一键 hook 自吐脚本网页版¶

前言¶

本文介绍在 js 逆向中可能会用到的自吐脚本，原理与 app 逆向中安卓自吐的几种方法的 frida 自吐算法脚本中的一致。

目前常用的 js hook 自吐脚本如下：

js hook 自吐常见加密算法，比如 hook Crypto RSA, AES, DES, 3DES, HMAC, SHA 等常用方法
一些其它常见的 js hook 方法：
- hook request headers 请求头参数脚本，请在企查查 headers 请求数据获取方法说明文档中查看
- hook cookie 的 js 本地生成的脚本，请在房天下滑块验证全流程说明文档中查看
- 补环境（自吐环境）的脚本，请在 v_jstools 自吐环境说明和补环境框架使用介绍中查看

1. 前提条件¶

自测在 Nexus 5x 的 root 安卓 8.1.0 同样成功

js hook 自吐脚本使用前准备如下：

浏览器：用于调试，Google 或 firefox 等不限制
油猴插件：用于编写和管理 js hook 的脚本

2. 操作步骤¶

2.1. 浏览器安装油猴¶

这里不再详细说明如何在浏览器上安装油猴插件，这里放上官方安装及使用说明链接。

各浏览器安装油猴的方法：Greasy Fork 官方文档

2.2. 编写 js 自吐脚本¶

同样，这里不再介绍如何通过油猴来编写脚本，具体请在官网中查看，这里只展示对应的脚本内容。

2.2.1. 一键 hook 加密算法¶

// ==UserScript==
// @name         一键Hook加密算法
// @namespace    By:亮亮
// @version      1.2
// @description  一键Hook Crypto RSA 几个基本的方法  AES DES 3DES Hmac  SHA
// @author       liangliang
// @match        https://*/*
// @match        http://*/*
// @icon         data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==
// @grant        none
// ==/UserScript==

(function() {
    'use strict';
    console.log("亮亮网页Hook脚本初始化成功");
    //过dubugger
    var constructorEx = constructor;
    Function.prototype.constructor = function(s) {
        if (s == "debugger") {
            return null;
        }
        return constructorEx(s);
    }

    window.SHook = true
    window.IsDebugger = false
    function hex2b64(h) {
        var b64map = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
        var i;
        var c;
        var ret = "";
        for (i = 0; i + 3 <= h.length; i += 3) {
            c = parseInt(h.substring(i, i + 3), 16);
            ret += b64map.charAt(c >> 6) + b64map.charAt(c & 63);
        }
        if (i + 1 == h.length) {
            c = parseInt(h.substring(i, i + 1), 16);
            ret += b64map.charAt(c << 2);
        } else if (i + 2 == h.length) {
            c = parseInt(h.substring(i, i + 2), 16);
            ret += b64map.charAt(c >> 2) + b64map.charAt((c & 3) << 4);
        }
        while ((ret.length & 3) > 0)
            ret += "=";
        return ret;
    }
    if (window.CryptoJS != undefined) {
        var Crypto = window.CryptoJS
        //AES加解密
        if (Crypto.AES != undefined) {
            var AESencrypt = Crypto.AES.encrypt
            var AESdecrypt = Crypto.AES.decrypt
            window.CryptoJS.AES.encrypt = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return AESencrypt(arguments[0], arguments[1], arguments[2])
                }
                console.log('检测到AES加密：');
                var AESKey = arguments[1]
                var AESIv = arguments[2]["iv"]
                console.log("EnData:" + CryptoJS.enc.Utf8.stringify(Data))
                console.log("AES Key:" + CryptoJS.enc.Utf8.stringify(AESKey))
                console.log("AES Iv:" + CryptoJS.enc.Utf8.stringify(AESIv))
                if (IsDebugger == true) {
                    debugger ;
                }
                return AESencrypt(arguments[0], arguments[1], arguments[2])
            }
            window.CryptoJS.AES.decrypt = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return AESdecrypt(arguments[0], arguments[1], arguments[2])
                }
                console.log('检测到AES解密：');
                var AESKey = arguments[1]
                var AESIv = arguments[2]["iv"]
                console.log("DeData:" + Data)
                console.log("AES Key:" + CryptoJS.enc.Utf8.stringify(AESKey))
                console.log("AES Iv:" + CryptoJS.enc.Utf8.stringify(AESIv))
                if (IsDebugger == true) {
                    debugger ;
                }
                return AESdecrypt(arguments[0], arguments[1], arguments[2])
            }
        }
        //DES加解密
        if (Crypto.DES != undefined) {
            var DESencrypt = Crypto.DES.encrypt
            var DESdecrypt = Crypto.DES.decrypt
            window.CryptoJS.DES.encrypt = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return DESencrypt(arguments[0], arguments[1], arguments[2])
                }
                console.log('检测到DES加密：');
                var AESKey = arguments[1]
                var AESIv = arguments[2]["iv"]
                console.log("EnData:" + CryptoJS.enc.Utf8.stringify(Data))
                console.log("AES Key:" + CryptoJS.enc.Utf8.stringify(AESKey))
                console.log("AES Iv:" + CryptoJS.enc.Utf8.stringify(AESIv))
                if (IsDebugger == true) {
                    debugger ;
                }
                return AESencrypt(arguments[0], arguments[1], arguments[2])
            }
            window.CryptoJS.DES.decrypt = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return AESdecrypt(arguments[0], arguments[1], arguments[2])
                }
                console.log('检测到DES解密：');
                var AESKey = arguments[1]
                var AESIv = arguments[2]["iv"]
                console.log("DeData:" + Data)
                console.log("AES Key:" + CryptoJS.enc.Utf8.stringify(AESKey))
                console.log("AES Iv:" + CryptoJS.enc.Utf8.stringify(AESIv))
                if (IsDebugger == true) {
                    debugger ;
                }
                return DESdecrypt(arguments[0], arguments[1], arguments[2])
            }
        }
        //3DES加解密
        if (Crypto.TripleDES != undefined) {
            var TripleDESencrypt = Crypto.TripleDES.encrypt
            var TripleDESdecrypt = Crypto.TripleDES.decrypt
            window.CryptoJS.TripleDES.encrypt = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return TripleDESencrypt(arguments[0], arguments[1], arguments[2])
                }
                console.log('检测到TripleDES加密：');
                var AESKey = arguments[1]
                var AESIv = arguments[2]["iv"]
                console.log("EnData:" + CryptoJS.enc.Utf8.stringify(Data))
                console.log("AES Key:" + CryptoJS.enc.Utf8.stringify(AESKey))
                console.log("AES Iv:" + CryptoJS.enc.Utf8.stringify(AESIv))
                if (IsDebugger == true) {
                    debugger ;
                }
                return AESencrypt(arguments[0], arguments[1], arguments[2])
            }
            window.CryptoJS.TripleDES.decrypt = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return AESdecrypt(arguments[0], arguments[1], arguments[2])
                }
                console.log('检测到TripleDES解密：');
                var AESKey = arguments[1]
                var AESIv = arguments[2]["iv"]
                console.log("DeData:" + Data)
                console.log("AES Key:" + CryptoJS.enc.Utf8.stringify(AESKey))
                console.log("AES Iv:" + CryptoJS.enc.Utf8.stringify(AESIv))
                if (IsDebugger == true) {
                    debugger ;
                }
                return TripleDESdecrypt(arguments[0], arguments[1], arguments[2])
            }
        }
        //Hmac
        var HMAC_MD5encrypt = Crypto.HmacMD5
        var HMAC_SHA1encrypt = Crypto.HmacSHA1
        var HMAC_SHA256encrypt = Crypto.HmacSHA256
        var HMAC_SHA384encrypt = Crypto.HmacSHA384
        var HMAC_SHA512encrypt = Crypto.HmacSHA512

        if (Crypto.HmacMD5 != undefined) {
            window.CryptoJS.HmacMD5 = function() {
                var Data = arguments[0];
                if (Data == "" || window.SHook == false) {
                    return HMAC_MD5encrypt(arguments[0], arguments[1]);
                }
                ;console.log("检测到HmacMD5加密：");
                var HmacKey = arguments[1];
                console.log("EnData:" + Data);
                console.log("HmacKey:" + HmacKey);
                if (IsDebugger == true) {
                    debugger ;
                }
                return HMAC_MD5encrypt(arguments[0], arguments[1]);
            }
        }
        if (Crypto.HmacSHA1 != undefined) {
            window.CryptoJS.HmacSHA1 = function() {
                var Data = arguments[0];
                if (Data == "" || window.SHook == false) {
                    return HMAC_SHA1encrypt(arguments[0], arguments[1]);
                }
                ;console.log("检测到HmacSHA1加密：");
                var HmacKey = arguments[1];
                console.log("EnData:" + Data);
                console.log("HmacKey:" + HmacKey);
                if (IsDebugger == true) {
                    debugger ;
                }
                return HMAC_SHA1encrypt(arguments[0], arguments[1]);
            }
        }
        if (Crypto.HmacSHA256 != undefined) {
            window.CryptoJS.HmacSHA256 = function() {
                var Data = arguments[0];
                if (Data == "" || window.SHook == false) {
                    return HMAC_SHA256encrypt(arguments[0], arguments[1]);
                }
                ;console.log("检测到HmacSHA256加密：");
                var HmacKey = arguments[1];
                console.log("EnData:" + Data);
                console.log("HmacKey:" + HmacKey);
                if (IsDebugger == true) {
                    debugger ;
                }
                return HMAC_SHA256encrypt(arguments[0], arguments[1]);
            }
        }
        if (Crypto.HmacSHA384 != undefined) {
            window.CryptoJS.HmacSHA384 = function() {
                var Data = arguments[0];
                if (Data == "" || window.SHook == false) {
                    return HMAC_SHA384encrypt(arguments[0], arguments[1]);
                }
                ;console.log("检测到HmacSHA384加密：");
                var HmacKey = arguments[1];
                console.log("EnData:" + Data);
                console.log("HmacKey:" + HmacKey);
                if (IsDebugger == true) {
                    debugger ;
                }
                return HMAC_SHA384encrypt(arguments[0], arguments[1]);
            }
        }
        if (Crypto.HmacSHA512 != undefined) {
            window.CryptoJS.HmacSHA512 = function() {
                var Data = arguments[0];
                if (Data == "" || window.SHook == false) {
                    return HMAC_SHA512encrypt(arguments[0], arguments[1]);
                }
                ;console.log("检测到HmacSHA512加密：");
                var HmacKey = arguments[1];
                console.log("EnData:" + Data);
                console.log("HmacKey:" + HmacKey);
                if (IsDebugger == true) {
                    debugger ;
                }
                return HMAC_SHA512encrypt(arguments[0], arguments[1]);
            }
        }
        //Rabbit加解密
        if (Crypto.TripleDES != undefined) {
            var Rabbitencrypt = Crypto.Rabbit.encrypt
            var Rabbitdecrypt = Crypto.Rabbit.decrypt
            window.CryptoJS.Rabbit.encrypt = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return Rabbitencrypt(arguments[0], arguments[1])
                }
                console.log('检测到Rabbit加密：');
                console.log("EnData:" + Data)
                console.log("Key:" + arguments[1])
                if (IsDebugger == true) {
                    debugger ;
                }
                return Rabbitencrypt(arguments[0], arguments[1])
            }
            window.CryptoJS.Rabbit.decrypt = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return Rabbitdecrypt(arguments[0], arguments[1])
                }
                console.log('检测到Rabbit解密：');
                console.log("DeData:" + Data)
                console.log("Key:" + arguments[1])
                if (IsDebugger == true) {
                    debugger ;
                }
                return Rabbitdecrypt(arguments[0], arguments[1])
            }
        }
        //PBKDF2加解密
        if (Crypto.PBKDF2 != undefined) {
            var PBKDF2encrypt = Crypto.PBKDF2
            window.CryptoJS.PBKDF2 = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return PBKDF2encrypt(arguments[0], arguments[1], arguments[2])
                }
                console.log('检测到PBKDF2加密：');
                console.log("EnData:" + Data)
                console.log("Salt:" + arguments[1])
                console.log("KeySize:" + arguments[2]['keySize'])
                console.log("iterations:" + arguments[2]['iterations'])
                if (IsDebugger == true) {
                    debugger ;
                }
                return PBKDF2encrypt(arguments[0], arguments[1], arguments[2])
            }
        }
        //PBKDF2加解密
        if (Crypto.EvpKDF != undefined) {
            var EvpKDFencrypt = Crypto.EvpKDF
            window.CryptoJS.EvpKDF = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return EvpKDFencrypt(arguments[0], arguments[1], arguments[2])
                }
                console.log('检测到EvpKDF加密：');
                console.log("EnData:" + Data)
                console.log("Salt:" + arguments[1])
                console.log("KeySize:" + arguments[2]['keySize'])
                console.log("iterations:" + arguments[2]['iterations'])
                if (IsDebugger == true) {
                    debugger ;
                }
                return EvpKDFencrypt(arguments[0], arguments[1], arguments[2])
            }
        }
        //Md5加密
        if (Crypto.MD5 != undefined) {
            var MD5encrypt = Crypto.MD5
            window.CryptoJS.MD5 = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return MD5encrypt(arguments[0])
                }
                console.log('检测到MD5加密：');
                console.log("EnData:" + Data)
                if (IsDebugger == true) {
                    debugger ;
                }
                return MD5encrypt(arguments[0])
            }
        }
        //SHA1加密
        if (Crypto.SHA1 != undefined) {
            var SHA1encrypt = Crypto.SHA1
            window.CryptoJS.SHA1 = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return SHA1encrypt(arguments[0])
                }
                console.log('检测到SHA1加密：');
                console.log("EnData:" + Data)
                if (IsDebugger == true) {
                    debugger ;
                }
                return SHA1encrypt(arguments[0])
            }
        }
        //SHA3加密
        if (Crypto.SHA3 != undefined) {
            var SHA3encrypt = Crypto.SHA3
            window.CryptoJS.SHA3 = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return SHA3encrypt(arguments[0])
                }
                console.log('检测到SHA3加密：');
                console.log("EnData:" + Data)
                if (IsDebugger == true) {
                    debugger ;
                }
                return SHA3encrypt(arguments[0])
            }
        }
        //SHA224加密
        if (Crypto.SHA224 != undefined) {
            var SHA224encrypt = Crypto.SHA224
            window.CryptoJS.SHA224 = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return SHA224encrypt(arguments[0])
                }
                console.log('检测到SHA224加密：');
                console.log("EnData:" + Data)
                if (IsDebugger == true) {
                    debugger ;
                }
                return SHA224encrypt(arguments[0])
            }
        }
        //SHA256加密
        if (Crypto.SHA256 != undefined) {
            var SHA256encrypt = Crypto.SHA256
            window.CryptoJS.SHA256 = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return SHA256encrypt(arguments[0])
                }
                console.log('检测到SHA256加密：');
                console.log("EnData:" + Data)
                if (IsDebugger == true) {
                    debugger ;
                }
                return SHA256encrypt(arguments[0])
            }
        }
        //SHA384加密
        if (Crypto.SHA384 != undefined) {
            var SHA384encrypt = Crypto.SHA384
            window.CryptoJS.SHA384 = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return SHA384encrypt(arguments[0])
                }
                console.log('检测到SHA384加密：');
                console.log("EnData:" + Data)
                if (IsDebugger == true) {
                    debugger ;
                }
                return SHA384encrypt(arguments[0])
            }
        }
        //SHA512加密
        if (Crypto.SHA512 != undefined) {
            var SHA512encrypt = Crypto.SHA512
            window.CryptoJS.SHA512 = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return SHA512encrypt(arguments[0])
                }
                console.log('检测到SHA512加密：');
                console.log("EnData:" + Data)
                if (IsDebugger == true) {
                    debugger ;
                }
                return SHA512encrypt(arguments[0])
            }
        }
        //RIPEMD160加密
        if (Crypto.RIPEMD160encrypt != undefined) {
            var RIPEMD160encrypt = Crypto.RIPEMD160
            window.CryptoJS.RIPEMD160 = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return RIPEMD160encrypt(arguments[0])
                }
                console.log('检测到RIPEMD160加密：');
                console.log("EnData:" + Data)
                if (IsDebugger == true) {
                    debugger ;
                }
                return RIPEMD160encrypt(arguments[0])
            }
        }
    }
    //RSA  加解密
    if (window.biToHex != undefined) {
        var ToHex = window.biToHex
        if (window.encryptedString != undefined) {
            var RsaEncrypt = window.encryptedString
            window.encryptedString = function() {
                var KeyPair = arguments[0];
                var Data = arguments[1]
                if (Data == "" || window.SHook == false) {
                    return RsaEncrypt(KeyPair, Data)
                }
                console.log('检测到RSA加密：');
                var PublicKey = ToHex(KeyPair.e).substr(2)
                //取右边6位就是公钥了
                var Modulus = "00" + ToHex(KeyPair.m);
                //前面补俩个0
                console.log("EnData:" + Data);
                console.log("PublicKey:" + PublicKey);
                console.log("Modulus:" + Modulus);
                if (IsDebugger == true) {
                    debugger ;
                }
                return RsaEncrypt(KeyPair, Data)
            }
        }
        if (window.decryptedString != undefined) {
            var RsaDecrypt = window.decryptedString
            window.decryptedString = function() {
                var KeyPair = arguments[0];
                var Data = arguments[1]
                if (Data == "" || window.SHook == false) {
                    return RsaEncrypt(KeyPair, Data)
                }
                console.log('检测到RSA加密：');
                var PublicKey = ToHex(KeyPair.e).substr(2)
                //取右边6位就是公钥了
                var Modulus = "00" + ToHex(KeyPair.m);
                //前面补俩个0
                console.log("EnData:" + Data);
                console.log("PublicKey:" + PublicKey);
                console.log("Modulus:" + Modulus);
                if (IsDebugger == true) {
                    debugger ;
                }
                return RsaDecrypt(KeyPair, Data)
            }
        }
    }
    if (window.JSEncrypt != undefined) {
        var RSA = window.JSEncrypt.prototype
        if (RSA.encrypt != undefined) {
            var RSA_encrypt = RSA.encrypt
            window.JSEncrypt.prototype.encrypt = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return hex2b64(RSA.key.encrypt(Data))
                }
                console.log('检测到RSA加密：');
                console.log('EnData：' + Data);
                if (IsDebugger == true) {
                    debugger ;
                }
                return hex2b64(RSA.key.encrypt(Data))
            }
        }
        if (RSA.decrypt != undefined) {
            var RSA_decrypt = RSA.decrypt
            window.JSEncrypt.prototype.decrypt = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return hex2b64(RSA.key.decrypt(Data))
                }
                console.log('检测到RSA解密：');
                console.log('DeData：' + Data);
                if (IsDebugger == true) {
                    debugger ;
                }
                return hex2b64(RSA.key.decrypt(Data))
            }
        }
        if (RSA.setPublicKey != undefined) {
            var RSA_setPublicKey = RSA.setPublicKey
            window.JSEncrypt.prototype.setPublicKey = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return RSA.setKey(Data)
                    return
                }
                console.log('检测到RSA设置公钥：');
                console.log('PublicKey：' + Data);
                if (IsDebugger == true) {
                    debugger ;
                }
                return RSA.setKey(Data)
            }
        }
        if (RSA.setPrivateKey != undefined) {
            var RSA_setPrivateKey = RSA.setPrivateKey
            window.JSEncrypt.prototype.setPrivateKey = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return RSA.setKey(Data)
                }
                console.log('检测到RSA设置私钥：');
                console.log('PrivateKey：' + Data);
                if (IsDebugger == true) {
                    debugger ;
                }
                return RSA.setKey(Data)
            }
        }

    }
}
)();

2.2.2. hook base64 脚本¶

若碰到类似 base64 的编码时，可以先尝试使用此脚本

// ==UserScript==
// @name         HookBase64
// @namespace    https://login1.scrape.center/
// @version      0.1
// @description  Hook Base64 encode function
// @author       Germey
// @match        https://login1.scrape.center/
// @grant        none
// ==/UserScript==
(function () {
  "use strict";
  function hook(object, attr) {
    var func = object[attr];
    object[attr] = function () {
      console.log("hooked", object, attr);
      var ret = func.apply(object, arguments);
      debugger;
      return ret;
    };
  }
  hook(window, "btoa");
})();

2.2.3. hook headers 脚本¶

js hook request 请求头 headers 中的参数的脚本，记得修改需要 hook 的 headers 的参数 key 的值。

// ==UserScript==
// @name         RequestHeadersHook
// @namespace    By: Ayuge
// @version      0.1
// @description  Hook Base64 encode function
// @author       Ayuge
// @match        https://*/*
// @match        http://*/*
// @grant        none
// ==/UserScript==
var hook = function () {
    var org = window.XMLHttpRequest.prototype.setRequestHeader;
    window.XMLHttpRequest.prototype.setRequestHeader = function (key, value) {
        if (key == '4c652017c70bc313bbdd') {
            debugger;
        }
        return org.apply(this, arguments);
    }
}
var script = document.createElement('script');
script.textContent = '(' + hook + ')()';
(document.head || document.documentElement).appendChild(script);
script.parentNode.removeChild(script);

2.2.3. 其它 js hook 脚本¶

其他的 hook 自吐脚本会在参考文章中补充。

一键 hook 自吐脚本网页版¶

前言¶

1. 前提条件¶

2. 操作步骤¶

2.1. 浏览器安装油猴¶

2.2. 编写 js 自吐脚本¶

2.2.1. 一键 hook 加密算法¶

2.2.2. hook base64 脚本¶

2.2.3. hook headers 脚本¶

2.2.3. 其它 js hook 脚本¶

3. 参考文章¶

评论