js加密算法自动逆向

拦截加解密框架函数，获取密钥、IV等关键数据
安裝腳本 ?
換行
// ==UserScript==
// @name         js加密算法自动逆向
// @description  拦截加解密框架函数，获取密钥、IV等关键数据
// @author       ejfkdev
// @namespace    @ejfkdev
// @version      1.0
// @license      MIT
// @match        https://*/*
// @match        http://*/*
// @grant        none
// @run-at       document-start
// ==/UserScript==

function arraysEqual(a, b) {
  if (a === b) return true;
  if (!Array.isArray(a) || !Array.isArray(b)) return false;
  if (a.length !== b.length) return false;
  for (let i = 0; i < a.length; i++) {
    if (a[i] !== b[i]) return false;
  }
  return true;
}

const containsAllUnique = (A, B) =>
  Array.isArray(A) && Array.isArray(B) &&
  [...new Set(B)].every(x => A.includes(x));

function wordArrayToHex(t) {
  const { words, sigBytes } = t;
  const u8 = new Uint8Array(sigBytes);
  for (let n = 0; n < sigBytes; n++) {
    u8[n] = (words[n >>> 2] >>> (24 - (n % 4) * 8)) & 0xff;
  }
  return Array.from(u8, b => b.toString(16).padStart(2, "0")).join("");
}

function wordArrayToBase64(wordArray) {
  const { words, sigBytes } = wordArray;
  const bytes = new Uint8Array(sigBytes);

  for (let i = 0; i < sigBytes; i++) {
    bytes[i] = (words[i >>> 2] >>> (24 - (i % 4) * 8)) & 0xff;
  }

  // 内置函数 btoa 只能处理字符串，所以要先转成 binary string
  let binary = String.fromCharCode(...bytes);
  return btoa(binary);
}

function utf8Stringify(wordArray) {
  const { words, sigBytes } = wordArray;
  const bytes = new Uint8Array(sigBytes);

  // 提取有效字节
  for (let i = 0; i < sigBytes; i++) {
    bytes[i] = (words[i >>> 2] >>> (24 - (i % 4) * 8)) & 0xff;
  }

  try {
    return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
  } catch {
    return ""
  }
}

function detectAlgorithm(algo) {
  if (!algo) return "Unknown";

  // DES/3DES/AES 区分
  if (algo.blockSize === 2 && algo.keySize === 2 && algo.ivSize === 2) return "DES";
  if (algo.blockSize === 2 && algo.keySize === 6 && algo.ivSize === 2) return "TripleDES";
  if (algo.blockSize === 4 && algo.ivSize === 4) return "AES";

  // 可扩展更多算法特征
  return "Unknown";
}

function detectPadding(pad) {
  if (!pad || !pad.pad) return "Unknown";

  const len = pad.pad.length;
  if (len === 2) {
    // Pkcs7 / AnsiX923 / Iso10126 都是 2 参数，进一步根据函数名字或 toString 内容
    const fnStr = pad.pad.toString();
    if (fnStr.includes("Pkcs7")) return "Pkcs7";
    if (fnStr.includes("AnsiX923")) return "AnsiX923";
    if (fnStr.includes("Iso10126")) return "Iso10126";
    return "Pkcs7"; // 默认
  }
  if (len === 1) return "ZeroPadding";
  return "Unknown";
}

function detectMode(mode, algo) {
  if (!mode) return "Unknown";

  const s = mode.$super;
  if (!s) return "Unknown";

  // ECB：没有 ivSize 或 iv = undefined
  if (!algo.ivSize || algo.ivSize === 0) return "ECB";

  // 根据内部方法区分 CBC / CFB / OFB / CTR
  if (s._doCryptBlock && s.createEncryptor && s.createDecryptor) {
    // 进一步区分
    if (s.hasOwnProperty('processBlock')) return "CFB";
    if (s.ivSize && s._doCryptBlock.length === 3) return "CBC";
    return "OFB"; // fallback
  }
  return "Unknown";
}

const getLog = (ctx) => {
  const { rule, self, thisArg, argArray, caller } = ctx;
  rule?.encrypt(ctx)
  let encryptSource;
  try {
    encryptSource = rule?.encryptSource(ctx)
  } catch { }
  return ({ plaintext, cipherText }) => {
    const table = {
      ...(rule.lib !== undefined ? { lib: rule.lib } : {}),
      ...(rule.mode ? { mode: rule.mode(ctx) } : {}),
      ...(rule.padding ? { padding: rule.padding(ctx) } : {}),
      ...(rule.key ? { key: rule.key(ctx) } : {}),
      ...(rule.keyHex ? { keyHex: rule.keyHex(ctx) } : {}),
      ...(rule.keyBase64 ? { keyBase64: rule.keyBase64(ctx) } : {}),
      ...(rule.iv ? { iv: rule.iv(ctx) } : {}),
      ...(rule.ivHex ? { ivHex: rule.ivHex(ctx) } : {}),
      ...(rule.ivBase64 ? { ivBase64: rule.ivBase64(ctx) } : {}),
      ...(rule.algorithm ? { algorithm: rule.algorithm(ctx) } : {}),
      ...(plaintext ? { plaintext: rule?.plaintext({ ...ctx, plaintext }) ?? plaintext } : {}),
      ...(cipherText ? { cipherText: rule?.cipherText?.({ ...ctx, cipherText }) ?? cipherText } : {}),
    };
    console.table(table)
    encryptSource && console.log(encryptSource)
  }
}

const findTargetCaller = (rootCaller, targetSeq) => {
  function tryMatch(node, seqIndex) {
    if (!node) return null;
    if (node.name !== targetSeq[seqIndex]) return null;


    if (seqIndex === targetSeq.length - 1) {
      // 匹配完成，返回最后一个节点的 caller
      return node.caller || null;
    }
    return tryMatch(node.caller, seqIndex + 1);
  }
  function search(node) {
    if (!node) return null;
    const match = tryMatch(node, 0);
    if (match) return match;
    // 从下一个 caller 开始重新尝试
    return search(node.caller);
  }
  return search(rootCaller);
}

const rules = [{
  lib: 'CryptoJS',
  hook: 'apply',
  argsLength: 3,
  funcName: '',
  thisKeys: ['init', '$super', 'cfg', '_xformMode', '_key', '_data', '_nDataBytes', '_mode'],
  argsKeys: [[], ['words', 'sigBytes'], ['init', '$super']],
  chain: ['create', 'createEncryptor', 'encrypt', 'encrypt'],
  key: ({ rule, self, thisArg, argArray }) => argArray[1]?.toString({ stringify: utf8Stringify }),
  keyHex: ({ rule, self, thisArg, argArray }) => argArray[1]?.toString({ stringify: wordArrayToHex }),
  keyBase64: ({ rule, self, thisArg, argArray }) => argArray[1]?.toString({ stringify: wordArrayToBase64 }),
  iv: ({ rule, self, thisArg, argArray }) => argArray[2]?.iv?.toString({ stringify: utf8Stringify }),
  ivHex: ({ rule, self, thisArg, argArray }) => argArray[2]?.iv?.toString({ stringify: wordArrayToHex }),
  ivBase64: ({ rule, self, thisArg, argArray }) => argArray[2]?.iv?.toString({ stringify: wordArrayToBase64 }),
  algorithm: ({ rule, self, thisArg, argArray }) => detectAlgorithm(argArray[2]?.algorithm),
  padding: ({ rule, self, thisArg, argArray }) => detectPadding(argArray[2]?.padding),
  // mode: ({ rule, self, thisArg, argArray }) => argArray[2]?.mode,
  plaintext: ({ rule, self, thisArg, argArray, plaintext }) => plaintext?.toString({ stringify: utf8Stringify }),
  cipherText: ({ rule, self, thisArg, argArray, cipherText }) => cipherText?.toString(),
  encrypt: ({ rule, self, thisArg, argArray, encrypt }) => encrypt && (window.__encrypt__ = (plaintext) => encrypt(plaintext).toString()),
  encryptSource: ({ rule, self, thisArg, argArray, caller }) => findTargetCaller(caller, rule.chain),
  return: ({ returnValue, log, rule, self, thisArg, argArray }) => {
    const finalize_original = thisArg.finalize;
    rule?.encrypt({ returnValue, log, rule, self, thisArg, argArray, encrypt: finalize_original.bind(thisArg) })
    thisArg.finalize = (...args) => {
      const plaintext = args[0];
      const cipherText = finalize_original.apply_original(thisArg, args);
      log({ plaintext, cipherText });
      return cipherText
    }
    return returnValue;
  },
}]

function getCallerDepth(args, depth = 1) {
  try {
    let callee = args?.callee
    while (callee && depth--) {
      callee = callee.caller
    }
    return callee
  } catch {
  }
}

Function.prototype.apply_original = Function.prototype.apply_original ?? Function.prototype.apply;
Function.prototype.call_original = Function.prototype.call_original ?? Function.prototype.call;

// 覆盖 apply
Function.prototype.apply = function (thisArg, argArray) {
  let returnValue = this.apply_original(thisArg, argArray)
  try {
    argArray = argArray ?? []
    const caller = getCallerDepth(arguments, 32)
    if (caller) return returnValue
    const self = this;
    const rule = rules.find(rule =>
      rule.hook === 'apply' &&
      argArray.length === rule.argsLength &&
      this.name === rule.funcName &&
      containsAllUnique(Object.keys(thisArg ?? 0), rule.thisKeys) &&
      Array.from(argArray).every((arg, i) => containsAllUnique(Object.keys(arg), rule.argsKeys[i])));
    if (!rule) return returnValue;
    const log = getLog({ rule, self, thisArg, argArray, caller: arguments?.callee })
    if (rule.return) returnValue = rule.return({ returnValue, log, rule, self, thisArg, argArray });
    else log(returnValue);
  } catch (error) {
    console.error('apply 错误:', error);
  }
  return returnValue;
};

Function.prototype.call = function (thisArg, ...argArray) {
  let returnValue = this.call_original(thisArg, ...argArray)
  try {
    const caller = getCallerDepth(arguments, 32)
    if (caller) return returnValue
    let rule;
    const self = this;
    for (const r of rules) {
      if (argArray.length ===
        r.hook === 'call' &&
        r.argsLength &&
        this.name === r.funcName &&
        containsAllUnique(Object.keys(thisArg ?? 0), r.thisKeys) &&
        Array.from(argArray).every((arg, i) => containsAllUnique(Object.keys(arg), r.argsKeys[i]))) {
        rule = r;
        break;
      }
    }
    if (!rule) return returnValue;
    const log = getLog({ rule, self, thisArg, argArray, caller: arguments?.callee })
    if (rule.return) returnValue = rule.return({ returnValue, log, rule, self, thisArg, argArray });
    else log(returnValue);
  } catch (error) {
    console.error('call 错误:', error);
  }
  return returnValue;
};
欢迎访问Greasy Fork镜像
