Extremely Knowing v2 Analysis

案例地址：geetest.com/Register
案例内容：Analyzing the detection when logging inV2提交的Request Payload信息.

The content of the article is only for learning reference,如有侵权请联系作者进行删除

---

---

接口分析

POST请求

加密Payload：

---

参数定位

长话短说,通过XHR断点.

往回走5You can see where the parameters are generated.

According to the debug information and the value in the interface comparison,发现e = DWYi[ymDv(1137)](l)是payload的其中一部分.

继续调试,发现代码：e + h[AUJ_(1173)]

Combining debugging information to draw conclusions：payload = DWYi[ymDv(1137)](l) + h[AUJ_(1173)]

---

h[AUJ_(1173)]

经测试,h是动态的,其中的aeskey和rsa的值不固定.

再次分析源码,可知 h = o[AUJ_(1156)]()

继续调试,AUJ_(1156) = ‘LpFU’

双击点进去,找到对应的方法.

Put the contents of this file in Lxtools Dissolve the confusion,Variable names are restored.

The overall code structure after copying to local formatting is as follows：

Discovery is a self-executing method,After manual processing, it can be changed to the following：

Then make up the environment according to the error,Such as these appear

Run it again after finishing,会返回MlHc. Then modify the code,让其返回 LkEB['prototype'].LpFU().

运行测试,成功打印了 o[AUJ_(1156)](),raised from itrsa参数即可.

---

DWYi[ymDv(1137)](l)

Check out the meanings first,其中 l 是EbF_[ymDv(409)](e, h[ymDv(1194)]),调用方法为DWYi['tc_t']

---

先看 l

Know it here aeskey It is analyzed from the first paragraph of our analysis o[AUJ_(1156)]() extracted from the object.

此处的e actions are includedid、行为轨迹,and unknown parameters.

EbF_[ymDv(409)]是对应的encrypt加密方法.Available locallyJOOO返回,JOOO在EbF_中.

那可以直接使用 EbF_.encrypt()to call the encryption method.

即：EbF_.encrypt(e, h[ymDv(1194)])

本地调用,成功生成 l .

---

调用tc_t

有了l 之后,We are making upJS中直接调用DWYi.tc_t(l) 即可.

总体流程：

// 注册 _asekey_rsa 
_asekey_rsa = LkEB['prototype'].LpFU()
rsa = _asekey_rsa.rsa
aeskey = _asekey_rsa.aeskey
// 生成 l
var l = EbF_.encrypt(e,aeskey)
// 加密后拼接
return DWYi.tc_t(l)+rsa

打印结果：

---

总结

The main content is process analysis and processing and calling of obfuscated code.

The content of the article is only the skin of the relatively well-informed detection,only analyzedPayload参数,In-depth detection and analysis is a long way to go.

The auxiliary code for this article is in the official account《Pythonlx》回复 shenzhi 领取.