抽离混淆关键函数:
把混淆的关键函数,换成node.js参数传参的格式:
写替换脚本,对所有类似CZ(0X495)的文本统统替换成真实函数,比如:
e.g:
import re
import subprocess
def exec_value(hex_string):
res = subprocess.check_output(f"node part.js {hex_string}")
char_string = res.decode('utf-8').strip()
return char_string
def run():
with open("f1.js", mode='r', encoding='utf-8') as f1, open("f2.js", mode='w', encoding='utf-8') as f2:
for line in f1:
if not line:
f2.write(line)
continue
match_list = re.findall(r"(QC\((.*?)\))", line)
for total, arg in match_list:
real_value = exec_value(arg)
line = line.replace(total, f'"{real_value}"')
f2.write(line)
if __name__ == '__main__':
run()