bj某dongfang医院js 反混淆 分析结果

没啥特别的手段，就是反混淆，动态调试+替换

const CryptoJS = require('crypto-js');
const forge = require('node-forge');
const axios = require('axios');
const { v4: uuidv4 } = require('uuid');
const qs = require('querystring');

function createRandomStr(length) {
    const chars = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
    let res = '';
    for (let i = 0; i < length; ++i) {
        res += chars[Math.floor(Math.random() * chars.length)];
    }
    return res;
}

function getTimestamp() {
    return Date.now();
}

function getNonce() {  
    let s = 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx';
    return s.replace(/[xy]/g, function (c) {
        const r = Math.random() * 16 | 0;
        const v = c === 'x' ? r : (r & 0x3 | 0x8);
        return v.toString(16);
    });
}

function dictToSortedParamString(d) {
    return Object.keys(d).sort().map(k => `${k}=${d[k]}`).join('&');
}
function genEncryptedParams(mobile, activationKeyType, encryptPublicKey) {

    const params = {
        mobileNumber: mobile,
        activationKeyType: activationKeyType,
        timestamp: getTimestamp(),
        nonce: getNonce()
    };
    const paramStr = dictToSortedParamString(params);
    const sign = CryptoJS.MD5(paramStr).toString();
    const paramStrWithSign = `${paramStr}&sign=${sign}`;
    const h = createRandomStr(16);
    const d = CryptoJS.MD5(h.slice(0, 4) + encryptPublicKey.slice(0, 10) + "54").toString().slice(0, 16);
    const aesKey = CryptoJS.enc.Utf8.parse(d);
    const aesIv = CryptoJS.enc.Utf8.parse(h);
    const encrypted = CryptoJS.AES.encrypt(
        paramStrWithSign,
        aesKey,
        {
            iv: aesIv,
            mode: CryptoJS.mode.CBC,
            padding: CryptoJS.pad.Pkcs7
        }
    );
   
    const encryptedDataB64 = CryptoJS.enc.Base64.stringify(encrypted.ciphertext);
    const encryptedData = encodeURIComponent(encryptedDataB64);

    // RSA公钥加密h
    const pubKeyPem =
        "-----BEGIN PUBLIC KEY-----\n" +
        encryptPublicKey.match(/.{1,64}/g).join('\n') +
        "\n-----END PUBLIC KEY-----";

    const pub = forge.pki.publicKeyFromPem(pubKeyPem);
    // 用 forge 的加密方式
    const encryptedKeyBin = pub.encrypt(h, "RSAES-PKCS1-V1_5");
    const encryptedKeyB64 = Buffer.from(encryptedKeyBin, "binary").toString("base64");
    const encryptedKey = encodeURIComponent(encryptedKeyB64);

    return { encryptedData, encryptedKey };
}
const ACTIVATION_KEY_TYPE = 33;
const encryptPublicKey = `调试可获取`.replace(/\s/g, '');

 const { encryptedData, encryptedKey } = genEncryptedParams('测试', ACTIVATION_KEY_TYPE, encryptPublicKey);

欢迎交流 MTMwMDU4MDAzMA