关于之前论坛的在线工具箱源码

Zynstream

今天查看了下里面的部分代码，发现有个JS被加密了，static/script/pcjs/img2base64.js

不知道是不是有什么见不得人的操作，图片base64的js都要加密。里面好像涉及到文件读写？

不会JS逆向，有能力大佬破解逆向看看。

1. __=["\x6f\x6e\x6c\x6f\x61\x64","\x67\x65\x74\x45\x6c\x65\x6d\x65\x6e\x74\x42\x79\x49\x64","\x64\x65\x6d\x6f\x5f\x69\x6e\x70\x75\x74","\x72\x65\x73\x75\x6c\x74","\x69\x6d\x67\x5f\x61\x72\x65\x61",'\x75\x6e\x64\x65\x66\x69\x6e\x65\x64',"\x23\x72\x65\x73\x75\x6c\x74","\x68\x74\x6d\x6c","\u62b1\u6b49\uff0c\u4f60\u7684\u6d4f\u89c8\u5668\u4e0d\u652f\u6301 \x46\x69\x6c\x65\x52\x65\x61\x64\x65\x72\uff0c\u8bf7\u4f7f\u7528\u6700\u65b0\u7684\u4e3b\u6d41\u6d4f\u89c8\u5668\u64cd\u4f5c\uff01","\x73\x65\x74\x41\x74\x74\x72\x69\x62\x75\x74\x65",'\x64\x69\x73\x61\x62\x6c\x65\x64',"\x61\x64\x64\x45\x76\x65\x6e\x74\x4c\x69\x73\x74\x65\x6e\x65\x72",'\x63\x68\x61\x6e\x67\x65',"\x66\x69\x6c\x65\x73","\x74\x65\x73\x74","\x74\x79\x70\x65","\x63\x6f\x6c\x6f\x72","\x72\x65\x64","\u8bf7\u786e\u4fdd\u6587\u4ef6\u4e3a\u56fe\u50cf\u7c7b\u578b","\x72\x65\x61\x64\x41\x73\x44\x61\x74\x61\x55\x52\x4c","\x76\x61\x6c","\x23\x69\x6d\x67\x5f\x61\x72\x65\x61",'\x3c\x69\x6d\x67 \x73\x72\x63\x3d\x22','\x22 \x61\x6c\x74\x3d\x22\x70\x63\x6a\x73\x6f\x6e\x2e\x63\x6f\x6d\u56fe\u7247\x42\x61\x73\x65\x36\x34\u7f16\u7801\x22 \x73\x74\x79\x6c\x65\x3d\x22\x6d\x61\x72\x67\x69\x6e\x3a\x61\x75\x74\x6f\x3b\x6d\x61\x78\x2d\x77\x69\x64\x74\x68\x3a\x39\x39\x25\x3b \x6d\x61\x78\x2d\x68\x65\x69\x67\x68\x74\x3a\x31\x30\x30\x30\x70\x78\x3b\x22\x2f\x3e',"\x69\x6e\x64\x65\x78\x4f\x66","\x3c\x69\x6d\x67",'\x22 \x61\x6c\x74\x3d\x22\x70\x63\x6a\x73\x6f\x6e\x2e\x63\x6f\x6d\u56fe\u7247\x42\x61\x73\x65\x36\x34\u7f16\u7801\x22 \x73\x74\x79\x6c\x65\x3d\x22\x6d\x61\x78\x2d\x77\x69\x64\x74\x68\x3a\x39\x39\x25\x3b \x6d\x61\x78\x2d\x68\x65\x69\x67\x68\x74\x3a\x31\x30\x30\x30\x70\x78\x3b\x22 \x2f\x3e','','\u8bf7\u8f93\u5165\x42\x61\x73\x65\x36\x34\u7f16\u7801\x21',"\x62\x61\x73\x65\x36\x34",'\u8bf7\u8f93\u5165\u6b63\u786e\u7684\x42\x61\x73\x65\x36\x34\u56fe\u7247\u7f16\u7801\x21',"","\x73\x65\x6c\x65\x63\x74"];window[__[0]] = function () {var s1 = window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"][__[1]](__[2]);var iEhm_Wab2 = window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"][__[1]](__[3]);var U3 = window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"][__[1]](__[4]);if (typeof (FileReader) === __[5]) {$(__[6])[__[7]](__[8]);s1[__[9]](__[10], __[10]);} else {s1[__[11]](__[12], readFile, false);}};function readFile() {var HdFtRd4 = this[__[13]][0];if (!/image\/\w+/[__[14]](HdFtRd4[__[15]])) {result[__[9]](__[16], __[17]);$(__[6])[__[7]](__[18]);return false;};var QKjaGzEwW5 = new FileReader();QKjaGzEwW5[__[19]](HdFtRd4);QKjaGzEwW5[__[0]] = function (__2) {$(__[6])[__[20]](this[__[3]]);$(__[21])[__[7]](__[22] + this[__[3]] + __[23]);}};function imgfun() {var FvLIJXGV6 = $(__[6])[__[20]]();if (FvLIJXGV6[__[24]](__[25]) < 0) {$(__[6])[__[20]](__[22] + FvLIJXGV6 + __[26]);$(__[21])[__[7]](__[27] + $(__[6])[__[20]]() + __[27]);}};function base642img(){var $PCqnyyI7 = $(__[6])[__[20]]();if ($PCqnyyI7==__[27]){pcjson_com_msg($(__[6]),__[28]);};if ($PCqnyyI7[__[24]](__[29]) < 0){pcjson_com_msg($(__[6]),__[30]);};if ($PCqnyyI7[__[24]](__[25]) < 0) {$(__[6])[__[20]](__[22] + $PCqnyyI7 + __[26]);$(__[21])[__[7]](__[27] + $(__[6])[__[20]]() + __[27]);}};function empty() {$(__[21])[__[7]](__[31]);$(__[6])[__[20]](__[31]);$(__[6])[__[32]]();}

复制代码

xshell

这个？
https://tool.tvv.tw/

cnskis

好像没什么。你看看：https://netcut.cn/hostloc
粘贴进去了

orz2

https://tool.lu/js/  

只是简单的替换关键词。

onecloud

cnskis 发表于 2022-3-16 14:00
好像没什么。你看看：https://netcut.cn/hostloc
粘贴进去了

大佬你这个网址有git吗

cnskis

onecloud 发表于 2022-3-16 14:32
大佬你这个网址有git吗

我随便百度的一个，网络剪切板，你去搜一下，应该有类似的。

蝙蝠侠

按解码工具和实际使用来看，它是在追加img标签的时候把自己网址插入到alt

acg88

蝙蝠侠 发表于 2022-3-16 14:52
按解码工具和实际使用来看，它是在追加img标签的时候把自己网址插入到alt

追加了什么网址？mjj让他剑皇

escn

acg88 发表于 2022-3-16 15:54
追加了什么网址？mjj让他剑皇

pcjson.com