本文为看雪论坛优秀文章
看雪论坛作者ID:wbwnnx
一
第一步
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/1-1683374964.png)
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/7-1683374965.png)
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/9-1683374966.png)
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/1-1683374967.png)
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/7-1683374970.png)
V M198048:1 [null,[null,{},null,null,”u0002ÿ-%.$ú{^1ì÷FË¢u000f÷°Q”,”s2″,”=”,{“s0″:”ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=”,”s1″:”Dkdpgh4ZKsQB80/Mfvw36XI1R25+WUAlEi7NLboqYTOPuzmFjJnryx9HVGcaStCe=”,”s2″:”Dkdpgh4ZKsQB80/Mfvw36XI1R25-WUAlEi7NLboqYTOPuzmFjJnryx9HVGcaStCe=”},”Dkdpgh4ZKsQB80/Mfvw36XI1R25-WUAlEi7NLboqYTOPuzmFjJnryx9HVGcaStCe=”,”DFSz”,196397,4],null,”u0002ÿ-%.$ú{^1ì÷FË¢u000f÷°Q”,[3],[null,{},null,null,”u0002ÿ-%.$ú{^1ì÷FË¢u000f÷°Q”,”s2″,”=”,{“s0″:”ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=”,”s1″:”Dkdpgh4ZKsQB80/Mfvw36XI1R25+WUAlEi7NLboqYTOPuzmFjJnryx9HVGcaStCe=”,”s2″:”Dkdpgh4ZKsQB80/Mfvw36XI1R25-WUAlEi7NLboqYTOPuzmFjJnryx9HVGcaStCe=”},”Dkdpgh4ZKsQB80/Mfvw36XI1R25-WUAlEi7NLboqYTOPuzmFjJnryx9HVGcaStCe=”,”DFSz”,196397,4],4,3]
[null,[null,{},null,null,”yso¨ÉHðr u000e1fã6(MÉXìu001fu0000N úg´f&o¿Öu000fÔº¤FWåà$u001b3A
ÊàÿÙku001e<Ì93u001au000föu0000u0006a²9Êu0002ç?8u0001;/·u0010mr-i’j|Bu000f+ÜÁ»u0003ëôu001e{dÇu000fF^u0004¥;Jä·q[“,”s0″,”=”,{“s0″:”ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=”,”s1″:”Dkdpgh4ZKsQB80/Mfvw36XI1R25+WUAlEi7NLboqYTOPuzmFjJnryx9HVGcaStCe=”,”s2″:”Dkdpgh4ZKsQB80/Mfvw36XI1R25-WUAlEi7NLboqYTOPuzmFjJnryx9HVGcaStCe=”},”ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=”,”eXNvqMlI8HJgDjFm4zYoTclY7B8ATqD6Z7RmJm+ev9YPl9S6pEZX5Z3gJBszQWCayuD/2WsegTzMOTMagA/2AAZhsjnKAuc/OAE7L7eYiBBtDS1pJ2p8QoIPK9zBuwPr9B57ZMetjIkPRl4Ei6U7Spfkt3F”,12022107,117],”eXNvqMlI8HJgDjFm4zYoTclY7B8ATqD6Z7RmJm+ev9YPl9S6pEZX5Z3gJBszQWCayuD/2WsegTzMOTMagA/2AAZhsjnKAuc/OAE7L7eYiBBtDS1pJ2p8QoIPK9zBuwPr9B57ZMetjIkPRl4Ei6U7Spfkt3F”,null,”ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=”,[27],63,117]
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/5-1683374971.png)
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/4-1683374971.png)
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/8-1683374973.png)
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/6-1683374974.png)
所以断点条件
E == 208 && P == 0 && O[4][1] == ‘Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36’,
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/8-1683374976.png)
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/7-1683374977.png)
二
第二步
接下来就是分析base64之后这个字节数据怎么来的了,直接在外层设置条件断点,然后分析vmp内层日志。
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/1-1683374977.png)
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/1-1683374978.png)
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/0-1683374979.png)
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/3-1683374979.png)
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/3-1683374980.png)
saltpayload 是 payload的md5 转 十六进制字节 在md5在转十六进制字节
salt是空字符串 同上
salt_ua是最开始分析的base64的md5转十六进制字节
这些salt都是取后两位做校验
时间戳和canvas都是取高低8位与255
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/9-1683374982.png)
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/3-1683374983.png)
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/7-1683374984.png)
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/6-1683374985.png)
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/7-1683374986.png)
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/2-1683374986.png)
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/3-1683374987.png)
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/7-1683374988.png)
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/8-1683374989.png)
走到这里发现第一个字符串D已经出来了,索引就是上面运行的值,断点走到这流程就是
‘Dkdpgh4ZKsQB80/Mfvw36XI1R25-WUAlEi7NLboqYTOPuzmFjJnryx9HVGcaStCe=’.charAt(0)
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/3-1683374990.png)
192512 = 196397 & 258048
但发现下面取索引的时候变成了47,原来是漏掉了一步,
192512 >> 12
那这样上面的不是直接等于0的是,0 >> 18 ,这个18和12都是解释器固定的值。
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/9-1683374990.png)
60 = (196397 & 4032)>> 6
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/7-1683374991.png)
45 = 196397 & 63
发现些许不同,没有 >> 这一步了。
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/2-1683374992.png)
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/8-1683374993.png)
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/7-1683374993.png)
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/7-1683374994.png)
看雪ID:wbwnnx
https://bbs.kanxue.com/user-home-917207.htm
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/9-1683374994.png)
# 往期推荐
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/4-1683374996.jpeg)
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/5-1683374996.gif)
球分享
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/1-1683374996.gif)
球点赞
![X-Bogus vmp分析 X-Bogus vmp分析](https://ctfiot.oss-cn-beijing.aliyuncs.com/uploads/2023/05/10-1683374997.gif)
球在看
原文始发于微信公众号(看雪学苑):X-Bogus vmp分析