当前位置：首页 > news >正文

AST反混淆实战|嵌套的赋值语句通用还原处理

news 2025/7/21 16:23:24

关注它，不迷路。

本文章中所有内容仅供学习交流，不可用于任何商业用途和非法用途，否则后果自负，如有侵权，请联系作者立即删除！

1.混淆代码

下面的这段代码是来自px3验证码核心混淆代码:

function _u() {var  n = r(v(980, 817));return (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = (n = n["replace"](/px_width/g, qu))["replace"](/px_cnt_width/g, hu))["replace"](/px_height/g, Iu))["replace"](/px_background/g, su))["replace"](/pxcntId/g, Uc))["replace"](/pxcId/g, Mc))["replace"](/pxdc/g, Bc))["replace"](/pxcd/g, Hc))["replace"](/pxcac/g, Ec))["replace"](/pxifc/g, Rc))["replace"](/pxbbwof/g, Uu))["replace"](/pxba/g, Zc))["replace"](/pxtc/g, jc))["replace"](/px_bar_height/g, wu))["replace"](/pxtId/g, bc))["replace"](/pxbtnwarpper/g, xc))["replace"](/px_border_width/g, tu))["replace"](/px_border_color/g, vu))["replace"](/px_border_radius/g, cu))["replace"](/px_fill_color/g, uu))["replace"](/px_text_color/g, iu))["replace"](/px_text_size/g, fu))["replace"](/px_text_font/g, ou))["replace"](/px_inner_height/g, eu))["replace"](/px_target_color/g, Cu))["replace"](/px_font_weight/g, zu))["replace"](/px_btn_padding/g, Lu))["replace"](/px_pressable_area_padding/g, ku))["replace"](/px_pressable_area_width/g, lu))["replace"](/px_pressable_area_top/g, du))["replace"](/px_text_transform/g, yu))["replace"](/px_checkmark_thickness/g, Du))["replace"](/px_checkmark_height/g, au))["replace"](/px_checkmark_width/g, Au))["replace"](/px_acc_text/g, Wc))["replace"](/px_acc_email_input/g, Tc))["replace"](/px_acc_value_box/g, Yc))["replace"](/px_acc_value_hyphen/g, Nc))["replace"](/px_acc_step_two_continue_btn/g, Jc))["replace"](/px_value_box_container/g, pc))["replace"](/px_acc_img/g, _c))["replace"](/px_acc_tooltip/g, Fc))["replace"](/pxvisuallyhidden/g, ru);}

可以说，非常的恶心，

2.反混淆插件

我们可以写个插件，将其进行还原处理:

const reduceAssign =
{AssignmentExpression(path) {let { parentPath, node } = path;if (!parentPath.isMemberExpression({ object: node })) {return;}let { left, operator, right } = node;if (operator != "=") return;let expressionPath = path.findParent(p => p.isStatement());if (!expressionPath) {return;}expressionPath.insertBefore(types.ExpressionStatement(node));path.replaceWith(left);}
}traverse(ast, reduceAssign);

3.还原效果

经过上面的插件处理后，代码很清晰:

function _u() {var n = r(v(980, 817));n = n["replace"](/px_width/g, qu);n = n["replace"](/px_cnt_width/g, hu);n = n["replace"](/px_height/g, Iu);n = n["replace"](/px_background/g, su);n = n["replace"](/pxcntId/g, Uc);n = n["replace"](/pxcId/g, Mc);n = n["replace"](/pxdc/g, Bc);n = n["replace"](/pxcd/g, Hc);n = n["replace"](/pxcac/g, Ec);n = n["replace"](/pxifc/g, Rc);n = n["replace"](/pxbbwof/g, Uu);n = n["replace"](/pxba/g, Zc);n = n["replace"](/pxtc/g, jc);n = n["replace"](/px_bar_height/g, wu);n = n["replace"](/pxtId/g, bc);n = n["replace"](/pxbtnwarpper/g, xc);n = n["replace"](/px_border_width/g, tu);n = n["replace"](/px_border_color/g, vu);n = n["replace"](/px_border_radius/g, cu);n = n["replace"](/px_fill_color/g, uu);n = n["replace"](/px_text_color/g, iu);n = n["replace"](/px_text_size/g, fu);n = n["replace"](/px_text_font/g, ou);n = n["replace"](/px_inner_height/g, eu);n = n["replace"](/px_target_color/g, Cu);n = n["replace"](/px_font_weight/g, zu);n = n["replace"](/px_btn_padding/g, Lu);n = n["replace"](/px_pressable_area_padding/g, ku);n = n["replace"](/px_pressable_area_width/g, lu);n = n["replace"](/px_pressable_area_top/g, du);n = n["replace"](/px_text_transform/g, yu);n = n["replace"](/px_checkmark_thickness/g, Du);n = n["replace"](/px_checkmark_height/g, au);n = n["replace"](/px_checkmark_width/g, Au);n = n["replace"](/px_acc_text/g, Wc);n = n["replace"](/px_acc_email_input/g, Tc);n = n["replace"](/px_acc_value_box/g, Yc);n = n["replace"](/px_acc_value_hyphen/g, Nc);n = n["replace"](/px_acc_step_two_continue_btn/g, Jc);n = n["replace"](/px_value_box_container/g, pc);n = n["replace"](/px_acc_img/g, _c);n = n["replace"](/px_acc_tooltip/g, Fc);return n["replace"](/pxvisuallyhidden/g, ru);
}