关于dejs.vip中手工反混淆功能的使用方法
posted@ 2023-10-25
阅读(2536)
编程
手动反混淆模块介绍
dejs.vip最新上线手动解析反混淆功能。我们以手动解析obfuscator混淆代码为例逐步讲解。
混淆原始代码：
function hi() {
console.log("dejs.vip can help me decry javascript code!");
}
hi();
混淆后的代码放在了文章最后面。
函数调用表达式转换
根据混淆后的代码结构，我们将功能部分和函数定义部分拆分开。也就分为下面的内容。当我们在页面中勾选函数调用表达式转换时候，页面将自动显示函数定义代码，函数引用名称两部分。
根据代码结构我们将主要的代码功能抽取出来内容如下,：
function hi() {
var _0x403901 = {
'MqYkK': function(_0x4f8875, _0x966cc6) {
return _0x4f8875(_0x966cc6);
},
'aanxv': function(_0x15b34c, _0x161b34) {
return _0x15b34c + _0x161b34;
},
'VkKlj': function(_0x2f4a4e, _0x48fa8d) {
return _0x2f4a4e === _0x48fa8d;
},
'msjIp': _0x17cecc(0x87, 0xa8, 0xa0, 0x95),
'GzHem': function(_0x4d387d, _0x2c700a) {
return _0x4d387d !== _0x2c700a;
},
'BFYDk': _0x5c2dd9(0x25f, 0x245, 0x257, 0x24f),
'LolAz': _0x17cecc(0x4b, 0x42, 0x28, 0x2b),
'rLEBs': 'ttVqM',
'EmGsF': _0x5c2dd9(0x292, 0x277, 0x285, 0x27e) + '+$',
'iVLZh': _0x17cecc(0x4a, 0x35, 0x4e, 0x67),
'sTudw': _0x17cecc(0x5f, 0x5b, 0x40, 0x62),
'qgNKd': function(_0x17c37a, _0x1a7440) {
return _0x17c37a !== _0x1a7440;
},
'hMsub': _0x5c2dd9(0x26a, 0x25b, 0x275, 0x25d) + _0x17cecc(0x64, 0x50, 0x77, 0x68),
'sYUJh': _0x17cecc(0x7f, 0x89, 0x66, 0x99) + _0x5c2dd9(0x27e, 0x284, 0x27e, 0x2a3) + _0x5c2dd9(0x272, 0x27f, 0x25e, 0x286) + '\x20)',
'SYhHd': _0x5c2dd9(0x285, 0x260, 0x270, 0x276),
'ggGSK': _0x5c2dd9(0x29a, 0x2b0, 0x281, 0x2a4),
'CMuRM': _0x5c2dd9(0x29e, 0x2bf, 0x2b2, 0x28f),
'bUvOO': _0x5c2dd9(0x29d, 0x2bf, 0x278, 0x28c),
'LKfxQ': _0x17cecc(0x7b, 0x8a, 0x88, 0x62),
'FmpHR': _0x17cecc(0x6d, 0x91, 0x68, 0x56),
'cbqUm': 'trace',
'aLtSl': function(_0x5363ba, _0x1cad96) {
return _0x5363ba < _0x1cad96;
},
'GkagR': function(_0x1d68eb, _0x16156d) {
return _0x1d68eb === _0x16156d;
},
'OYZPv': _0x17cecc(0x78, 0x89, 0x61, 0x83),
'JSXmw': _0x5c2dd9(0x296, 0x285, 0x2b7, 0x285) + '2',
'LyGqD': function(_0x5073bc, _0x4365e8, _0x36c6e6) {
return _0x5073bc(_0x4365e8, _0x36c6e6);
},
'dynVf': function(_0x9bd290) {
return _0x9bd290();
},
'vHfEe': function(_0xf6876a, _0x592c73, _0x3c8f64) {
return _0xf6876a(_0x592c73, _0x3c8f64);
},
'EYcpp': function(_0x301e66) {
return _0x301e66();
},
'RTVij': 'dejs.vip\x20c' + _0x17cecc(0x4e, 0x39, 0x69, 0x70) + '\x20decry\x20jav' + 'ascript\x20co' + _0x17cecc(0x5b, 0x7a, 0x49, 0x44)
},
_0x44f127 = (function() {
function _0x1eaa3d(_0x3b383a, _0xd57d6a, _0x37edca, _0x3233cf) {
return _0x5c2dd9(_0x3b383a - -0x149, _0xd57d6a - 0x1bc, _0x3233cf, _0x3233cf - 0x1bb);
}
var _0x463cb1 = {
'ciCXa': _0x1eaa3d(0x123, 0x111, 0x144, 0x104) + '0',
'AWicQ': function(_0xa50688, _0x459648) {
function _0x200da0(_0x20aae5, _0x4280cc, _0x3840ec, _0x3ebb47) {
return _0x1eaa3d(_0x20aae5 - 0xd5, _0x4280cc - 0x6c, _0x3840ec - 0x1d1, _0x4280cc);
}
return _0x403901[_0x200da0(0x1f0, 0x1d4, 0x1cf, 0x203)](_0xa50688, _0x459648);
},
'YpMpe': _0x403901[_0x16718e(0x1f7, 0x1f6, 0x209, 0x1f7)],
'NePqp': _0x403901[_0x16718e(0x22b, 0x213, 0x226, 0x21a)]
};
// 这个代码引用较多
function _0x16718e(_0x260535, _0x5a177d, _0x1214f2, _0x1d80c1) {
return _0x17cecc(_0x5a177d - 0x1ae, _0x5a177d - 0x189, _0x1214f2 - 0xb6, _0x1214f2);
}
var _0x25e2da = !![];
return function(_0x1ae0e6, _0x2b9ca7) {
var _0x1701a0 = {
'MPtXf': function(_0x219dbc, _0x4ca5b9) {
function _0x707107(_0x5dc709, _0x1d72b6, _0x17e467, _0x5b9b54) {
return _0x13f3(_0x5dc709 - 0x24, _0x5b9b54);
}
return _0x403901[_0x707107(0xbd, 0xac, 0xbe, 0x9c)](_0x219dbc, _0x4ca5b9);
},
'DFBve': function(_0x10cd8d, _0x422e36) {
function _0x334ca8(_0x59a0a8, _0x2c0fce, _0x22a194, _0x4411de) {
return _0x13f3(_0x2c0fce - -0x302, _0x4411de);
}
return _0x403901[_0x334ca8(-0x25c, -0x239, -0x21d, -0x242)](_0x10cd8d, _0x422e36);
},
'oozRY': _0x582474(0x8c, 0x98, 0x88, 0x6d) + 'nction()\x20',
'nuGoP': '{}.constru' + _0x582474(0xa9, 0xc1, 0x9c, 0xc1) + 'rn\x20this\x22)(' + '\x20)'
};
// 这个代码引用较多
function _0x582474(_0x376413, _0x49f3e7, _0x39f185, _0x1a7aa3) {
return _0x1eaa3d(_0x39f185 - -0x99, _0x49f3e7 - 0xd6, _0x39f185 - 0x118, _0x376413);
}
// 这个代码引用较多
function _0x19460f(_0x3aa686, _0x265e73, _0x5db3f0, _0x4fe757) {
return _0x16718e(_0x3aa686 - 0x17d, _0x265e73 - 0x7d, _0x5db3f0, _0x4fe757 - 0x1ab);
}
if (_0x403901['VkKlj'](_0x403901[_0x19460f(0x295, 0x2b4, 0x2a7, 0x2b9)], _0x403901[_0x19460f(0x2b7, 0x2b4, 0x2ae, 0x2c6)])) {
var _0x1b6370 = _0x25e2da ? function() {
var _0x579d93 = {};
function _0x11f46(_0x138c5c, _0x1bdd8c, _0x1dbe8e, _0x20dfb0) {
return _0x582474(_0x1dbe8e, _0x1bdd8c - 0xcd, _0x1bdd8c - -0xe7, _0x20dfb0 - 0x60);
}
_0x579d93[_0x11f46(-0x26, -0x2a, -0x2d, -0x38)] = _0x463cb1[_0x11f46(-0x5b, -0x6c, -0x65, -0x63)];
function _0xd14adf(_0x535b16, _0x1c5432, _0x3bc1ba, _0x2963af) {
return _0x19460f(_0x535b16 - 0x125, _0x535b16 - -0x243, _0x3bc1ba, _0x2963af - 0x173);
}
var _0x3a5e82 = _0x579d93;
if (_0x2b9ca7) {
if (_0x463cb1['AWicQ'](_0x463cb1[_0xd14adf(0x5a, 0x3b, 0x3c, 0x76)], _0x463cb1['NePqp'])) {
var _0x53b848 = _0x2b9ca7[_0xd14adf(0x5c, 0x70, 0x70, 0x72)](_0x1ae0e6, arguments);
return _0x2b9ca7 = null, _0x53b848;
} else {
var _0x1f1423 = _0x3a5e82[_0xd14adf(0x6a, 0x59, 0x83, 0x79)][_0x11f46(-0x4b, -0x43, -0x38, -0x5d)]('|'),
_0x421add = -0x536 + 0x2d * 0x29 + -0x1ff;
while (!![]) {
switch (_0x1f1423[_0x421add++]) {
case '0':
_0x364934[_0x15b3b5] = _0x15b365;
continue;
case '1':
_0x15b365[_0xd14adf(0x6b, 0x5d, 0x83, 0x7e)] = _0x4f9844[_0xd14adf(0x45, 0x3c, 0x29, 0x65)](_0x34ff96);
continue;
case '2':
var _0x15b3b5 = _0x5569e6[_0x1dda0d];
continue;
case '3':
_0x15b365[_0x11f46(-0x4c, -0x56, -0x42, -0x78)] = _0x4b0055['toString'][_0x11f46(-0x6e, -0x4f, -0x3e, -0x3f)](_0x4b0055);
continue;
case '4':
var _0x4b0055 = _0x7a1e76[_0x15b3b5] || _0x15b365;
continue;
case '5':
var _0x15b365 = _0x4d7132[_0x11f46(-0x71, -0x58, -0x3a, -0x41) + 'r'][_0x11f46(-0x41, -0x24, -0x3e, -0x16)][_0xd14adf(0x45, 0x55, 0x35, 0x46)](_0x45b753);
continue;
}
break;
}
}
}
} : function() {};
return _0x25e2da = ![], _0x1b6370;
} else _0x75f18e = hYburg[_0x19460f(0x252, 0x26e, 0x27f, 0x259)](_0x3aa762, hYburg[_0x582474(0x74, 0x73, 0x95, 0xa6)](hYburg[_0x19460f(0x2a5, 0x285, 0x2a2, 0x293)](hYburg[_0x19460f(0x283, 0x270, 0x24b, 0x289)], hYburg['nuGoP']), ');'))();
};
}()),
_0x5174cd = _0x403901[_0x5c2dd9(0x269, 0x26f, 0x25a, 0x26c)](_0x44f127, this, function() {
function _0xc1fc9f(_0x2fafb7, _0x82e2b3, _0x140f77, _0x574f1a) {
return _0x5c2dd9(_0x140f77 - -0x36d, _0x82e2b3 - 0x15c, _0x2fafb7, _0x574f1a - 0x1a2);
}
// 这个代码引用较多
function _0x5ac601(_0x5db9b4, _0x37635e, _0x54a35c, _0x562a5d) {
return _0x17cecc(_0x5db9b4 - 0x3c1, _0x37635e - 0x15, _0x54a35c - 0x7b, _0x37635e);
}
if (_0x403901[_0xc1fc9f(-0xe8, -0x104, -0xf8, -0xed)] === _0x403901['rLEBs']) return _0x5174cd[_0xc1fc9f(-0x112, -0x110, -0xfa, -0xf9)]()[_0x5ac601(0x41d, 0x423, 0x418, 0x41b)](_0xc1fc9f(-0xee, -0xca, -0xdb, -0xf6) + '+$')[_0xc1fc9f(-0xfc, -0x101, -0xfa, -0xff)]()[_0xc1fc9f(-0x108, -0x110, -0xfc, -0x118) + 'r'](_0x5174cd)[_0x5ac601(0x41d, 0x431, 0x41b, 0x40a)](_0x403901['EmGsF']);
else {
if (_0x1914c0) {
var _0x54b6d8 = _0x3852ce[_0xc1fc9f(-0xce, -0xfe, -0xdc, -0xea)](_0x548966, arguments);
return _0x354992 = null, _0x54b6d8;
}
}
});
// 这个代码引用较多
function _0x17cecc(_0x39df94, _0x3f1a38, _0x1baf33, _0x55f95a) {
return _0x13f3(_0x39df94 - -0x58, _0x55f95a);
}
_0x403901[_0x5c2dd9(0x2a3, 0x2c3, 0x27f, 0x2b0)](_0x5174cd);
var _0x588682 = (function() {
var _0x5c2a76 = {};
_0x5c2a76[_0x55a34f(-0x2f4, -0x2d6, -0x2dc, -0x2da)] = _0x403901['iVLZh'];
function _0x55a34f(_0x542143, _0xfef6b5, _0x1a30d7, _0x57f6b1) {
return _0x17cecc(_0x57f6b1 - -0x338, _0xfef6b5 - 0x173, _0x1a30d7 - 0x9d, _0x1a30d7);
}
function _0x6064a3(_0x4d95d3, _0x39e15e, _0x19a450, _0x46bce2) {
return _0x5c2dd9(_0x4d95d3 - -0x53b, _0x39e15e - 0x168, _0x46bce2, _0x46bce2 - 0x2);
}
var _0x55d52f = _0x5c2a76;
if (_0x403901[_0x55a34f(-0x30b, -0x2e6, -0x303, -0x2f1)](_0x403901[_0x6064a3(-0x2ab, -0x287, -0x289, -0x2c8)], _0x403901[_0x6064a3(-0x2ab, -0x2c7, -0x2b1, -0x2ab)])) {
var _0x523615 = _0x556ceb ? function() {
function _0x45882b(_0x5c360e, _0x3c1e42, _0x3ae7c7, _0xa3fd32) {
return _0x55a34f(_0x5c360e - 0x1d3, _0x3c1e42 - 0x1c1, _0x5c360e, _0xa3fd32 - 0x3f6);
}
if (_0x324fc5) {
var _0xb53bd0 = _0x8c514d[_0x45882b(0x14e, 0x157, 0x12a, 0x132)](_0x337cfa, arguments);
return _0x539bff = null, _0xb53bd0;
}
} : function() {};
return _0x55a369 = ![], _0x523615;
} else {
var _0x3f6822 = !![];
return function(_0x27f03e, _0x1890a3) {
var _0x40b826 = _0x3f6822 ? function() {
function _0x3ece80(_0x4ec848, _0x24fe4f, _0x562762, _0x253918) {
return _0x13f3(_0x4ec848 - -0x3b7, _0x253918);
}
function _0x56988d(_0x465e07, _0xc5d1e2, _0x45acc2, _0x532b24) {
return _0x13f3(_0x532b24 - -0x187, _0x45acc2);
}
if (_0x3ece80(-0x2f3, -0x2f2, -0x301, -0x308) !== _0x55d52f[_0x3ece80(-0x301, -0x323, -0x309, -0x2f8)]) {
if (_0x1890a3) {
var _0x39f83f = _0x1890a3[_0x3ece80(-0x2eb, -0x300, -0x30f, -0x309)](_0x27f03e, arguments);
return _0x1890a3 = null, _0x39f83f;
}
} else {
var _0x4232ac = _0x27d2ca ? function() {
function _0x4766fd(_0x8b175b, _0x569692, _0x1b61bd, _0x4af167) {
return _0x56988d(_0x8b175b - 0x146, _0x569692 - 0x17d, _0x569692, _0x4af167 - 0x1c1);
}
if (_0x105a17) {
var _0x5c3d63 = _0x5ae677[_0x4766fd(0x111, 0x121, 0xe6, 0x106)](_0x58f514, arguments);
return _0x54835c = null, _0x5c3d63;
}
} : function() {};
return _0x35931d = ![], _0x4232ac;
}
} : function() {};
return _0x3f6822 = ![], _0x40b826;
};
}
}()),
_0x2fe542 = _0x403901[_0x17cecc(0x62, 0x42, 0x7a, 0x49)](_0x588682, this, function() {
var _0x15293a = function() {
var _0x2ce930;
function _0x992bda(_0x20d400, _0x4c6ddd, _0x424a8d, _0x47cbc9) {
return _0x13f3(_0x47cbc9 - 0x4a, _0x4c6ddd);
}
try {
if (_0x403901['qgNKd']('jhsOs', _0x15ae6b(0x2cb, 0x2ae, 0x2cc, 0x2b1))) {
if (_0xe098ae) {
var _0x3f8fb9 = _0x4636ab[_0x992bda(0x134, 0x136, 0x115, 0x116)](_0x3ad332, arguments);
return _0x3301d8 = null, _0x3f8fb9;
}
} else _0x2ce930 = Function(_0x403901[_0x992bda(0x103, 0x10f, 0xf0, 0x113)](_0x403901['hMsub'], _0x403901[_0x15ae6b(0x2ce, 0x2ea, 0x2cb, 0x2e2)]) + ');')();
} catch (_0x18bafb) {
if (_0x403901[_0x992bda(0xce, 0xd2, 0xdf, 0xf2)](_0x403901[_0x992bda(0x103, 0x12e, 0x100, 0x111)], 'KWocs')) {
var _0x2ffeda = _0x139ef3[_0x15ae6b(0x2d4, 0x2c2, 0x2de, 0x2d4)](_0x561867, arguments);
return _0x1e30a5 = null, _0x2ffeda;
} else _0x2ce930 = window;
}
function _0x15ae6b(_0x2089bb, _0x206e0a, _0x593d8d, _0x4f4b87) {
return _0x13f3(_0x2089bb - 0x208, _0x593d8d);
}
return _0x2ce930;
},
_0x4127f9 = _0x15293a(),
_0xe7922a = _0x4127f9['console'] = _0x4127f9[_0x259962(0x47b, 0x459, 0x43c, 0x45b)] || {};
function _0x259962(_0x30efe7, _0x37a559, _0x13abbd, _0x49374e) {
return _0x5c2dd9(_0x37a559 - 0x1be, _0x37a559 - 0x169, _0x49374e, _0x49374e - 0xe);
}
function _0x245203(_0xc94716, _0x3c4f46, _0x55904e, _0x301877) {
return _0x5c2dd9(_0x3c4f46 - -0x4d4, _0x3c4f46 - 0x102, _0xc94716, _0x301877 - 0x188);
}
var _0x2f061d = [_0x245203(-0x275, -0x257, -0x27a, -0x26b), _0x403901[_0x259962(0x428, 0x43e, 0x42a, 0x428)], _0x403901['CMuRM'], _0x403901[_0x259962(0x406, 0x424, 0x447, 0x43f)], _0x403901[_0x245203(-0x21e, -0x232, -0x232, -0x229)], _0x403901[_0x259962(0x430, 0x44b, 0x470, 0x426)], _0x403901[_0x259962(0x459, 0x457, 0x44d, 0x440)]];
for (var _0x4abc6a = -0x315 + -0x1 * 0x149d + 0x17b2; _0x403901[_0x245203(-0x25f, -0x266, -0x274, -0x289)](_0x4abc6a, _0x2f061d['length']); _0x4abc6a++) {
if (_0x403901[_0x245203(-0x21f, -0x23d, -0x23c, -0x245)](_0x403901['OYZPv'], _0x403901['OYZPv'])) {
var _0x5bbf21 = _0x403901[_0x259962(0x478, 0x45f, 0x454, 0x43a)][_0x245203(-0x259, -0x24e, -0x251, -0x232)]('|'),
_0x305d3f = -0x1f13 + 0x230a + -0x3f7;
while (!![]) {
switch (_0x5bbf21[_0x305d3f++]) {
case '0':
var _0xfe9ab9 = _0x588682[_0x259962(0x43e, 0x42f, 0x41d, 0x42a) + 'r'][_0x245203(-0x242, -0x22f, -0x241, -0x20c)][_0x245203(-0x278, -0x25a, -0x262, -0x23a)](_0x588682);
continue;
case '1':
_0xfe9ab9[_0x259962(0x451, 0x45e, 0x465, 0x476)] = _0x588682[_0x245203(-0x23e, -0x25a, -0x257, -0x25f)](_0x588682);
continue;
case '2':
_0xe7922a[_0x31d045] = _0xfe9ab9;
continue;
case '3':
_0xfe9ab9[_0x259962(0x44a, 0x431, 0x415, 0x427)] = _0xa1a981[_0x245203(-0x244, -0x261, -0x256, -0x26b)]['bind'](_0xa1a981);
continue;
case '4':
var _0x31d045 = _0x2f061d[_0x4abc6a];
continue;
case '5':
var _0xa1a981 = _0xe7922a[_0x31d045] || _0xfe9ab9;
continue;
}
break;
}
} else {
var _0x4c3610 = _0x6368c[_0x259962(0x46e, 0x44f, 0x44b, 0x446)](_0x3f1c5b, arguments);
return _0xb4b97e = null, _0x4c3610;
}
}
});
_0x403901['EYcpp'](_0x2fe542);
// 这个代码引用较多
function _0x5c2dd9(_0x1dbead, _0x164441, _0x45fea1, _0x3ea3d6) {
return _0x13f3(_0x1dbead - 0x1c5, _0x45fea1);
}
console[_0x17cecc(0x60, 0x7e, 0x3f, 0x54)](_0x403901['RTVij']);
}
hi();
我们观察代码发现_0x13f3存在较多的引用，输入框函数引用名称也就是 _0x13f3
函数定义代码我们可以整理为下面的代码。直接将其拷贝函数定义代码中。
function _0x226a() {
var _0x10ee2e = ['qgNKd', 'aLtSl', '893691PtuaZM', '1285624fSDSEa', 'constructo', 'rn\x20this\x22)(', 'toString', '155gHvFCb', 'rLEBs', '253144hrhZLO', 'DFBve', 'de!', 'search', 'bind', 'SEkIZ', 'niEKc', 'log', 'ctor(\x22retu', 'vHfEe', 'ggGSK', 'nction()\x20', 'LolAz', '47908HYnHaL', '4219306dnHepk', 'KWocs', 'split', '29SgdfNk', 'jhsOs', 'Jwezy', 'table', 'sYUJh', 'SYhHd', 'FmpHR', 'aanxv', 'YpMpe', 'sTudw', 'apply', '(((.+)+)+)', '103164ZYyIjb', '11iPGZJX', 'xyAFT', '0|4|5|1|3|', 'GkagR', 'exception', 'cbqUm', 'warn', 'console', '{}.constru', 'error', 'info', 'SOsXn', '__proto__', 'JSXmw', 'LKfxQ', 'dynVf', 'QkVMT', 'prototype', 'msjIp', 'ciCXa', 'MqYkK', 'fTBDA', 'MPtXf', '36hiqgUp', 'oozRY', '795630qaJJqp', 'GzHem', 'BFYDk', 'bUvOO', 'pisoj', 'sfKTq', 'LyGqD', 'return\x20(fu', 'an\x20help\x20me', '5|2|4|1|3|'];
_0x226a = function() {
return _0x10ee2e;
};
return _0x226a();
}(function(_0x93113b, _0x467c9d) {
function _0x5bb989(_0x4cfa9b, _0x5a390c, _0x12bf48, _0x15025d) {
return _0x13f3(_0x12bf48 - -0x12, _0x4cfa9b);
}
function _0x22053e(_0x21c11e, _0x33aba2, _0x5e87f0, _0x7524c1) {
return _0x13f3(_0x5e87f0 - 0xa3, _0x7524c1);
}
var _0x51e3bd = _0x93113b();
while (!![]) {
try {
var _0x435a81 = -parseInt(_0x5bb989(0xaf, 0xd5, 0xb0, 0x93)) / (0x46f * 0x3 + -0x3 * -0x57a + -0x5 * 0x5f2) * (parseInt(_0x22053e(0x170, 0x160, 0x161, 0x16e)) / (0x209 * -0x7 + 0x1fab + -0x2e7 * 0x6)) + parseInt(_0x22053e(0x154, 0x134, 0x14d, 0x133)) / (0x37a + -0x4 * 0x781 + 0x1a8d) + -parseInt(_0x22053e(0x16b, 0x157, 0x14e, 0x159)) / (0x1 * 0xc5b + 0x62 * 0x16 + -0x14c3 * 0x1) + parseInt(_0x22053e(0x173, 0x140, 0x152, 0x165)) / (-0xb4 * 0x1d + -0x5 * 0x34b + 0x24e0) * (parseInt(_0x5bb989(0xd6, 0x9f, 0xbc, 0xbb)) / (0xd * -0x2c5 + -0x17be + 0x3bc5)) + parseInt(_0x5bb989(0x90, 0x8b, 0xad, 0x9a)) / (-0x84c + -0x7c3 + -0x1d * -0x8e) + -parseInt(_0x22053e(0x16c, 0x15b, 0x154, 0x138)) / (-0x531 * 0x5 + -0x27 * 0x20 + -0x1 * -0x1edd) * (parseInt(_0x5bb989(0x80, 0x9c, 0x8a, 0x73)) / (0x1 * -0xe17 + -0x2e3 * -0x1 + -0x15 * -0x89)) + parseInt(_0x5bb989(0x9d, 0xab, 0x8c, 0x87)) / (0x1668 + -0x1d6b * 0x1 + 0x5 * 0x169) * (parseInt(_0x22053e(0x169, 0x178, 0x172, 0x16e)) / (-0xac * 0x20 + 0x2343 + -0x1b7 * 0x8));
if (_0x435a81 === _0x467c9d) break;
else _0x51e3bd['push'](_0x51e3bd['shift']());
} catch (_0xe3f6df) {
_0x51e3bd['push'](_0x51e3bd['shift']());
}
}
}(_0x226a, -0x6827b + -0x1 * -0x176b9 + 0x5e76 * 0x1d));
function _0x13f3(_0x5e380c, _0x49afb6) {
var _0x226a0a = _0x226a();
return _0x13f3 = function(_0x13f346, _0x3d0f58) {
_0x13f346 = _0x13f346 - (0x25 * -0x25 + -0x1488 + 0x1b * 0xfb);
var _0x18fa7c = _0x226a0a[_0x13f346];
return _0x18fa7c;
}, _0x13f3(_0x5e380c, _0x49afb6);
}
有了原始代码，函数定义代码，函数引用名称。勾选免责声明后，点击反混淆。我们会发下其中函数引用部分已经被替换掉了。
如果_0x13f3存在子函数循环引用的情况，系统会自动将其替换。内容如下：
function hi() {
var _0x403901 = {
'MqYkK': function (_0x4f8875, _0x966cc6) {
return _0x4f8875(_0x966cc6);
},
'aanxv': function (_0x15b34c, _0x161b34) {
return _0x15b34c + _0x161b34;
},
'VkKlj': function (_0x2f4a4e, _0x48fa8d) {
return _0x2f4a4e === _0x48fa8d;
},
'msjIp': 'QkVMT',
'GzHem': function (_0x4d387d, _0x2c700a) {
return _0x4d387d !== _0x2c700a;
},
'BFYDk': 'fTBDA',
'LolAz': 'sfKTq',
'rLEBs': 'ttVqM',
'EmGsF': '(((.+)+)+)' + '+$',
'iVLZh': 'pisoj',
'sTudw': 'niEKc',
'qgNKd': function (_0x17c37a, _0x1a7440) {
return _0x17c37a !== _0x1a7440;
},
'hMsub': 'return (fu' + 'nction() ',
'sYUJh': '{}.constru' + 'ctor("retu' + 'rn this")(' + ' )',
'SYhHd': 'KWocs',
'ggGSK': 'warn',
'CMuRM': 'info',
'bUvOO': 'error',
'LKfxQ': 'exception',
'FmpHR': 'table',
'cbqUm': 'trace',
'aLtSl': function (_0x5363ba, _0x1cad96) {
return _0x5363ba < _0x1cad96;
},
'GkagR': function (_0x1d68eb, _0x16156d) {
return _0x1d68eb === _0x16156d;
},
'OYZPv': 'xyAFT',
'JSXmw': '0|4|5|1|3|' + '2',
'LyGqD': function (_0x5073bc, _0x4365e8, _0x36c6e6) {
return _0x5073bc(_0x4365e8, _0x36c6e6);
},
'dynVf': function (_0x9bd290) {
return _0x9bd290();
},
'vHfEe': function (_0xf6876a, _0x592c73, _0x3c8f64) {
return _0xf6876a(_0x592c73, _0x3c8f64);
},
'EYcpp': function (_0x301e66) {
return _0x301e66();
},
'RTVij': 'dejs.vip c' + 'an help me' + ' decry jav' + 'ascript co' + 'de!'
}, _0x44f127 = function () {
var _0x463cb1 = {
'ciCXa': '5|2|4|1|3|' + '0',
'AWicQ': function (_0xa50688, _0x459648) {
return _0x403901['GzHem'](_0xa50688, _0x459648);
},
'YpMpe': _0x403901['BFYDk'],
'NePqp': _0x403901['LolAz']
};
var _0x25e2da = !![];
return function (_0x1ae0e6, _0x2b9ca7) {
var _0x1701a0 = {
'MPtXf': function (_0x219dbc, _0x4ca5b9) {
return _0x403901['MqYkK'](_0x219dbc, _0x4ca5b9);
},
'DFBve': function (_0x10cd8d, _0x422e36) {
return _0x403901['aanxv'](_0x10cd8d, _0x422e36);
},
'oozRY': 'return (fu' + 'nction() ',
'nuGoP': '{}.constru' + 'ctor("retu' + 'rn this")(' + ' )'
};
if (_0x403901['VkKlj'](_0x403901['msjIp'], _0x403901['msjIp'])) {
var _0x1b6370 = _0x25e2da ? function () {
var _0x579d93 = {};
_0x579d93['SOsXn'] = _0x463cb1['ciCXa'];
var _0x3a5e82 = _0x579d93;
if (_0x2b9ca7) {
if (_0x463cb1['AWicQ'](_0x463cb1['YpMpe'], _0x463cb1['NePqp'])) {
var _0x53b848 = _0x2b9ca7['apply'](_0x1ae0e6, arguments);
return _0x2b9ca7 = null, _0x53b848;
} else {
var _0x1f1423 = _0x3a5e82['SOsXn']['split']('|'), _0x421add = -1334 + 45 * 41 + -511;
while (!![]) {
switch (_0x1f1423[_0x421add++]) {
case '0':
_0x364934[_0x15b3b5] = _0x15b365;
continue;
case '1':
_0x15b365['__proto__'] = _0x4f9844['bind'](_0x34ff96);
continue;
case '2':
var _0x15b3b5 = _0x5569e6[_0x1dda0d];
continue;
case '3':
_0x15b365['toString'] = _0x4b0055['toString']['bind'](_0x4b0055);
continue;
case '4':
var _0x4b0055 = _0x7a1e76[_0x15b3b5] || _0x15b365;
continue;
case '5':
var _0x15b365 = _0x4d7132['constructo' + 'r']['prototype']['bind'](_0x45b753);
continue;
}
break;
}
}
}
} : function () {
};
return _0x25e2da = ![], _0x1b6370;
} else
_0x75f18e = hYburg['MPtXf'](_0x3aa762, hYburg['DFBve'](hYburg['DFBve'](hYburg['oozRY'], hYburg['nuGoP']), ');'))();
};
}(), _0x5174cd = _0x403901['LyGqD'](_0x44f127, this, function () {
if (_0x403901['rLEBs'] === _0x403901['rLEBs'])
return _0x5174cd['toString']()['search']('(((.+)+)+)' + '+$')['toString']()['constructo' + 'r'](_0x5174cd)['search'](_0x403901['EmGsF']);
else {
if (_0x1914c0) {
var _0x54b6d8 = _0x3852ce['apply'](_0x548966, arguments);
return _0x354992 = null, _0x54b6d8;
}
}
});
_0x403901['dynVf'](_0x5174cd);
var _0x588682 = function () {
var _0x5c2a76 = {};
_0x5c2a76['SEkIZ'] = _0x403901['iVLZh'];
var _0x55d52f = _0x5c2a76;
if (_0x403901['GzHem'](_0x403901['sTudw'], _0x403901['sTudw'])) {
var _0x523615 = _0x556ceb ? function () {
if (_0x324fc5) {
var _0xb53bd0 = _0x8c514d['apply'](_0x337cfa, arguments);
return _0x539bff = null, _0xb53bd0;
}
} : function () {
};
return _0x55a369 = ![], _0x523615;
} else {
var _0x3f6822 = !![];
return function (_0x27f03e, _0x1890a3) {
var _0x40b826 = _0x3f6822 ? function () {
if ('Jwezy' !== _0x55d52f['SEkIZ']) {
if (_0x1890a3) {
var _0x39f83f = _0x1890a3['apply'](_0x27f03e, arguments);
return _0x1890a3 = null, _0x39f83f;
}
} else {
var _0x4232ac = _0x27d2ca ? function () {
if (_0x105a17) {
var _0x5c3d63 = _0x5ae677['apply'](_0x58f514, arguments);
return _0x54835c = null, _0x5c3d63;
}
} : function () {
};
return _0x35931d = ![], _0x4232ac;
}
} : function () {
};
return _0x3f6822 = ![], _0x40b826;
};
}
}(), _0x2fe542 = _0x403901['vHfEe'](_0x588682, this, function () {
var _0x15293a = function () {
var _0x2ce930;
try {
if (_0x403901['qgNKd']('jhsOs', 'jhsOs')) {
if (_0xe098ae) {
var _0x3f8fb9 = _0x4636ab['apply'](_0x3ad332, arguments);
return _0x3301d8 = null, _0x3f8fb9;
}
} else
_0x2ce930 = Function(_0x403901['aanxv'](_0x403901['hMsub'], _0x403901['sYUJh']) + ');')();
} catch (_0x18bafb) {
if (_0x403901['qgNKd'](_0x403901['SYhHd'], 'KWocs')) {
var _0x2ffeda = _0x139ef3['apply'](_0x561867, arguments);
return _0x1e30a5 = null, _0x2ffeda;
} else
_0x2ce930 = window;
}
return _0x2ce930;
}, _0x4127f9 = _0x15293a(), _0xe7922a = _0x4127f9['console'] = _0x4127f9['console'] || {};
var _0x2f061d = [
'log',
_0x403901['ggGSK'],
_0x403901['CMuRM'],
_0x403901['bUvOO'],
_0x403901['LKfxQ'],
_0x403901['FmpHR'],
_0x403901['cbqUm']
];
for (var _0x4abc6a = -789 + -1 * 5277 + 6066; _0x403901['aLtSl'](_0x4abc6a, _0x2f061d['length']); _0x4abc6a++) {
if (_0x403901['GkagR'](_0x403901['OYZPv'], _0x403901['OYZPv'])) {
var _0x5bbf21 = _0x403901['JSXmw']['split']('|'), _0x305d3f = -7955 + 8970 + -1015;
while (!![]) {
switch (_0x5bbf21[_0x305d3f++]) {
case '0':
var _0xfe9ab9 = _0x588682['constructo' + 'r']['prototype']['bind'](_0x588682);
continue;
case '1':
_0xfe9ab9['__proto__'] = _0x588682['bind'](_0x588682);
continue;
case '2':
_0xe7922a[_0x31d045] = _0xfe9ab9;
continue;
case '3':
_0xfe9ab9['toString'] = _0xa1a981['toString']['bind'](_0xa1a981);
continue;
case '4':
var _0x31d045 = _0x2f061d[_0x4abc6a];
continue;
case '5':
var _0xa1a981 = _0xe7922a[_0x31d045] || _0xfe9ab9;
continue;
}
break;
}
} else {
var _0x4c3610 = _0x6368c['apply'](_0x3f1c5b, arguments);
return _0xb4b97e = null, _0x4c3610;
}
}
});
_0x403901['EYcpp'](_0x2fe542);
console['log'](_0x403901['RTVij']);
}
hi();
我们清晰的可以看到函数引用地方已经被替换掉。
对象属性应用转换
但是我们发现_0x403901这对象中有很多属性和方法，完全看不懂，没关系。 我们可以使用对象属性应用转换，其引用地方将会自动替换掉。勾选此选项后，你会发现还有一部分没有被去除掉。这是由于属性是二元表达式，并不是单存的属性值，无法一次完成多种功能，就需要结合二元表达式转换 和序列表达式拆分处理中。
// 这种类型的对象，可以使用对象属性应用转换将其去除。
var _0x403901 = {
'MqYkK': function (_0x4f8875, _0x966cc6) {
return _0x4f8875(_0x966cc6);
},
'aanxv': function (_0x15b34c, _0x161b34) {
return _0x15b34c + _0x161b34;
},
'VkKlj': function (_0x2f4a4e, _0x48fa8d) {
return _0x2f4a4e === _0x48fa8d;
},
'msjIp': 'QkVMT',
'GzHem': function (_0x4d387d, _0x2c700a) {
return _0x4d387d !== _0x2c700a;
},
'BFYDk': 'fTBDA',
'LolAz': 'sfKTq'
}
处理后的代码：
function hi() {
var _0x44f127 = function () {
var _0x25e2da = !![];
return function (_0x1ae0e6, _0x2b9ca7) {
if (true) {
var _0x1b6370 = _0x25e2da ? function () {
_0x579d93['SOsXn'] = '5|2|4|1|3|0';
var _0x3a5e82 = _0x579d93;
if (_0x2b9ca7) {
if (true) {
var _0x53b848 = _0x2b9ca7['apply'](_0x1ae0e6, arguments);
_0x2b9ca7 = null;
return _0x53b848;
} else {
var _0x1f1423 = _0x3a5e82['SOsXn']['split']('|'), _0x421add = 0;
while (!![]) {
switch (_0x1f1423[_0x421add++]) {
case '0':
_0x364934[_0x15b3b5] = _0x15b365;
continue;
case '1':
_0x15b365['__proto__'] = _0x4f9844['bind'](_0x34ff96);
continue;
case '2':
var _0x15b3b5 = _0x5569e6[_0x1dda0d];
continue;
case '3':
_0x15b365['toString'] = _0x4b0055['toString']['bind'](_0x4b0055);
continue;
case '4':
var _0x4b0055 = _0x7a1e76[_0x15b3b5] || _0x15b365;
continue;
case '5':
var _0x15b365 = _0x4d7132['constructor']['prototype']['bind'](_0x45b753);
continue;
}
break;
}
}
}
} : function () {
};
_0x25e2da = ![];
return _0x1b6370;
} else
_0x75f18e = hYburg['MPtXf'](_0x3aa762, hYburg['DFBve'](hYburg['DFBve'](hYburg['oozRY'], hYburg['nuGoP']), ');'))();
};
}(), _0x5174cd = _0x44f127(this, function () {
if (true)
return _0x5174cd['toString']()['search']('(((.+)+)+)+$')['toString']()['constructor'](_0x5174cd)['search']('(((.+)+)+)+$');
else {
if (_0x1914c0) {
var _0x54b6d8 = _0x3852ce['apply'](_0x548966, arguments);
_0x354992 = null;
return _0x54b6d8;
}
}
});
_0x5174cd();
var _0x588682 = function () {
_0x5c2a76['SEkIZ'] = 'pisoj';
var _0x55d52f = _0x5c2a76;
if (false) {
var _0x523615 = _0x556ceb ? function () {
if (_0x324fc5) {
var _0xb53bd0 = _0x8c514d['apply'](_0x337cfa, arguments);
_0x539bff = null;
return _0xb53bd0;
}
} : function () {
};
_0x55a369 = ![];
return _0x523615;
} else {
var _0x3f6822 = !![];
return function (_0x27f03e, _0x1890a3) {
var _0x40b826 = _0x3f6822 ? function () {
if ('Jwezy' !== _0x55d52f['SEkIZ']) {
if (_0x1890a3) {
var _0x39f83f = _0x1890a3['apply'](_0x27f03e, arguments);
_0x1890a3 = null;
return _0x39f83f;
}
} else {
var _0x4232ac = _0x27d2ca ? function () {
if (_0x105a17) {
var _0x5c3d63 = _0x5ae677['apply'](_0x58f514, arguments);
_0x54835c = null;
return _0x5c3d63;
}
} : function () {
};
_0x35931d = ![];
return _0x4232ac;
}
} : function () {
};
_0x3f6822 = ![];
return _0x40b826;
};
}
}(), _0x2fe542 = _0x588682(this, function () {
var _0x15293a = function () {
var _0x2ce930;
try {
if (false) {
if (_0xe098ae) {
var _0x3f8fb9 = _0x4636ab['apply'](_0x3ad332, arguments);
_0x3301d8 = null;
return _0x3f8fb9;
}
} else
_0x2ce930 = Function('return (function() {}.constructor("return this")( ));')();
} catch (_0x18bafb) {
if (false) {
var _0x2ffeda = _0x139ef3['apply'](_0x561867, arguments);
_0x1e30a5 = null;
return _0x2ffeda;
} else
_0x2ce930 = window;
}
return _0x2ce930;
}, _0x4127f9 = _0x15293a(), _0xe7922a = _0x4127f9['console'] = _0x4127f9['console'] || {};
var _0x2f061d = [
'log',
'warn',
'info',
'error',
'exception',
'table',
'trace'
];
for (var _0x4abc6a = 0; _0x4abc6a < _0x2f061d['length']; _0x4abc6a++) {
if (true) {
var _0x5bbf21 = '0|4|5|1|3|2'['split']('|'), _0x305d3f = 0;
while (!![]) {
switch (_0x5bbf21[_0x305d3f++]) {
case '0':
var _0xfe9ab9 = _0x588682['constructor']['prototype']['bind'](_0x588682);
continue;
case '1':
_0xfe9ab9['__proto__'] = _0x588682['bind'](_0x588682);
continue;
case '2':
_0xe7922a[_0x31d045] = _0xfe9ab9;
continue;
case '3':
_0xfe9ab9['toString'] = _0xa1a981['toString']['bind'](_0xa1a981);
continue;
case '4':
var _0x31d045 = _0x2f061d[_0x4abc6a];
continue;
case '5':
var _0xa1a981 = _0xe7922a[_0x31d045] || _0xfe9ab9;
continue;
}
break;
}
} else {
var _0x4c3610 = _0x6368c['apply'](_0x3f1c5b, arguments);
_0xb4b97e = null;
return _0x4c3610;
}
}
});
_0x2fe542();
console['log']('dejs.vip can help me decry javascript code!');
}
hi();
观察上面的代码，你会发现有很多的if判定，其判定条件是true的情况。这个时候好想将无效代码去除。那么就可使用去除if语句
去除if语句
该模块的功能是将条件为假的语句自动去除掉。 比如：
if(true){
console.info(1);
}else{
console.info(2);
}
// 转换为===>
console.info(1);
勾选该功能后再次反混淆
function hi() {
var _0x44f127 = function () {
var _0x25e2da = !![];
return function (_0x1ae0e6, _0x2b9ca7) {
var _0x1b6370 = _0x25e2da ? function () {
_0x579d93['SOsXn'] = '5|2|4|1|3|0';
var _0x3a5e82 = _0x579d93;
if (_0x2b9ca7) {
var _0x53b848 = _0x2b9ca7['apply'](_0x1ae0e6, arguments);
_0x2b9ca7 = null;
return _0x53b848;
}
} : function () {
};
_0x25e2da = ![];
return _0x1b6370;
};
}(), _0x5174cd = _0x44f127(this, function () {
return _0x5174cd['toString']()['search']('(((.+)+)+)+$')['toString']()['constructor'](_0x5174cd)['search']('(((.+)+)+)+$');
});
_0x5174cd();
var _0x588682 = function () {
_0x5c2a76['SEkIZ'] = 'pisoj';
var _0x55d52f = _0x5c2a76;
var _0x3f6822 = !![];
return function (_0x27f03e, _0x1890a3) {
var _0x40b826 = _0x3f6822 ? function () {
if ('Jwezy' !== _0x55d52f['SEkIZ']) {
if (_0x1890a3) {
var _0x39f83f = _0x1890a3['apply'](_0x27f03e, arguments);
_0x1890a3 = null;
return _0x39f83f;
}
} else {
var _0x4232ac = _0x27d2ca ? function () {
if (_0x105a17) {
var _0x5c3d63 = _0x5ae677['apply'](_0x58f514, arguments);
_0x54835c = null;
return _0x5c3d63;
}
} : function () {
};
_0x35931d = ![];
return _0x4232ac;
}
} : function () {
};
_0x3f6822 = ![];
return _0x40b826;
};
}(), _0x2fe542 = _0x588682(this, function () {
var _0x15293a = function () {
var _0x2ce930;
try {
_0x2ce930 = Function('return (function() {}.constructor("return this")( ));')();
} catch (_0x18bafb) {
_0x2ce930 = window;
}
return _0x2ce930;
}, _0x4127f9 = _0x15293a(), _0xe7922a = _0x4127f9['console'] = _0x4127f9['console'] || {};
var _0x2f061d = [
'log',
'warn',
'info',
'error',
'exception',
'table',
'trace'
];
for (var _0x4abc6a = 0; _0x4abc6a < _0x2f061d['length']; _0x4abc6a++) {
var _0x5bbf21 = '0|4|5|1|3|2'['split']('|'), _0x305d3f = 0;
while (!![]) {
switch (_0x5bbf21[_0x305d3f++]) {
case '0':
var _0xfe9ab9 = _0x588682['constructor']['prototype']['bind'](_0x588682);
continue;
case '1':
_0xfe9ab9['__proto__'] = _0x588682['bind'](_0x588682);
continue;
case '2':
_0xe7922a[_0x31d045] = _0xfe9ab9;
continue;
case '3':
_0xfe9ab9['toString'] = _0xa1a981['toString']['bind'](_0xa1a981);
continue;
case '4':
var _0x31d045 = _0x2f061d[_0x4abc6a];
continue;
case '5':
var _0xa1a981 = _0xe7922a[_0x31d045] || _0xfe9ab9;
continue;
}
break;
}
}
});
_0x2fe542();
console['log']('dejs.vip can help me decry javascript code!');
}
hi();
二元表达式转换
该功能主要是将下面这些运算计算出结果。有些是无法进行计算的。比如 var a = 1 + b+ “hello”; 由于你不知道b的类型，或者b是一个函数的参数。
["==" , "!=" , "===" , "!==" , "<" , "<=" , ">" , ">=" , "<<" , ">>" , ">>>" , "+" , "-" , "*" , "/" , "%" , "**" , "," , "^" , "&" , "in" , "instanceof"]
'return (fu' + 'nction() ' // = 装换为==> return (function()
'{}.constru' + 'ctor("retu' + 'rn this")(' + ' )', //==转换为==> {}.constructor("return this")( )
变量声明拆分
多个变量在一行的时候，被拆分为一行一个定义。
var a,b,c,d;
// ==转换为===>
var a;
var b;
var c;
var d;
去除无效变量定义
变量定义后，如仅被使用过一次，这个时候使用该功能，会极大的美化代码。
成员表达式转换
console['log'](_0x403901['RTVij']);
// ==转换为==>
console.log(_0x403901.RTVij);
最后的总结：
将所有的模块全部选择上，转化结果如下。再结合obfuscator伪代码样式去除无效的内容，你会发现反混淆完成了。
以上就是手动反混淆的基本过程，不过ob反混淆里面的处理逻辑比这个多出二十几种。
function hi() {
var _0x44f127 = function () {
var _0x25e2da = !![];
return function (_0x1ae0e6, _0x2b9ca7) {
var _0x1b6370 = _0x25e2da ? function () {
_0x579d93.SOsXn = '5|2|4|1|3|0';
if (_0x2b9ca7) {
var _0x53b848 = _0x2b9ca7.apply(_0x1ae0e6, arguments);
_0x2b9ca7 = null;
return _0x53b848;
}
} : function () {
};
_0x25e2da = ![];
return _0x1b6370;
};
}();
var _0x5174cd = _0x44f127(this, function () {
return _0x5174cd.toString().search('(((.+)+)+)+$').toString().constructor(_0x5174cd).search('(((.+)+)+)+$');
});
_0x5174cd();
var _0x588682 = function () {
_0x5c2a76.SEkIZ = 'pisoj';
var _0x3f6822 = !![];
return function (_0x27f03e, _0x1890a3) {
var _0x40b826 = _0x3f6822 ? function () {
if ('Jwezy' !== _0x5c2a76.SEkIZ) {
if (_0x1890a3) {
var _0x39f83f = _0x1890a3.apply(_0x27f03e, arguments);
_0x1890a3 = null;
return _0x39f83f;
}
} else {
var _0x4232ac = _0x27d2ca ? function () {
if (_0x105a17) {
var _0x5c3d63 = _0x5ae677.apply(_0x58f514, arguments);
_0x54835c = null;
return _0x5c3d63;
}
} : function () {
};
_0x35931d = ![];
return _0x4232ac;
}
} : function () {
};
_0x3f6822 = ![];
return _0x40b826;
};
}();
var _0x2fe542 = _0x588682(this, function () {
var _0x15293a = function () {
var _0x2ce930;
try {
_0x2ce930 = Function('return (function() {}.constructor("return this")( ));')();
} catch (_0x18bafb) {
_0x2ce930 = window;
}
return _0x2ce930;
};
var _0x4127f9 = _0x15293a();
var _0xe7922a = _0x4127f9.console = _0x4127f9.console || {};
var _0x2f061d = [
'log',
'warn',
'info',
'error',
'exception',
'table',
'trace'
];
for (var _0x4abc6a = 0; _0x4abc6a < _0x2f061d.length; _0x4abc6a++) {
var _0x5bbf21 = '0|4|5|1|3|2'.split('|');
var _0x305d3f = 0;
while (!![]) {
switch (_0x5bbf21[_0x305d3f++]) {
case '0':
var _0xfe9ab9 = _0x588682.constructor.prototype.bind(_0x588682);
continue;
case '1':
_0xfe9ab9.__proto__ = _0x588682.bind(_0x588682);
continue;
case '2':
_0xe7922a[_0x31d045] = _0xfe9ab9;
continue;
case '3':
_0xfe9ab9.toString = _0xa1a981.toString.bind(_0xa1a981);
continue;
case '4':
var _0x31d045 = _0x2f061d[_0x4abc6a];
continue;
case '5':
var _0xa1a981 = _0xe7922a[_0x31d045] || _0xfe9ab9;
continue;
}
break;
}
}
});
_0x2fe542();
console.log('dejs.vip can help me decry javascript code!');
}
hi();
end
