网页脚本解密

韩冰

作者：冰狐浪子　　来自：http://www.icyfoxlovelace.com/

! g" C1 n3 c3 ]) R1 [* p

一网友给我一加密网页“太乙奇門六壬排盤程式”，其中脚本采用微软工具进行了加[VBScript.Encode]，说是用解密软件不能解密，我看后发现页面编码是UTF-8,改为ANSI后，使用scrdec顺利解密，看来编码问题有的时候满有用的，对于解密失败的朋友可以尝试看下编码格式，因为现在的解码工具好像是针对ANSI编码的！

附scrdec1.3源代码[c代码]：

/**********************************************************************/ /* scrdec.c - Decoder for Microsoft Script Encoder */ /* Version 1.3 */ ) }# s0 u' y+ \- F: N/* */ : L; \/ r* V% z( s" n6 l. p* g/* COPYRIGHT: */ ) w0 U, I2 v5 m! K/* (c)2000/2001 MrBrownstone, _blank>mrbrownstone@virtualconspiracy.com */ /* Some changes by Joe Steele to correct minor stuff */ 8 J- ?& h1 n$ _' H; F$ n3 F0 g8 g/* */ /* DISCLAIMER: */ /* This program is for demonstrative and educational purposes only. */ 9 U( v N4 c X6 D5 {/* Use of this program is at your own risk. The author cannot be held */ 7 h4 W* m' x8 n. i1 m/ X/* responsible if any laws are broken by use of this program. */ . h( D5 A$ i% `* d3 \* v& @/* */ . d: b- x! ^! Y1 T0 m. {* h8 U/* If you use or distribute this code, this message should be held */ /* intact. Also, any program based upon this code should display the */ : J, N/ a* I/ m/* copyright message and the disclaimer. */ /**********************************************************************/

8 j/ s& i( c/ P. q* W& {

#include #include : c- V H# o7 E) j; C6 i#include

3 E4 z" L9 m% y: Y

#define LEN_OUTBUF 64 #define LEN_INBUF 1024

; g' V- {1 O3 k: Q+ f

#define STATE_INIT_COPY 100 ) D) K$ M7 i: Y8 i#define STATE_COPY_INPUT 101 #define STATE_SKIP_ML 102 - r- z0 H H! K% _8 k$ f0 f+ c& b#define STATE_CHECKSUM 103 #define STATE_READLEN 104 ; G- T% i# b+ v& V#define STATE_DECODE 105 8 p0 o4 {0 ?- e. W#define STATE_UNESCAPE 106 #define STATE_FLUSHING 107 1 l& K" R, E |; I6 u5 o. p0 S#define STATE_DBCS 108 #define STATE_INIT_READLEN 109

unsigned char rawData[292] = { : B* @$ }' q/ Q3 x7 D" L( @ 0x64,0x37,0x69, 0x50,0x7E,0x2C, 0x22,0x5A,0x65, 0x4A,0x45,0x72, 0x61,0x3A,0x5B, 0x5E,0x79,0x66, 0x5D,0x59,0x75, 0x5B,0x27,0x4C, 1 \2 _& D& |& v1 d 0x42,0x76,0x45, 0x60,0x63,0x76, 0x23,0x62,0x2A, 0x65,0x4D,0x43, " k1 G2 I) S- b; f9 T5 E& E 0x5F,0x51,0x33, 0x7E,0x53,0x42, 0x4F,0x52,0x20, 0x52,0x20,0x63, $ @, e# L, t' O* d 0x7A,0x26,0x4A, 0x21,0x54,0x5A, 0x46,0x71,0x38, 0x20,0x2B,0x79, 0x26,0x66,0x32, 0x63,0x2A,0x57, 0x2A,0x58,0x6C, 0x76,0x7F,0x2B, 0x47,0x7B,0x46, 0x25,0x30,0x52, 0x2C,0x31,0x4F, 0x29,0x6C,0x3D, 0x69,0x49,0x70, 0x3F,0x3F,0x3F, 0x27,0x78,0x7B, 0x3F,0x3F,0x3F, % u5 k" Z" C+ T8 x( Z2 O 0x67,0x5F,0x51, 0x3F,0x3F,0x3F, 0x62,0x29,0x7A, 0x41,0x24,0x7E, 0x5A,0x2F,0x3B, 0x66,0x39,0x47, 0x32,0x33,0x41, 0x73,0x6F,0x77, K! N# {2 w |6 ?. R 0x4D,0x21,0x56, 0x43,0x75,0x5F, 0x71,0x28,0x26, 0x39,0x42,0x78, / K" _* h2 V0 i5 Q0 U% E 0x7C,0x46,0x6E, 0x53,0x4A,0x64, 0x48,0x5C,0x74, 0x31,0x48,0x67, , k2 K& Z9 ^/ N% n& h/ i 0x72,0x36,0x7D, 0x6E,0x4B,0x68, 0x70,0x7D,0x35, 0x49,0x5D,0x22, $ R# m7 R& E/ `6 O6 d! t 0x3F,0x6A,0x55, 0x4B,0x50,0x3A, 0x6A,0x69,0x60, 0x2E,0x23,0x6A, & z- Z1 U; }3 o6 t0 ` 0x7F,0x09,0x71, 0x28,0x70,0x6F, 0x35,0x65,0x49, 0x7D,0x74,0x5C, + F- o! f/ l6 K# }% _1 [ 0x24,0x2C,0x5D, 0x2D,0x77,0x27, 0x54,0x44,0x59, 0x37,0x3F,0x25, 0x7B,0x6D,0x7C, 0x3D,0x7C,0x23, 0x6C,0x43,0x6D, 0x34,0x38,0x28, 0x6D,0x5E,0x31, 0x4E,0x5B,0x39, 0x2B,0x6E,0x7F, 0x30,0x57,0x36, 0x6F,0x4C,0x54, 0x74,0x34,0x34, 0x6B,0x72,0x62, 0x4C,0x25,0x4E, * }* P3 [. S. s# t7 A8 R$ x Z 0x33,0x56,0x30, 0x56,0x73,0x5E, 0x3A,0x68,0x73, 0x78,0x55,0x09, 0x57,0x47,0x4B, 0x77,0x32,0x61, 0x3B,0x35,0x24, 0x44,0x2E,0x4D, / E) v9 Q; p3 k C& U 0x2F,0x64,0x6B, 0x59,0x4F,0x44, 0x45,0x3B,0x21, 0x5C,0x2D,0x37, 0x68,0x41,0x53, 0x36,0x61,0x58, 0x58,0x7A,0x48, 0x79,0x22,0x2E, 0x09,0x60,0x50, 0x75,0x6B,0x2D, 0x38,0x4E,0x29, 0x55,0x3D,0x3F, / C1 _2 p8 g9 q5 j. p0 A 0x51,0x67,0x2f * x2 T' @, k" b% H2 {' u% e1 a} ;

( r) ~4 C3 ^1 H( p: |) @) R

const unsigned char pick_encoding[64] = { 1, 2, 0, 1, 2, 0, 2, 0, 0, 2, 0, 2, 1, 0, 2, 0, 1, 0, 2, 0, 1, 1, 2, 0, 0, 2, 1, 0, 2, 0, 0, 2, 1, 1, 0, 2, 0, 2, 0, 1, 0, 1, 1, 2, 0, 1, 0, 2, ( y/ h/ B! A% ~# G) d1, 0, 2, 0, 1, 1, 2, 0, 0, 1, 1, 2, 0, 1, 0, 2 7 O* r% ?4 I) s7 H9 Y. B; Y};

unsigned char transformed[3][128]; - I' ]' W. Q, nint digits[0x7b];

unsigned char unescape (unsigned char c) 8 {9 ] g0 Q. H2 D0 h8 a- B* A{ 6 K9 k# y& a$ |1 ] static unsigned char escapes[] = "#&!*$"; / I. O5 J4 r/ C6 r static unsigned char escaped[] = "\r\n<>@"; int i=0;

' e# ?1 R0 G. D+ d) [0 B' F ]

if (c > 127) 2 X4 l4 [" F9 g9 ~ return c; * h0 o% b6 L. A while (escapes) { 9 z: T% i5 b9 n: T if (escapes == c) return escaped; : E8 m" H7 g2 q, M7 c i++; 8 v# P6 p& d) p6 J: s' g } 1 X+ a: i9 A9 G# }. q- H v. O return '?'; , U% L7 D" `8 g}

' D2 c4 H! w3 g4 ?, x! I) V( f& L: T

void maketrans (void) { int i, j;

for (i=31; i<=127; i++) for (j=0; j<3; j++) 3 h) R) ` X% j transformed[j][rawData[(i-31)*3 + j]] = (i==31) ? 9 : i; ; ~; a) w" o8 B0 H( A) P6 \}

韩冰

void makedigits (void) % n0 f- f% E, G{ int i;

for (i=0; i<26; i++) , v8 C9 f: @$ P$ H { digits['A'+i] = i; 6 T# h+ X& T) ` digits['a'+i] = i+26; 4 W, W5 h8 l( R. O' M: F- V } % R6 B. o- o6 F' d( T for (i=0; i<10; i++) - [3 |% o+ h4 w& ]) d% O digits['0'+i] = i+52; " u! X5 I* @' }6 q4 t' ?" Y0 ], \% b4 { digits[0x2b] = 62; digits[0x2f] = 63; }

unsigned long int decodeBase64 (unsigned char *p) { 8 T; u( r& P8 d) ]0 H unsigned long int val = 0;

val += (digits[p[0]] << 2); 0 [9 O# S0 {8 D& m val += (digits[p[1]] >> 4); val += (digits[p[1]] & 0xf) << 12; val += ((digits[p[2]] >> 2) << 8); . w0 }8 v+ x: T6 s ?5 {- E val += ((digits[p[2]] & 0x3) << 22); " T. n$ \; R7 x0 N val += (digits[p[3]] << 16); val += ((digits[p[4]] << 2) << 24); $ C5 [6 D+ _% m) W. e- O. E3 l2 z val += ((digits[p[5]] >> 4) << 24);

/* 543210 543210 543210 543210 543210 543210

765432 10 ba98 fedc / Z6 Z/ a8 d" C; J& r 76 8 g: L! L( L8 I% e" z 543210 fedcba 98---- " [0 Y+ ~3 U9 L' c. Y5 }7 ? |- LSB -||- -||- -| |- MSB -| * a% h& n( Y% i/ @6 X! o */ return val; }

int isLeadByte (unsigned int cp, unsigned char ucByte) { /* Code page 932 - Japanese Shift-JIS - 0x81-0x9f 9 Q: V! n. Q) k J, Y$ H 0xe0-0xfc . N6 C# X6 J+ R2 [4 a- I- e 936 - Simplified Chinese GBK - 0xa1-0xfe x( ]- y" T6 G9 N7 L% x' D 949 - Korean Wansung - 0x81-0xfe 950 - Traditional Chinese Big5 - 0x81-0xfe 1361 - Korean Johab - 0x84-0xd3 0xd9-0xde ' o& Z' g& S. ^ 0xe0-0xf9 */ - U$ F4 D6 y) s switch (cp) { case 932: - P6 c9 W( V4 N* m. E7 S if ((ucByte > 0x80) && (ucByte < 0xa0)) return 1; . G+ R3 k" m1 w* ^ if ((ucByte > 0xdf) && (ucByte < 0xfd)) return 1; 5 P4 ?% G' P; n6 I; A9 i4 @ else return 0; * s4 o5 w. R$ @$ G& f* s case 936: 9 T5 t1 I# b" e0 l: ?9 v6 Y: U1 C4 q9 o if ((ucByte > 0xa0) && (ucByte < 0xff)) return 1; else return 0; case 949: case 950: + B$ G$ R& G% G3 w if ((ucByte > 0x80) && (ucByte < 0xff)) return 1; $ d% j5 n6 R C. J: v: V) B else return 0; % N9 d% B5 h' z4 j case 1361: ' d4 y$ ?2 h/ \! V7 c if ((ucByte > 0x83) && (ucByte < 0xd4)) return 1; 5 V6 ?& I c6 _( O; S" L if ((ucByte > 0xd8) && (ucByte < 0xdf)) return 1; if ((ucByte > 0xdf) && (ucByte < 0xfa)) return 1; else return 0; . }$ R' h, O) N! E default: return 0; }

}

int ScriptDecoder (unsigned char *inname, unsigned char *outname, unsigned int cp) { ' T6 n/ b0 m7 ?5 _: ^- w unsigned char inbuf[LEN_INBUF+1]; 7 X! `3 e$ Q4 |6 v4 x+ o unsigned char outbuf[LEN_OUTBUF+1]; unsigned char c, lenbuf[7], csbuf[7]; + k0 | p( E8 a) u4 \ D0 m unsigned char marker[] = "#@~^"; 1 b' T6 f2 z7 _; T5 @# [1 D int nextstate, state = 0; " s7 ^1 {0 y% A, {- ^ int i, j, k, m, ml = 0; unsigned long int csum = 0, len = 0; FILE *infile, *outfile;

infile = fopen (inname, "rb"); 0 I) H7 Y, `: }( V \3 A outfile = fopen (outname, "wb"); if (!infile || !outfile) ) M% h8 x% x, e( d7 o8 @$ S { printf ("Error opening file!\n"); ; n/ n- U s" f% q7 U return 10; ) X- x3 Z6 x# p } 7 H, V: g+ s' g! c ) G8 K7 ~: J, F% ~& X. Y maketrans(); makedigits(); memset (inbuf, 0, sizeof (inbuf)); , r2 w5 z; @8 e' d4 ~' B memset (outbuf, 0, sizeof (outbuf)); memset (lenbuf, 0, sizeof (lenbuf)); / ^' `" O- k. ?1 A& ^% A& v8 F state = STATE_INIT_COPY; ; r% m9 l; U; z! l1 o i = 0; . m! u/ v1 [; ?/ f0 w: n j = 0;

while (state) 5 s8 H9 W6 Q2 y% W& O3 v4 B { if (inbuf == 0) { if (feof (infile)) break;

memset (inbuf, 0, sizeof (inbuf)); fgets (inbuf, LEN_INBUF, infile); 2 @3 E O! }/ N9 F+ B, h" \5 Y; m. a- D i = 0; continue; 6 }) g+ I/ h3 w$ u! h" G }

if (j == LEN_OUTBUF) 4 L5 T! Y& l9 A; u* R3 _' H, v! f { # n2 g# W0 n; z6 M1 N fwrite (outbuf, sizeof(char), j, outfile); ) D+ u4 U* x- J# R j = 0; }

switch (state) { case STATE_INIT_COPY: 4 ~* l! |* C% E: i ml = strlen (marker); + C' R0 ]1 A3 B& t m = 0; state = STATE_COPY_INPUT; break;

韩冰

case STATE_COPY_INPUT: if (inbuf == marker[m]) - r" @4 O$ f# }2 E0 y4 s$ p- m/ X { / a6 g; ?( p3 w4 c+ J i++; m++; . d) p# l" R6 m& G } else { if (m) { - w! Z" C K% |% ^4 I! t3 b1 _. ^ k = 0; state = STATE_FLUSHING; . I6 P# h# h1 t- w$ D/ y( x } else 7 k3 Z8 L" ?, W9 S" d outbuf[j++] = inbuf[i++];

} if (m == ml) 1 x6 q1 c/ [9 d+ t5 e& Q state = STATE_INIT_READLEN; break;

case STATE_FLUSHING: outbuf[j++] = marker[k++]; 8 n) s& M3 V# q0 G( U' m4 e! u* ? m--; 4 Y' k! H O+ d" I1 z3 G$ \0 H if (m==0) S5 O7 Q+ w& F2 M! f% d state = STATE_COPY_INPUT; break; case STATE_SKIP_ML: 7 U. x6 q) o. z i++; if (!(--ml)) 3 ^$ c$ W/ J! e& k# ^# i state = nextstate; break;

! |$ f% f/ s* N9 C! E! s* Y case STATE_INIT_READLEN: ml = 6; state = STATE_READLEN; 6 x7 p6 i1 V3 P" c break;

case STATE_READLEN: lenbuf[6-ml] = inbuf[i++]; if (!(--ml)) { 1 b$ b3 u% V9 L2 u2 k len = decodeBase64 (lenbuf); 8 L1 o6 N8 q& M& x% ] m = 0; & G; d5 Y0 u( @9 z ml = 2; ! `0 O; b7 M% A# t$ m" Z& { state = STATE_SKIP_ML; . Y) v( V4 h! l7 Y; e9 z2 E" C$ F6 u nextstate = STATE_DECODE; } break;

case STATE_DECODE: if (!len) : I* D* S5 z. w8 D% Q' Z% V1 a { ml = 6; 2 d# S: _$ x9 c: ` state = STATE_CHECKSUM; . p; f/ Z N; Q( L! m* j. E2 C break; } , G* e. s9 C( M( B0 Z: O/ |+ u if (inbuf == _blank>'@') state = STATE_UNESCAPE; ) g, m t1 d! B; g# y4 _( \: S else 2 x M, r: z5 i& I, c { 1 [- F9 F) }% Z5 c2 L if (inbuf < 0x80) ; q% p2 j! f. {3 G$ n5 u& \1 W* j" i { 8 u' A8 m' ~( c& Z outbuf[j++] = c = transformed[pick_encoding[m%64]][inbuf]; 1 V, L1 e( K/ Y. t csum += c; m++; } else 0 q& x# e" k$ ^, u { outbuf[j++] = inbuf; if ((cp) && (isLeadByte (cp,inbuf))) " ^: M: u+ f. O# M: C j% i state = STATE_DBCS; }

} |4 v* R7 h/ ]4 x+ n9 \ i++; $ x* Z/ J' ^& I9 w len--; break;

case STATE_DBCS: , y. ]$ ~$ Z9 E( j" e4 e outbuf[j++] = inbuf[i++]; 6 l- }8 d5 |) f state = STATE_DECODE; , A" f- P, _/ `$ c break; 5 a% B; Z( t ` ?6 ~3 Z case STATE_UNESCAPE: outbuf[j++] = c = unescape (inbuf[i++]); & v( M5 k# J7 M) l8 N2 y6 [5 s1 h csum += c; len--; m++; state = STATE_DECODE; break;

case STATE_CHECKSUM: ' `# L/ v. Q2 y( s( Z csbuf[6-ml] = inbuf[i++]; 9 K. S* d0 x4 i; a if (!(--ml)) { 5 k0 e: f; O8 `: q4 s+ P; X csum -= decodeBase64 (csbuf); if (csum) ! d& b4 `+ K0 ]# L* A' j5 Q8 r { //printf ("Error - Incorrect checksum! (%lu)\n", csum); & H8 g5 P" k. W) C% |# J //csum=0; 此处注释掉好点，不然好多时候不能解密 嘿嘿 [icyfox] } m = 0; ml = 6; state = STATE_SKIP_ML; ; q3 G# ~" |1 a1 L5 O nextstate = STATE_INIT_COPY; } break;

default: * L8 |3 v; D7 A4 u7 I1 _. o printf ("Invalid state: %d\n", state); - `7 N' [2 X; N3 I- O# s. G" y break; * E9 l4 \+ V+ `; U$ r" N" T% ` } $ a1 ], l. U3 p6 g! ~* `* C; ^( u } , ?8 `9 N, | G5 s' A; `6 G4 D fwrite (outbuf, sizeof (char), j, outfile); ( _+ ]9 m" ~/ \0 V% B4 Z fclose (infile); fclose (outfile); - l( z/ w+ f2 j2 E8 p9 q return 0; }

* X$ ?/ |* L, I! e/ c7 k4 v( f6 Uint main (int argc, char **argv) 0 C0 ^( N, K9 n+ F/ d3 l: m+ o{ int cp = 0;

if (argc < 3) { printf ("Decoder for Microsoft Script Encoder v1.3\n" "(c)2000/2001 MrBrownstone, _blank>mrbrownstone@virtualconspiracy.com\n" "Home page: _blank>http://www.virtualconspiracy.com/scrdec.html\n\n" "Usage: scrdec13 [codepage]\n\n" "Code pages can be 932 - Japanese\n" . c# |, D( L9 O. [. D& k! J " 936 - Chinese (Simplified)\n" " 950 - Chinese (Traditional)\n" ' \& }) D0 X, q) }# G3 [( a& m " 949 - Korean (Wansung)\n" " 1361 - Korean (Johab)\n" 0 {; _& k( v# D1 o* c "Any other code pages don't need to be specified.\n"); return 10; }

if (argc > 3) 5 k3 E& C( y: ]# [2 h' [' C5 H cp = atoi (argv[3]); 3 ~" w, ]& J f% O return ScriptDecoder (argv[1], argv[2], cp); & I2 C9 M: x3 U4 A1 Y& Y}