一键 hook 自吐脚本网页版

前言

本文介绍在 js 逆向中可能会用到的自吐脚本，原理与 app 逆向中 安卓自吐的几种方法 的 frida 自吐算法脚本中的一致。

目前常用的 js hook 自吐脚本如下：

• js hook 自吐常见加密算法，比如 hook Crypto RSA, AES, DES, 3DES, HMAC, SHA 等常用方法
• 一些其它常见的 js hook 方法：
  • hook request headers 请求头参数脚本，请在 企查查 headers 请求数据获取方法说明文档 中查看
  • hook cookie 的 js 本地生成的脚本，请在 房天下滑块验证全流程说明文档 中查看
  • 补环境（自吐环境）的脚本，请在 v_jstools 自吐环境说明 和 补环境框架使用介绍 中查看

1. 前提条件

自测在 Nexus 5x 的 root 安卓 8.1.0 同样成功

js hook 自吐脚本使用前准备如下：

• 浏览器：用于调试，Google 或 firefox 等不限制
• 油猴插件：用于编写和管理 js hook 的脚本

2. 操作步骤

2.1. 浏览器安装油猴

这里不再详细说明如何在浏览器上安装油猴插件，这里放上官方安装及使用说明链接。

各浏览器安装油猴的方法：Greasy Fork 官方文档

2.2. 编写 js 自吐脚本

同样，这里不再介绍如何通过油猴来编写脚本，具体请在官网中查看，这里只展示对应的脚本内容。

2.2.1. 一键 hook 加密算法

// ==UserScript==
// @name         一键Hook加密算法
// @namespace    By:亮亮
// @version      1.2
// @description  一键Hook Crypto RSA 几个基本的方法  AES DES 3DES Hmac  SHA
// @author       liangliang
// @match        https://*/*
// @match        http://*/*
// @icon         data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==
// @grant        none
// ==/UserScript==

(function() {
    'use strict';
    console.log("亮亮网页Hook脚本初始化成功");
    //过dubugger
    var constructorEx = constructor;
    Function.prototype.constructor = function(s) {
        if (s == "debugger") {
            return null;
        }
        return constructorEx(s);
    }

    window.SHook = true
    window.IsDebugger = false
    function hex2b64(h) {
        var b64map = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
        var i;
        var c;
        var ret = "";
        for (i = 0; i + 3 <= h.length; i += 3) {
            c = parseInt(h.substring(i, i + 3), 16);
            ret += b64map.charAt(c >> 6) + b64map.charAt(c & 63);
        }
        if (i + 1 == h.length) {
            c = parseInt(h.substring(i, i + 1), 16);
            ret += b64map.charAt(c << 2);
        } else if (i + 2 == h.length) {
            c = parseInt(h.substring(i, i + 2), 16);
            ret += b64map.charAt(c >> 2) + b64map.charAt((c & 3) << 4);
        }
        while ((ret.length & 3) > 0)
            ret += "=";
        return ret;
    }
    if (window.CryptoJS != undefined) {
        var Crypto = window.CryptoJS
        //AES加解密
        if (Crypto.AES != undefined) {
            var AESencrypt = Crypto.AES.encrypt
            var AESdecrypt = Crypto.AES.decrypt
            window.CryptoJS.AES.encrypt = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return AESencrypt(arguments[0], arguments[1], arguments[2])
                }
                console.log('检测到AES加密：');
                var AESKey = arguments[1]
                var AESIv = arguments[2]["iv"]
                console.log("EnData:" + CryptoJS.enc.Utf8.stringify(Data))
                console.log("AES Key:" + CryptoJS.enc.Utf8.stringify(AESKey))
                console.log("AES Iv:" + CryptoJS.enc.Utf8.stringify(AESIv))
                if (IsDebugger == true) {
                    debugger ;
                }
                return AESencrypt(arguments[0], arguments[1], arguments[2])
            }
            window.CryptoJS.AES.decrypt = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return AESdecrypt(arguments[0], arguments[1], arguments[2])
                }
                console.log('检测到AES解密：');
                var AESKey = arguments[1]
                var AESIv = arguments[2]["iv"]
                console.log("DeData:" + Data)
                console.log("AES Key:" + CryptoJS.enc.Utf8.stringify(AESKey))
                console.log("AES Iv:" + CryptoJS.enc.Utf8.stringify(AESIv))
                if (IsDebugger == true) {
                    debugger ;
                }
                return AESdecrypt(arguments[0], arguments[1], arguments[2])
            }
        }
        //DES加解密
        if (Crypto.DES != undefined) {
            var DESencrypt = Crypto.DES.encrypt
            var DESdecrypt = Crypto.DES.decrypt
            window.CryptoJS.DES.encrypt = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return DESencrypt(arguments[0], arguments[1], arguments[2])
                }
                console.log('检测到DES加密：');
                var AESKey = arguments[1]
                var AESIv = arguments[2]["iv"]
                console.log("EnData:" + CryptoJS.enc.Utf8.stringify(Data))
                console.log("AES Key:" + CryptoJS.enc.Utf8.stringify(AESKey))
                console.log("AES Iv:" + CryptoJS.enc.Utf8.stringify(AESIv))
                if (IsDebugger == true) {
                    debugger ;
                }
                return AESencrypt(arguments[0], arguments[1], arguments[2])
            }
            window.CryptoJS.DES.decrypt = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return AESdecrypt(arguments[0], arguments[1], arguments[2])
                }
                console.log('检测到DES解密：');
                var AESKey = arguments[1]
                var AESIv = arguments[2]["iv"]
                console.log("DeData:" + Data)
                console.log("AES Key:" + CryptoJS.enc.Utf8.stringify(AESKey))
                console.log("AES Iv:" + CryptoJS.enc.Utf8.stringify(AESIv))
                if (IsDebugger == true) {
                    debugger ;
                }
                return DESdecrypt(arguments[0], arguments[1], arguments[2])
            }
        }
        //3DES加解密
        if (Crypto.TripleDES != undefined) {
            var TripleDESencrypt = Crypto.TripleDES.encrypt
            var TripleDESdecrypt = Crypto.TripleDES.decrypt
            window.CryptoJS.TripleDES.encrypt = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return TripleDESencrypt(arguments[0], arguments[1], arguments[2])
                }
                console.log('检测到TripleDES加密：');
                var AESKey = arguments[1]
                var AESIv = arguments[2]["iv"]
                console.log("EnData:" + CryptoJS.enc.Utf8.stringify(Data))
                console.log("AES Key:" + CryptoJS.enc.Utf8.stringify(AESKey))
                console.log("AES Iv:" + CryptoJS.enc.Utf8.stringify(AESIv))
                if (IsDebugger == true) {
                    debugger ;
                }
                return AESencrypt(arguments[0], arguments[1], arguments[2])
            }
            window.CryptoJS.TripleDES.decrypt = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return AESdecrypt(arguments[0], arguments[1], arguments[2])
                }
                console.log('检测到TripleDES解密：');
                var AESKey = arguments[1]
                var AESIv = arguments[2]["iv"]
                console.log("DeData:" + Data)
                console.log("AES Key:" + CryptoJS.enc.Utf8.stringify(AESKey))
                console.log("AES Iv:" + CryptoJS.enc.Utf8.stringify(AESIv))
                if (IsDebugger == true) {
                    debugger ;
                }
                return TripleDESdecrypt(arguments[0], arguments[1], arguments[2])
            }
        }
        //Hmac
        var HMAC_MD5encrypt = Crypto.HmacMD5
        var HMAC_SHA1encrypt = Crypto.HmacSHA1
        var HMAC_SHA256encrypt = Crypto.HmacSHA256
        var HMAC_SHA384encrypt = Crypto.HmacSHA384
        var HMAC_SHA512encrypt = Crypto.HmacSHA512

        if (Crypto.HmacMD5 != undefined) {
            window.CryptoJS.HmacMD5 = function() {
                var Data = arguments[0];
                if (Data == "" || window.SHook == false) {
                    return HMAC_MD5encrypt(arguments[0], arguments[1]);
                }
                ;console.log("检测到HmacMD5加密：");
                var HmacKey = arguments[1];
                console.log("EnData:" + Data);
                console.log("HmacKey:" + HmacKey);
                if (IsDebugger == true) {
                    debugger ;
                }
                return HMAC_MD5encrypt(arguments[0], arguments[1]);
            }
        }
        if (Crypto.HmacSHA1 != undefined) {
            window.CryptoJS.HmacSHA1 = function() {
                var Data = arguments[0];
                if (Data == "" || window.SHook == false) {
                    return HMAC_SHA1encrypt(arguments[0], arguments[1]);
                }
                ;console.log("检测到HmacSHA1加密：");
                var HmacKey = arguments[1];
                console.log("EnData:" + Data);
                console.log("HmacKey:" + HmacKey);
                if (IsDebugger == true) {
                    debugger ;
                }
                return HMAC_SHA1encrypt(arguments[0], arguments[1]);
            }
        }
        if (Crypto.HmacSHA256 != undefined) {
            window.CryptoJS.HmacSHA256 = function() {
                var Data = arguments[0];
                if (Data == "" || window.SHook == false) {
                    return HMAC_SHA256encrypt(arguments[0], arguments[1]);
                }
                ;console.log("检测到HmacSHA256加密：");
                var HmacKey = arguments[1];
                console.log("EnData:" + Data);
                console.log("HmacKey:" + HmacKey);
                if (IsDebugger == true) {
                    debugger ;
                }
                return HMAC_SHA256encrypt(arguments[0], arguments[1]);
            }
        }
        if (Crypto.HmacSHA384 != undefined) {
            window.CryptoJS.HmacSHA384 = function() {
                var Data = arguments[0];
                if (Data == "" || window.SHook == false) {
                    return HMAC_SHA384encrypt(arguments[0], arguments[1]);
                }
                ;console.log("检测到HmacSHA384加密：");
                var HmacKey = arguments[1];
                console.log("EnData:" + Data);
                console.log("HmacKey:" + HmacKey);
                if (IsDebugger == true) {
                    debugger ;
                }
                return HMAC_SHA384encrypt(arguments[0], arguments[1]);
            }
        }
        if (Crypto.HmacSHA512 != undefined) {
            window.CryptoJS.HmacSHA512 = function() {
                var Data = arguments[0];
                if (Data == "" || window.SHook == false) {
                    return HMAC_SHA512encrypt(arguments[0], arguments[1]);
                }
                ;console.log("检测到HmacSHA512加密：");
                var HmacKey = arguments[1];
                console.log("EnData:" + Data);
                console.log("HmacKey:" + HmacKey);
                if (IsDebugger == true) {
                    debugger ;
                }
                return HMAC_SHA512encrypt(arguments[0], arguments[1]);
            }
        }
        //Rabbit加解密
        if (Crypto.TripleDES != undefined) {
            var Rabbitencrypt = Crypto.Rabbit.encrypt
            var Rabbitdecrypt = Crypto.Rabbit.decrypt
            window.CryptoJS.Rabbit.encrypt = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return Rabbitencrypt(arguments[0], arguments[1])
                }
                console.log('检测到Rabbit加密：');
                console.log("EnData:" + Data)
                console.log("Key:" + arguments[1])
                if (IsDebugger == true) {
                    debugger ;
                }
                return Rabbitencrypt(arguments[0], arguments[1])
            }
            window.CryptoJS.Rabbit.decrypt = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return Rabbitdecrypt(arguments[0], arguments[1])
                }
                console.log('检测到Rabbit解密：');
                console.log("DeData:" + Data)
                console.log("Key:" + arguments[1])
                if (IsDebugger == true) {
                    debugger ;
                }
                return Rabbitdecrypt(arguments[0], arguments[1])
            }
        }
        //PBKDF2加解密
        if (Crypto.PBKDF2 != undefined) {
            var PBKDF2encrypt = Crypto.PBKDF2
            window.CryptoJS.PBKDF2 = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return PBKDF2encrypt(arguments[0], arguments[1], arguments[2])
                }
                console.log('检测到PBKDF2加密：');
                console.log("EnData:" + Data)
                console.log("Salt:" + arguments[1])
                console.log("KeySize:" + arguments[2]['keySize'])
                console.log("iterations:" + arguments[2]['iterations'])
                if (IsDebugger == true) {
                    debugger ;
                }
                return PBKDF2encrypt(arguments[0], arguments[1], arguments[2])
            }
        }
        //PBKDF2加解密
        if (Crypto.EvpKDF != undefined) {
            var EvpKDFencrypt = Crypto.EvpKDF
            window.CryptoJS.EvpKDF = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return EvpKDFencrypt(arguments[0], arguments[1], arguments[2])
                }
                console.log('检测到EvpKDF加密：');
                console.log("EnData:" + Data)
                console.log("Salt:" + arguments[1])
                console.log("KeySize:" + arguments[2]['keySize'])
                console.log("iterations:" + arguments[2]['iterations'])
                if (IsDebugger == true) {
                    debugger ;
                }
                return EvpKDFencrypt(arguments[0], arguments[1], arguments[2])
            }
        }
        //Md5加密
        if (Crypto.MD5 != undefined) {
            var MD5encrypt = Crypto.MD5
            window.CryptoJS.MD5 = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return MD5encrypt(arguments[0])
                }
                console.log('检测到MD5加密：');
                console.log("EnData:" + Data)
                if (IsDebugger == true) {
                    debugger ;
                }
                return MD5encrypt(arguments[0])
            }
        }
        //SHA1加密
        if (Crypto.SHA1 != undefined) {
            var SHA1encrypt = Crypto.SHA1
            window.CryptoJS.SHA1 = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return SHA1encrypt(arguments[0])
                }
                console.log('检测到SHA1加密：');
                console.log("EnData:" + Data)
                if (IsDebugger == true) {
                    debugger ;
                }
                return SHA1encrypt(arguments[0])
            }
        }
        //SHA3加密
        if (Crypto.SHA3 != undefined) {
            var SHA3encrypt = Crypto.SHA3
            window.CryptoJS.SHA3 = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return SHA3encrypt(arguments[0])
                }
                console.log('检测到SHA3加密：');
                console.log("EnData:" + Data)
                if (IsDebugger == true) {
                    debugger ;
                }
                return SHA3encrypt(arguments[0])
            }
        }
        //SHA224加密
        if (Crypto.SHA224 != undefined) {
            var SHA224encrypt = Crypto.SHA224
            window.CryptoJS.SHA224 = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return SHA224encrypt(arguments[0])
                }
                console.log('检测到SHA224加密：');
                console.log("EnData:" + Data)
                if (IsDebugger == true) {
                    debugger ;
                }
                return SHA224encrypt(arguments[0])
            }
        }
        //SHA256加密
        if (Crypto.SHA256 != undefined) {
            var SHA256encrypt = Crypto.SHA256
            window.CryptoJS.SHA256 = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return SHA256encrypt(arguments[0])
                }
                console.log('检测到SHA256加密：');
                console.log("EnData:" + Data)
                if (IsDebugger == true) {
                    debugger ;
                }
                return SHA256encrypt(arguments[0])
            }
        }
        //SHA384加密
        if (Crypto.SHA384 != undefined) {
            var SHA384encrypt = Crypto.SHA384
            window.CryptoJS.SHA384 = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return SHA384encrypt(arguments[0])
                }
                console.log('检测到SHA384加密：');
                console.log("EnData:" + Data)
                if (IsDebugger == true) {
                    debugger ;
                }
                return SHA384encrypt(arguments[0])
            }
        }
        //SHA512加密
        if (Crypto.SHA512 != undefined) {
            var SHA512encrypt = Crypto.SHA512
            window.CryptoJS.SHA512 = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return SHA512encrypt(arguments[0])
                }
                console.log('检测到SHA512加密：');
                console.log("EnData:" + Data)
                if (IsDebugger == true) {
                    debugger ;
                }
                return SHA512encrypt(arguments[0])
            }
        }
        //RIPEMD160加密
        if (Crypto.RIPEMD160encrypt != undefined) {
            var RIPEMD160encrypt = Crypto.RIPEMD160
            window.CryptoJS.RIPEMD160 = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return RIPEMD160encrypt(arguments[0])
                }
                console.log('检测到RIPEMD160加密：');
                console.log("EnData:" + Data)
                if (IsDebugger == true) {
                    debugger ;
                }
                return RIPEMD160encrypt(arguments[0])
            }
        }
    }
    //RSA  加解密
    if (window.biToHex != undefined) {
        var ToHex = window.biToHex
        if (window.encryptedString != undefined) {
            var RsaEncrypt = window.encryptedString
            window.encryptedString = function() {
                var KeyPair = arguments[0];
                var Data = arguments[1]
                if (Data == "" || window.SHook == false) {
                    return RsaEncrypt(KeyPair, Data)
                }
                console.log('检测到RSA加密：');
                var PublicKey = ToHex(KeyPair.e).substr(2)
                //取右边6位就是公钥了
                var Modulus = "00" + ToHex(KeyPair.m);
                //前面补俩个0
                console.log("EnData:" + Data);
                console.log("PublicKey:" + PublicKey);
                console.log("Modulus:" + Modulus);
                if (IsDebugger == true) {
                    debugger ;
                }
                return RsaEncrypt(KeyPair, Data)
            }
        }
        if (window.decryptedString != undefined) {
            var RsaDecrypt = window.decryptedString
            window.decryptedString = function() {
                var KeyPair = arguments[0];
                var Data = arguments[1]
                if (Data == "" || window.SHook == false) {
                    return RsaEncrypt(KeyPair, Data)
                }
                console.log('检测到RSA加密：');
                var PublicKey = ToHex(KeyPair.e).substr(2)
                //取右边6位就是公钥了
                var Modulus = "00" + ToHex(KeyPair.m);
                //前面补俩个0
                console.log("EnData:" + Data);
                console.log("PublicKey:" + PublicKey);
                console.log("Modulus:" + Modulus);
                if (IsDebugger == true) {
                    debugger ;
                }
                return RsaDecrypt(KeyPair, Data)
            }
        }
    }
    if (window.JSEncrypt != undefined) {
        var RSA = window.JSEncrypt.prototype
        if (RSA.encrypt != undefined) {
            var RSA_encrypt = RSA.encrypt
            window.JSEncrypt.prototype.encrypt = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return hex2b64(RSA.key.encrypt(Data))
                }
                console.log('检测到RSA加密：');
                console.log('EnData：' + Data);
                if (IsDebugger == true) {
                    debugger ;
                }
                return hex2b64(RSA.key.encrypt(Data))
            }
        }
        if (RSA.decrypt != undefined) {
            var RSA_decrypt = RSA.decrypt
            window.JSEncrypt.prototype.decrypt = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return hex2b64(RSA.key.decrypt(Data))
                }
                console.log('检测到RSA解密：');
                console.log('DeData：' + Data);
                if (IsDebugger == true) {
                    debugger ;
                }
                return hex2b64(RSA.key.decrypt(Data))
            }
        }
        if (RSA.setPublicKey != undefined) {
            var RSA_setPublicKey = RSA.setPublicKey
            window.JSEncrypt.prototype.setPublicKey = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return RSA.setKey(Data)
                    return
                }
                console.log('检测到RSA设置公钥：');
                console.log('PublicKey：' + Data);
                if (IsDebugger == true) {
                    debugger ;
                }
                return RSA.setKey(Data)
            }
        }
        if (RSA.setPrivateKey != undefined) {
            var RSA_setPrivateKey = RSA.setPrivateKey
            window.JSEncrypt.prototype.setPrivateKey = function() {
                var Data = arguments[0]
                if (Data == "" || window.SHook == false) {
                    return RSA.setKey(Data)
                }
                console.log('检测到RSA设置私钥：');
                console.log('PrivateKey：' + Data);
                if (IsDebugger == true) {
                    debugger ;
                }
                return RSA.setKey(Data)
            }
        }

    }
}
)();

2.2.2. hook base64 脚本

若碰到类似 base64 的编码时，可以先尝试使用此脚本

// ==UserScript==
// @name         HookBase64
// @namespace    https://login1.scrape.center/
// @version      0.1
// @description  Hook Base64 encode function
// @author       Germey
// @match        https://login1.scrape.center/
// @grant        none
// ==/UserScript==
(function () {
  "use strict";
  function hook(object, attr) {
    var func = object[attr];
    object[attr] = function () {
      console.log("hooked", object, attr);
      var ret = func.apply(object, arguments);
      debugger;
      return ret;
    };
  }
  hook(window, "btoa");
})();

2.2.3. hook headers 脚本

js hook request 请求头 headers 中的参数的脚本，记得修改需要 hook 的 headers 的参数 key 的值。

// ==UserScript==
// @name         RequestHeadersHook
// @namespace    By: Ayuge
// @version      0.1
// @description  Hook Base64 encode function
// @author       Ayuge
// @match        https://*/*
// @match        http://*/*
// @grant        none
// ==/UserScript==
var hook = function () {
    var org = window.XMLHttpRequest.prototype.setRequestHeader;
    window.XMLHttpRequest.prototype.setRequestHeader = function (key, value) {
        if (key == '4c652017c70bc313bbdd') {
            debugger;
        }
        return org.apply(this, arguments);
    }
}
var script = document.createElement('script');
script.textContent = '(' + hook + ')()';
(document.head || document.documentElement).appendChild(script);
script.parentNode.removeChild(script);

2.2.3. 其它 js hook 脚本

其他的 hook 自吐脚本会在参考文章中补充。

3. 参考文章

• Tampermonkey 官网
• Greasy Fork 官方文档
• 崔庆才博客中 js hook 文章
• js hook 技巧整合参看文章

评论