当前位置：首页 > news >正文

某海外 _signature签名分析

news 2026/8/6 19:52:39

1. 目标

aHR0cHM6Ly93d3cudGlrdG9rLmNvbS9hcGkvc2hvcC91cy9ob21lcGFnZV9kZXNrdG9wL3NlYXJjaF93b3JkX3N1Z2dlc3Rpb24/bXNUb2tlbj1mWEItOHRoRU9hNllIblkyellKM1lLaDlBMUtGeks3NnpXWjk2bnRwMUlldjNjTDFBdmNQRllpTmtLVllXUThLNVhYUkdJRFd4VjM2ekxWWEtPNFNLLWNGUFpjLU44cGhab1pWMW1kVWxwNi01Sm8xdVZkQjM4bHBBSU1oZzN1T000dnNPeE1xRHM0LTFTMD0mWC1Cb2d1cz1ERlN6c3dTTy16MFFvRHlhQ0ZVMnpJWEZoc3E3Jl9zaWduYXR1cmU9XzAyQjRaNndvMDAwMDFVSVFBd1FBQUlERG9kLnprZ05HaTlWQ0VBZUFBRG5MYWQNCg==

2.debug

2.1. 断点

2.2 目标栈

2.3 日志断点

目标位于控制流里面，所有的数都是控制流里出的
日志断点1

"执行 l->",l,"执行func->", l[Cb[110]]," 参数 U-> ",U,"返回 B->",B

日志断点2

B&&console.log("执行 m->",m,"执行func->",Gb[237]," 参数 i-> ",i," 参数 s-> ",s," 参数 u-> ",u," 参数 g-> ",g," 参数 c-> ",c," 参数 d-> ",d," 参数 f-> ",f," 参数 h-> ",h)

日志断点3

B&&console.log("执行 Cb->",Cb,"执行func->", Cb[0]," 参数 B[0]-> ",B[0]," 参数 W-> ",W," 参数 N-> ",N," 参数 B[1]-> ",B[1])

日志断点4

!B&&console.log("执行 U->",U,"执行func->", U[Gb[1]]," 对象 W-> ",W," 参数 N-> ",N,"返回 M->",M,"typeof M:",typeof M)

3.日志分析

3.1 扣代码

从x-bogus完结开始就是signature的签名，然后开始扣代码

这里开始，会有个时间戳的计算，扣代码不必讲
这些代码最后会拿到一些数

9277170541566359821e_s35391881347265e_s_ma2185601929e_s_ua3083975405bodyhash3093772032paramshash1472233066Canvas3102997541

3.2 计算值

控制流出数，部分不复杂的计算是直接丢在控制里面的，非常需要耐心，这是我的一些控制流计算日志

9277170541566359821e_s35391881347265e_s_ma2185601929e_s_ua3083975405bodyhash3093772032paramshash1472233066Canvas3102997541e_s3539188134726535391881347265>>2337707056337707056>>242020&632020<26?20+65 ->U337707056>>1812881288&6388<268+65 ->I337707056>>128244882448&63168<2616+65 ->Q337707056>>65276672&63->I337707056337707056&6348I{35}5226<48<5248+71 ->w UIQAw ---4294967296//未知35391881347265<<282684354568240>>4515//8240未知268435456+515268435971268435971//推测>>2416<2616+65>Q268435971//推测>>181024&63+65>A268435971>>12&63+65 ->A268435971>>6&63+65 ->I268435971&63+65 ->D ***QAAID ---3102997541//画布353918813472653102997541^35391881347265 //-3947896608240<<26//-1073741824R=60940275-1073741824^60940275 //-1012801549 -1012801549>>24-61 -61&63=3->D ***Dod.z --- -394789660 //上一步画布 -394789660&63>3636+71>k ----1472233066//paramshash1472233066%6552141717-2133744907 //？？ -2133744907>>2-533436227 -533436227&63>-32 -32&63+65>g ***gNGi9 -----35391881347265-2133744907 -2133744907>>28//-81350828513//?1350828513>>>4//844267821426604062//?1426604062>>248585&63+65 ->V *** VCEAe ----1566359821%65521=14795//1566359821时间戳计算一次14795>>24//00&63+65 ->A *** AADnL ----1350828513//出现于 gNGi9输出后1350828513<<26//-20803747841350828513|0;-2080374784>>24-124 -124&63+65//E *** EAAAA ---0&63+65//A ---1350828513输出"_02B4Z6wo00001UIQAwQAAIDDod.zkgNGi9VCEAeAADnL"-- bodyHash(0,"_02B4Z6wo00001UIQAwQAAIDDod.zkgNGi9VCEAeAADnL")//854188717 扣代码 parseInt(854188717).toString("16")// 32e9e2ad 32e9e2ad slice6,8//ad"_02B4Z6wo00001UIQAwQAAIDDod.zkgNGi9VCEAeAADnLad"