refactor: 将文件从子目录提升到仓库根目录

所有文件从 hello_js_reverse_skill/ 子目录移至仓库根目录，使项目结构更清晰，便于作为 Skill 直接引用。 Made-with: Cursor
2026-03-18 22:55:27 +08:00
parent cfd0cc919d
commit fb14cf7916
29 changed files with 0 additions and 0 deletions
@@ -0,0 +1,117 @@
+/**
+ * 主脚本模板 - VM 沙箱执行
+ * 
+ * 适用场景：服务端返回混淆JS用于生成Cookie/Token
+ * 流程：
+ *   1. 请求接口 → 返回混淆 JS
+ *   2. VM 沙箱执行 JS → 提取 Cookie
+ *   3. 携带 Cookie 请求数据接口
+ * 
+ * TODO: 根据逆向分析结果修改配置和逻辑
+ */
+
+const { executeAndExtractCookie } = require('./utils/sandbox');
+const { TwoPhaseClient } = require('./utils/request');
+
+// ============ 配置区域 ============
+
+const CONFIG = {
+    name: '示例项目 - 动态Cookie',
+    description: '采集全部5页数据',
+    
+    baseURL: 'https://target.com',
+    
+    // 第一阶段：获取动态JS的接口
+    jsEndpoint: '/api/init',
+    
+    // 第二阶段：数据接口
+    dataEndpoint: '/api/data',
+    
+    referer: 'https://target.com/page',
+    totalPages: 5,
+    delay: 2000,
+    
+    cookies: {
+        // sessionid: 'your_session_id',
+    },
+};
+
+// ============ 主逻辑 ============
+
+async function getDynamicCookie(client) {
+    console.log('[*] 获取动态Cookie...');
+    
+    // 第一阶段：请求返回JS代码的接口
+    const jsCode = await client.fetchDynamicJS(CONFIG.jsEndpoint);
+    
+    // 在VM沙箱中执行，提取Cookie
+    const result = executeAndExtractCookie(jsCode, {
+        url: CONFIG.baseURL + CONFIG.referer,
+        initialCookie: client.getCookieString(),
+    });
+    
+    if (result.success && Object.keys(result.cookies).length > 0) {
+        console.log(`[+] Cookie 提取成功: ${result.cookieString.substring(0, 100)}...`);
+        client.setCookies(result.cookies);
+        return true;
+    } else {
+        console.error('[-] Cookie 提取失败:', result.error || '未生成Cookie');
+        return false;
+    }
+}
+
+async function fetchPage(client, page) {
+    // TODO: 根据实际接口修改参数
+    const params = { page };
+    return client.fetchWithDelay(CONFIG.dataEndpoint, params);
+}
+
+async function main() {
+    console.log(`[*] 项目：${CONFIG.name}`);
+    console.log(`[*] 目标：${CONFIG.description}`);
+    console.log('');
+    
+    const client = new TwoPhaseClient({
+        baseURL: CONFIG.baseURL,
+        cookies: CONFIG.cookies,
+        delay: CONFIG.delay,
+    });
+    
+    // 获取动态Cookie
+    const cookieOk = await getDynamicCookie(client);
+    if (!cookieOk) {
+        console.error('[!] 无法获取动态Cookie，退出');
+        process.exit(1);
+    }
+    
+    // 采集数据
+    const allData = [];
+    
+    for (let page = 1; page <= CONFIG.totalPages; page++) {
+        try {
+            // 某些网站每次请求都需要刷新Cookie
+            // await getDynamicCookie(client);
+            
+            const responseData = await fetchPage(client, page);
+            const pageData = responseData.data || [];
+            allData.push(...pageData);
+            console.log(`[+] 正在采集第 ${page}/${CONFIG.totalPages} 页... ✓ 获取 ${pageData.length} 条数据`);
+        } catch (error) {
+            console.error(`[-] 第 ${page} 页采集失败: ${error.message}`);
+        }
+    }
+    
+    console.log(`\n[+] 采集完成，共 ${allData.length} 条数据`);
+    
+    // TODO: 根据需求计算结果
+    const result = allData.reduce((sum, item) => sum + (item.value || 0), 0);
+    
+    console.log('\n' + '='.repeat(30) + ' 计算结果 ' + '='.repeat(30));
+    console.log(`答案：${result}`);
+    console.log('='.repeat(70));
+}
+
+main().catch(error => {
+    console.error('\n[!] 运行错误:', error.message);
+    process.exit(1);
+});
@@ -0,0 +1,13 @@
+{
+  "name": "js-reverse-vm-sandbox",
+  "version": "1.0.0",
+  "description": "JS逆向 - VM沙箱执行模板",
+  "main": "main.js",
+  "scripts": {
+    "start": "node main.js",
+    "test": "node main.js --test"
+  },
+  "dependencies": {
+    "axios": "^1.7.0"
+  }
+}
@@ -0,0 +1,81 @@
+/**
+ * 请求封装模块（VM沙箱版本）
+ * 支持两阶段请求：先获取动态JS生成Cookie，再携带Cookie请求数据
+ */
+
+const axios = require('axios');
+
+const DEFAULT_HEADERS = {
+    'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+    'Accept': 'application/json, text/javascript, */*; q=0.01',
+    'Accept-Language': 'zh-CN,zh;q=0.9,en;q=0.8',
+    'X-Requested-With': 'XMLHttpRequest',
+};
+
+class TwoPhaseClient {
+    constructor(options = {}) {
+        this.baseURL = options.baseURL || '';
+        this.cookies = options.cookies || {};
+        this.headers = { ...DEFAULT_HEADERS, ...options.headers };
+        this.delay = options.delay || 1500;
+
+        this.client = axios.create({
+            baseURL: this.baseURL,
+            timeout: options.timeout || 30000,
+            headers: this.headers,
+        });
+    }
+
+    getCookieString() {
+        return Object.entries(this.cookies).map(([k, v]) => `${k}=${v}`).join('; ');
+    }
+
+    setCookies(cookieObj) {
+        Object.assign(this.cookies, cookieObj);
+    }
+
+    /**
+     * 第一阶段：获取动态JS代码
+     * @param {string} url - 返回JS代码的接口
+     * @returns {string} JS 代码字符串
+     */
+    async fetchDynamicJS(url, params = {}) {
+        const response = await this.client.get(url, {
+            params,
+            headers: { Cookie: this.getCookieString() },
+            transformResponse: [(data) => data],
+        });
+        return response.data;
+    }
+
+    /**
+     * 第二阶段：携带Cookie请求数据
+     */
+    async fetchData(url, params = {}) {
+        const response = await this.client.get(url, {
+            params,
+            headers: { Cookie: this.getCookieString() },
+        });
+        return response.data;
+    }
+
+    async post(url, data = {}) {
+        const response = await this.client.post(url, data, {
+            headers: { Cookie: this.getCookieString() },
+        });
+        return response.data;
+    }
+
+    sleep(ms) {
+        return new Promise(resolve => setTimeout(resolve, ms));
+    }
+
+    async fetchWithDelay(url, params = {}) {
+        const data = await this.fetchData(url, params);
+        const jitter = Math.random() * this.delay * 0.3;
+        await this.sleep(this.delay + jitter);
+        return data;
+    }
+}
+
+module.exports = { TwoPhaseClient, DEFAULT_HEADERS };
@@ -0,0 +1,152 @@
+/**
+ * VM 沙箱模块
+ * 用于执行服务端返回的混淆 JS 代码，提取动态生成的 Cookie/Token
+ */
+
+const vm = require('vm');
+
+function createSandbox(options = {}) {
+    const cookies = {};
+    const logs = [];
+    
+    const sandbox = {
+        window: null,
+        self: null,
+        globalThis: null,
+        top: null,
+        parent: null,
+        
+        document: {
+            cookie: options.initialCookie || '',
+            createElement: (tag) => ({
+                tagName: tag.toUpperCase(), style: {}, src: '',
+                setAttribute: () => {}, getAttribute: () => null,
+                appendChild: () => {}, innerHTML: '',
+            }),
+            getElementById: () => null,
+            getElementsByTagName: (tag) => tag === 'script' ? [1, 2, 3] : [],
+            getElementsByClassName: () => [],
+            querySelector: () => null,
+            querySelectorAll: () => [],
+            head: { appendChild: () => {} },
+            body: { appendChild: () => {} },
+            location: { href: options.url || 'https://example.com' },
+            referrer: '',
+            readyState: 'complete',
+        },
+        
+        navigator: {
+            userAgent: options.userAgent || 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+            appCodeName: 'Mozilla', appName: 'Netscape', appVersion: '5.0',
+            platform: 'MacIntel', language: 'zh-CN', languages: ['zh-CN', 'zh', 'en'],
+            cookieEnabled: true, onLine: true, webdriver: false,
+            plugins: { length: 3 }, mimeTypes: { length: 4 },
+            hardwareConcurrency: 8, maxTouchPoints: 0,
+        },
+        
+        location: {
+            href: options.url || 'https://example.com',
+            protocol: 'https:', host: 'example.com',
+            hostname: 'example.com', pathname: '/', search: '', hash: '',
+            origin: 'https://example.com',
+        },
+        
+        screen: { width: 1920, height: 1080, availWidth: 1920, availHeight: 1055, colorDepth: 24, pixelDepth: 24 },
+        
+        setTimeout: (fn, ms) => setTimeout(fn, Math.min(ms || 0, 3000)),
+        setInterval: (fn, ms) => { /* 不执行定时器避免死循环 */ return -1; },
+        clearTimeout, clearInterval,
+        
+        String, Array, Object, Math, Date, RegExp, JSON, Map, Set,
+        parseInt, parseFloat, isNaN, isFinite, NaN, Infinity, undefined,
+        encodeURIComponent, decodeURIComponent, encodeURI, decodeURI,
+        escape, unescape,
+        Error, TypeError, RangeError, SyntaxError, ReferenceError,
+        ArrayBuffer, Uint8Array, Int32Array, Float64Array, DataView,
+        Promise, Proxy, Reflect, Symbol, Number, Boolean,
+        
+        btoa: (str) => Buffer.from(str, 'binary').toString('base64'),
+        atob: (b64) => Buffer.from(b64, 'base64').toString('binary'),
+        
+        console: {
+            log: (...args) => logs.push(args.join(' ')),
+            warn: () => {}, error: () => {}, info: () => {},
+            debug: () => {}, trace: () => {}, clear: () => {},
+        },
+        
+        XMLHttpRequest: class {
+            open() {} setRequestHeader() {} send() {
+                this.readyState = 4; this.status = 200; this.responseText = '{}';
+                if (this.onreadystatechange) this.onreadystatechange();
+            }
+            addEventListener(e, fn) { this['on' + e] = fn; }
+        },
+    };
+    
+    sandbox.window = sandbox;
+    sandbox.self = sandbox;
+    sandbox.globalThis = sandbox;
+    sandbox.top = sandbox;
+    sandbox.parent = sandbox;
+    sandbox.frames = sandbox;
+    
+    // Cookie 拦截
+    Object.defineProperty(sandbox.document, 'cookie', {
+        get() {
+            return Object.entries(cookies).map(([k, v]) => `${k}=${v}`).join('; ');
+        },
+        set(val) {
+            const mainPart = val.split(';')[0];
+            const eqIdx = mainPart.indexOf('=');
+            if (eqIdx > 0) {
+                const name = mainPart.substring(0, eqIdx).trim();
+                const value = mainPart.substring(eqIdx + 1).trim();
+                cookies[name] = value;
+            }
+        },
+        configurable: true,
+    });
+    
+    if (options.initialCookie) {
+        options.initialCookie.split(';').forEach(pair => {
+            const [k, ...rest] = pair.trim().split('=');
+            if (k) cookies[k.trim()] = rest.join('=');
+        });
+    }
+    
+    return { sandbox, cookies, logs };
+}
+
+/**
+ * 执行混淆 JS 代码并提取 Cookie
+ * @param {string} code - 混淆的 JS 代码
+ * @param {Object} options - 配置选项
+ * @returns {Object} { cookies, logs, success }
+ */
+function executeAndExtractCookie(code, options = {}) {
+    const { sandbox, cookies, logs } = createSandbox(options);
+    vm.createContext(sandbox);
+    
+    try {
+        vm.runInContext(code, sandbox, {
+            timeout: options.timeout || 5000,
+            filename: 'dynamic.js',
+        });
+        
+        return {
+            success: true,
+            cookies: { ...cookies },
+            cookieString: Object.entries(cookies).map(([k, v]) => `${k}=${v}`).join('; '),
+            logs,
+        };
+    } catch (error) {
+        return {
+            success: false,
+            error: error.message,
+            cookies: { ...cookies },
+            logs,
+        };
+    }
+}
+
+module.exports = { createSandbox, executeAndExtractCookie };