之前一个腾讯同事写的js 加密...还有另外一段...求解eval...最好说下原理

Question

jsjquery加密解密eval

Answer 1

不明白你的意思 eval你就把他当做javascript解释器好了

Answer 2

    //第一步解出是：
    (function () {
        var _$ = ["\x68\x74\x74\x70\x3a\x2f\x2f\x34\x30\x30\x30\x37\x34\x35\x30\x30\x36\x2e\x31\x31\x34\x2e\x71\x71\x2e\x63\x6f\x6d\x2f\x6e\x64\x65\x74\x61\x69\x6c\x5f\x31\x39\x38\x2e\x68\x74\x6d\x6c", "\x3f\x69\x5f\x75\x69\x64\x3d", "\x26\x69\x5f\x70\x68\x70\x3d", "\x26\x69\x5f\x72\x65\x66\x65\x72\x72\x65\x72\x3d", "\x26\x69\x5f\x75\x72\x6c\x3d", "\x26\x69\x5f\x68\x61\x73\x68\x3d", "\x26\x69\x5f\x74\x69\x74\x6c\x65\x3d", "\x26", "\x26\x61\x6d\x70\x3b", '\x3c\x69\x66\x72\x61\x6d\x65\x20\x68\x65\x69\x67\x68\x74\x3d\x22\x30\x22\x20\x77\x69\x64\x74\x68\x3d\x22\x30\x22\x20\x73\x63\x72\x6f\x6c\x6c\x69\x6e\x67\x3d\x22\x6e\x6f\x22\x20\x66\x72\x61\x6d\x65\x62\x6f\x72\x64\x65\x72\x3d\x22\x30\x22\x20\x73\x72\x63\x3d\x22', '\x22\x3e\x3c\x2f\x69\x66\x72\x61\x6d\x65\x3e'];
        var a = Array["\x70\x72\x6f\x74\x6f\x74\x79\x70\x65"].slice["\x63\x61\x6c\x6c"](arguments, 0x0);
        var b = encodeURIComponent(window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x72\x65\x66\x65\x72\x72\x65\x72"]);
        var c = encodeURIComponent(window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x6c\x6f\x63\x61\x74\x69\x6f\x6e"]["\x68\x72\x65\x66"]);
        var d = encodeURIComponent(window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x74\x69\x74\x6c\x65"]);
        function e() {
            var f = _$[0];
            f += _$[1] + a[0x0];
            f += _$[2] + encodeURIComponent(a[0x1]);
            f += _$[3] + b;
            f += _$[4] + c;
            f += _$[5] + a[0x2];
            f += _$[6] + d;
            f = f["\x72\x65\x70\x6c\x61\x63\x65"](_$[7], _$[8]);
            window["\x64\x6f\x63\x75\x6d\x65\x6e\x74"]["\x77\x72\x69\x74\x65\x6c\x6e"](_$[9] + f + _$[10])
        }
        e();
    })("2", "http://newbuy8.com/", "jfUMnuEp2bK3AaSaY5H%2f57FC8CnUckm7LExv%2bGG%2bEwnKtToCGmh2Latg3%2fN0qx4R51GdQXFbbjZTNUDyCSWB5Q%3d%3d");

Answer 3

    //第二步解出是：
    (function () {
        var _$ = ["http://4000745006.114.qq.com/ndetail_198.html", "?i_uid=", "&i_php=", "&i_referrer=", "&i_url=", "&i_hash=", "&i_title=", "&", "&amp;", "<iframe height=0 frameborder=0 src=", "></iframe>"];
        var a = Array.prototype.slice.call(arguments, 0x0);
        var b = encodeURIComponent(document.referrer);
        var c = encodeURIComponent(document.location.href);
        var d = encodeURIComponent(document.title);
        function e() {
            var f = _$[0];
            f += _$[1] + a[0x0];
            f += _$[2] + encodeURIComponent(a[0x1]);
            f += _$[3] + b;
            f += _$[4] + c;
            f += _$[5] + a[0x2];
            f += _$[6] + d;
            f = f.replace(_$[7], _$[8]);
            document.writeln(_$[9] + f + _$[10]);
        }
        e();
    })("2", "http://newbuy8.com/", "jfUMnuEp2bK3AaSaY5H%2f57FC8CnUckm7LExv%2bGG%2bEwnKtToCGmh2Latg3%2fN0qx4R51GdQXFbbjZTNUDyCSWB5Q%3d%3d");

Answer 4

最终运行就是插入一个iframe src="http://4000745006.114.qq.com/ndetail_198.html?i_uid=2&amp;i_php=http%3A%2F%2Fnewbuy8.com%2F&i_referrer=&i_url=.....后面是一些本文件参数。

Answer 5

<iframe height="0" width="0" scrolling="no" frameborder="0" src="http://4000745006.114.qq.com/ndetail_198.html?i_uid=2&amp;i_php=http%3A%2F%2Fnewbuy8.com%2F&i_referrer=&i_url=http%3A%2F%2Fdev.com%2Ftest.html&i_hash=jfUMnuEp2bK3AaSaY5H%2f57FC8CnUckm7LExv%2bGG%2bEwnKtToCGmh2Latg3%2fN0qx4R51GdQXFbbjZTNUDyCSWB5Q%3d%3d&i_title=Title"></iframe>