查看: 3861|回复: 8
收起左侧

[病毒样本] 大家来解密

[复制链接]
dayang1717
发表于 2009-5-3 18:54:01 | 显示全部楼层 |阅读模式
<script language =javascript>
function utf8to16(str){var out,i,len,c;var char2,char3;out=[];len=str.length;i=0;while(i<len){c=str.charCodeAt(i++);switch(c>>4)
{case 0:case 1:case 2:case 3:case 4:case 5:case 6:case 7:out[out.length]=str.charAt(i-1);break;case 12:case 13:char2=str.charCodeAt(i++);out[out.length]=String.fromCharCode(((c&0x1F)<<6)|(char2&0x3F));break;case 14:char2=str.charCodeAt(i++);char3=str.charCodeAt(i++);out[out.length]=String.fromCharCode(((c&0x0F)<<12)|((char2&0x3F)<<6)|((char3&0x3F)<<0));break;}}
return out.join('');}
var base64DecodeChars=new Array(-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,-1,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,-1,-1,-1,-1,-1);
function base64decode(str)
{var c1,c2,c3,c4;var i,len,out;len=str.length;i=0;out = "";while(i<len)
{do
{c1=base64DecodeChars[str.charCodeAt(i++)&0xff]}while(i<len&&c1==-1);if(c1==-1)
break;do
{c2=base64DecodeChars[str.charCodeAt(i++)&0xff]}while(i<len&&c2==-1);if(c2==-1)
break;out+=String.fromCharCode((c1<<2)|((c2&0x30)>>4));do
{c3=str.charCodeAt(i++)&0xff;if(c3==61)
return out;c3=base64DecodeChars[c3]}while(i<len&&c3==-1);if(c3==-1)
break;out+=String.fromCharCode(((c2&0XF)<<4)|((c3&0x3C)>>2));do
{c4=str.charCodeAt(i++)&0xff;if(c4==61)
return out;c4=base64DecodeChars[c4]}while(i<len&&c4==-1);if(c4==-1)
break;out+=String.fromCharCode(((c3&0x03)<<6)|c4)}
return out}
function long2str(v,w){var vl=v.length;var sl=v[vl-1]&0xffffffff;for(var i=0;i<vl;i++)
{v=String.fromCharCode(v&0xff,v>>>8&0xff,v>>>16&0xff,v>>>24&0xff);}
if(w){return v.join('').substring(0,sl);}
else{return v.join('');}}
function str2long(s,w){var len=s.length;var v=[];for(var i=0;i<len;i+=4)
{v[i>>2]=s.charCodeAt(i)|s.charCodeAt(i+1)<<8|s.charCodeAt(i+2)<<16|s.charCodeAt(i+3)<<24;}
if(w){v[v.length]=len;}
return v;}
function xxtea_decrypt(str,key){if(str==""){return"";}
var v=str2long(str,false);var k=str2long(key,false);var n=v.length-1;var z=v[n-1],y=v[0],delta=0x9E3779B9;var mx,e,q=Math.floor(6+52/(n+1)),sum=q*delta&0xffffffff;while(sum!=0){e=sum>>>2&3;for(var p=n;p>0;p--){z=v[p-1];mx=(z>>>5^y<<2)+(y>>>3^z<<4)^(sum^y)+(k[p&3^e]^z);y=v[p]=v[p]-mx&0xffffffff;}
z=v[n];mx=(z>>>5^y<<2)+(y>>>3^z<<4)^(sum^y)+(k[p&3^e]^z);y=v[0]=v[0]-mx&0xffffffff;sum=sum-delta&0xffffffff;}
return long2str(v,true);}
t="T7LtJpmJYchNbeqbkHY/buizAKlaAIRO1/dnyt/mWy9pwC+dWs9/eXSoaOxXIYDColIay1uo0EqIanFUE3PkO2fvVMksDwq5kENU+A+z715blWpIqYPLhrcl476lRqe8ARe/lEkJ5BeakcFfYpJW6vfslPA8TGCpXxGS9P3tsGV7/JwvgrpE3iwb9a7VOod76kuaAHCbcQvWN+mQgVrEXb4jtNxz8RAqHFi03ZuHlIb5YGho3mclu6SJ+1shWAOWqU/l2ZY/QuZvX8AaF7o6kUYinrsYBKSk88sVxYGDua8paO/YsKqxfkpBXen6uN1SWuMctUSAu+NGixprlIxdKp3KeOadfmomKd8ruq9rqQb/dHRwVUDpIC8YTKrRez/0FBNaMMnW7WWXRuKDNMXwOm3G7NShwBM6iyAD8XtWT+uxrOBCr4RdI9eqbLusORlTQrVrbr5XKChAjyuli7y0ZX8bW5koe+qQuvm+g3st8+diJ26zq3f3Q6yKI28W34Bqkym5gEDSoxVsQJt8HyyI12dLiVNAt3zhf8Z+vo4CvL7gPzE7g5NT0doxo+gk+jdxgRZ9zPWvlWxBfX3yd3TdulaTeUwcxQzfiA7P6TSHOfubw5sLsIStY0JE41LPbjb5OyscPp8kCT60iGxMZd3gdxXwE+WF3swJ+cGvTmmDOv7HgwxHwqnh4oKeFuPb4iyR0JWneXvAS3VLvDolgwybWyZ4a1Z3srOAz66XYd2cUBfPOs+GdJ8vak3gy+I8ptfF7EaVVoxsZmlYC5znOtGZMJ54sg0Vm85qDll3QJSEUmjHOuUUqvL6qk2iFwRH5Y/QtiuPYtzSDyWvs39yMwnUnm03EQ2CPG9E7braP8WhYw3cftBe9IMXcx+ftp0jsaCg39w/WVIM0tfd2i6CjMo2WD55V+tVHj1sLFiQbNN8PWk++B3LU+zSzyZiupKy8rkd58zSQueCpUYoo/+NdsaMsorZEPHdmXdNT6qxoN4gW/vY4iy9wW3Off+wCj7QdKcQPt+olbC5M+w0KyduI9PDHT6TDvbHu9lAsI7EFHq2fMvIZHjjjkZCOioFNzqcRy4kmxev8YKgDeGSQD2b2WN8uCGsh41Db9DsKFpk6KxtrrlL8XV9k7PZRnf6qzb/irfsbaDWYQCVWJ+IEcWx1R0MCIw654V/dVUlAEXOmJEXHKzM9gJR3NRRWiFLOMst4EuF+QTuyEWDm8zqQpCfeFMbD92NXyWEfkbXnoyHJcvvURibeTEnYoqM3iuDVmzFWUMQx2dY3uAw0lnd5KR6Z99MUUQEQzmhPwjcqu+W27xCw1SSnT9CWn519xzn1n3s7B+ZnfFcW96LHha9PUdPVB/RZx/+vPEYoTKDGCiFm+SzdHVLzo7d/btf/3FCubfrXR+kBB53lmHeeBfE61ILrwIqoidLFGO+RGgB8G12zddupzxZrTkqOLsYKstatxvPbG8u/iDfdybKU4lFPWeS6dV+ZDQomLQNm5TQlgwIS6DINONv7CaeXhRfqTIooLh4SM9YEIFLpw6t12ArMTxHVQufsRg9Zv1IH4+XHJ0fl7Za/e4M4c2mcfcWkv4XD237PKsnVcJSOPGYgdFaU/T/tbxPTmB66lQEhe4eTTADTteECVWHyazCmwN0WpS/jbJKcRDq7UbOfjSHXz1n+66ySSLqloDBhQZmA3hriBAVnBVQp58inQRMeAvBPqzx32lcV34EcE+OWPaWl2EkcMqYzFDaxmjOCodm0t87ErKJURPX7y8qtdmeOyTb0jVMqpgrdpqUYwiRIOfuSnrwUNN+/wU6eueXgnXNhoLHiEwg6ccetmc0nmaZcCGhlNhW57pY9tXgjCfVwxsbboCA3zvVmQ9Na9+B+DZGGdWN51azeKgaYeyzQoIKEhx7qIVFyv8/BzvgmC59LYjurPIWzE6a9czIpPhR9gm1rai8CYUAdj5V2TdmZr5ouJpeUU84nMhsXnGqmCED0ccyQ+1cNTkKtC5OF6ubG9iUL1amKwpCA17cJOOXwqqCjP6L77ZDB3A25SI3lNf5ES0dCyfcsUGLkpWLykW+acihDbW1XKnEWtEN2x1llZVNmH1mkftiGGTtx0rQ96cxaZFaBlPufu0PUPI/dKVNLKsbb1jvDDkMs2JUjGeKIBxOxSDFlm6TlriL3yoknARuqAJSwe3YCOYSGXHoaUL5ABW+TpPLDNdzj4PVkW1c4ozYVvprYSYuna6GPJhjpvp/g4zVK9FOE6BRxJOJvV2esAOeUy3UVIUI0dX27XdJ6cgSqJQMQwsdbLkJX2A6Id9bCcIFn1cuVwjYpeKJkHoTLbbhEYe0b4hkunEQPjab7IiA92dE6UXvgv1Zt8MjJZg+T5+wJKOvdxAiBsSm4bC1Dgh3uMJEBHvWA0RnK265jQceB/E+MZXn0giP1OKCSqdgwPSwgdffzNL9OX40NeV7YvkN5pOiykUAS0i2uv9fEkgG1ECatu/Cs+vLN7MiClFi6QTTVdCwSN8lk/EGa5srSeArnPhqcR26lsA82HvAO6TNSGbNG0Ekfh5C5btlN4q8ajGQ1S8zlwfNSJ/VTN9lFyh+yCl7XhwloFeb2aU646uKutwOgUbZmNohgeh5dGOtofegJ/H2j4aEWpxTdhorHCnp92HacSQnC1DyTVjYSgX5pXTqtZ2wH6MpAN2PPi7FKXRCyYjL8Vplsk7AeQTbGdjqYaKNNbmOhexmEzEQ6Gx1M5WGilrGkoRtH3/9FW4e9/ju/rEmOmZeaenQnC68N5dt9p6gvHrHVYCtGtOiCMjJ13lcLwZrkrStBNRmos3B2jTCUjEkkM0UcQBVD9vFQXc=";
t=utf8to16(xxtea_decrypt(base64decode(t), '324fdsf'));
document.write (t);
</script>
hddu
发表于 2009-5-3 19:34:21 | 显示全部楼层
不懂,快快跑过去。
nzyq
发表于 2009-5-3 19:42:25 | 显示全部楼层
這個不難啊。。。。xxtea  金鑰324fdsf
花间酒
发表于 2009-5-3 19:55:55 | 显示全部楼层
return v.join('').substring(0,sl);无法正常返回
无法进入 t=utf8to16(xxtea_decrypt(base64decode(t), '324fdsf'));
                       这里

[ 本帖最后由 lunglungyu 于 2009-5-3 20:22 编辑 ]
dayang1717
 楼主| 发表于 2009-5-3 20:25:52 | 显示全部楼层
t=utf8to16(xxtea_decrypt(base64decode(t), '324fdsf'));
document.write (t);
t就是已经解密后的了,把document.write (t);
改成alert(t);就OK了,不过不能复制,呵呵,还有其他的方法没?
花间酒
发表于 2009-5-3 20:28:15 | 显示全部楼层
原帖由 dayang1717 于 2009-5-3 20:25 发表
t=utf8to16(xxtea_decrypt(base64decode(t), '324fdsf'));
document.write (t);
t就是已经解密后的了,把document.write (t);
改成alert(t);就OK了,不过不能复制,呵呵,还有其他的方法没?

不是,我跑了一次,
xxtea_decrypt通过long2str结果回调,

function long2str(v,w)
 {
   var vl=v.length;
   var sl=v[vl-1]&0xffffffff;
   var lly;
   alert (sl);
   for(var i=0;
   i<vl;
   i++)
   {
     v=String.fromCharCode(v&0xff,v>>>8&0xff,v>>>16&0xff,v>>>24&0xff);
 
   }
   
    if(w){return v.join('').substring(0,sl);}
   else
   {
    return v.join('');
    }
 }
 
这个无法执行

传入utf8to16以前已经中断
document.write (t);没可能执行到。。。


难道是偶人品问题??、
你alert(t);可不可以上张图

[ 本帖最后由 lunglungyu 于 2009-5-3 20:30 编辑 ]
zzh161
发表于 2009-5-3 20:33:45 | 显示全部楼层
v.join() 这个方法感觉选择性支持。。。。。
花间酒
发表于 2009-5-3 20:36:52 | 显示全部楼层
原帖由 zzh161 于 2009-5-3 20:33 发表
v.join() 这个方法感觉选择性支持。。。。。

IE7+XPSP2 +AVIRA无法顺利执行。。
zzh161
发表于 2009-5-3 20:49:28 | 显示全部楼层

回复 5楼 dayang1717 的帖子

选那个窗口,按Ctrl+C,就复制了里面的内容了
您需要登录后才可以回帖 登录 | 快速注册

本版积分规则

手机版|杀毒软件|软件论坛| 卡饭论坛

Copyright © KaFan  KaFan.cn All Rights Reserved.

Powered by Discuz! X3.4( 沪ICP备2020031077号-2 ) GMT+8, 2026-10-21 19:24 , Processed in 0.085769 second(s), 4 queries , Redis On.

卡饭网所发布的一切软件、样本、工具、文章等仅限用于学习和研究,不得将上述内容用于商业或者其他非法用途,否则产生的一切后果自负,本站信息来自网络,版权争议问题与本站无关,您必须在下载后的24小时之内从您的电脑中彻底删除上述信息,如有问题请通过邮件与我们联系。

快速回复 客服 返回顶部 返回列表