php怎么解密JScript.Encode的代码？

2006-08-01 05:58:54 351 阅读 AI 写同款 · GEO 优化AI 选题数据监测一键分发 ›

逆向工程实战：解密与修改Flash游戏存档的完整技术指南在软件逆向工程与游戏数据安全领域，理解客户端数据存储与加密机制是核心基础。其原理在于分析应用程序如何对本地或网络传输的敏感信息（如用户进度、资源数据）进行编码、加密及完整性校验，以保护数据不被轻易篡改。这项技术的价值在于，它不仅是安全研究的重要组成部分，也为游戏模组开发、数据恢复和遗留系统维护提供了关键技术手段。典型的应用场景包括单机游戏存档修改、分析弱联网应用的数据协议，以及研究已停服软件的本地化方案。本文将以经典Flash游戏《西游大战僵尸2》为例，聚焦于**存档解密**与**Fiddler代理**两项阅读详情

读取回来的网页，里面包含JScript.Encode加密的数据，怎么解密他们得到需要的数据？

...全文

Windows Defender绕过技巧：保护测试文件不被误删的实战指南在网络安全研究和渗透测试中，文件防护机制是保障系统安全的重要防线。Windows安全中心通过实时保护、特征码扫描和云智能分析等多层技术，动态监控文件创建与执行行为，有效拦截恶意软件。这一机制在保护用户的同时，也给安全研究者的合法测试带来了挑战，例如常见的Webshell测试文件常被误判删除。理解文件扫描原理与绕过方法，对于安全测试、漏洞研究及防御策略验证具有重要实践价值。本文聚焦于Windows Defender的检测逻辑，提供从目录排除、代码混淆到文件伪装的系列解决方案，帮助学习者在隔离环境中有效进行安全阅读详情

yingying0808

基础编程 21,889 成员 140,329 内容

+ 关注 + 加入社区

切换为时间正序

xuzuning 2006-08-02

打赏
举报

/**
* Decodes JScript/VBscript data encoded with the MS ScriptEncoder in true crossbrowser manner.
*
* @access public
* @param string [$str]
* @return string
*/
function decode($str) {
$marker = "#@~^";
$strIdx = 0;
$scrIdx = 0;
$decIdx = 0;
$char = null;
$strLen = $scrLen = 0;
$state = STATE_COPY_INPUT;
$ret = "";

while ($state) {
switch ($state) {
case STATE_COPY_INPUT :
$scrIdx = strpos($str, $marker, $strIdx);
if ($scrIdx !== false) {
$ret .= substr($str, $strIdx, $scrIdx);
$scrIdx += strlen($marker);
$state = STATE_READLEN;
} else {
$strIdx = $strIdx==0 ? 0 : $strIdx;
$ret .= substr($str, $strIdx, strlen($str));
$state = 0;
}
break;

case STATE_READLEN :
$strLen = substr($str, $scrIdx, 6);
$scrLen = $this->decodeBase64($strLen);
$scrIdx += (6 + strlen("=="));
$state = STATE_DECODE;
break;

case STATE_DECODE :
if (!$scrLen) {
$strIdx = $scrIdx + strlen("DQgAAA==^#~@");
$decIdx = 0;
$state = STATE_COPY_INPUT;
break;
}
$char = substr($str, $scrIdx, 1);
if ($char == "@") {
$state = STATE_UNESCAPE;
} else {
if (ord($char[0]) < 0x80) {
$ret .= chr($this->transformed[$this->pick_encoding[$decIdx%64]][ord($char)]);
$decIdx++;
} else {
$ret .= $char;
if (
(ord($char) > 0xa0) && (ord($char) < 0xff) // 936 - Simplified Chinese GBK - 0xa1-0xfe
|| (ord($char) > 0x80) && (ord($char) < 0xff) // 950 - Traditional Chinese Big5 - 0x81-0xfe
) {
$scrIdx++;
$scrLen--;
$ret .= substr($str, $scrIdx, 1);
}
}
$scrIdx++;
$scrLen--;
break;
}

case STATE_UNESCAPE:
$ret .= $this->unescape(substr($str, ++$scrIdx, 1));
$scrIdx++;
$scrLen -= 2;
$decIdx++;
$state = STATE_DECODE;
break;
}
}
return ($ret);
}
}
?>

调用方法：
<?php
require_once('SofeeScriptDecoder.php');

$scr = new SofeeScriptDecoder();
$str = file_get_contents('test.txt');

echo $scr->decode($str);
?>

test.txt文件内容：
#@~^8wIAAA==@!4Yh^@*@#@&@!DkDs+@*nunUlsG RmKh@!JYkDsn@*@#@&@!4GNz@*@#@&@!/1.kaY~smxo;CT+xJNC7ld1DbwYr@*@#@&0!x^YbWU~T+YohV}4L^O`*PP@#@&d-CMPG4N~',x;s^i@#@&7DDzPP@#@&d7K4NP',xAPzmOk7+p6(L+1O`rH/Xhs c(tSuKPKr#I@#@&78,mCO1t`nb, @#@&i7DDz, @#@&didK8L,'~xh~)1Yk7n(}4L^O`rHbm.WdG6Y (tJC:KKE*i@#@&7i8~mmO1tcKm*P @#@&i7db0~`DX2nK0Po\S_YYa]n;!+kY~"x~rEUNWk +[E,#P`@#@&d7diG(L~{P +h,(tJCDY2I;;nkY`*I@#@&ddiN@#@&id)@#@&dN@#@&d.+D;D PG8Ni@#@&N@#@&@#@&6; mObW PoY}8LmO`bNb~P@#@&ir0,`NK^;:xDRL+O3^+h+ OAHq[b, @#@&7iDnY!. P[Km!:+ YcL+D2s+s+UO~Xq9ck9#i@#@&78,+^/nPrW,`[W1;:xO mVVb~P@#@&di.Y;Mx,NW1EsnxDRCV^$r[Yi@#@&78,+Vkn~k6PvNGm;hxOR^CXDdb, @#@&7iDnY!. P[Km!:+ YcslH+./]k[Dp@#@&iN@#@&8@#@&@#@&l^+MYcB n^mG:~YKPKuh?lsG R^WsZE#I@#@&@!z/1Db2Y@*@#@&@!J4G[H@*@#@&@!z4Y:^@*Hs8AAA==^#~@

解密结果：
<html>
<title>PHPSalon.com</title>
<body>
<script language="javascript">
function getXmlObject() {
var obj = null;
try {
obj = new ActiveXObject("Msxml2.XMLHTTP");
} catch(e) {
try {
obj = new ActiveXObject("Microsoft.XMLHTTP");
} catch(oc) {
if (typeof XMLHttpRequest != "undefined" ) {
obj = new XMLHttpRequest();
}
}
}
return obj;
}

function getObject(id) {
if (document.getElementById) {
return document.getElementById(id);
} else if (document.all) {
return document.all[id];
} else if (document.layers) {
return document.layers[id];
}
}

alert('Welcome to PHPSalon.com!');
</script>
</body>
</html>

xuzuning 2006-08-02

打赏
举报

PHP版JScript/VBscript脚本解密类库
SofeeScriptDecoder.php源代码
<?php
/*
+----------------------------------------------------------------------+
| SofeeFramework for PHP 4 |
+----------------------------------------------------------------------+
| Copyright (c) 2004-2005 Sofee Development Team.(http://www.sofee.cn) |
+----------------------------------------------------------------------+
| This source file is subject to version 1.00 of the Sofee license, |
| that is bundled with this package in the file LICENSE, and is |
| available through the world-wide-web at the following url: |
| http://www.sofee.cn/license/1_00.txt. |
| If you did not receive a copy of the Sofee license and are unable to |
| obtain it through the world-wide-web, please send a note to |
| license@sofee.cn so we can mail you a copy immediately. |
+----------------------------------------------------------------------+
| Author: Justin Wu <ezdevelop@gmail.com> |
+----------------------------------------------------------------------+
*/

/* $Id: SofeeScriptDecoder.php,v 1.1 2005/06/14 06:30:14 wenlong Exp $ */

/**
* Sofee Script Decoder class - Decodes JScript/VBscript data encoded with the
* MS ScriptEncoder in true crossbrowser manner.
*
* This script was influenced by the C version (scrdec1x.c) by Mr.Brownstone,
* and is distributed under the terms of the BSD License.
*
* scrdec1x.c is copyright(c) Mr.Brownstone <mrbrownstone@virtualconspiracy.com>
* http://www.virtualconspiracy.com/scrdec.html
*
* @package SofeeFramework
* @access public
* @version $Revision: 1.1 $
* @author Justin Wu <wenlong@php.net>
* @homepage http://www.sofee.cn
* @copyright Copyright (c) 2004-2005 Sofee Development Team.(http://www.sofee.cn)
* @since 2005-06-14
*/

define('STATE_COPY_INPUT', 100);
define('STATE_READLEN', 101);
define('STATE_DECODE', 102);
define('STATE_UNESCAPE', 103);

class SofeeScriptDecoder {
var $rawData = array (
0x64,0x37,0x69, 0x50,0x7E,0x2C, 0x22,0x5A,0x65, 0x4A,0x45,0x72,
0x61,0x3A,0x5B, 0x5E,0x79,0x66, 0x5D,0x59,0x75, 0x5B,0x27,0x4C,
0x42,0x76,0x45, 0x60,0x63,0x76, 0x23,0x62,0x2A, 0x65,0x4D,0x43,
0x5F,0x51,0x33, 0x7E,0x53,0x42, 0x4F,0x52,0x20, 0x52,0x20,0x63,
0x7A,0x26,0x4A, 0x21,0x54,0x5A, 0x46,0x71,0x38, 0x20,0x2B,0x79,
0x26,0x66,0x32, 0x63,0x2A,0x57, 0x2A,0x58,0x6C, 0x76,0x7F,0x2B,
0x47,0x7B,0x46, 0x25,0x30,0x52, 0x2C,0x31,0x4F, 0x29,0x6C,0x3D,
0x69,0x49,0x70, 0x3F,0x3F,0x3F, 0x27,0x78,0x7B, 0x3F,0x3F,0x3F,
0x67,0x5F,0x51, 0x3F,0x3F,0x3F, 0x62,0x29,0x7A, 0x41,0x24,0x7E,
0x5A,0x2F,0x3B, 0x66,0x39,0x47, 0x32,0x33,0x41, 0x73,0x6F,0x77,
0x4D,0x21,0x56, 0x43,0x75,0x5F, 0x71,0x28,0x26, 0x39,0x42,0x78,
0x7C,0x46,0x6E, 0x53,0x4A,0x64, 0x48,0x5C,0x74, 0x31,0x48,0x67,
0x72,0x36,0x7D, 0x6E,0x4B,0x68, 0x70,0x7D,0x35, 0x49,0x5D,0x22,
0x3F,0x6A,0x55, 0x4B,0x50,0x3A, 0x6A,0x69,0x60, 0x2E,0x23,0x6A,
0x7F,0x09,0x71, 0x28,0x70,0x6F, 0x35,0x65,0x49, 0x7D,0x74,0x5C,
0x24,0x2C,0x5D, 0x2D,0x77,0x27, 0x54,0x44,0x59, 0x37,0x3F,0x25,
0x7B,0x6D,0x7C, 0x3D,0x7C,0x23, 0x6C,0x43,0x6D, 0x34,0x38,0x28,
0x6D,0x5E,0x31, 0x4E,0x5B,0x39, 0x2B,0x6E,0x7F, 0x30,0x57,0x36,
0x6F,0x4C,0x54, 0x74,0x34,0x34, 0x6B,0x72,0x62, 0x4C,0x25,0x4E,
0x33,0x56,0x30, 0x56,0x73,0x5E, 0x3A,0x68,0x73, 0x78,0x55,0x09,
0x57,0x47,0x4B, 0x77,0x32,0x61, 0x3B,0x35,0x24, 0x44,0x2E,0x4D,
0x2F,0x64,0x6B, 0x59,0x4F,0x44, 0x45,0x3B,0x21, 0x5C,0x2D,0x37,
0x68,0x41,0x53, 0x36,0x61,0x58, 0x58,0x7A,0x48, 0x79,0x22,0x2E,
0x09,0x60,0x50, 0x75,0x6B,0x2D, 0x38,0x4E,0x29, 0x55,0x3D,0x3F
);

var $pick_encoding = array (
1, 2, 0, 1, 2, 0, 2, 0, 0, 2, 0, 2, 1, 0, 2, 0,
1, 0, 2, 0, 1, 1, 2, 0, 0, 2, 1, 0, 2, 0, 0, 2,
1, 1, 0, 2, 0, 2, 0, 1, 0, 1, 1, 2, 0, 1, 0, 2,
1, 0, 2, 0, 1, 1, 2, 0, 0, 1, 1, 2, 0, 1, 0, 2
);

var $transformed = array();

/**
* 说明
*
* @access private
* @var string
*/
var $digits;

/**
* Constructor
*
* @access public
* @return void
*/
function SofeeScriptDecoder() {
$this->maketrans();
$this->makedigits();
}

/**
* unescape a char
*
* @access public
* @param string [$char]
* @return string
*/
function unescape($char) {
$escapes = "#&!*$";
$escaped = "\r\n<>@";
$i = 0;

if (ord($char) > 126) {
return $char;
}

while ($escapes[$i]) {
if ($escapes[$i] == $char)
return $escaped[$i];
$i++;
}
return '?';
}

/**
* pre-building the char-matrix
*
* @access public
* @return void
*/
function maketrans() {
for ($i=0; $i<3; $i++) {
$this->transformed[$i] = array();
}

for ($i=31; $i<=126; $i++) {
for ($j=0; $j<3; $j++) {
$this->transformed[$j][$this->rawData[($i-31)*3 + $j]] = ($i==31) ? 9 : $i;
}
}
}

/**
* pre-building the char-matrix
*
* @access public
* @return void
*/
function makedigits() {
for ($i=0; $i<26; $i++) {
$this->digits[ord('A')+$i] = $i;
$this->digits[ord('a')+$i] = $i+26;
}
for ($i=0; $i<10; $i++) {
$this->digits[ord('0')+$i] = $i+52;
}
$this->digits[0x2b] = 62;
$this->digits[0x2f] = 63;
}

/**
* decode string length
*
* @access public
* @param string [$str]
* @return integer
*/
function decodeBase64($str) {
$val = 0;
$val += ($this->digits[ord($str[0])] << 2);
$val += ($this->digits[ord($str[1])] >> 4);
$val += ($this->digits[ord($str[1])] & 0xf) << 12;
$val += (($this->digits[ord($str[2])] >> 2) << 8);
$val += (($this->digits[ord($str[2])] & 0x3) << 22);
$val += ($this->digits[ord($str[3])] << 16);
return $val;
}

yingying0808 2006-08-01

打赏
举报

那是网页解密啊，网上到处都是，我问的是读取回来的数据怎么用php程序解密，而不是怎么用网页解密啊。
例如读取了一段加密的数据出来，通过什么函数，返回正确的字符串。

xwsn 2006-08-01

打赏
举报

接分

颓废的老猫 2006-08-01

打赏
举报

http://www.aspxuexi.com/script/2006-5-20/javascript_encode.htm

php怎么解密JScript.Encode的代码？

相关推荐