前言
这次算是我自己的一次小突破吧，毕竟之前没有搞过某验的验证码，总感觉难度很高，其实花点时间下去总是能解决的~
目标网站：https://passport.bilibili.com/login
加密类型：RSA、AES
验证码：某验点选
一、页面分析
1.1 模拟页面请求
按F12直接刷新，看xhr里的请求：
combine链接里的参数gt、challenge、key都是要用到的。
然后是点击登入，看看验证码的请求，这个是获取验证码的类型，可以看到是点选的，请求时携带了一个w参数，这里由于是点选验证码，不会校验此处的w，我们传个空值即可。
下面这个返回的数据里，c、s是w参数加密用到的，pic就是图片的链接。
这个是验证码识别正确返回的数据，其中validate是我们需要的，同时请求里的w参数就需要我们自己构建，这个后面会讲。
先来看看登入请求的这几个参数：password是加密的、key是在一开始请求时获得的，challenge跟validate是通过校验验证码得到的。
二、参数破解
2.1 登入参数password解密
password参数加密比较简单，是RSA类型的，我们直接在这里可以看到加密的js文件就是login开头的这个。
直接进去搜password参数，找到加密位置下断点调试
这里直接扣JSEncrypt生成的JS文件放到本地调试，没用的删掉，加点环境就可以用了
var window = global;
var navigator = {
};
window['navigator'] = navigator;
!function (t, e) {
"function" == typeof define && define.amd ? define(["exports"], e) : e("object" == typeof exports && "string" != typeof exports.nodeName ? module.exports : t)
}(this, function (t) {
function e(t, e, i) {
null != t && ("number" == typeof t ? this.fromNumber(t, e, i) : null == e && "string" != typeof t ? this.fromString(t, 256) : this.fromString(t, e))
}
function i() {
return new e(null)
}
function r(t, e, i, r, s, n) {
for (; --n >= 0;) {
var o = e * this[t++] + i[r] + s;
s = Math.floor(o / 67108864),
i[r++] = 67108863 & o
}
return s
}
function s(t, e, i, r, s, n) {
for (var o = 32767 & e, h = e >> 15; --n >= 0;) {
var a = 32767 & this[t]
, u = this[t++] >> 15
, c = h * a + u * o;
a = o * a + ((32767 & c) << 15) + i[r] + (1073741823 & s),
s = (a >>> 30) + (c >>> 15) + h * u + (s >>> 30),
i[r++] = 1073741823 & a
}
return s
}
function n(t, e, i, r, s, n) {
for (var o = 16383 & e, h = e >> 14; --n >= 0;) {
var a = 16383 & this[t]
, u = this[t++] >> 14
, c = h * a + u * o;
a = o * a + ((16383 & c) << 14) + i[r] + s,
s = (a >> 28) + (c >> 14) + h * u,
i[r++] = 268435455 & a
}
return s
}
function o(t) {
return Be.charAt(t)
}
function h(t, e) {
var i = Ke[t.charCodeAt(e)];
return null == i ? -1 : i
}
function a(t) {
for (var e = this.t - 1; e >= 0; --e)
t[e] = this[e];
t.t = this.t,
t.s = this.s
}
function u(t) {
this.t = 1,
this.s = 0 > t ? -1 : 0,
t > 0 ? this[0] = t : -1 > t ? this[0] = t + this.DV : this.t = 0
}
function c(t) {
var e = i();
return e.fromInt(t),
e
}
function f(t, i) {
var r;
if (16 == i)
r = 4;
else if (8 == i)
r = 3;
else if (256 == i)
r = 8;
else if (2 == i)
r = 1;
else if (32 == i)
r = 5;
else {
if (4 != i)
return void this.fromRadix(t, i);
r = 2
}
this.t = 0,
this.s = 0;
for (var s = t.length, n = !1, o = 0; --s >= 0;) {
var a = 8 == r ? 255 & t[s] : h(t, s);
0 > a ? "-" == t.charAt(s) && (n = !0) : (n = !1,
0 == o ? this[this.t++] = a : o + r > this.DB ? (this[this.t - 1] |= (a & (1 << this.DB - o) - 1) << o,
this[this.t++] = a >> this.DB - o) : this[this.t - 1] |= a << o,
o += r,
o >= this.DB && (o -= this.DB))
}
8 == r && 0 != (128 & t[0]) && (this.s = -1,
o > 0 && (this[this.t - 1] |= (1 << this.DB - o) - 1 << o)),
this.clamp(),
n && e.ZERO.subTo(this, this)
}
function p() {
for (var t = this.s & this.DM; this.t > 0 && this[this.t - 1] == t;)
--this.t
}
function l(t) {
if (this.s < 0)
return "-" + this.negate().toString(t);
var e;
if (16 == t)
e = 4;
else if (8 == t)
e = 3;
else if (2 == t)
e = 1;
else if (32 == t)
e = 5;
else {
if (4 != t)
return this.toRadix(t);
e = 2
}
var i, r = (1 << e) - 1, s = !1, n = "", h = this.t, a = this.DB - h * this.DB % e;
if (h-- > 0)
for (a < this.DB && (i = this[h] >> a) > 0 && (s = !0,
n = o(i)); h >= 0;)
e > a ? (i = (this[h] & (1 << a) - 1) << e - a,
i |= this[--h] >> (a += this.DB - e)) : (i = this[h] >> (a -= e) & r,
0 >= a && (a += this.DB,
--h)),
i > 0 && (s = !0),
s && (n += o(i));
return s ? n : "0"
}
function d() {
var t = i();
return e.ZERO.subTo(this, t),
t
}
function g() {
return this.s < 0 ? this.negate() : this
}
function m(t) {
var e = this.s - t.s;
if (0 != e)
return e;
var i = this.t;
if (e = i - t.t,
0 != e)
return this.s < 0 ? -e : e;
for (; --i >= 0;)
if (0 != (e = this[i] - t[i]))
return e;
return 0
}
function y(t) {
var e, i = 1;
return 0 != (e = t >>> 16) && (t = e,
i += 16),
0 != (e = t >> 8) && (t = e,
i += 8),
0 != (e = t >> 4) && (t = e,
i += 4),
0 != (e = t >> 2) && (t = e,
i += 2),
0 != (e = t >> 1) && (t = e,
i += 1),
i
}
function b() {
return this.t <= 0 ? 0 : this.DB * (this.t - 1) + y(this[this.t - 1] ^ this.s & this.DM)
}
function T(t, e) {
var i;
for (i = this.t - 1; i >= 0; --i)
e[i + t] = this[i];
for (i = t - 1; i >= 0; --i)
e[i] = 0;
e.t = this.t + t,
e.s = this.s
}
function S(t, e) {
for (var i = t; i < this.t; ++i)
e[i - t] = this[i];
e.t = Math.max(this.t - t, 0),
e.s = this.s
}
function R(t, e) {
var i, r = t % this.DB, s = this.DB - r, n = (1 << s) - 1, o = Math.floor(t / this.DB),
h = this.s << r & this.DM;
for (i = this.t - 1; i >= 0; --i)
e[i + o + 1] = this[i] >> s | h,
h = (this[i] & n) << r;
for (i = o - 1; i >= 0; --i)
e[i] = 0;
e[o] = h,
e.t = this.t + o + 1,
e.s = this.s,
e.clamp()
}
function E(t, e) {
e.s = this.s;
var i = Math.floor(t / this.DB);
if (i >= this.t)
return void (e.t = 0);
var r = t % this.DB
, s = this.DB - r
, n = (1 << r) - 1;
e[0] = this[i] >> r;
for (var o = i + 1; o < this.t; ++o)
e[o - i - 1] |= (this[o] & n) << s,
e[o - i] = this[o] >> r;
r > 0 && (e[this.t - i - 1] |= (this.s & n) << s),
e.t = this.t - i,
e.clamp()
}
function D(t, e) {
for (var i = 0, r = 0, s = Math.min(t.t, this.t); s > i;)
r += this[i] - t[i],
e[i++] = r & this.DM,
r >>= this.DB;
if (t.t < this.t) {
for (r -= t.s; i < this.t;)
r += this[i],
e[i++] = r & this.DM,
r >>= this.DB;
r += this.s
} else {
for (r += this.s; i < t.t;)
r -= t[i],
e[i++] = r & this.DM,
r >>= this.DB;
r -= t.s
}
e.s = 0 > r ? -1 : 0,
-1 > r ? e[i++] = this.DV + r : r > 0 && (e[i++] = r),
e.t = i,
e.clamp()
}
function w(t, i) {
var r = this.abs()
, s = t.abs()
, n = r.t;
for (i.t = n + s.t; --n >= 0;)
i[n] = 0;
for (n = 0; n < s.t; ++n)
i[n + r.t] = r.am(0, s[n], i, n, 0, r.t);
i.s = 0,
i.clamp(),
this.s != t.s && e.ZERO.subTo(i, i)
}
function x(t) {
for (var e = this.abs(), i = t.t = 2 * e.t; --i >= 0;)
t[i] = 0;
for (i = 0; i < e.t - 1; ++i) {
var r = e.am(i, e[i], t, 2 * i, 0, 1);
(t[i + e.t] += e.am(i + 1, 2 * e[i], t, 2 * i + 1, r, e.t - i - 1)) >= e.DV && (t[i + e.t] -= e.DV,
t[i + e.t + 1] = 1)
}
t.t > 0 && (t[t.t - 1] += e.am(i, e[i], t, 2 * i, 0, 1)),
t.s = 0,
t.clamp()
}
function B(t, r, s) {
var n = t.abs();
if (!(n.t <= 0)) {
var o = this.abs();
if (o.t < n.t)
return null != r && r.fromInt(0),
void (null != s && this.copyTo(s));
null == s && (s = i());
var h = i()
, a = this.s
, u = t.s
, c = this.DB - y(n[n.t - 1]);
c > 0 ? (n.lShiftTo(c, h),
o.lShiftTo(c, s)) : (n.copyTo(h),
o.copyTo(s));
var f = h.t
, p = h[f - 1];
if (0 != p) {
var l = p * (1 << this.F1) + (f > 1 ? h[f - 2] >> this.F2 : 0)
, d = this.FV / l
, g = (1 << this.F1) / l
, m = 1 << this.F2
, v = s.t
, b = v - f
, T = null == r ? i() : r;
for (h.dlShiftTo(b, T),
s.compareTo(T) >= 0 && (s[s.t++] = 1,
s.subTo(T, s)),
e.ONE.dlShiftTo(f, T),
T.subTo(h, h); h.t < f;)
h[h.t++] = 0;
for (; --b >= 0;) {
var S = s[--v] == p ? this.DM : Math.floor(s[v] * d + (s[v - 1] + m) * g);
if ((s[v] += h.am(0, S, s, b, 0, f)) < S)
for (h.dlShiftTo(b, T),
s.subTo(T, s); s[v] < --S;)
s.subTo(T, s)
}
null != r && (s.drShiftTo(f, r),
a != u && e.ZERO.subTo(r, r)),
s.t = f,
s.clamp(),
c > 0 && s.rShiftTo(c, s),
0 > a && e.ZERO.subTo(s, s)
}
}
}
function K(t) {
var r = i();
return this.abs().divRemTo(t, null, r),
this.s < 0 && r.compareTo(e.ZERO) > 0 && t.subTo(r, r),
r
}
function A(t) {
this.m = t
}
function U(t) {
return t.s < 0 || t.compareTo(this.m) >= 0 ? t.mod(this.m) : t
}
function O(t) {
return t
}
function V(t) {
t.divRemTo(this.m, null, t)
}
function N(t, e, i) {
t.multiplyTo(e, i),
this.reduce(i)
}
function J(t, e) {
t.squareTo(e),
this.reduce(e)
}
function I() {
if (this.t < 1)
return 0;
var t = this[0];
if (0 == (1 & t))
return 0;
var e = 3 & t;
return e = e * (2 - (15 & t) * e) & 15,
e = e * (2 - (255 & t) * e) & 255,
e = e * (2 - ((65535 & t) * e & 65535)) & 65535,
e = e * (2 - t * e % this.DV) % this.DV,
e > 0 ? this.DV - e : -e
}
function P(t) {
this.m = t,
this.mp = t.invDigit(),
this.mpl = 32767 & this.mp,
this.mph = this.mp >> 15,
this.um = (1 << t.DB - 15) - 1,
this.mt2 = 2 * t.t
}
function M(t) {
var r = i();
return t.abs().dlShiftTo(this.m.t, r),
r.divRemTo(this.m, null, r),
t.s < 0 && r.compareTo(e.ZERO) > 0 && this.m.subTo(r, r),
r
}
function L(t) {
var e = i();
return t.copyTo(e),
this.reduce(e),
e
}
function q(t) {
for (; t.t <= this.mt2;)
t[t.t++] = 0;
for (var e = 0; e < this.m.t; ++e) {
var i = 32767 & t[e]
, r = i * this.mpl + ((i * this.mph + (t[e] >> 15) * this.mpl & this.um) << 15) & t.DM;
for (i = e + this.m.t,
t[i] += this.m.am(0, r, t, e, 0, this.m.t); t[i] >= t.DV;)
t[i] -= t.DV,
t[++i]++
}
t.clamp(),
t.drShiftTo(this.m.t, t),
t.compareTo(this.m) >= 0 && t.subTo(this.m, t)
}
function C(t, e) {
t.squareTo(e),
this.reduce(e)
}
function H(t, e, i) {
t.multiplyTo(e, i),
this.reduce(i)
}
function j() {
return 0 == (this.t > 0 ? 1 & this[0] : this.s)
}
function k(t, r) {
if (t > 4294967295 || 1 > t)
return e.ONE;
var s = i()
, n = i()
, o = r.convert(this)
, h = y(t) - 1;
for (o.copyTo(s); --h >= 0;)
if (r.sqrTo(s, n),
(t & 1 << h) > 0)
r.mulTo(n, o, s);
else {
var a = s;
s = n,
n = a
}
return r.revert(s)
}
function F(t, e) {
var i;
return i = 256 > t || e.isEven() ? new A(e) : new P(e),
this.exp(t, i)
}
function _() {
var t = i();
return this.copyTo(t),
t
}
function z() {
if (this.s < 0) {
if (1 == this.t)
return this[0] - this.DV;
if (0 == this.t)
return -1
} else {
if (1 == this.t)
return this[0];
if (0 == this.t)
return 0
}
return (this[1] & (1 << 32 - this.DB) - 1) << this.DB | this[0]
}
function Z() {
return 0 == this.t ? this.s : this[0] << 24 >> 24
}
function $(t) {
return Math.floor(Math.LN2 * this.DB / Math.log(t))
}
function Y() {
return this.s < 0 ? -1 : this.t <= 0 || 1 == this.t && this[0] <= 0 ? 0 : 1
}
function W(t) {
if (null == t && (t = 10),
0 == this.signum() || 2 > t || t > 36)
return "0";
var e = this.chunkSize(t)
, r = Math.pow(t, e)
, s = c(r)
, n = i()
, o = i()
, h = "";
for (this.divRemTo(s, n, o); n.signum() > 0;)
h = (r + o.intValue()).toString(t).substr(1) + h,
n.divRemTo(s, n, o);
return o.intValue().toString(t) + h
}
function Q(t, i) {
this.fromInt(0),
null == i && (i = 10);
for (var r = this.chunkSize(i), s = Math.pow(i, r), n = !1, o = 0, a = 0, u = 0; u < t.length; ++u) {
var c = h(t, u);
0 > c ? "-" == t.charAt(u) && 0 == this.signum() && (n = !0) : (a = i * a + c,
++o >= r && (this.dMultiply(s),
this.dAddOffset(a, 0),
o = 0,
a = 0))
}
o > 0 && (this.dMultiply(Math.pow(i, o)),
this.dAddOffset(a, 0)),
n && e.ZERO.subTo(this, this)
}
function X(t, i, r) {
if ("number" == typeof i)
if (2 > t)
this.fromInt(1);
else
for (this.fromNumber(t, r),
this.testBit(t - 1) || this.bitwiseTo(e.ONE.shiftLeft(t - 1), ht, this),
this.isEven() && this.dAddOffset(1, 0); !this.isProbablePrime(i);)
this.dAddOffset(2, 0),
this.bitLength() > t && this.subTo(e.ONE.shiftLeft(t - 1), this);
else {
var s = new Array
, n = 7 & t;
s.length = (t >> 3) + 1,
i.nextBytes(s),
n > 0 ? s[0] &= (1 << n) - 1 : s[0] = 0,
this.fromString(s, 256)
}
}
function tt() {
var t = this.t
, e = new Array;
e[0] = this.s;
var i, r = this.DB - t * this.DB % 8, s = 0;
if (t-- > 0)
for (r < this.DB && (i = this[t] >> r) != (this.s & this.DM) >> r && (e[s++] = i | this.s << this.DB - r); t >= 0;)
8 > r ? (i = (this[t] & (1 << r) - 1) << 8 - r,
i |= this[--t] >> (r += this.DB - 8)) : (i = this[t] >> (r -= 8) & 255,
0 >= r && (r += this.DB,
--t)),
0 != (128 & i) && (i |= -256),
0 == s && (128 & this.s) != (128 & i) && ++s,
(s > 0 || i != this.s) && (e[s++] = i);
return e
}
function it(t) {
return this.compareTo(t) < 0 ? this : t
}
function rt(t) {
return this.compareTo(t) > 0 ? this : t
}
function st(t, e, i) {
var r, s, n = Math.min(t.t, this.t);
for (r = 0; n > r; ++r)
i[r] = e(this[r], t[r]);
if (t.t < this.t) {
for (s = t.s & this.DM,
r = n; r < this.t; ++r)
i[r] = e(this[r], s);
i.t = this.t
} else {
for (s = this.s & this.DM,
r = n; r < t.t; ++r)
i[r] = e(s, t[r]);
i.t = t.t
}
i.s = e(this.s, t.s),
i.clamp()
}
function nt(t, e) {
return t & e
}
function ht(t, e) {
return t | e
}
function dt(t) {
var e = i();
return 0 > t ? this.rShiftTo(-t, e) : this.lShiftTo(t, e),
e
}
function gt(t) {
var e = i();
return 0 > t ? this.lShiftTo(-t, e) : this.rShiftTo(t, e),
e
}
function mt(t) {
if (0 == t)
return -1;
var e = 0;
return 0 == (65535 & t) && (t >>= 16,
e += 16),
0 == (255 & t) && (t >>= 8,
e += 8),
0 == (15 & t) && (t >>= 4,
e += 4),
0 == (3 & t) && (t >>= 2,
e += 2),
0 == (1 & t) && ++e,
e
}
function yt() {
for (var t = 0; t < this.t; ++t)
if (0 != this[t])
return t * this.DB + mt(this[t]);
return this.s < 0 ? this.t * this.DB : -1
}
function Tt(t) {
var e = Math.floor(t / this.DB);
return e >= this.t ? 0 != this.s : 0 != (this[e] & 1 << t % this.DB)
}
function St(t, i) {
var r = e.ONE.shiftLeft(t);
return this.bitwiseTo(r, i, r),
r
}
function wt(t, e) {
for (var i = 0, r = 0, s = Math.min(t.t, this.t); s > i;)
r += this[i] + t[i],
e[i++] = r & this.DM,
r >>= this.DB;
if (t.t < this.t) {
for (r += t.s; i < this.t;)
r += this[i],
e[i++] = r & this.DM,
r >>= this.DB;
r += this.s
} else {
for (r += this.s; i < t.t;)
r += t[i],
e[i++] = r & this.DM,
r >>= this.DB;
r += t.s
}
e.s = 0 > r ? -1 : 0,
r > 0 ? e[i++] = r : -1 > r && (e[i++] = this.DV + r),
e.t = i,
e.clamp()
}
function xt(t) {
var e = i();
return this.addTo(t, e),
e
}
function Bt(t) {
var e = i();
return this.subTo(t, e),
e
}
function Kt(t) {
var e = i();
return this.multiplyTo(t, e),
e
}
function Ut(t) {
var e = i();
return this.divRemTo(t, e, null),
e
}
function Nt(t) {
this[this.t] = this.am(0, t - 1, this, 0, 0, this.t),
++this.t,
this.clamp()
}
function Jt(t, e) {
if (0 != t) {
for (; this.t <= e;)
this[this.t++] = 0;
for (this[e] += t; this[e] >= this.DV;)
this[e] -= this.DV,
++e >= this.t && (this[this.t++] = 0),
++this[e]
}
}
function It() {
}
function Pt(t) {
return t
}
function Mt(t, e, i) {
t.multiplyTo(e, i)
}
function Lt(t, e) {
t.squareTo(e)
}
function qt(t) {
return this.exp(t, new It)
}
function Ct(t, e, i) {
var r = Math.min(this.t + t.t, e);
for (i.s = 0,
i.t = r; r > 0;)
i[--r] = 0;
var s;
for (s = i.t - this.t; s > r; ++r)
i[r + this.t] = this.am(0, t[r], i, r, 0, this.t);
for (s = Math.min(t.t, e); s > r; ++r)
this.am(0, t[r], i, r, 0, e - r);
i.clamp()
}
function Ht(t, e, i) {
--e;
var r = i.t = this.t + t.t - e;
for (i.s = 0; --r >= 0;)
i[r] = 0;
for (r = Math.max(e - this.t, 0); r < t.t; ++r)
i[this.t + r - e] = this.am(e - r, t[r], i, 0, 0, this.t + r - e);
i.clamp(),
i.drShiftTo(1, i)
}
function jt(t) {
this.r2 = i(),
this.q3 = i(),
e.ONE.dlShiftTo(2 * t.t, this.r2),
this.mu = this.r2.divide(t),
this.m = t
}
function kt(t) {
if (t.s < 0 || t.t > 2 * this.m.t)
return t.mod(this.m);
if (t.compareTo(this.m) < 0)
return t;
var e = i();
return t.copyTo(e),
this.reduce(e),
e
}
function Ft(t) {
return t
}
function _t(t) {
for (t.drShiftTo(this.m.t - 1, this.r2),
t.t > this.m.t + 1 && (t.t = this.m.t + 1,
t.clamp()),
this.mu.multiplyUpperTo(this.r2, this.m.t + 1, this.q3),
this.m.multiplyLowerTo(this.q3, this.m.t + 1, this.r2); t.compareTo(this.r2) < 0;)
t.dAddOffset(1, this.m.t + 1);
for (t.subTo(this.r2, t); t.compareTo(this.m) >= 0;)
t.subTo(this.m, t)
}
function zt(t, e) {
t.squareTo(e),
this.reduce(e)
}
function Zt(t, e, i) {
t.multiplyTo(e, i),
this.reduce(i)
}
function Gt(t, e) {
var r, s, n = t.bitLength(), o = c(1);
if (0 >= n)
return o;
r = 18 > n ? 1 : 48 > n ? 3 : 144 > n ? 4 : 768 > n ? 5 : 6,
s = 8 > n ? new A(e) : e.isEven() ? new jt(e) : new P(e);
var h = new Array
, a = 3
, u = r - 1
, f = (1 << r) - 1;
if (h[1] = s.convert(this),
r > 1) {
var p = i();
for (s.sqrTo(h[1], p); f >= a;)
h[a] = i(),
s.mulTo(p, h[a - 2], h[a]),
a += 2
}
var l, d, g = t.t - 1, m = !0, v = i();
for (n = y(t[g]) - 1; g >= 0;) {
for (n >= u ? l = t[g] >> n - u & f : (l = (t[g] & (1 << n + 1) - 1) << u - n,
g > 0 && (l |= t[g - 1] >> this.DB + n - u)),
a = r; 0 == (1 & l);)
l >>= 1,
--a;
if ((n -= a) < 0 && (n += this.DB,
--g),
m)
h[l].copyTo(o),
m = !1;
else {
for (; a > 1;)
s.sqrTo(o, v),
s.sqrTo(v, o),
a -= 2;
a > 0 ? s.sqrTo(o, v) : (d = o,
o = v,
v = d),
s.mulTo(v, h[l], o)
}
for (; g >= 0 && 0 == (t[g] & 1 << n);)
s.sqrTo(o, v),
d = o,
o = v,
v = d,
--n < 0 && (n = this.DB - 1,
--g)
}
return s.revert(o)
}
function $t(t) {
var e = this.s < 0 ? this.negate() : this.clone()
, i = t.s < 0 ? t.negate() : t.clone();
if (e.compareTo(i) < 0) {
var r = e;
e = i,
i = r
}
var s = e.getLowestSetBit()
, n = i.getLowestSetBit();
if (0 > n)
return e;
for (n > s && (n = s),
n > 0 && (e.rShiftTo(n, e),
i.rShiftTo(n, i)); e.signum() > 0;)
(s = e.getLowestSetBit()) > 0 && e.rShiftTo(s, e),
(s = i.getLowestSetBit()) > 0 && i.rShiftTo(s, i),
e.compareTo(i) >= 0 ? (e.subTo(i, e),
e.rShiftTo(1, e)) : (i.subTo(e, i),
i.rShiftTo(1, i));
return n > 0 && i.lShiftTo(n, i),
i
}
function Yt(t) {
if (0 >= t)
return 0;
var e = this.DV % t
, i = this.s < 0 ? t - 1 : 0;
if (this.t > 0)
if (0 == e)
i = this[0] % t;
else
for (var r = this.t - 1; r >= 0; --r)
i = (e * i + this[r]) % t;
return i
}
function Wt(t) {
var i = t.isEven();
if (this.isEven() && i || 0 == t.signum())
return e.ZERO;
for (var r = t.clone(), s = this.clone(), n = c(1), o = c(0), h = c(0), a = c(1); 0 != r.signum();) {
for (; r.isEven();)
r.rShiftTo(1, r),
i ? (n.isEven() && o.isEven() || (n.addTo(this, n),
o.subTo(t, o)),
n.rShiftTo(1, n)) : o.isEven() || o.subTo(t, o),
o.rShiftTo(1, o);
for (; s.isEven();)
s.rShiftTo(1, s),
i ? (h.isEven() && a.isEven() || (h.addTo(this, h),
a.subTo(t, a)),
h.rShiftTo(1, h)) : a.isEven() || a.subTo(t, a),
a.rShiftTo(1, a);
r.compareTo(s) >= 0 ? (r.subTo(s, r),
i && n.subTo(h, n),
o.subTo(a, o)) : (s.subTo(r, s),
i && h.subTo(n, h),
a.subTo(o, a))
}
return 0 != s.compareTo(e.ONE) ? e.ZERO : a.compareTo(t) >= 0 ? a.subtract(t) : a.signum() < 0 ? (a.addTo(t, a),
a.signum() < 0 ? a.add(t) : a) : a
}
function Qt(t) {
var e, i = this.abs();
if (1 == i.t && i[0] <= Ae[Ae.length - 1]) {
for (e = 0; e < Ae.length; ++e)
if (i[0] == Ae[e])
return !0;
return !1
}
if (i.isEven())
return !1;
for (e = 1; e < Ae.length;) {
for (var r = Ae[e], s = e + 1; s < Ae.length && Ue > r;)
r *= Ae[s++];
for (r = i.modInt(r); s > e;)
if (r % Ae[e++] == 0)
return !1
}
return i.millerRabin(t)
}
function Xt(t) {
var r = this.subtract(e.ONE)
, s = r.getLowestSetBit();
if (0 >= s)
return !1;
var n = r.shiftRight(s);
t = t + 1 >> 1,
t > Ae.length && (t = Ae.length);
for (var o = i(), h = 0; t > h; ++h) {
o.fromInt(Ae[Math.floor(Math.random() * Ae.length)]);
var a = o.modPow(n, this);
if (0 != a.compareTo(e.ONE) && 0 != a.compareTo(r)) {
for (var u = 1; u++ < s && 0 != a.compareTo(r);)
if (a = a.modPowInt(2, this),
0 == a.compareTo(e.ONE))
return !1;
if (0 != a.compareTo(r))
return !1
}
}
return !0
}
function te() {
this.i = 0,
this.j = 0,
this.S = new Array
}
function ee(t) {
var e, i, r;
for (e = 0; 256 > e; ++e)
this.S[e] = e;
for (i = 0,
e = 0; 256 > e; ++e)
i = i + this.S[e] + t[e % t.length] & 255,
r = this.S[e],
this.S[e] = this.S[i],
this.S[i] = r;
this.i = 0,
this.j = 0
}
function ie() {
var t;
return this.i = this.i + 1 & 255,
this.j = this.j + this.S[this.i] & 255,
t = this.S[this.i],
this.S[this.i] = this.S[this.j],
this.S[this.j] = t,
this.S[t + this.S[this.i] & 255]
}
function re() {
return new te
}
function se() {
if (null == Oe) {
for (Oe = re(); Je > Ne;) {
var t = Math.floor(65536 * Math.random());
Ve[Ne++] = 255 & t
}
for (Oe.init(Ve),
Ne = 0; Ne < Ve.length; ++Ne)
Ve[Ne] = 0;
Ne = 0
}
return Oe.next()
}
function ne(t) {
var e;
for (e = 0; e < t.length; ++e)
t[e] = se()
}
function oe() {
}
function he(t, i) {
return new e(t, i)
}
function ae(t, i) {
if (i < t.length + 11)
return console.error("Message too long for RSA"),
null;
for (var r = new Array, s = t.length - 1; s >= 0 && i > 0;) {
var n = t.charCodeAt(s--);
128 > n ? r[--i] = n : n > 127 && 2048 > n ? (r[--i] = 63 & n | 128,
r[--i] = n >> 6 | 192) : (r[--i] = 63 & n | 128,
r[--i] = n >> 6 & 63 | 128,
r[--i] = n >> 12 | 224)
}
r[--i] = 0;
for (var o = new oe, h = new Array; i > 2;) {
for (h[0] = 0; 0 == h[0];)
o.nextBytes(h);
r[--i] = h[0]
}
return r[--i] = 2,
r[--i] = 0,
new e(r)
}
function ue() {
this.n = null,
this.e = 0,
this.d = null,
this.p = null,
this.q = null,
this.dmp1 = null,
this.dmq1 = null,
this.coeff = null
}
function fe(t) {
return t.modPowInt(this.e, this.n)
}
function pe(t) {
var e = ae(t, this.n.bitLength() + 7 >> 3);
if (null == e)
return null;
var i = this.doPublic(e);
if (null == i)
return null;
var r = i.toString(16);
return 0 == (1 & r.length) ? r : "0" + r
}
function me(t, i) {
var r = new oe
, s = t >> 1;
this.e = parseInt(i, 16);
for (var n = new e(i, 16); ;) {
for (; this.p = new e(t - s, 1, r),
0 != this.p.subtract(e.ONE).gcd(n).compareTo(e.ONE) || !this.p.isProbablePrime(10);)
;
for (; this.q = new e(s, 1, r),
0 != this.q.subtract(e.ONE).gcd(n).compareTo(e.ONE) || !this.q.isProbablePrime(10);)
;
if (this.p.compareTo(this.q) <= 0) {
var o = this.p;
this.p = this.q,
this.q = o
}
var h = this.p.subtract(e.ONE)
, a = this.q.subtract(e.ONE)
, u = h.multiply(a);
if (0 == u.gcd(n).compareTo(e.ONE)) {
this.n = this.p.multiply(this.q),
this.d = n.modInverse(u),
this.dmp1 = this.d.mod(h),
this.dmq1 = this.d.mod(a),
this.coeff = this.q.modInverse(this.p);
break
}
}
}
function ye(t) {
if (null == this.p || null == this.q)
return t.modPow(this.d, this.n);
for (var e = t.mod(this.p).modPow(this.dmp1, this.p), i = t.mod(this.q).modPow(this.dmq1, this.q); e.compareTo(i) < 0;)
e = e.add(this.p);
return e.subtract(i).multiply(this.coeff).mod(this.p).multiply(this.q).add(i)
}
function be(t) {
var e, i, r = "";
for (e = 0; e + 3 <= t.length; e += 3)
i = parseInt(t.substring(e, e + 3), 16),
r += Le.charAt(i >> 6) + Le.charAt(63 & i);
for (e + 1 == t.length ? (i = parseInt(t.substring(e, e + 1), 16),
r += Le.charAt(i << 2)) : e + 2 == t.length && (i = parseInt(t.substring(e, e + 2), 16),
r += Le.charAt(i >> 2) + Le.charAt((3 & i) << 4)); (3 & r.length) > 0;)
r += qe;
return r
}
var Se, Re = 0xdeadbeefcafe, Ee = 15715070 == (16777215 & Re);
Ee && "Microsoft Internet Explorer" == navigator.appName ? (e.prototype.am = s,
Se = 30) : Ee && "Netscape" != navigator.appName ? (e.prototype.am = r,
Se = 26) : (e.prototype.am = n,
Se = 28),
e.prototype.DB = Se,
e.prototype.DM = (1 << Se) - 1,
e.prototype.DV = 1 << Se;
var De = 52;
e.prototype.FV = Math.pow(2, De),
e.prototype.F1 = De - Se,
e.prototype.F2 = 2 * Se - De;
var we, xe, Be = "0123456789abcdefghijklmnopqrstuvwxyz", Ke = new Array;
for (we = "0".charCodeAt(0),
xe = 0; 9 >= xe; ++xe)
Ke[we++] = xe;
for (we = "a".charCodeAt(0),
xe = 10; 36 > xe; ++xe)
Ke[we++] = xe;
for (we = "A".charCodeAt(0),
xe = 10; 36 > xe; ++xe)
Ke[we++] = xe;
A.prototype.convert = U,
A.prototype.revert = O,
A.prototype.reduce = V,
A.prototype.mulTo = N,
A.prototype.sqrTo = J,
P.prototype.convert = M,
P.prototype.revert = L,
P.prototype.reduce = q,
P.prototype.mulTo = H,
P.prototype.sqrTo = C,
e.prototype.copyTo = a,
e.prototype.fromInt = u,
e.prototype.fromString = f,
e.prototype.clamp = p,
e.prototype.dlShiftTo = T,
e.prototype.drShiftTo = S,
e.prototype.lShiftTo = R,
e.prototype.rShiftTo = E,
e.prototype.subTo = D,
e.prototype.multiplyTo = w,
e.prototype.squareTo = x,
e.prototype.divRemTo = B,
e.prototype.invDigit = I,
e.prototype.isEven = j,
e.prototype.exp = k,
e.prototype.toString = l,
e.prototype.negate = d,
e.prototype.abs = g,
e.prototype.compareTo = m,
e.prototype.bitLength = b,
e.prototype.mod = K,
e.prototype.modPowInt = F,
e.ZERO = c(0),
e.ONE = c(1),
It.prototype.convert = Pt,
It.prototype.revert = Pt,
It.prototype.mulTo = Mt,
It.prototype.sqrTo = Lt,
jt.prototype.convert = kt,
jt.prototype.revert = Ft,
jt.prototype.reduce = _t,
jt.prototype.mulTo = Zt,
jt.prototype.sqrTo = zt;
var Ae = [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131, 137, 139, 149, 151, 157, 163, 167, 173, 179, 181, 191, 193, 197, 199, 211, 223, 227, 229, 233, 239, 241, 251, 257, 263, 269, 271, 277, 281, 283, 293, 307, 311, 313, 317, 331, 337, 347, 349, 353, 359, 367, 373, 379, 383, 389, 397, 401, 409, 419, 421, 431, 433, 439, 443, 449, 457, 461, 463, 467, 479, 487, 491, 499, 503, 509, 521, 523, 541, 547, 557, 563, 569, 571, 577, 587, 593, 599, 601, 607, 613, 617, 619, 631, 641, 643, 647, 653, 659, 661, 673, 677, 683, 691, 701, 709, 719, 727, 733, 739, 743, 751, 757, 761, 769, 773, 787, 797, 809, 811, 821, 823, 827, 829, 839, 853, 857, 859, 863, 877, 881, 883, 887, 907, 911, 919, 929, 937, 941, 947, 953, 967, 971, 977, 983, 991, 997]
, Ue = (1 << 26) / Ae[Ae.length - 1];
e.prototype.chunkSize = $,
e.prototype.toRadix = W,
e.prototype.fromRadix = Q,
e.prototype.fromNumber = X,
e.prototype.bitwiseTo = st,
e.prototype.changeBit = St,
e.prototype.addTo = wt,
e.prototype.dMultiply = Nt,
e.prototype.dAddOffset = Jt,
e.prototype.multiplyLowerTo = Ct,
e.prototype.multiplyUpperTo = Ht,
e.prototype.modInt = Yt,
e.prototype.millerRabin = Xt,
e.prototype.clone = _,
e.prototype.intValue = z,
e.prototype.signum = Y,
e.prototype.toByteArray = tt,
e.prototype.min = it,
e.prototype.max = rt,
e.prototype.shiftLeft = dt,
e.prototype.shiftRight = gt,
e.prototype.getLowestSetBit = yt,
e.prototype.testBit = Tt,
e.prototype.add = xt,
e.prototype.subtract = Bt,
e.prototype.multiply = Kt,
e.prototype.divide = Ut,
e.prototype.modPow = Gt,
e.prototype.modInverse = Wt,
e.prototype.pow = qt,
e.prototype.gcd = $t,
e.prototype.isProbablePrime = Qt,
te.prototype.init = ee,
te.prototype.next = ie;
var Oe, Ve, Ne, Je = 256;
if (null == Ve) {
Ve = new Array,
Ne = 0;
var Ie;
if (window.crypto && window.crypto.getRandomValues) {
var Pe = new Uint32Array(256);
for (window.crypto.getRandomValues(Pe),
Ie = 0; Ie < Pe.length; ++Ie)
Ve[Ne++] = 255 & Pe[Ie]
}
var Me = function (t) {
if (this.count = this.count || 0,
this.count >= 256 || Ne >= Je)
return void (window.removeEventListener ? window.removeEventListener("mousemove", Me, !1) : window.detachEvent && window.detachEvent("onmousemove", Me));
try {
var e = t.x + t.y;
Ve[Ne++] = 255 & e,
this.count += 1
} catch (i) {
}
};
window.addEventListener ? window.addEventListener("mousemove", Me, !1) : window.attachEvent && window.attachEvent("onmousemove", Me)
}
oe.prototype.nextBytes = ne,
ue.prototype.doPublic = fe,
ue.prototype.encrypt = pe,
ue.prototype.doPrivate = ye,
ue.prototype.generate = me
var Le = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
, qe = "="
, Ce = Ce || {
};
Ce.env = Ce.env || {
};
Ce.env.parseUA =
function (t) {
"use strict";
var e, i = {
};
i.decode = function (i) {
var r;
if (e === t) {
var s = "0123456789ABCDEF"
, n = " \f\n\r \u2028\u2029";
for (e = [],
r = 0; 16 > r; ++r)
e[s.charAt(r)] = r;
for (s = s.toLowerCase(),
r = 10; 16 > r; ++r)
e[s.charAt(r)] = r;
for (r = 0; r < n.length; ++r)
e[n.charAt(r)] = -1
}
var o = []
, h = 0
, a = 0;
for (r = 0; r < i.length; ++r) {
var u = i.charAt(r);
if ("=" == u)
break;
if (u = e[u],
-1 != u) {
if (u === t)
throw "Illegal character at offset " + r;
h |= u,
++a >= 2 ? (o[o.length] = h,
h = 0,
a = 0) : h <<= 4
}
}
if (a)
throw "Hex encoding incomplete: 4 bits missing";
return o
}
,
window.Hex = i
}(),
function (t) {
"use strict";
var e, i = {
};
i.decode = function (i) {
var r;
if (e === t) {
var s = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
, n = "= \f\n\r \u2028\u2029";
for (e = [],
r = 0; 64 > r; ++r)
e[s.charAt(r)] = r;
for (r = 0; r < n.length; ++r)
e[n.charAt(r)] = -1
}
var o = []
, h = 0
, a = 0;
for (r = 0; r < i.length; ++r) {
var u = i.charAt(r);
if ("=" == u)
break;
if (u = e[u],
-1 != u) {
if (u === t)
throw "Illegal character at offset " + r;
h |= u,
++a >= 4 ? (o[o.length] = h >> 16,
o[o.length] = h >> 8 & 255,
o[o.length] = 255 & h,
h = 0,
a = 0) : h <<= 6
}
}
switch (a) {
case 1:
throw "Base64 encoding incomplete: at least 2 bits missing";
case 2:
o[o.length] = h >> 10;
break;
case 3:
o[o.length] = h >> 16,
o[o.length] = h >> 8 & 255
}
return o
}
,
i.re = /-----BEGIN [^-]+-----([A-Za-z0-9+\/=\s]+)-----END [^-]+-----|begin-base64[^\n]+\n([A-Za-z0-9+\/=\s]+)====/,
i.unarmor = function (t) {
var e = i.re.exec(t);
if (e)
if (e[1])
t = e[1];
else {
if (!e[2])
throw "RegExp out of sync";
t = e[2]
}
return i.decode(t)
}
,
window.Base64 = i
}(),
function (t) {
"use strict";
function e(t, i) {
t instanceof e ? (this.enc = t.enc,
this.pos = t.pos) : (this.enc = t,
this.pos = i)
}
function i(t, e, i, r, s) {
this.stream = t,
this.header = e,
this.length = i,
this.tag = r,
this.sub = s
}
var r = 100
, s = "…"
, n = {
tag: function (t, e) {
var i = document.createElement(t);
return i.className = e,
i
},
text: function (t) {
return document.createTextNode(t)
}
};
e.prototype.get = function (e) {
if (e === t && (e = this.pos++),
e >= this.enc.length)
throw "Requesting byte offset " + e + " on a stream of length " + this.enc.length;
return this.enc[e]
}
,
e.prototype.hexDigits = "0123456789ABCDEF",
e.prototype.hexByte = function (t) {
return this.hexDigits.charAt(t >> 4 & 15) + this.hexDigits.charAt(15 & t)
}
,
e.prototype.hexDump = function (t, e, i) {
for (var r = "", s = t; e > s; ++s)
if (r += this.hexByte(this.get(s)),
i !== !0)
switch (15 & s) {
case 7:
r += " ";
break;
case 15:
r += "\n";
break;
default:
r += " "
}
return r
}
,
e.prototype.parseStringISO = function (t, e) {
for (var i = "", r = t; e > r; ++r)
i += String.fromCharCode(this.get(r));
return i
}
,
e.prototype.parseStringUTF = function (t, e) {
for (var i = "", r = t; e > r;) {
var s = this.get(r++);
i += 128 > s ? String.fromCharCode(s) : s > 191 && 224 > s ? String.fromCharCode((31 & s) << 6 | 63 & this.get(r++)) : String.fromCharCode((15 & s) << 12 | (63 & this.get(r++)) << 6 | 63 & this.get(r++))
}
return i
}
,
e.prototype.parseStringBMP = function (t, e) {
for (var i = "", r = t; e > r; r += 2) {
var s = this.get(r)
, n = this.get(r + 1);
i += String.fromCharCode((s << 8) + n)
}
return i
}
,
e.prototype.reTime = /^((?:1[89]|2\d)?\d\d)(0[1-9]|1[0-2])(0[1-9]|[12]\d|3[01])([01]\d|2[0-3])(?:([0-5]\d)(?:([0-5]\d)(?:[.,](\d{1,3}))?)?)?(Z|[-+](?:[0]\d|1[0-2])([0-5]\d)?)?$/,
e.prototype.parseTime = function (t, e) {
var i = this.parseStringISO(t, e)
, r = this.reTime.exec(i);
return r ? (i = r[1] + "-" + r[2] + "-" + r[3] + " " + r[4],
r[5] && (i += ":" + r[5],
r[6] && (i += ":" + r[6],
r[7] && (i += "." + r[7]))),
r[8] && (i += " UTC",
"Z" != r[8] && (i += r[8],
r[9] && (i += ":" + r[9]))),
i) : "Unrecognized time: " + i
}
,
e.prototype.parseInteger = function (t, e) {
var i = e - t;
if (i > 4) {
i <<= 3;
var r = this.get(t);
if (0 === r)
i -= 8;
else
for (; 128 > r;)
r <<= 1,
--i;
return "(" + i + " bit)"
}
for (var s = 0, n = t; e > n; ++n)
s = s << 8 | this.get(n);
return s
}
,
e.prototype.parseBitString = function (t, e) {
var i = this.get(t)
, r = (e - t - 1 << 3) - i
, s = "(" + r + " bit)";
if (20 >= r) {
var n = i;
s += " ";
for (var o = e - 1; o > t; --o) {
for (var h = this.get(o), a = n; 8 > a; ++a)
s += h >> a & 1 ? "1" : "0";
n = 0
}
}
return s
}
,
e.prototype.parseOctetString = function (t, e) {
var i = e - t
, n = "(" + i + " byte) ";
i > r && (e = t + r);
for (var o = t; e > o; ++o)
n += this.hexByte(this.get(o));
return i > r && (n += s),
n
}
,
e.prototype.parseOID = function (t, e) {
for (var i = "", r = 0, s = 0, n = t; e > n; ++n) {
var o = this.get(n);
if (r = r << 7 | 127 & o,
s += 7,
!(128 & o)) {
if ("" === i) {
var h = 80 > r ? 40 > r ? 0 : 1 : 2;
i = h + "." + (r - 40 * h)
} else
i += "." + (s >= 31 ? "bigint" : r);
r = s = 0
}
}
return i
}
,
i.prototype.typeName = function () {
if (this.tag === t)
return "unknown";
var e = this.tag >> 6
, i = (this.tag >> 5 & 1,
31 & this.tag);
switch (e) {
case 0:
switch (i) {
case 0:
return "EOC";
case 1:
return "BOOLEAN";
case 2:
return "INTEGER";
case 3:
return "BIT_STRING";
case 4:
return "OCTET_STRING";
case 5:
return "NULL";
case 6:
return "OBJECT_IDENTIFIER";
case 7:
return "ObjectDescriptor";
case 8:
return "EXTERNAL";
case 9:
return "REAL";
case 10:
return "ENUMERATED";
case 11:
return "EMBEDDED_PDV";
case 12:
return "UTF8String";
case 16:
return "SEQUENCE";
case 17:
return "SET";
case 18:
return "NumericString";
case 19:
return "PrintableString";
case 20:
return "TeletexString";
case 21:
return "VideotexString";
case 22:
return "IA5String";
case 23:
return "UTCTime";
case 24:
return "GeneralizedTime";
case 25:
return "GraphicString";
case 26:
return "VisibleString";
case 27:
return "GeneralString";
case 28:
return "UniversalString";
case 30:
return "BMPString";
default:
return "Universal_" + i.toString(16)
}
case 1:
return "Application_" + i.toString(16);
case 2:
return "[" + i + "]";
case 3:
return "Private_" + i.toString(16)
}
}
,
i.prototype.reSeemsASCII = /^[ -~]+$/,
i.prototype.content = function () {
if (this.tag === t)
return null;
var e = this.tag >> 6
, i = 31 & this.tag
, n = this.posContent()
, o = Math.abs(this.length);
if (0 !== e) {
if (null !== this.sub)
return "(" + this.sub.length + " elem)";
var h = this.stream.parseStringISO(n, n + Math.min(o, r));
return this.reSeemsASCII.test(h) ? h.substring(0, 2 * r) + (h.length > 2 * r ? s : "") : this.stream.parseOctetString(n, n + o)
}
switch (i) {
case 1:
return 0 === this.stream.get(n) ? "false" : "true";
case 2:
return this.stream.parseInteger(n, n + o);
case 3:
return this.sub ? "(" + this.sub.length + " elem)" : this.stream.parseBitString(n, n + o);
case 4:
return this.sub ? "(" + this.sub.length + " elem)" : this.stream.parseOctetString(n, n + o);
case 6:
return this.stream.parseOID(n, n + o);
case 16:
case 17:
return "(" + this.sub.length + " elem)";
case 12:
return this.stream.parseStringUTF(n, n + o);
case 18:
case 19:
case 20:
case 21:
case 22:
case 26:
return this.stream.parseStringISO(n, n + o);
case 30:
return this.stream.parseStringBMP(n, n + o);
case 23:
case 24:
return this.stream.parseTime(n, n + o)
}
return null
}
,
i.prototype.toString = function () {
return this.typeName() + "@" + this.stream.pos + "[header:" + this.header + ",length:" + this.length + ",sub:" + (null === this.sub ? "null" : this.sub.length) + "]"
}
,
i.prototype.print = function (e) {
if (e === t && (e = ""),
document.writeln(e + this),
null !== this.sub) {
e += " ";
for (var i = 0, r = this.sub.length; r > i; ++i)
this.sub[i].print(e)
}
}
,
i.prototype.toPrettyString = function (e) {
e === t && (e = "");
var i = e + this.typeName() + " @" + this.stream.pos;
if (this.length >= 0 && (i += "+"),
i += this.length,
32 & this.tag ? i += " (constructed)" : 3 != this.tag && 4 != this.tag || null === this.sub || (i += " (encapsulates)"),
i += "\n",
null !== this.sub) {
e += " ";
for (var r = 0, s = this.sub.length; s > r; ++r)
i += this.sub[r].toPrettyString(e)
}
return i
}
,
i.prototype.toDOM = function () {
var t = n.tag("div", "node");
t.asn1 = this;
var e = n.tag("div", "head")
, i = this.typeName().replace(/_/g, " ");
e.innerHTML = i;
var r = this.content();
if (null !== r) {
r = String(r).replace(/</g, "<");
var s = n.tag("span", "preview");
s.appendChild(n.text(r)),
e.appendChild(s)
}
t.appendChild(e),
this.node = t,
this.head = e;
var o = n.tag("div", "value");
if (i = "Offset: " + this.stream.pos + "<br/>",
i += "Length: " + this.header + "+",
i += this.length >= 0 ? this.length : -this.length + " (undefined)",
32 & this.tag ? i += "<br/>(constructed)" : 3 != this.tag && 4 != this.tag || null === this.sub || (i += "<br/>(encapsulates)"),
null !== r && (i += "<br/>Value:<br/><b>" + r + "</b>",
"object" == typeof oids && 6 == this.tag)) {
var h = oids[r];
h && (h.d && (i += "<br/>" + h.d),
h.c && (i += "<br/>" + h.c),
h.w && (i += "<br/>(warning!)"))
}
o.innerHTML = i,
t.appendChild(o);
var a = n.tag("div", "sub");
if (null !== this.sub)
for (var u = 0, c = this.sub.length; c > u; ++u)
a.appendChild(this.sub[u].toDOM());
return t.appendChild(a),
e.onclick = function () {
t.className = "node collapsed" == t.className ? "node" : "node collapsed"
}
,
t
}
,
i.prototype.posStart = function () {
return this.stream.pos
}
,
i.prototype.posContent = function () {
return this.stream.pos + this.header
}
,
i.prototype.posEnd = function () {
return this.stream.pos + this.header + Math.abs(this.length)
}
,
i.prototype.fakeHover = function (t) {
this.node.className += " hover",
t && (this.head.className += " hover")
}
,
i.prototype.fakeOut = function (t) {
var e = / ?hover/;
this.node.className = this.node.className.replace(e, ""),
t && (this.head.className = this.head.className.replace(e, ""))
}
,
i.prototype.toHexDOM_sub = function (t, e, i, r, s) {
if (!(r >= s)) {
var o = n.tag("span", e);
o.appendChild(n.text(i.hexDump(r, s))),
t.appendChild(o)
}
}
,
i.prototype.toHexDOM = function (e) {
var i = n.tag("span", "hex");
if (e === t && (e = i),
this.head.hexNode = i,
this.head.onmouseover = function () {
this.hexNode.className = "hexCurrent"
}
,
this.head.onmouseout = function () {
this.hexNode.className = "hex"
}
,
i.asn1 = this,
i.onmouseover = function () {
var t = !e.selected;
t && (e.selected = this.asn1,
this.className = "hexCurrent"),
this.asn1.fakeHover(t)
}
,
i.onmouseout = function () {
var t = e.selected == this.asn1;
this.asn1.fakeOut(t),
t && (e.selected = null,
this.className = "hex")
}
,
this.toHexDOM_sub(i, "tag", this.stream, this.posStart(), this.posStart() + 1),
this.toHexDOM_sub(i, this.length >= 0 ? "dlen" : "ulen", this.stream, this.posStart() + 1, this.posContent()),
null === this.sub)
i.appendChild(n.text(this.stream.hexDump(this.posContent(), this.posEnd())));
else if (this.sub.length > 0) {
var r = this.sub[0]
, s = this.sub[this.sub.length - 1];
this.toHexDOM_sub(i, "intro", this.stream, this.posContent(), r.posStart());
for (var o = 0, h = this.sub.length; h > o; ++o)
i.appendChild(this.sub[o].toHexDOM(e));
this.toHexDOM_sub(i, "outro", this.stream, s.posEnd(), this.posEnd())
}
return i
}
,
i.prototype.toHexString = function (t) {
return this.stream.hexDump(this.posStart(), this.posEnd(), !0)
}
,
i.decodeLength = function (t) {
var e = t.get()
, i = 127 & e;
if (i == e)
return i;
if (i > 3)
throw "Length over 24 bits not supported at position " + (t.pos - 1);
if (0 === i)
return -1;
e = 0;
for (var r = 0; i > r; ++r)
e = e << 8 | t.get();
return e
}
,
i.hasContent = function (t, r, s) {
if (32 & t)
return !0;
if (3 > t || t > 4)
return !1;
var n = new e(s);
3 == t && n.get();
var o = n.get();
if (o >> 6 & 1)
return !1;
try {
var h = i.decodeLength(n);
return n.pos - s.pos + h == r
} catch (a) {
return !1
}
}
,
i.decode = function (t) {
t instanceof e || (t = new e(t, 0));
var r = new e(t)
, s = t.get()
, n = i.decodeLength(t)
, o = t.pos - r.pos
, h = null;
if (i.hasContent(s, n, t)) {
var a = t.pos;
if (3 == s && t.get(),
h = [],
n >= 0) {
for (var u = a + n; t.pos < u;)
h[h.length] = i.decode(t);
if (t.pos != u)
throw "Content size is not correct for container starting at offset " + a
} else
try {
for (; ;) {
var c = i.decode(t);
if (0 === c.tag)
break;
h[h.length] = c
}
n = a - t.pos
} catch (f) {
throw "Exception while decoding undefined length content: " + f
}
} else
t.pos += n;
return new i(r, o, n, s, h)
}
,
i.test = function () {
for (var t = [{
value: [39],
expected: 39
}, {
value: [129, 201],
expected: 201
}, {
value: [131, 254, 220, 186],
expected: 16702650
}], r = 0, s = t.length; s > r; ++r) {
var n = new e(t[r].value, 0)
, o = i.decodeLength(n);
o != t[r].expected && document.write("In test[" + r + "] expected " + t[r].expected + " got " + o + "\n")
}
}
,
window.ASN1 = i
}(),
ASN1.prototype.getHexStringValue = function () {
var t = this.toHexString()
, e = 2 * this.header
, i = 2 * this.length;
return t.substr(e, i)
}
,
ue.prototype.parseKey = function (t) {
try {
var e = 0
, i = 0
, r = /^\s*(?:[0-9A-Fa-f][0-9A-Fa-f]\s*)+$/
, s = r.test(t) ? Hex.decode(t) : Base64.unarmor(t)
, n = ASN1.decode(s);
if (3 === n.sub.length && (n = n.sub[2].sub[0]),
9 === n.sub.length) {
e = n.sub[1].getHexStringValue(),
this.n = he(e, 16),
i = n.sub[2].getHexStringValue(),
this.e = parseInt(i, 16);
var o = n.sub[3].getHexStringValue();
this.d = he(o, 16);
var h = n.sub[4].getHexStringValue();
this.p = he(h, 16);
var a = n.sub[5].getHexStringValue();
this.q = he(a, 16);
var u = n.sub[6].getHexStringValue();
this.dmp1 = he(u, 16);
var c = n.sub[7].getHexStringValue();
this.dmq1 = he(c, 16);
var f = n.sub[8].getHexStringValue();
this.coeff = he(f, 16)
} else {
if (2 !== n.sub.length)
return !1;
var p = n.sub[1]
, l = p.sub[0];
e = l.sub[0].getHexStringValue(),
this.n = he(e, 16),
i = l.sub[1].getHexStringValue(),
this.e = parseInt(i, 16)
}
return !0
} catch (d) {
return !1
}
}
;
var _e = function (t) {
ue.call(this),
t && (this.parseKey(t) )
};
_e.prototype = new ue;
var ze = function (t) {
};
ze.prototype.setKey = function (t) {
this.log && this.key && console.warn("A key was already set, overriding existing."),
this.key = new _e(t)
}
,
ze.prototype.setPublicKey = function (t) {
this.setKey(t)
}
,
ze.prototype.encrypt = function (t) {
try {
return be(this.getKey().encrypt(t))
} catch (e) {
return !1
}
}
,
ze.prototype.getKey = function (t) {
if (!this.key) {
if (this.key = new _e,
t && "[object Function]" === {
}.toString.call(t))
return void this.key.generateAsync(this.default_key_size, this.default_public_exponent, t);
this.key.generate(this.default_key_size, this.default_public_exponent)
}
return this.key
}
,
ze.prototype.getPublicKey = function () {
return this.getKey().getPublicKey()
}
,
ze.version = "2.3.1",
window.JSEncrypt = ze
});
function get_password(hash, key,password) {
var n = new window.JSEncrypt;
n.setPublicKey(key);
var a = n.encrypt(hash+password);
return a
}
2.2 验证码参数w破解
某验的点选加密js都在click.xxx.js里，这个JS是经过混淆的，直接用还原神器AST反混淆
在还原后的文件里直接搜w参数，用"w"进行搜索，找到加密位置
原网页的位置如下图
直接打上断点重新请求，可以看到w参数是由l+_组成的
我们一步一步走，先看看_是怎么生成的，继续下断点调试，走到这里看到K函数
先看看里面的t[hgfY(754)](e)是啥东西，里面其实是一个随机的4组4位数组成的字符串，叫做aeskey，这里画个重点，aeskey需要全局唯一，因为涉及到加解密，如果两次不一致，就会报 param decrypt error
然后回来看看那个K函数，实际上是一个RSA加密，直接扣下来补一下环境就可以
OK，解决掉_之后，l参数是最复杂的，其中o是一个json，c是编码后的数组，这里的r[DaxA(754)]()实际上就是aeskey需要与生成_时用到的aeskey一致
然后我们先看下o里面有啥东西，参数a是经过处理的点选位置，ep、lang这里可以直接固定，passtime就是点选用的时间，随机一下就可以，pic就是图片地址rp是根据gt+challenge+passtime的MD5，tt是经过加密后的轨迹参数
点选位置处理的方法
接下来看看轨迹参数tt，然后吧pe函数扣下来就行
到这里为止o参数就解决了，Q函数跟p["WBvt"]，其中c是AES生成的数组，r["fxVG"]()是aeskey，l是将数组转成字符
三、实现模拟登入
四、总结
总的来说，极验点选只需要传入点击位置即可，其他加密函数都可以扣过来！
