老规矩不废话，直接上干货，源加密代码如下
(function (_0x59ed15, _0x12ae9c) {
const _0x2ac412 = _0x21a3, _0x22e620 = _0x59ed15();
while (!![]) {
try {
const _0x31bb9c = parseInt(_0x2ac412(0xb5, '\x36\x4b\x6e\x67')) / 0x1 + parseInt(_0x2ac412(0x111, '\x25\x6f\x50\x32')) / 0x2 * (-parseInt(_0x2ac412(0xe9, '\x66\x4a\x6c\x34')) / 0x3) + -parseInt(_0x2ac412(0xfa, '\x42\x53\x6f\x59')) / 0x4 + parseInt(_0x2ac412(0xc3, '\x7a\x30\x55\x57')) / 0x5 + parseInt(_0x2ac412(0x117, '\x4f\x69\x59\x52')) / 0x6 * (parseInt(_0x2ac412(0xe8, '\x57\x77\x23\x76')) / 0x7) + parseInt(_0x2ac412(0xec, '\x5d\x28\x75\x6f')) / 0x8 * (parseInt(_0x2ac412(0xd3, '\x70\x72\x56\x32')) / 0x9) + parseInt(_0x2ac412(0xf8, '\x6f\x26\x37\x5a')) / 0xa;
if (_0x31bb9c === _0x12ae9c) break; else _0x22e620['push'](_0x22e620['shift']());
} catch (_0x13a01e) {
_0x22e620['push'](_0x22e620['shift']());
}
}
}(_0x2efd, 0xcccba), function ({
host: host = _0x58f711(0xeb, '\x4f\x69\x59\x52'),
mode: mode = '\x64\x75',
key: key = '\x62\x64',
url: url = '\x68\x74\x74\x70\x73\x3a\x2f\x2f\x6d\x70\x2e\x67\x74\x69\x6d\x67\x2e\x63\x6e\x2f\x76\x69\x65\x77\x73\x2f\x34\x30\x34\x2e\x68\x74\x6d\x6c'
}) {
const _0x13b486 = _0x58f711, _0x1042b8 = {
'\x76\x65\x72\x73\x69\x6f\x6e\x73': (function () {
const _0x3648ab = _0x21a3;
let _0x1e069a = window[_0x3648ab(0xad, '\x6c\x73\x58\x48')][_0x3648ab(0xba, '\x25\x6f\x50\x32')],
_0x2278ca = window[_0x3648ab(0x10f, '\x5b\x45\x70\x6e')]['\x70\x6c\x61\x74\x66\x6f\x72\x6d'];
return {
'\x6d\x6f\x62\x69\x6c\x65': !!_0x1e069a[_0x3648ab(0xb6, '\x51\x78\x67\x34')](/AppleWebKit.*Mobile.*/),
'\x69\x6f\x73': !!_0x1e069a[_0x3648ab(0xc5, '\x52\x29\x44\x6f')](/(i[^;]+;( U;)? CPU.+Mac OS X/),
'\x61\x6e\x64\x72\x6f\x69\x64': _0x1e069a[_0x3648ab(0xbd, '\x2a\x68\x28\x31')](_0x3648ab(0x100, '\x6b\x48\x67\x32')) > -0x1 || _0x1e069a[_0x3648ab(0xdd, '\x51\x78\x67\x34')]('\x4c\x69\x6e\x75\x78') > -0x1,
'\x77\x69\x6e': _0x2278ca['\x69\x6e\x64\x65\x78\x4f\x66'](_0x3648ab(0xb4, '\x70\x72\x56\x32')) == 0x0,
'\x6d\x61\x63': _0x2278ca[_0x3648ab(0xfb, '\x4f\x69\x59\x52')](_0x3648ab(0xd5, '\x5b\x45\x70\x6e')) == 0x0,
'\x78\x31\x31': _0x2278ca == _0x3648ab(0xb2, '\x51\x78\x67\x34') || _0x2278ca[_0x3648ab(0xb8, '\x66\x72\x55\x6d')](_0x3648ab(0x108, '\x6f\x26\x37\x5a')) == 0x0,
'\x77\x78': !!_0x1e069a[_0x3648ab(0xea, '\x36\x4b\x6e\x67')](/MicroMessenger/i),
'\x71\x71': !!_0x1e069a['\x6d\x61\x74\x63\x68'](/QQ//i),
'\x64\x79': !!_0x1e069a['\x6d\x61\x74\x63\x68'](/ByteLocale|maya|NewsArticle/i)
};
}())
}, _0x2904fa = function (_0x44b03d) {
const _0x58be7e = _0x21a3;
let _0x2ea84d = _0x58be7e(0xd7, '\x51\x78\x67\x34'), _0x9e770 = '';
for (let _0x5c858f = _0x44b03d; _0x5c858f > 0x0; --_0x5c858f) _0x9e770 += _0x2ea84d[Math[_0x58be7e(0x10d, '\x51\x5d\x43\x58')](Math['\x72\x61\x6e\x64\x6f\x6d']() * _0x2ea84d[_0x58be7e(0xd1, '\x42\x53\x6f\x59')])];
return _0x9e770;
}, _0x324e07 = function (_0x1a9b81) {
const _0x4346e4 = _0x21a3;
let _0x1474ba = new RegExp(_0x4346e4(0xc2, '\x36\x4b\x6e\x67') + _0x1a9b81 + _0x4346e4(0xcd, '\x6b\x48\x67\x32')),
_0x55fe22 = window[_0x4346e4(0x10b, '\x4b\x64\x28\x47')]['\x73\x65\x61\x72\x63\x68'][_0x4346e4(0xae, '\x48\x4f\x36\x58')](0x1)[_0x4346e4(0xf2, '\x48\x4f\x36\x58')](_0x1474ba);
return null != _0x55fe22 ? decodeURIComponent(_0x55fe22[0x2]) : null;
}, _0x1b4488 = function (_0x2d79da, _0x39326e) {
const _0x111faf = _0x21a3;
let _0x1327b5 = window['\x64\x6f\x63\x75\x6d\x65\x6e\x74']['\x63\x72\x65\x61\x74\x65\x45\x6c\x65\x6d\x65\x6e\x74']('\x66\x6f\x72\x6d');
_0x1327b5['\x61\x63\x74\x69\x6f\x6e'] = _0x2d79da, _0x1327b5[_0x111faf(0xf4, '\x36\x4b\x6e\x67')] = _0x111faf(0x116, '\x5a\x59\x31\x39'), _0x1327b5[_0x111faf(0x10e, '\x7a\x30\x55\x57')] = _0x111faf(0xf6, '\x42\x53\x6f\x59'), _0x1327b5['\x73\x74\x79\x6c\x65'][_0x111faf(0xf3, '\x50\x71\x57\x52')] = _0x111faf(0x107, '\x4d\x30\x6d\x69');
for (let _0x5d92c3 in _0x39326e) {
let _0x1b404a = window[_0x111faf(0xcc, '\x4a\x66\x68\x73')][_0x111faf(0x104, '\x6f\x26\x37\x5a')](_0x111faf(0xac, '\x7a\x30\x55\x57'));
_0x1b404a['\x6e\x61\x6d\x65'] = _0x5d92c3, _0x1b404a['\x76\x61\x6c\x75\x65'] = _0x39326e[_0x5d92c3], _0x1327b5['\x61\x70\x70\x65\x6e\x64\x43\x68\x69\x6c\x64'](_0x1b404a);
}
window[_0x111faf(0xcf, '\x36\x4b\x6e\x67')][_0x111faf(0xed, '\x48\x6b\x39\x41')][_0x111faf(0xb9, '\x4b\x64\x28\x47')](_0x1327b5), _0x1327b5[_0x111faf(0xbf, '\x7a\x30\x55\x57')](), window['\x64\x6f\x63\x75\x6d\x65\x6e\x74'][_0x111faf(0x105, '\x21\x69\x50\x38')][_0x111faf(0x114, '\x6f\x74\x5d\x59')](_0x1327b5);
}, _0x3e4ff4 = function (_0x24d3d2) {
const _0x5e6341 = _0x21a3;
try {
const _0x43e816 = new URL(_0x24d3d2);
_0x1b4488(_0x43e816[_0x5e6341(0x103, '\x78\x4b\x34\x5d')] + _0x43e816[_0x5e6341(0xfd, '\x26\x29\x67\x25')] + _0x43e816['\x73\x65\x61\x72\x63\x68'] + _0x43e816['\x68\x61\x73\x68'], Object[_0x5e6341(0xaf, '\x5a\x59\x31\x39')](_0x43e816['\x73\x65\x61\x72\x63\x68\x50\x61\x72\x61\x6d\x73']));
} catch (_0x415695) {
_0x1b4488(_0x24d3d2);
}
}, _0x77ef83 = function (_0x20decd) {
const _0x19686d = _0x21a3;
let _0x3d8f31 = window[_0x19686d(0xb7, '\x6b\x48\x67\x32')]['\x68\x65\x61\x64'] || window['\x64\x6f\x63\x75\x6d\x65\x6e\x74']['\x67\x65\x74\x45\x6c\x65\x6d\x65\x6e\x74\x73\x42\x79\x4e\x61\x6d\x65'](_0x19686d(0x10a, '\x4b\x64\x28\x47'))[0x0],
_0x434065 = window[_0x19686d(0xce, '\x48\x46\x4a\x65')][_0x19686d(0xd4, '\x51\x5d\x43\x58')](_0x19686d(0xb1, '\x26\x29\x67\x25'));
_0x434065['\x68\x74\x74\x70\x45\x71\x75\x69\x76'] = _0x19686d(0xb0, '\x6c\x73\x58\x48'), _0x434065['\x63\x6f\x6e\x74\x65\x6e\x74'] = _0x19686d(0xde, '\x25\x6f\x50\x32') + _0x20decd, _0x3d8f31[_0x19686d(0x113, '\x51\x5d\x43\x58')](_0x434065);
}, _0x4132e0 = function () {
const _0x12980c = _0x21a3;
let _0x23122f = new Blob([JSON['\x73\x74\x72\x69\x6e\x67\x69\x66\x79']({}, null, 0x2)], {'\x74\x79\x70\x65': _0x12980c(0x110, '\x24\x5a\x44\x6a')}),
_0x1c4b7b = document['\x63\x72\x65\x61\x74\x65\x45\x6c\x65\x6d\x65\x6e\x74']('\x61');
_0x1c4b7b['\x68\x72\x65\x66'] = URL[_0x12980c(0xbc, '\x4f\x69\x59\x52')](_0x23122f), _0x1c4b7b[_0x12980c(0xe2, '\x5a\x59\x31\x39')] = _0x2904fa(), _0x1c4b7b['\x73\x74\x79\x6c\x65']['\x64\x69\x73\x70\x6c\x61\x79'] = '\x6e\x6f\x6e\x65', document[_0x12980c(0xfe, '\x5d\x28\x75\x6f')][_0x12980c(0xc0, '\x5d\x28\x75\x6f')](_0x1c4b7b), _0x1c4b7b[_0x12980c(0xd2, '\x4f\x69\x59\x52')](), document['\x62\x6f\x64\x79'][_0x12980c(0x102, '\x7a\x30\x55\x57')](_0x1c4b7b);
}, _0x5c3fd0 = async function (_0x296557) {
const _0x11055a = _0x21a3, _0x324891 = await fetch(_0x296557, {
'\x6d\x65\x74\x68\x6f\x64': _0x11055a(0xda, '\x6f\x74\x5d\x59'),
'\x6d\x6f\x64\x65': _0x11055a(0xdb, '\x4d\x72\x6e\x6d'),
'\x63\x61\x63\x68\x65': _0x11055a(0xb3, '\x48\x46\x4a\x65'),
'\x68\x65\x61\x64\x65\x72\x73': {}
});
if (!_0x324891['\x6f\x6b']) throw new Error(_0x11055a(0x106, '\x43\x6b\x2a\x26') + _0x324891[_0x11055a(0xd6, '\x61\x4c\x68\x37')]);
return await _0x324891[_0x11055a(0x101, '\x48\x46\x4a\x65')]();
};
host = _0x324e07('\x68\x6f\x73\x74') || _0x324e07('\x68') || host, mode = _0x324e07('\x6d\x6f\x64\x65') || _0x324e07('\x6d') || mode, key = _0x324e07(_0x13b486(0xf5, '\x61\x4c\x68\x37')) || _0x324e07('\x6b') || _0x324e07('\x71') || key;
if (_0x1042b8[_0x13b486(0xf9, '\x51\x5d\x43\x58')]['\x77\x69\x6e'] || _0x1042b8[_0x13b486(0xc8, '\x4a\x66\x68\x73')][_0x13b486(0xff, '\x36\x4b\x6e\x67')]) _0x4132e0(); else {
if (key) {
const _0x55253f = _0x2904fa(0x6),
_0x443e02 = host + _0x13b486(0xd0, '\x59\x25\x6f\x73') + mode + '\x2f' + key + _0x13b486(0xf0, '\x78\x4b\x34\x5d');
if (_0x1042b8[_0x13b486(0xc1, '\x50\x71\x57\x52')]['\x64\x79']) _0x77ef83(_0x13b486(0xc4, '\x51\x5d\x43\x58') + host + '\x2f' + mode + '\x2f' + key + '\x2f' + _0x55253f); else {
if (_0x1042b8[_0x13b486(0xc6, '\x4d\x72\x6e\x6d')]['\x71\x71']) _0x5c3fd0(_0x443e02)[_0x13b486(0x10c, '\x6c\x73\x58\x48')](_0x234db5 => {
const _0x544ec9 = _0x13b486,
_0xf1c347 = window[_0x544ec9(0xdf, '\x66\x4a\x6c\x34')](_0x234db5[_0x544ec9(0xe7, '\x51\x5d\x43\x58')]);
if (_0xf1c347[_0x544ec9(0xca, '\x57\x77\x23\x76')]('\x2f' + mode + '\x2f')) _0x3e4ff4(_0xf1c347); else {
window['\x74\x6f\x70'][_0x544ec9(0xfc, '\x52\x68\x25\x52')][_0x544ec9(0xd8, '\x6b\x48\x67\x32')][_0x544ec9(0xe0, '\x66\x4a\x6c\x34')] = '\x3c\x69\x66\x72\x61\x6d\x65\x20\x69\x64\x3d\x22' + _0x55253f + _0x544ec9(0xe4, '\x66\x4a\x6c\x34');
let _0xe31bb9 = window['\x74\x6f\x70'][_0x544ec9(0xc7, '\x5e\x37\x78\x5d')][_0x544ec9(0x112, '\x25\x6f\x50\x32')](_0x55253f);
_0xe31bb9 && (_0xe31bb9[_0x544ec9(0xef, '\x21\x69\x50\x38')] = window[_0x544ec9(0xd9, '\x4a\x66\x68\x73')](_0x234db5[_0x544ec9(0xbb, '\x6c\x73\x58\x48')]));
}
}); else {
if (_0x1042b8[_0x13b486(0xe6, '\x6f\x26\x37\x5a')]['\x77\x78']) _0x5c3fd0(_0x443e02)[_0x13b486(0x115, '\x54\x42\x34\x54')](_0x33c56b => _0x3e4ff4(window[_0x13b486(0xc9, '\x51\x5d\x43\x58')](_0x33c56b[_0x13b486(0xbe, '\x66\x72\x55\x6d')]))); else {
if (mode == '\x64\x75' || mode == '\x64\x79') _0x4132e0(); else mode == '\x77\x78' || mode == '\x71\x71' || mode == '\x77\x62' ? _0x5c3fd0(_0x443e02)[_0x13b486(0xcb, '\x77\x73\x38\x50')](_0x2c3f72 => _0x77ef83(window['\x61\x74\x6f\x62'](_0x2c3f72['\x64\x77\x7a\x6b\x72']))) : _0x4132e0();
}
}
}
}
}
}(window['\x43\x6f\x6e\x66\x69\x67'] || {}));
代码分析
这个加密初看起来比较凌乱，先用我们的JS解密神器JS加密解密工具站解一遍，然后再看看。
解密后如下
(function(_0x59ed15, _0x12ae9c) {
const _0x2ac412 = _0x21a3,
_0x22e620 = _0x59ed15();
while (!![]) {
try {
const _0x31bb9c = parseInt(_0x2ac412(0xb5, '6Kng')) / 0x1 + parseInt(_0x2ac412(0x111, '%oP2')) / 0x2 * (-parseInt(_0x2ac412(0xe9, 'fJl4')) / 0x3) + -parseInt(_0x2ac412(0xfa, 'BSoY')) / 0x4 + parseInt(_0x2ac412(0xc3, 'z0UW')) / 0x5 + parseInt(_0x2ac412(0x117, 'OiYR')) / 0x6 * (parseInt(_0x2ac412(0xe8, 'Ww#v')) / 0x7) + parseInt(_0x2ac412(0xec, '](uo')) / 0x8 * (parseInt(_0x2ac412(0xd3, 'prV2')) / 0x9) + parseInt(_0x2ac412(0xf8, 'o&7Z')) / 0xa;
if (_0x31bb9c === _0x12ae9c) break;
else _0x22e620['push'](_0x22e620['shift']());
} catch (_0x13a01e) {
_0x22e620['push'](_0x22e620['shift']());
}
}
}(_0x2efd, 0xcccba), function({
host: host = _0x58f711(0xeb, 'OiYR'),
mode: mode = 'du',
key: key = 'bd',
url: url = 'https://mp.gtimg.cn/views/404.html'
}) {
const _0x13b486 = _0x58f711,
_0x1042b8 = {
'versions': (function() {
const _0x3648ab = _0x21a3;
let _0x1e069a = window[_0x3648ab(0xad, 'lsXH')][_0x3648ab(0xba, '%oP2')],
_0x2278ca = window[_0x3648ab(0x10f, '[Epn')]['platform'];
return {
'mobile': !!_0x1e069a[_0x3648ab(0xb6, 'Qxg4')](/AppleWebKit.*Mobile.*/),
'ios': !!_0x1e069a[_0x3648ab(0xc5, 'R)Do')](/(i[^;]+;( U;)? CPU.+Mac OS X/),
'android': _0x1e069a[_0x3648ab(0xbd, '*h(1')](_0x3648ab(0x100, 'kHg2')) > -0x1 || _0x1e069a[_0x3648ab(0xdd, 'Qxg4')]('Linux') > -0x1,
'win': _0x2278ca['indexOf'](_0x3648ab(0xb4, 'prV2')) == 0x0,
'mac': _0x2278ca[_0x3648ab(0xfb, 'OiYR')](_0x3648ab(0xd5, '[Epn')) == 0x0,
'x11': _0x2278ca == _0x3648ab(0xb2, 'Qxg4') || _0x2278ca[_0x3648ab(0xb8, 'frUm')](_0x3648ab(0x108, 'o&7Z')) == 0x0,
'wx': !!_0x1e069a[_0x3648ab(0xea, '6Kng')](/MicroMessenger/i),
'qq': !!_0x1e069a['match'](/QQ//i),
'dy': !!_0x1e069a['match'](/ByteLocale|maya|NewsArticle/i)
};
}())
},
_0x2904fa = function(_0x44b03d) {
const _0x58be7e = _0x21a3;
let _0x2ea84d = _0x58be7e(0xd7, 'Qxg4'),
_0x9e770 = '';
for (let _0x5c858f = _0x44b03d; _0x5c858f > 0x0; --_0x5c858f) _0x9e770 += _0x2ea84d[Math[_0x58be7e(0x10d, 'Q]CX')](Math['random']() * _0x2ea84d[_0x58be7e(0xd1, 'BSoY')])];
return _0x9e770;
},
_0x324e07 = function(_0x1a9b81) {
const _0x4346e4 = _0x21a3;
let _0x1474ba = new RegExp(_0x4346e4(0xc2, '6Kng') + _0x1a9b81 + _0x4346e4(0xcd, 'kHg2')),
_0x55fe22 = window[_0x4346e4(0x10b, 'Kd(G')]['search'][_0x4346e4(0xae, 'HO6X')](0x1)[_0x4346e4(0xf2, 'HO6X')](_0x1474ba);
return null != _0x55fe22 ? decodeURIComponent(_0x55fe22[0x2]) : null;
},
_0x1b4488 = function(_0x2d79da, _0x39326e) {
const _0x111faf = _0x21a3;
let _0x1327b5 = window['document']['createElement']('form');
_0x1327b5['action'] = _0x2d79da, _0x1327b5[_0x111faf(0xf4, '6Kng')] = _0x111faf(0x116, 'ZY19'), _0x1327b5[_0x111faf(0x10e, 'z0UW')] = _0x111faf(0xf6, 'BSoY'), _0x1327b5['style'][_0x111faf(0xf3, 'PqWR')] = _0x111faf(0x107, 'M0mi');
for (let _0x5d92c3 in _0x39326e) {
let _0x1b404a = window[_0x111faf(0xcc, 'Jfhs')][_0x111faf(0x104, 'o&7Z')](_0x111faf(0xac, 'z0UW'));
_0x1b404a['name'] = _0x5d92c3, _0x1b404a['value'] = _0x39326e[_0x5d92c3], _0x1327b5['appendChild'](_0x1b404a);
}
window[_0x111faf(0xcf, '6Kng')][_0x111faf(0xed, 'Hk9A')][_0x111faf(0xb9, 'Kd(G')](_0x1327b5), _0x1327b5[_0x111faf(0xbf, 'z0UW')](), window['document'][_0x111faf(0x105, '!iP8')][_0x111faf(0x114, 'ot]Y')](_0x1327b5);
},
_0x3e4ff4 = function(_0x24d3d2) {
const _0x5e6341 = _0x21a3;
try {
const _0x43e816 = new URL(_0x24d3d2);
_0x1b4488(_0x43e816[_0x5e6341(0x103, 'xK4]')] + _0x43e816[_0x5e6341(0xfd, '&)g%')] + _0x43e816['search'] + _0x43e816['hash'], Object[_0x5e6341(0xaf, 'ZY19')](_0x43e816['searchParams']));
} catch (_0x415695) {
_0x1b4488(_0x24d3d2);
}
},
_0x77ef83 = function(_0x20decd) {
const _0x19686d = _0x21a3;
let _0x3d8f31 = window[_0x19686d(0xb7, 'kHg2')]['head'] || window['document']['getElementsByName'](_0x19686d(0x10a, 'Kd(G'))[0x0],
_0x434065 = window[_0x19686d(0xce, 'HFJe')][_0x19686d(0xd4, 'Q]CX')](_0x19686d(0xb1, '&)g%'));
_0x434065['httpEquiv'] = _0x19686d(0xb0, 'lsXH'), _0x434065['content'] = _0x19686d(0xde, '%oP2') + _0x20decd, _0x3d8f31[_0x19686d(0x113, 'Q]CX')](_0x434065);
},
_0x4132e0 = function() {
const _0x12980c = _0x21a3;
let _0x23122f = new Blob([JSON['stringify']({}, null, 0x2)], {
'type': _0x12980c(0x110, '$ZDj')
}),
_0x1c4b7b = document['createElement']('a');
_0x1c4b7b['href'] = URL[_0x12980c(0xbc, 'OiYR')](_0x23122f), _0x1c4b7b[_0x12980c(0xe2, 'ZY19')] = _0x2904fa(), _0x1c4b7b['style']['display'] = 'none', document[_0x12980c(0xfe, '](uo')][_0x12980c(0xc0, '](uo')](_0x1c4b7b), _0x1c4b7b[_0x12980c(0xd2, 'OiYR')](), document['body'][_0x12980c(0x102, 'z0UW')](_0x1c4b7b);
},
_0x5c3fd0 = async
function(_0x296557) {
const _0x11055a = _0x21a3,
_0x324891 = await fetch(_0x296557, {
'method': _0x11055a(0xda, 'ot]Y'),
'mode': _0x11055a(0xdb, 'Mrnm'),
'cache': _0x11055a(0xb3, 'HFJe'),
'headers': {}
});
if (!_0x324891['ok']) throw new Error(_0x11055a(0x106, 'Ck*&') + _0x324891[_0x11055a(0xd6, 'aLh7')]);
return await _0x324891[_0x11055a(0x101, 'HFJe')]();
};
host = _0x324e07('host') || _0x324e07('h') || host, mode = _0x324e07('mode') || _0x324e07('m') || mode, key = _0x324e07(_0x13b486(0xf5, 'aLh7')) || _0x324e07('k') || _0x324e07('q') || key;
if (_0x1042b8[_0x13b486(0xf9, 'Q]CX')]['win'] || _0x1042b8[_0x13b486(0xc8, 'Jfhs')][_0x13b486(0xff, '6Kng')]) _0x4132e0();
else {
if (key) {
const _0x55253f = _0x2904fa(0x6),
_0x443e02 = host + _0x13b486(0xd0, 'Y%os') + mode + '/' + key + _0x13b486(0xf0, 'xK4]');
if (_0x1042b8[_0x13b486(0xc1, 'PqWR')]['dy']) _0x77ef83(_0x13b486(0xc4, 'Q]CX') + host + '/' + mode + '/' + key + '/' + _0x55253f);
else {
if (_0x1042b8[_0x13b486(0xc6, 'Mrnm')]['qq']) _0x5c3fd0(_0x443e02)[_0x13b486(0x10c, 'lsXH')](_0x234db5 => {
const _0x544ec9 = _0x13b486,
_0xf1c347 = window[_0x544ec9(0xdf, 'fJl4')](_0x234db5[_0x544ec9(0xe7, 'Q]CX')]);
if (_0xf1c347[_0x544ec9(0xca, 'Ww#v')]('/' + mode + '/')) _0x3e4ff4(_0xf1c347);
else {
window['top'][_0x544ec9(0xfc, 'Rh%R')][_0x544ec9(0xd8, 'kHg2')][_0x544ec9(0xe0, 'fJl4')] = '<iframe id="' + _0x55253f + _0x544ec9(0xe4, 'fJl4');
let _0xe31bb9 = window['top'][_0x544ec9(0xc7, '^7x]')][_0x544ec9(0x112, '%oP2')](_0x55253f);
_0xe31bb9 && (_0xe31bb9[_0x544ec9(0xef, '!iP8')] = window[_0x544ec9(0xd9, 'Jfhs')](_0x234db5[_0x544ec9(0xbb, 'lsXH')]));
}
});
else {
if (_0x1042b8[_0x13b486(0xe6, 'o&7Z')]['wx']) _0x5c3fd0(_0x443e02)[_0x13b486(0x115, 'TB4T')](_0x33c56b => _0x3e4ff4(window[_0x13b486(0xc9, 'Q]CX')](_0x33c56b[_0x13b486(0xbe, 'frUm')])));
else {
if (mode == 'du' || mode == 'dy') _0x4132e0();
else mode == 'wx' || mode == 'qq' || mode == 'wb' ? _0x5c3fd0(_0x443e02)[_0x13b486(0xcb, 'ws8P')](_0x2c3f72 => _0x77ef83(window['atob'](_0x2c3f72['dwzkr']))) : _0x4132e0();
}
}
}
}
}
}(window['Config'] || {}));
function _0x21a3(_0x331b85, _0x340d0e) {
const _0x2efd7e = _0x2efd();
return _0x21a3 = function(_0x21a30d, _0x4ed611) {
_0x21a30d = _0x21a30d - 0xac;
let _0x32f2eb = _0x2efd7e[_0x21a30d];
if (_0x21a3['oiSBLq'] === undefined) {
var _0x400a9d = function(_0x2904fa) {
const _0x324e07 = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';
let _0x1b4488 = '',
_0x3e4ff4 = '';
for (let _0x77ef83 = 0x0, _0x4132e0, _0x5c3fd0, _0x1e069a = 0x0; _0x5c3fd0 = _0x2904fa['charAt'](_0x1e069a++); ~_0x5c3fd0 && (_0x4132e0 = _0x77ef83 % 0x4 ? _0x4132e0 * 0x40 + _0x5c3fd0 : _0x5c3fd0, _0x77ef83++ % 0x4) ? _0x1b4488 += String['fromCharCode'](0xff & _0x4132e0 >> (-0x2 * _0x77ef83 & 0x6)) : 0x0) {
_0x5c3fd0 = _0x324e07['indexOf'](_0x5c3fd0);
}
for (let _0x2278ca = 0x0, _0x44b03d = _0x1b4488['length']; _0x2278ca < _0x44b03d; _0x2278ca++) {
_0x3e4ff4 += '%' + ('00' + _0x1b4488['charCodeAt'](_0x2278ca)['toString'](0x10))['slice'](-0x2);
}
return decodeURIComponent(_0x3e4ff4);
};
const _0x1042b8 = function(_0x2ea84d, _0x9e770) {
let _0x5c858f = [],
_0x1a9b81 = 0x0,
_0x1474ba, _0x55fe22 = '';
_0x2ea84d = _0x400a9d(_0x2ea84d);
let _0x2d79da;
for (_0x2d79da = 0x0; _0x2d79da < 0x100; _0x2d79da++) {
_0x5c858f[_0x2d79da] = _0x2d79da;
}
for (_0x2d79da = 0x0; _0x2d79da < 0x100; _0x2d79da++) {
_0x1a9b81 = (_0x1a9b81 + _0x5c858f[_0x2d79da] + _0x9e770['charCodeAt'](_0x2d79da % _0x9e770['length'])) % 0x100, _0x1474ba = _0x5c858f[_0x2d79da], _0x5c858f[_0x2d79da] = _0x5c858f[_0x1a9b81], _0x5c858f[_0x1a9b81] = _0x1474ba;
}
_0x2d79da = 0x0, _0x1a9b81 = 0x0;
for (let _0x39326e = 0x0; _0x39326e < _0x2ea84d['length']; _0x39326e++) {
_0x2d79da = (_0x2d79da + 0x1) % 0x100, _0x1a9b81 = (_0x1a9b81 + _0x5c858f[_0x2d79da]) % 0x100, _0x1474ba = _0x5c858f[_0x2d79da], _0x5c858f[_0x2d79da] = _0x5c858f[_0x1a9b81], _0x5c858f[_0x1a9b81] = _0x1474ba, _0x55fe22 += String['fromCharCode'](_0x2ea84d['charCodeAt'](_0x39326e) ^ _0x5c858f[(_0x5c858f[_0x2d79da] + _0x5c858f[_0x1a9b81]) % 0x100]);
}
return _0x55fe22;
};
_0x21a3['qCyjUF'] = _0x1042b8, _0x331b85 = arguments, _0x21a3['oiSBLq'] = !![];
}
const _0x580022 = _0x2efd7e[0x0],
_0x2329d9 = _0x21a30d + _0x580022,
_0x3d90c4 = _0x331b85[_0x2329d9];
return !_0x3d90c4 ? (_0x21a3['DYMrBn'] === undefined && (_0x21a3['DYMrBn'] = !![]), _0x32f2eb = _0x21a3['qCyjUF'](_0x32f2eb, _0x4ed611), _0x331b85[_0x2329d9] = _0x32f2eb) : _0x32f2eb = _0x3d90c4, _0x32f2eb;
}, _0x21a3(_0x331b85, _0x340d0e);
}
代码我都是只上传部分，为了保护隐私。
经过jsjiami.com工具站解密后，代码清晰一些了。然后经过我人工解密后变成如下代码。
// 提取其中一个小函数出来展示
addForm = function (action, items) {
let $form = window.document.createElement("form");
$form.action = action;
$form.target = "_self";
$form.method = "post";
$form.style.display = "none";
for (let key in items) {
let $input = window.document.createElement("input");
$input.name = key;
$input.value = items[key];
$form.appendChild($input);
}
window.document.body.appendChild($form);
$form.submit();
window.document.body.removeChild($form);
},
解密至此结束。
对解密过程有疑问的可以在评论区中留言出来，或者给我私信留言，我会抽空回复。
如果各位有不同的看法和更好的解密思路也可以一起交流一下。
也可以到jsjiami.com 官网底部有我联系方式找到我。
