网页脚本解密

韩冰

作者：冰狐浪子　　来自：http://www.icyfoxlovelace.com/

一网友给我一加密网页“太乙奇門六壬排盤程式”，其中脚本采用微软工具进行了加[VBScript.Encode]，说是用解密软件不能解密，我看后发现页面编码是UTF-8,改为ANSI后，使用scrdec顺利解密，看来编码问题有的时候满有用的，对于解密失败的朋友可以尝试看下编码格式，因为现在的解码工具好像是针对ANSI编码的！

1 R3 V1 F2 R) p$ W2 r8 p7 b9 b! ~

附scrdec1.3源代码[c代码]：

; `( ^; r- K9 I6 D9 W7 R, C

/**********************************************************************/ /* scrdec.c - Decoder for Microsoft Script Encoder */ /* Version 1.3 */ /* */ /* COPYRIGHT: */ 7 z' q% r, z& v$ e) V/* (c)2000/2001 MrBrownstone, _blank>mrbrownstone@virtualconspiracy.com */ /* Some changes by Joe Steele to correct minor stuff */ /* */ /* DISCLAIMER: */ /* This program is for demonstrative and educational purposes only. */ /* Use of this program is at your own risk. The author cannot be held */ /* responsible if any laws are broken by use of this program. */ /* */ /* If you use or distribute this code, this message should be held */ % C ?+ P1 [2 N( ~" S2 f/* intact. Also, any program based upon this code should display the */ /* copyright message and the disclaimer. */ 4 q% \9 e* I) J/**********************************************************************/

" W3 w* V) P2 B

#include ( B* @8 G( \; z9 ~% g) W, N/ i; q#include 7 X _* y. H+ O* r5 N" w% s#include

! B* W; l: z9 [3 t* c6 A8 X

#define LEN_OUTBUF 64 #define LEN_INBUF 1024

#define STATE_INIT_COPY 100 3 [( N+ G& B- z#define STATE_COPY_INPUT 101 #define STATE_SKIP_ML 102 " F; f$ S- r! q4 o; H7 D' b#define STATE_CHECKSUM 103 " |, n7 t- L/ I8 Y' ~% r, q6 S#define STATE_READLEN 104 #define STATE_DECODE 105 # J& N) z4 V% Q! L0 Z6 O: b7 H! S#define STATE_UNESCAPE 106 . l8 f; E8 M, b3 E8 M#define STATE_FLUSHING 107 9 \" B X7 }/ B& E6 X# z2 B7 J#define STATE_DBCS 108 6 h4 ~; a! i, Z' R#define STATE_INIT_READLEN 109

0 D4 ]% i+ g$ n

unsigned char rawData[292] = { 0x64,0x37,0x69, 0x50,0x7E,0x2C, 0x22,0x5A,0x65, 0x4A,0x45,0x72, 0x61,0x3A,0x5B, 0x5E,0x79,0x66, 0x5D,0x59,0x75, 0x5B,0x27,0x4C, 0x42,0x76,0x45, 0x60,0x63,0x76, 0x23,0x62,0x2A, 0x65,0x4D,0x43, 0x5F,0x51,0x33, 0x7E,0x53,0x42, 0x4F,0x52,0x20, 0x52,0x20,0x63, 0x7A,0x26,0x4A, 0x21,0x54,0x5A, 0x46,0x71,0x38, 0x20,0x2B,0x79, 0x26,0x66,0x32, 0x63,0x2A,0x57, 0x2A,0x58,0x6C, 0x76,0x7F,0x2B, 7 U( S1 _$ @: t! @1 } 0x47,0x7B,0x46, 0x25,0x30,0x52, 0x2C,0x31,0x4F, 0x29,0x6C,0x3D, 0x69,0x49,0x70, 0x3F,0x3F,0x3F, 0x27,0x78,0x7B, 0x3F,0x3F,0x3F, / Q$ z" t5 K9 H! W, o/ z0 Y7 Q6 h" r 0x67,0x5F,0x51, 0x3F,0x3F,0x3F, 0x62,0x29,0x7A, 0x41,0x24,0x7E, 0x5A,0x2F,0x3B, 0x66,0x39,0x47, 0x32,0x33,0x41, 0x73,0x6F,0x77, 3 R J* s0 T! J& f6 k* ?2 p3 P3 X 0x4D,0x21,0x56, 0x43,0x75,0x5F, 0x71,0x28,0x26, 0x39,0x42,0x78, 0x7C,0x46,0x6E, 0x53,0x4A,0x64, 0x48,0x5C,0x74, 0x31,0x48,0x67, ; o! C+ f7 ]. u 0x72,0x36,0x7D, 0x6E,0x4B,0x68, 0x70,0x7D,0x35, 0x49,0x5D,0x22, 0x3F,0x6A,0x55, 0x4B,0x50,0x3A, 0x6A,0x69,0x60, 0x2E,0x23,0x6A, 3 j7 t5 L! }6 e" T$ B 0x7F,0x09,0x71, 0x28,0x70,0x6F, 0x35,0x65,0x49, 0x7D,0x74,0x5C, ) D R8 ^6 ^" b7 f 0x24,0x2C,0x5D, 0x2D,0x77,0x27, 0x54,0x44,0x59, 0x37,0x3F,0x25, ) x8 S' Y c/ l6 m% n1 Q- [+ A 0x7B,0x6D,0x7C, 0x3D,0x7C,0x23, 0x6C,0x43,0x6D, 0x34,0x38,0x28, 0x6D,0x5E,0x31, 0x4E,0x5B,0x39, 0x2B,0x6E,0x7F, 0x30,0x57,0x36, : `( Y" X% O1 ^, d+ b; Q! C+ b 0x6F,0x4C,0x54, 0x74,0x34,0x34, 0x6B,0x72,0x62, 0x4C,0x25,0x4E, 6 G8 e: q w. |6 K3 A' J4 O 0x33,0x56,0x30, 0x56,0x73,0x5E, 0x3A,0x68,0x73, 0x78,0x55,0x09, ' C9 M) X- _, L0 u$ o7 _ 0x57,0x47,0x4B, 0x77,0x32,0x61, 0x3B,0x35,0x24, 0x44,0x2E,0x4D, - I; ?' F* a6 N9 [, @% J 0x2F,0x64,0x6B, 0x59,0x4F,0x44, 0x45,0x3B,0x21, 0x5C,0x2D,0x37, 3 f3 E V# p5 t0 t, x 0x68,0x41,0x53, 0x36,0x61,0x58, 0x58,0x7A,0x48, 0x79,0x22,0x2E, , F- c, L9 l, x 0x09,0x60,0x50, 0x75,0x6B,0x2D, 0x38,0x4E,0x29, 0x55,0x3D,0x3F, 0x51,0x67,0x2f } ;

const unsigned char pick_encoding[64] = { 1, 2, 0, 1, 2, 0, 2, 0, 0, 2, 0, 2, 1, 0, 2, 0, 0 w9 c/ _% I# N( M: }1 f0 j6 n8 r1, 0, 2, 0, 1, 1, 2, 0, 0, 2, 1, 0, 2, 0, 0, 2, ( H( z% W. n( z$ o1, 1, 0, 2, 0, 2, 0, 1, 0, 1, 1, 2, 0, 1, 0, 2, 1, 0, 2, 0, 1, 1, 2, 0, 0, 1, 1, 2, 0, 1, 0, 2 };

& f1 r5 R" n: D( c4 j/ `

unsigned char transformed[3][128]; 7 l& F5 i( z4 ]+ m& E8 X0 Oint digits[0x7b];

3 ~& q! k `. Z* U0 l+ L

unsigned char unescape (unsigned char c) ( Z; X, a% t0 C# e2 Z{ ( f# C- T# A% D4 d: Y5 b2 Z& @ static unsigned char escapes[] = "#&!*$"; : ^& A9 t* v' J7 ^ static unsigned char escaped[] = "\r\n<>@"; / w' a& l- {1 |0 `: ?8 @+ |- ] int i=0;

if (c > 127) return c; * |/ U' v: y. F* u/ z while (escapes) { if (escapes == c) return escaped; / t+ u5 B+ q7 A6 p* u- [/ U i++; } return '?'; }

; t, c- a) g, ^+ B- ^) M2 S

void maketrans (void) { int i, j;

for (i=31; i<=127; i++) for (j=0; j<3; j++) transformed[j][rawData[(i-31)*3 + j]] = (i==31) ? 9 : i; ' T5 A2 t& [: n1 I& O1 j}

韩冰

void makedigits (void) { 1 \. w4 _- C8 t0 }7 f5 V) Q8 Z int i;

for (i=0; i<26; i++) { digits['A'+i] = i; # V! `- M( i& @; a, T. q digits['a'+i] = i+26; , F* V9 x! |; [% H7 A6 e } 9 Y' `, \, k F for (i=0; i<10; i++) digits['0'+i] = i+52; digits[0x2b] = 62; / c0 D- g& f5 A4 y3 i4 w digits[0x2f] = 63; % m/ R5 P: |, T, m, a}

unsigned long int decodeBase64 (unsigned char *p) - i! s8 h9 u5 ~% U( T{ unsigned long int val = 0;

val += (digits[p[0]] << 2); 2 K, o/ U6 b o& t+ d val += (digits[p[1]] >> 4); 1 [3 k. |9 B: |# p/ J; Y val += (digits[p[1]] & 0xf) << 12; 8 P% H4 F0 k1 H val += ((digits[p[2]] >> 2) << 8); val += ((digits[p[2]] & 0x3) << 22); 4 U2 C. _" `$ }+ X! K val += (digits[p[3]] << 16); ) V! O4 r; T- D val += ((digits[p[4]] << 2) << 24); 6 a! D7 D* f: x: U val += ((digits[p[5]] >> 4) << 24);

/* 543210 543210 543210 543210 543210 543210

765432 ( l) F+ }' \: B& n# R4 C 10 ba98 fedc 76 + _0 s( X1 P9 h3 g; H9 ]% s 543210 fedcba 98---- |- LSB -||- -||- -| |- MSB -| * q" p& B4 c/ b+ m */ return val; }

int isLeadByte (unsigned int cp, unsigned char ucByte) { /* Code page 932 - Japanese Shift-JIS - 0x81-0x9f * j" U$ F1 Q6 j3 }8 [. q1 i+ i 0xe0-0xfc ! x7 U- K6 v% V2 G1 h( p 936 - Simplified Chinese GBK - 0xa1-0xfe " z) B. H# S$ @$ i1 F0 Z1 g 949 - Korean Wansung - 0x81-0xfe 2 z: k: O- w( e! F( A0 ?( o 950 - Traditional Chinese Big5 - 0x81-0xfe 1361 - Korean Johab - 0x84-0xd3 5 H. {2 ^" f/ J8 ^1 N5 F: S4 A3 } 0xd9-0xde - v" X M' d; e- {/ s( t 0xe0-0xf9 */ 9 h. e7 f! f& H. K switch (cp) + b5 O' v, X1 r- U" [0 D# V { 1 d& C4 Y0 k) K5 E. z+ g* j case 932: 2 ?, g& v6 r: v$ `9 u if ((ucByte > 0x80) && (ucByte < 0xa0)) return 1; if ((ucByte > 0xdf) && (ucByte < 0xfd)) return 1; else return 0; case 936: 5 e$ U4 D8 l3 T' x0 q1 q2 h/ M if ((ucByte > 0xa0) && (ucByte < 0xff)) return 1; else return 0; case 949: & M+ b) R! j+ _7 E% M5 l- v case 950: 7 t5 U2 ^; l T- W if ((ucByte > 0x80) && (ucByte < 0xff)) return 1; else return 0; case 1361: if ((ucByte > 0x83) && (ucByte < 0xd4)) return 1; * g- _) c& l9 \+ T+ h if ((ucByte > 0xd8) && (ucByte < 0xdf)) return 1; # `$ }$ I6 c' K ^+ M2 L if ((ucByte > 0xdf) && (ucByte < 0xfa)) return 1; ; `% g' o# G7 \2 |5 h: M else return 0; : ~5 g4 w- v' \, [( K# F default: / U# j* p3 s7 E/ _( I6 f return 0; }

}

int ScriptDecoder (unsigned char *inname, unsigned char *outname, unsigned int cp) { unsigned char inbuf[LEN_INBUF+1]; - }& p2 _: w& T unsigned char outbuf[LEN_OUTBUF+1]; 0 j/ Q# A4 @* ]" O3 g3 D1 r unsigned char c, lenbuf[7], csbuf[7]; 1 \9 ?3 K" j2 ~8 M unsigned char marker[] = "#@~^"; $ d; D8 z- M, y/ a k: {' O int nextstate, state = 0; int i, j, k, m, ml = 0; unsigned long int csum = 0, len = 0; FILE *infile, *outfile;

infile = fopen (inname, "rb"); outfile = fopen (outname, "wb"); ( X# g/ G0 w U) \" } if (!infile || !outfile) 8 j T: @6 j' n+ L { printf ("Error opening file!\n"); return 10; } maketrans(); makedigits(); 0 Z' d. M3 W7 q8 P) v& X( K memset (inbuf, 0, sizeof (inbuf)); ( o& U9 `1 {. L+ E# ^ memset (outbuf, 0, sizeof (outbuf)); memset (lenbuf, 0, sizeof (lenbuf)); ! n- ^) x& u% E) S2 D 8 P4 W0 f8 F% w( |0 ^& F' I! n' M state = STATE_INIT_COPY; + m+ \$ m* z: f% o& } i = 0; ; Z. _5 {2 q" E" {6 ?" q* H j = 0;

while (state) { if (inbuf == 0) { - e! {' e& {0 B7 p if (feof (infile)) break;

memset (inbuf, 0, sizeof (inbuf)); fgets (inbuf, LEN_INBUF, infile); i = 0; 0 o/ @/ f2 p! e5 G continue; 7 E( L0 l& q- V4 f$ I- ^" A; b }

if (j == LEN_OUTBUF) { 7 P7 o- @0 z6 [ |8 O0 o0 k fwrite (outbuf, sizeof(char), j, outfile); j = 0; # W+ o- j l. c" b }

switch (state) + v9 j, ^! K: K, L; L { 6 S& \! Z" X' l$ y8 d) s# w8 P case STATE_INIT_COPY: ml = strlen (marker); m = 0; state = STATE_COPY_INPUT; * _3 j: a9 T1 \ break;

韩冰

case STATE_COPY_INPUT: % \0 D$ y/ `! {2 Z$ ~5 X/ d* G0 y if (inbuf == marker[m]) 3 R# l4 x0 _2 [* _& _ { i++; m++; 7 X; L3 c% t7 ~# ^1 Q! b } 9 b; Q" x& V( q else { if (m) ^ v8 D7 z9 D! @: t { * w! w% K2 z! N3 H- G k = 0; " t; q! }: L4 O) F2 {/ o state = STATE_FLUSHING; } 8 U6 ^; Q }, h4 ]7 u! S else ( }/ F3 B" Y- B8 L u% _2 o outbuf[j++] = inbuf[i++];

} f, ]' n1 l' ` s; d0 s; @0 a if (m == ml) 0 u, B# N& I! m$ X9 p! X; ~ state = STATE_INIT_READLEN; break;

case STATE_FLUSHING: outbuf[j++] = marker[k++]; m--; if (m==0) state = STATE_COPY_INPUT; break; 0 [6 `7 a4 z; E+ P" _ 3 ~3 Q) K* b6 H. W% Q case STATE_SKIP_ML: i++; if (!(--ml)) state = nextstate; break;

+ @5 J, B8 `& {1 r* I case STATE_INIT_READLEN: ml = 6; state = STATE_READLEN; break;

case STATE_READLEN: y0 O! P) ?2 C8 L: p lenbuf[6-ml] = inbuf[i++]; . `; ?7 ?& p+ \, Z% g$ u: s4 {+ w if (!(--ml)) ' }9 W) o9 y# K T3 Y. }3 H { len = decodeBase64 (lenbuf); ' m+ l) O6 m& S1 } m = 0; ml = 2; 6 ^$ l( Z( J. G2 V state = STATE_SKIP_ML; nextstate = STATE_DECODE; 7 Q. d. r+ r6 ^6 ? V8 Z4 j } break;

case STATE_DECODE: 7 e) Z" O, V: M7 W# r# K7 d+ ~! W" F if (!len) { ; m6 w6 b8 d! w7 k" f9 I: g ml = 6; 5 I" x$ z, W, w& @6 V0 q" o! o state = STATE_CHECKSUM; ( V, i, T5 A- M$ D: X break; } if (inbuf == _blank>'@') ! [+ E5 Q& t X state = STATE_UNESCAPE; else { 7 e3 P7 y: p5 T4 Y, Q+ B2 Y if (inbuf < 0x80) { , _5 F ?) A# W2 n. [ outbuf[j++] = c = transformed[pick_encoding[m%64]][inbuf]; csum += c; : S) [ B) Q' j8 f m++; 2 y, D4 ]3 I {* q } ( v9 r; T! `3 u8 s. V* b! P else % a1 [' N4 G; \! r { outbuf[j++] = inbuf; ! _4 U6 P1 k7 @% \! t! m, F, w _ if ((cp) && (isLeadByte (cp,inbuf))) $ [9 h8 F% U2 o. Z state = STATE_DBCS; }

} # g2 F$ Y% T+ l: G# o% c5 } i++; len--; break;

case STATE_DBCS: 7 k. g0 K2 ~( H7 A outbuf[j++] = inbuf[i++]; 7 a' F% ? P9 T+ \$ V state = STATE_DECODE; break; . U, d. u6 w) N5 e& G case STATE_UNESCAPE: outbuf[j++] = c = unescape (inbuf[i++]); csum += c; len--; " L. M: q& G8 p* F m++; ]. L1 L: V# i; r' N state = STATE_DECODE; break;

case STATE_CHECKSUM: csbuf[6-ml] = inbuf[i++]; 3 N3 A& [ s/ d" V* @- L if (!(--ml)) { * q4 B% j' D' r+ J& F, K csum -= decodeBase64 (csbuf); if (csum) 9 r: {. N' c9 Z/ F( V5 M5 C { //printf ("Error - Incorrect checksum! (%lu)\n", csum); //csum=0; 此处注释掉好点，不然好多时候不能解密 嘿嘿 [icyfox] 1 W( Y4 |( H8 @3 k } * e" F* \, @$ @. r2 L/ z m = 0; ml = 6; ' l D) G8 z8 W: X state = STATE_SKIP_ML; nextstate = STATE_INIT_COPY; } 7 P5 G5 Y! c& b; ~ break;

default: , W: r8 g# l3 O# u5 T* D- s printf ("Invalid state: %d\n", state); break; } } fwrite (outbuf, sizeof (char), j, outfile); fclose (infile); fclose (outfile); * o7 {4 _3 l9 N return 0; }

: [- t' R( T& b& s n% sint main (int argc, char **argv) " r1 N' j0 v0 W" J; n{ int cp = 0;

if (argc < 3) { ) I! f8 s* W$ G8 n% ]6 V. r0 { printf ("Decoder for Microsoft Script Encoder v1.3\n" "(c)2000/2001 MrBrownstone, _blank>mrbrownstone@virtualconspiracy.com\n" . v* x" J) o* ~ s0 U( v. M "Home page: _blank>http://www.virtualconspiracy.com/scrdec.html\n\n" : |5 q7 O% K! A3 [ "Usage: scrdec13 [codepage]\n\n" ; H. Q" C1 m0 |! u3 c "Code pages can be 932 - Japanese\n" % `3 k# u; t1 _- j; C: N " 936 - Chinese (Simplified)\n" $ c+ q9 d% o9 g: V2 y" a; o @ " 950 - Chinese (Traditional)\n" " U' u: d A( X' F " 949 - Korean (Wansung)\n" ) Y' v1 y" x9 @' b " 1361 - Korean (Johab)\n" 8 U# J7 a4 a: a7 t! t _% o: n "Any other code pages don't need to be specified.\n"); 7 C6 v+ a; M @1 t" s return 10; ~5 Z5 Y$ b% Q. Y: P0 i. p5 D) M7 x I }

if (argc > 3) cp = atoi (argv[3]); return ScriptDecoder (argv[1], argv[2], cp); + e% q1 d3 ^4 H0 c4 R1 }" I+ K}