实践一

BD影视中网页中加载了一个script

  1. <div id="fmtdiv">
  2.   <script src="https://s.7384tv.com/bdfilm_v3/js/cms-gg.js?v=20200420">
  3.   </script>
  4. </div>

打开该srcipt得到以下内容，这显然是一个eval加密，用在线工具解密即可
http://www.oicqzone.com/tool/eval/

  1. eval(function(p,a,c,k,e,r){e=function(c){return c.toString(a)};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('(7(){"0.9.6"!=2.3&&"0.4-1.8"!=2.3&&"0.4-1.5"!=2.3&&(a.b.c="d://0.4-1.5/")})();',14,14,'www|film|document|domain|bd|cc|co|function|com|bdys|window|location|href|https'.split('|'),0,{}));
  2. eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('3 M="2f.26-24.1Z",1c="y://t.1W.1R/X/1J"+1f.1u(1t*1f.1s())+"1r.1e",9=k.I("9")||(J v).1a()%2,5=k.I("5")||(J v).1a()%2,16=[{A:"1X",s:"y://p.1U.1S/X/1N"+(J v).1d()+"1E"},{A:"1D",R:"3 1v=1q;3 2b=7;3 1T=0;3 29=2;",s:"//2h.1y.1K/1L.1e"}],P=[{s:"y://s.1Y.20/X/23"+(J v).1d()+"27",17:!0}],N=[],W=!1,4=j.m.n.S?P:16,8=[],G=r(){14(3 a=["D","1V"],b=0;b<a.u;b++)q(18.19&&-1<18.19.28().w(a[b]))2a!0},T=r(a,b){"2e"==U b&&(b="2l:2m !1p;");3 c=6.B("z");a=a+"{"+b+"}";c.O="C/1w";"1x"==U c.13?c.13.1z=a:c.1A=a;6.1B("1C")[0].V(c)},15=r(a){W=!0;6.1F("1G",r(b){q(b.1H===6.1I){3 a=b.x.Q,e=b.x.1M,d=b.x.1O("z");-1==N.w(b.x)&&a&&(a==e||d&&0==d.w("1P: 1o;"))&&(N.1Q(b.x),N.u%P.u!=9&&T("[Q=\'"+a+"\'], [Q=\'"+a+"\'] *"))}},!1)},H=r(a,b,c,e,d,f,g,h){j.m.n.D||-1==Y.Z.w(M)||G()||(a&&T(a),c&&6.F("<o>"+c+"\\L/o>"),b&&6.F("<o O=\'C/10\' K=\'"+b+"\' 11>\\L/o>"),d&&j.m.n.21&&6.F("<o O=\'C/10\' K=\'"+d+"\' "+g+" 11>\\L/o>"),f&&j.m.n.22&&6.F("<o O=\'C/10\' K=\'"+f+"\' "+h+" 11>\\L/o>"))};9>=4.u-1?9=0:9++;k.12("9",9);14(3 i=0;i<4.u;i++)q(!W&&4[i].17&&15(),"25"==U 4[i].u){3 l="";8=4[i];i!=9&&(l=8[5].l);H(l,8[5].s,8[5].R,8[5].A,8[5].1g,8[5].1h,8[5].1i,8[5].1j)}1k{l="";q(i!=9&&(l=4[i].l,5>=8.u-1?5=0:5++,k.12("5",5),4[i].2c))2d;H(l,4[i].s,4[i].R,4[i].A,4[i].1g,4[i].1h,4[i].1i,4[i].1j)}3 1l=r(){q(!(j.m.n.S||j.m.n.D||-1==Y.Z.w(M)||G()))q(k.I("E")){3 a=k.I("E");2g<(v.1m()-a)/2i&&k.2j("E")}1k H(2k,1c),k.12("E",v.1m())};1l();3 1n=r(){q(!j.m.n.D&&-1!=Y.Z.w(M)&&!G()){3 a=6.1b("#2n");6.1b("#2o");3 b=6.B("a"),c=6.B("2p");6.B("2q");j.m.n.S||(b.2r="y://2s.2t/2u?2v=j&2w=2x&2y=2z&2A=2B",c.K="y://2C.2D.2E/2F/2G.2H",a&&(a.2I("2J","2K-2L 2M"),a.z.2N=0,b.2O="2P",b.2Q="2R",c.z.2S="2T%",b.V(c),a.V(b)))}};1n();',62,180,'|||var|loopArray|fmtSubCount|document||subArray|fmtCount||||||||||bdfilm|localStorage|stl|browser|useragent|script||if|function|||length|Date|indexOf|srcElement|https|style|csid|createElement|text|spider|poped_time|writeln|checkUA|createCPV|getItem|new|src|x3c|adhost|listenArray|type|mfmtArray|id|sctx|mobile|createStyleElement|typeof|appendChild|listenBegan|vtdd|location|host|javascript|sync|setItem|styleSheet|for|addDomListener|fmtArray|listen|navigator|userAgent|getSeconds|querySelector|popScriptUrl|getTime|js|Math|sa|si|saAttrTxt|siAttrTxt|else|popWindow|now|createTonglanGG|fixed|important|708982|hnkl|random|1E4|round|qj_uid|css|object|tianji520|cssText|innerHTML|getElementsByTagName|head|qjfmt|ztw|addEventListener|DOMNodeInserted|relatedNode|body|hl1314yc|cn|o7_l|className|sd1319ogo|getAttribute|position|push|net|top|qj_maxw|gshtrl|bot|quandangdang|jmfmt|xalzny|cc|xyz|android|ios|jmx2553lcm|film|number|bd|ca|toLowerCase|showos|return|qj_tid|cpc|continue|undefined|www|60|vj|1E3|removeItem|null|display|none|gg_tonglan|index_slide|img|span|href|rebrand|ly|9b674|utm_source|utm_medium|banner|utm_campaign|2019_bdfilm|utm_content|1140x101|ae01|alicdn|com|kf|H2847dde56f68439da949a0245762e447z|jpg|setAttribute|class|dfg|layout|cleafix|padding|target|_blank|ref|nofollow|width|100'.split('|'),0,{})); //20200420

遇到的困难

一直没有解密成功，还提示什么unexpected token ;等等问题，这些其实是因为我们拷贝的代码不是按照下面格式的，比如严格拷贝。

  1. eval(function(){}) #这里不能有任何符号，包括;、注释