This is the 8th day of my participation in the August More Text Challenge. For details, see:August is more challenging

Today’s web site

aHR0cHM6Ly93d3cubWFuZ2Fiei5jb20vbTE4MDk3MC8=

Every day is to supplement the environment, water group, selling classes, in order not to drop powder but also forced to write a hydrology

Encryption location and analysis

First look at the request, we need to get the cartoon image, so we have to look for the request for the picture on the page, but there is no corresponding package in the network request

So first look through the other packages to see if there are any suspicious requests.

Without keeping you guessing, find the location of the chapterImage.ashx request

This request also returns an eval

eval(function(p,a,c,k,e,d){e=function(c){return(c<a?"":e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!' '.replace(/ ^ /.String)) {while(c--)d[e(c)]=k[c]||e(c); k=[function(e){returnd[e]}]; e=function(){return'\\w+'}; c=1; };while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b'.'g'),k[c]);returnp; } ('e 9(){2 6=4; 2 5=\'a\'; 2 7="g://j.h.f/1/b/4"; 2 3=["/c.8","/k.8"]; o(2 i=0; i<3.l; i++){3[i]=7+3[i]+\'? 6=4&5=a&m=\'}n 3}2 d; d=9(); '.25.25.'||var|pvalue|180970|key|cid|pix|jpg|dm5imagefun|e7a63405323a7a1735bb5b6774e48c36|266|1_8812||function|com|https|mangabz ||image|2_6933|length|uk|return|for'.split('|'),0{})),Copy the code

I think you all know eval here, but this is the code

function dm5imagefun(){var cid=180970; var key='e7a63405323a7a1735bb5b6774e48c36'; var pix="https://image.mangabz.com/1/266/180970"; var pvalue=["/1_8812.jpg"."/2_6933.jpg"];for(var i=0; i<pvalue.length; i++){pvalue[i]=pix+pvalue[i]+'? cid=180970&key=e7a63405323a7a1735bb5b6774e48c36&uk='}returnpvalue}var d; d=dm5imagefun();Copy the code

Run it in the editor to get the link below

Direct point open is the picture of the cartoon, write to the local everyone should be, over the matter ~

The sign in the request for this js code is returned by the page, but the sign test can also get the JS code without it. So eval just executes this js and you’re done.

Eval is not hard to find, and you can also use the Hook Eval script to quickly locate it

// Script source: wechat group collection forget which big guy hair, if there is infringement contact me delete ha
window.__cr_eval = window.eval;
var myeval = function (src) {
    console.log('eval:', src);
    return window.__cr_eval(src)
};
var _myeval = myeval.bind(null);
_myeval.toString = window.__cr_eval.toString;
Object.defineProperty(window.'eval', {value: _myeval});
Copy the code

That’s all for today’s article. See you next time