, a, b, c, x[k+1], S12, 0xE8C7B756);
c = FF(c, d, a, b, x[k+2], S13, 0x242070DB);
b = FF(b, c, d, a, x[k+3], S14, 0xC1BDCEEE);
a = FF(a, b, c, d, x[k+4], S11, 0xF57C0FAF);
d = FF(d, a, b, c, x[k+5], S12, 0x4787C62A);
c = FF(c, d, a, b, x[k+6], S13, 0xA8304613);
b = FF(b, c, d, a, x[k+7], S14, 0xFD469501);
a = FF(a, b, c, d, x[k+8], S11, 0x698098D8);
d = FF(d, a, b, c, x[k+9], S12, 0x8B44F7AF);
c = FF(c, d, a, b, x[k+10], S13, 0xFFFF5BB1);
b = FF(b, c, d, a, x[k+11], S14, 0x895CD7BE);
a = FF(a, b, c, d, x[k+12], S11, 0x6B901122);
d = FF(d, a, b, c, x[k+13], S12, 0xFD987193);
c = FF(c, d, a, b, x[k+14], S13, 0xA679438E);
b = FF(b, c, d, a, x[k+15], S14, 0x49B40821);
a = GG(a, b, c, d, x[k+1], S21, 0xF61E2562);
d = GG(d, a, b, c, x[k+6], S22, 0xC040B340);
c = GG(c, d, a, b, x[k+11], S23, 0x265E5A51);
b = GG(b, c, d, a, x[k+0], S24, 0xE9B6C7AA);
a = GG(a, b, c, d, x[k+5], S21, 0xD62F105D);
d = GG(d, a, b, c, x[k+10], S22, 0x2441453);
c = GG(c, d, a, b, x[k+15], S23, 0xD8A1E681);
b = GG(b, c, d, a, x[k+4], S24, 0xE7D3FBC8);
a = GG(a, b, c, d, x[k+9], S21, 0x21E1CDE6);
d = GG(d, a, b, c, x[k+14], S22, 0xC33707D6);
c = GG(c, d, a, b, x[k+3], S23, 0xF4D50D87);
b = GG(b, c, d, a, x[k+8], S24, 0x455A14ED);
a = GG(a, b, c, d, x[k+13], S21, 0xA9E3E905);
d = GG(d, a, b, c, x[k+2], S22, 0xFCEFA3F8);
c = GG(c, d, a, b, x[k+7], S23, 0x676F02D9);
b = GG(b, c, d, a, x[k+12], S24, 0x8D2A4C8A);
a = HH(a, b, c, d, x[k+5], S31, 0xFFFA3942);
d = HH(d, a, b, c, x[k+8], S32, 0x8771F681);
c = HH(c, d, a, b, x[k+11], S33, 0x6D9D6122);
b = HH(b, c, d, a, x[k+14], S34, 0xFDE5380C);
a = HH(a, b, c, d, x[k+1], S31, 0xA4BEEA44);
d = HH(d, a, b, c, x[k+4], S32, 0x4BDECFA9);
c = HH(c, d, a, b, x[k+7], S33, 0xF6BB4B60);
b = HH(b, c, d, a, x[k+10], S34, 0xBEBFBC70);
a = HH(a, b, c, d, x[k+13], S31, 0x289B7EC6);
d = HH(d, a, b, c, x[k+0], S32, 0xEAA127FA);
c = HH(c, d, a, b, x[k+3], S33, 0xD4EF3085);
b = HH(b, c, d, a, x[k+6], S34, 0x4881D05);
a = HH(a, b, c, d, x[k+9], S31, 0xD9D4D039);
d = HH(d, a, b, c, x[k+12], S32, 0xE6DB99E5);
c = HH(c, d, a, b, x[k+15], S33, 0x1FA27CF8);
b = HH(b, c, d, a, x[k+2], S34, 0xC4AC5665);
a = II(a, b, c, d, x[k+0], S41, 0xF4292244);
d = II(d, a, b, c, x[k+7], S42, 0x432AFF97);
c = II(c, d, a, b, x[k+14], S43, 0xAB9423A7);
b = II(b, c, d, a, x[k+5], S44, 0xFC93A039);
a = II(a, b, c, d, x[k+12], S41, 0x655B59C3);
d = II(d, a, b, c, x[k+3], S42, 0x8F0CCC92);
c = II(c, d, a, b, x[k+10], S43, 0xFFEFF47D);
b = II(b, c, d, a, x[k+1], S44, 0x85845DD1);
a = II(a, b, c, d, x[k+8], S41, 0x6FA87E4F);
d = II(d, a, b, c, x[k+15], S42, 0xFE2CE6E0);
c = II(c, d, a, b, x[k+6], S43, 0xA3014314);
b = II(b, c, d, a, x[k+13], S44, 0x4E0811A1);
a = II(a, b, c, d, x[k+4], S41, 0xF7537E82);
d = II(d, a, b, c, x[k+11], S42, 0xBD3AF235);
c = II(c, d, a, b, x[k+2], S43, 0x2AD7D2BB);
b = II(b, c, d, a, x[k+9], S44, 0xEB86D391);
a = addUnsigned(a, AA);
b = addUnsigned(b, BB);
c = addUnsigned(c, CC);
d = addUnsigned(d, DD);
}
var tempValue = wordToHex(a) + wordToHex(b) + wordToHex(c) + wordToHex(d);
return tempValue.toLowerCase();
}
});
})(jQuery);
</script>
<script>
var a = prompt("尝试输入测试密码","");
var b = "56ab34c15b73a457069c58a43fcfc640";
var c = /.+_.+_.+/gi;
var d = 0x0;
// e字符串为a的第九位到第十三位
var e = a.substr(0x8, 0x5);
// var b = b.replace(/3/ig, ++d+1).replace(/8/ig, 'e')
// console.log(b)
// F12控制台调试上面两条,输出得e的md5为56ab24c15b72a457069c5ea42fcfc640,然后解开得e=happy
if ($.md5(e) == b.replace(/3/ig, ++d+1).replace(/8/ig, 'e')) {
// f字符串为a的第一位到第七位
var f = a.substr(0x0 / d, 0x7);
// 第一个判断:f字符串第六七位为lb
// 第二个判断:解开下面md5得crcr,为f字符串的第一到第四位
// 结果f=crcr lb,第五位未知
if (f.substr(0x5, 0x2) == "lb" && $.md5(f.substr(0x0 / d, d + 0x3)) == "2481efd7de867935fe8fb3fde500c4a2") {
// r字符串为a的第十四位到结束,a总个数未知,此处d十六进制转十等于13,因为从0开始,所以+1为十四
r = a.substr(0xd);
// 第一个判断:r字符串的第二位跟第三位,两个值相同
// 第二个判断:r字符串的第一位unicode码加0x19的十进制,也就是加25,等于第二位的unicode码
// 重点:下面的if出现四个d,第一个为1,第二个++d为2,第三个--d为1,第四个--d为0,d是d每访问一次就+1或者-1
if (r.charCodeAt(d) - 0x19 == r.charCodeAt(++d) - 0x19 && r.charCodeAt(--d) - 0x19 == r.charCodeAt(--d)) {
var g = String.fromCharCode(0x4f);
g = g.toLowerCase() + g.toLowerCase();
// console.log(g)
// g = oo
// 第一个判断:r字符串第七位到十二位为oosoft,concat函数将g值oo与soft拼接起来
// 第二个判断:正则匹配a,猜测a的格式为xxxxxxx_xxxxx_xxxxx,a里面存在两个下划线
if (r.substr((++d) * 0x3, 0x6) == g.concat("soft") && c.test(a)) {
// 通过下面的a.substr(0x16, 0x1)猜测a长度可能为23,0x16的10进制为22,从0算起22是第23位,然后d值拼接0x01等于123
d = String(0x1) + String(a.length)
}
}
}
};
/**
* 到此,我们先将上面的信息集合起来。
* f = crcr lb 第1-7位
* e = happy 第9-13位
* r = 00oosoft 第14位到结束
* 组合得
* a = crcr lb happy 00oosoft
* 空格代表未知字符,其中里面两个00代表此处两个字符是相同的
*/
// 第一个判断:将上面的d=123代入得a的第五位是{符号
// 第二个判断:a第23个字符解得}符号
if (a.substr(0x4, 0x1) == String.fromCharCode(d) && a.substr(0x16, 0x1) == String.fromCharCode(0x7D)) {
alert("恭喜,输入过关key: "+a);
}
else{
alert('再想想~');
}
/**
* 到这里,看似结束,其实还有几个字符没解开
* a = crcr{lb happy 00oosoft}
* 中间两个空格,回想刚刚的正则匹配,可猜得对应的两个_下划线
* a = crcr{lb_happy_00oosoft}
* 倒回去看第230行备注
* 0的值为_下划线unicode码加25
* var r = '_'
* console.log(r.charCodeAt(0))
* 查询得_下划线unicode值95
* 95+25=120
* console.log(String.fromCharCode(120))
* 查询得00为字符串xx
* 最终获得a值,也就是我们的key:crcr{lb_happy_xxoosoft}
*/
</script>
</body>
</html>