JS逆向之补环境-手动补环境(一)

2025-9-17 / 0 评论 / 428 阅读

一、补环境

补环境的方式有很多,高端点的有用插件自动补环境(v-jstools)、有用jsdom补环境,但是高端的方式有时未必好用。
本次是用低端的纯手动补环境的方式,先用代理吐环境,然后挨个补环境。
吐环境的code附上:

代码一

function get_enviroment(proxy_array) {
    for(var i=0; i<proxy_array.length; i++){
        handler = '{\n' +
            '    get: function(target, property, receiver) {\n' +
            '        console.log("方法:", "get  ", "对象:", ' +
            '"' + proxy_array[i] + '" ,' +
            '"  属性:", property, ' +
            '"  属性类型:", ' + 'typeof property, ' +
            // '"  属性值:", ' + 'target[property], ' +
            '"  属性值类型:", typeof target[property]);\n' +
            '        return target[property];\n' +
            '    },\n' +
            '    set: function(target, property, value, receiver) {\n' +
            '        console.log("方法:", "set  ", "对象:", ' +
            '"' + proxy_array[i] + '" ,' +
            '"  属性:", property, ' +
            '"  属性类型:", ' + 'typeof property, ' +
            // '"  属性值:", ' + 'target[property], ' +
            '"  属性值类型:", typeof target[property]);\n' +
            '        return Reflect.set(...arguments);\n' +
            '    }\n' +
            '}'
        eval('try{\n' + proxy_array[i] + ';\n'
        + proxy_array[i] + '=new Proxy(' + proxy_array[i] + ', ' + handler + ')}catch (e) {\n' + proxy_array[i] + '={};\n'
        + proxy_array[i] + '=new Proxy(' + proxy_array[i] + ', ' + handler + ')}')
    }
}
proxy_array = ['window', 'document', 'location', 'navigator', 'history','screen']

// 这里写你要补的环境

get_enviroment(proxy_array)

代码二

function watch(obj, name){
    var console_log = console.log
    return new Proxy(obj, {
        get(target, p, receiver){
            // 过滤没用的信息,不进行打印
            if (p === "Math" || p === "isNaN" || p === "encodeURI" || p === "Uint8Array" || p.toString().indexOf("Symbol(Symbol.") != -1){
                let val = Reflect.get(...arguments);
                return val
            } else {
                let val = Reflect.get(...arguments);
                list_evn = ['navigator','location','performance','childNodes','top','self','document','pqs666']  // 可以过滤比较长的值,手动添加方法名

                console_log(`取值:`,name, '.', p, ` =>`, list_evn.includes(p)?p+'值过长省略....':val);
                return val
            }
        },
        set(target, p, value, receiver){
            let val = Reflect.get(...arguments);
            console_log(`设置值:${name}.${p}, ${val} => ${value}`);
            return Reflect.set(...arguments)
        },
        has(target,key){
            // debugger;
            console_log(`in => ${key} in ${target}`)
            return key in target
        },
        deleteProperty: function (target, prop) {
            console.log("delete => " + prop);
            return true;
        },
    })
}

// 使用示例

//补的所有环境必须在这个里面才有效果
/////=============补window环境===============

window = globalThis;
window = watch(window, 'window')

debugger

代码三

let setProxyArr = function (proxyObjArr) {
  for (let i = 0; i < proxyObjArr.length; i++) {
    const handler = `{
    get:function(target,property,receiver){
    console.log("方法:","get","对象","${proxyObjArr[i]}","属性:",
property,"属性类型:",typeof property,"属性值:",target[property],"属性值类型:",typeof target[property]);
return Reflect.get(...arguments)
    },
    set:function(target,property,value,receiver){
    console.log("方法:","set","对象:","${proxyObjArr[i]}","属性:",
property,"属性类型:",typeof property,"属性值:",value,"属性值类型:",typeof target[property]);
    return Reflect.set(...arguments);
    }
  }`;
    eval(`try{
        ${proxyObjArr[i]};
        ${proxyObjArr[i]} = new Proxy(${proxyObjArr[i]},${handler});
        } catch (e){
         ${proxyObjArr[i]} = {};
         ${proxyObjArr[i]} = new Proxy(${proxyObjArr[i]},${handler});
         }`);
  }
}
function watch(object) {
  const handler = {
    get: function (target, property, receiver) {
      if (property !== 'isNaN' && property !== 'encodeURI' && property !== "Uint8Array" && property !== 'undefined' && property !== 'JSON') {
        console.log("方法:", "get", "对象", target, "属性:",
          property, "属性类型:", typeof property, "属性值:", target[property], "属性值类型:", typeof target[property]);
      }
      return Reflect.get(...arguments)

    },
    set: function (target, property, value, receiver) {
      console.log("方法:", "set", "对象:", target, "属性:",
        property, "属性类型:", typeof property, "属性值:", value, "属性值类型:", typeof target[property]);
      return Reflect.set(...arguments);
    }
  }
  return new Proxy(object, handler)
}
const safeFunction = function safeFunction(func) {
  //处理安全函数
  Function.prototype.$call = Function.prototype.call;
  const $toString = Function.toString;
  const myFunction_toString_symbol = Symbol('('.concat('', ')'));

  const myToString = function myToString() {
    return typeof this === 'function' && this[myFunction_toString_symbol] || $toString.$call(this);
  }

  const set_native = function set_native(func, key, value) {
    Object.defineProperty(func, key, {
      "enumerable": false,
      "configurable": true,
      "writable": true,
      "value": value
    });
  }

  delete Function.prototype['toString'];
  set_native(Function.prototype, "toString", myToString);
  set_native(Function.prototype.toString, myFunction_toString_symbol, "function toString() { [native code] }");

  const safe_Function = function safe_Function(func) {
    set_native(func, myFunction_toString_symbol, "function" + (func.name ? " " + func.name : "") + "() { [native code] }");
  }

  return safe_Function(func)
}

//创建函数
const makeFunction = function makeFunction(name) {
  // 使用 Function 保留函数名
  let func = new Function("v_log", `
        return function ${name}() {
            v_log('函数${name}传参-->', arguments);
        };
    `)(v_log); // 传递 v_log 到动态函数

  safeFunction(func);
  func.prototype = myProxy(func.prototype, `方法${name}.prototype`);

  return func;
}
window = global
window.Buffer = Buffer
window.Window = function Window() { }
Object.setPrototypeOf(window, window.Window.prototype)
window.Document = function Document() { }
delete global
delete Buffer
delete __dirname
delete __filename
delete process
safeFunction(window.Window)
safeFunction(window.Document)

function HTMLDocument() {

}
Object.setPrototypeOf(HTMLDocument.prototype, window.Document.prototype)
HTMLDocument.prototype.constructor = HTMLDocument
document = new HTMLDocument()
window.HTMLDocument = HTMLDocument
safeFunction(window.HTMLDocument)

function Navigator() {

}
navigator = new Navigator()
window.Navigator = Navigator
safeFunction(window.Navigator)

function Screen() {

}
screen = new Screen()
window.Screen = Screen
safeFunction(window.Screen)

function History() {

}
history = new History()
window.History = History
safeFunction(window.History)

function Location() {

}
location = new Location()
window.Location = Location
safeFunction(window.Location)
setProxyArr(['window', 'document', 'location', 'history', 'screen', 'navigator'])

    评论一下?

    OωO
    取消