refactor: 将文件从子目录提升到仓库根目录

所有文件从 hello_js_reverse_skill/ 子目录移至仓库根目录，使项目结构更清晰，便于作为 Skill 直接引用。 Made-with: Cursor
2026-03-18 22:55:27 +08:00
parent cfd0cc919d
commit fb14cf7916
29 changed files with 0 additions and 0 deletions
@@ -0,0 +1,160 @@
+/**
+ * 主脚本模板 - WASM 加载还原
+ * 
+ * 适用场景：加密函数通过 WebAssembly 实现
+ * 流程：
+ *   1. 下载/加载 .wasm 文件
+ *   2. 补全运行环境
+ *   3. 调用 WASM 导出的加密函数
+ *   4. 使用加密结果构造请求
+ * 
+ * TODO: 根据逆向分析结果修改配置和逻辑
+ */
+
+const { loadWasmFromFile, loadWasmFromURL, analyzeWasm } = require('./utils/wasm-loader');
+const { patchWasmBindgen } = require('./utils/env-patch');
+const axios = require('axios');
+const path = require('path');
+
+// ============ 配置区域 ============
+
+const CONFIG = {
+    name: '示例项目 - WASM加密',
+    description: '采集全部5页数据',
+    
+    baseURL: 'https://target.com',
+    dataEndpoint: '/api/data',
+    
+    // WASM 文件路径或 URL
+    wasmSource: './main.wasm',    // 本地文件
+    // wasmSource: 'https://target.com/main.wasm',  // 远程 URL
+    
+    // WASM 导出函数名
+    encryptFunction: 'encode',
+    
+    // WASM 类型: 'plain' | 'emscripten' | 'wasm-bindgen' | 'go'
+    wasmType: 'plain',
+    
+    totalPages: 5,
+    delay: 1500,
+    
+    cookies: {},
+    headers: {
+        'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36',
+    },
+};
+
+// ============ 主逻辑 ============
+
+let wasmExports = null;
+
+async function initWasm() {
+    console.log('[*] 加载 WASM 模块...');
+    
+    // 根据 WASM 类型补全环境
+    if (CONFIG.wasmType === 'wasm-bindgen') {
+        patchWasmBindgen();
+    }
+    
+    // 分析 WASM 结构
+    if (CONFIG.wasmSource.startsWith('http')) {
+        console.log('[*] 从远程下载 WASM...');
+        const result = await loadWasmFromURL(CONFIG.wasmSource);
+        wasmExports = result.exports;
+        console.log('[+] WASM 导出函数:', Object.keys(result.exports).filter(k => typeof result.exports[k] === 'function'));
+    } else {
+        const wasmPath = path.resolve(CONFIG.wasmSource);
+        
+        // 先分析 WASM 结构
+        const analysis = await analyzeWasm(wasmPath);
+        console.log('[*] WASM 导出:', analysis.exports.map(e => `${e.name}(${e.kind})`).join(', '));
+        console.log('[*] WASM 导入:', analysis.imports.map(i => `${i.module}.${i.name}`).join(', '));
+        
+        const result = await loadWasmFromFile(wasmPath);
+        wasmExports = result.exports;
+    }
+    
+    // 验证加密函数存在
+    if (typeof wasmExports[CONFIG.encryptFunction] !== 'function') {
+        throw new Error(`WASM 导出函数 "${CONFIG.encryptFunction}" 不存在。可用函数: ${Object.keys(wasmExports).filter(k => typeof wasmExports[k] === 'function').join(', ')}`);
+    }
+    
+    console.log(`[+] WASM 加载成功，加密函数: ${CONFIG.encryptFunction}`);
+}
+
+function generateEncryptedParam(page) {
+    // TODO: 根据逆向分析修改参数生成逻辑
+    const timestamp = Math.floor(Date.now() / 1000);
+    
+    // 调用 WASM 导出的加密函数
+    const encrypted = wasmExports[CONFIG.encryptFunction](timestamp, page);
+    
+    // TODO: 根据实际格式组装参数
+    return `${encrypted}|${timestamp}|${page}`;
+}
+
+async function fetchPage(page) {
+    const m = generateEncryptedParam(page);
+    
+    const response = await axios.get(`${CONFIG.baseURL}${CONFIG.dataEndpoint}`, {
+        params: { page, m },
+        headers: {
+            ...CONFIG.headers,
+            Cookie: Object.entries(CONFIG.cookies).map(([k, v]) => `${k}=${v}`).join('; '),
+            Referer: CONFIG.baseURL,
+        },
+    });
+    
+    return response.data;
+}
+
+function sleep(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}
+
+async function main() {
+    console.log(`[*] 项目：${CONFIG.name}`);
+    console.log(`[*] 目标：${CONFIG.description}`);
+    console.log('');
+    
+    // 初始化 WASM
+    await initWasm();
+    console.log('');
+    
+    // 验证：测试加密函数
+    const testResult = generateEncryptedParam(1);
+    console.log(`[*] 加密测试: page=1 → m=${testResult}`);
+    console.log('');
+    
+    // 采集数据
+    const allData = [];
+    
+    for (let page = 1; page <= CONFIG.totalPages; page++) {
+        try {
+            const responseData = await fetchPage(page);
+            const pageData = responseData.data || [];
+            allData.push(...pageData);
+            console.log(`[+] 正在采集第 ${page}/${CONFIG.totalPages} 页... ✓ 获取 ${pageData.length} 条数据`);
+            
+            if (page < CONFIG.totalPages) {
+                await sleep(CONFIG.delay + Math.random() * 500);
+            }
+        } catch (error) {
+            console.error(`[-] 第 ${page} 页采集失败: ${error.message}`);
+        }
+    }
+    
+    console.log(`\n[+] 采集完成，共 ${allData.length} 条数据`);
+    
+    // TODO: 计算结果
+    const result = allData.reduce((sum, item) => sum + (item.value || 0), 0);
+    
+    console.log('\n' + '='.repeat(30) + ' 计算结果 ' + '='.repeat(30));
+    console.log(`答案：${result}`);
+    console.log('='.repeat(70));
+}
+
+main().catch(error => {
+    console.error('\n[!] 运行错误:', error.message);
+    process.exit(1);
+});
@@ -0,0 +1,13 @@
+{
+  "name": "js-reverse-wasm",
+  "version": "1.0.0",
+  "description": "JS逆向 - WASM加载还原模板",
+  "main": "main.js",
+  "scripts": {
+    "start": "node main.js",
+    "test": "node main.js --test"
+  },
+  "dependencies": {
+    "axios": "^1.7.0"
+  }
+}
@@ -0,0 +1,97 @@
+/**
+ * WASM 环境补全模块
+ * 为不同类型的 WASM（Emscripten、wasm-bindgen 等）提供最小运行环境
+ */
+
+/**
+ * 补全 wasm-bindgen (Rust) 生成的 WASM 所需的环境
+ * 常见于 Rust 编写的加密模块
+ */
+function patchWasmBindgen() {
+    class Window {
+        constructor() {
+            this.document = {
+                body: {},
+                head: {},
+                createElement: () => ({}),
+                getElementById: () => null,
+                querySelector: () => null,
+            };
+        }
+    }
+    
+    const win = new Window();
+    win.window = win;
+    win.self = win;
+    win.globalThis = win;
+    
+    globalThis.Window = Window;
+    globalThis.window = win;
+    globalThis.self = win;
+    globalThis.document = win.document;
+    
+    // wasm-bindgen 可能使用 TextEncoder/TextDecoder
+    if (typeof TextEncoder === 'undefined') {
+        const { TextEncoder, TextDecoder } = require('util');
+        globalThis.TextEncoder = TextEncoder;
+        globalThis.TextDecoder = TextDecoder;
+    }
+    
+    return win;
+}
+
+/**
+ * 补全 Emscripten 生成的 WASM 所需的环境
+ */
+function patchEmscripten() {
+    return {
+        print: console.log,
+        printErr: console.error,
+        TOTAL_MEMORY: 16777216,
+        TOTAL_STACK: 5242880,
+        noInitialRun: true,
+        noExitRuntime: true,
+        onRuntimeInitialized: null,
+        preRun: [],
+        postRun: [],
+    };
+}
+
+/**
+ * 补全 Go WASM 所需的环境
+ */
+function patchGoWasm() {
+    globalThis.process = globalThis.process || { argv: ['node'], env: {} };
+    globalThis.fs = globalThis.fs || require('fs');
+    
+    // Go WASM 需要 performance.now
+    if (typeof performance === 'undefined') {
+        globalThis.performance = {
+            now: () => Date.now(),
+        };
+    }
+    
+    // Go WASM 需要 crypto.getRandomValues
+    if (typeof globalThis.crypto === 'undefined') {
+        const nodeCrypto = require('crypto');
+        globalThis.crypto = {
+            getRandomValues: (arr) => {
+                const bytes = nodeCrypto.randomBytes(arr.length);
+                arr.set(bytes);
+                return arr;
+            },
+        };
+    }
+}
+
+/**
+ * 清理环境补丁（测试完成后调用）
+ */
+function cleanupPatches() {
+    delete globalThis.Window;
+    delete globalThis.window;
+    delete globalThis.self;
+    delete globalThis.document;
+}
+
+module.exports = { patchWasmBindgen, patchEmscripten, patchGoWasm, cleanupPatches };
@@ -0,0 +1,115 @@
+/**
+ * WASM 加载与执行模块
+ * 在 Node.js 中加载 WebAssembly 模块并调用导出函数
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+/**
+ * 加载本地 WASM 文件
+ * @param {string} wasmPath - WASM 文件路径
+ * @param {Object} importObject - 导入对象（环境依赖）
+ * @returns {Object} WASM 实例的 exports
+ */
+async function loadWasmFromFile(wasmPath, importObject = {}) {
+    const wasmBuffer = fs.readFileSync(wasmPath);
+    return loadWasm(wasmBuffer, importObject);
+}
+
+/**
+ * 从 URL 下载并加载 WASM
+ * @param {string} url - WASM 文件 URL
+ * @param {Object} importObject - 导入对象
+ * @returns {Object} WASM 实例的 exports
+ */
+async function loadWasmFromURL(url, importObject = {}) {
+    const axios = require('axios');
+    const response = await axios.get(url, { responseType: 'arraybuffer' });
+    return loadWasm(response.data, importObject);
+}
+
+/**
+ * 从二进制数据加载 WASM
+ */
+async function loadWasm(wasmBuffer, importObject = {}) {
+    const defaultImports = {
+        env: {
+            memory: new WebAssembly.Memory({ initial: 256, maximum: 512 }),
+            table: new WebAssembly.Table({ initial: 0, element: 'anyfunc' }),
+            abort: (msg, file, line, col) => {
+                console.error(`WASM abort at ${file}:${line}:${col}: ${msg}`);
+            },
+            __memory_base: 0,
+            __table_base: 0,
+            ...importObject.env,
+        },
+        wasi_snapshot_preview1: {
+            fd_write: () => 0,
+            fd_read: () => 0,
+            fd_close: () => 0,
+            fd_seek: () => 0,
+            fd_fdstat_get: () => 0,
+            environ_sizes_get: () => 0,
+            environ_get: () => 0,
+            proc_exit: (code) => { throw new Error(`WASM proc_exit(${code})`); },
+            clock_time_get: () => BigInt(Date.now()) * 1000000n,
+            ...importObject.wasi_snapshot_preview1,
+        },
+        ...importObject,
+    };
+    
+    // 检查 WASM 需要哪些导入
+    const module = await WebAssembly.compile(wasmBuffer);
+    const requiredImports = WebAssembly.Module.imports(module);
+    
+    // 确保所有需要的导入都存在
+    for (const imp of requiredImports) {
+        if (!defaultImports[imp.module]) {
+            defaultImports[imp.module] = {};
+        }
+        if (!defaultImports[imp.module][imp.name]) {
+            switch (imp.kind) {
+                case 'function':
+                    defaultImports[imp.module][imp.name] = () => {};
+                    break;
+                case 'global':
+                    defaultImports[imp.module][imp.name] = new WebAssembly.Global({ value: 'i32', mutable: true }, 0);
+                    break;
+                case 'memory':
+                    defaultImports[imp.module][imp.name] = new WebAssembly.Memory({ initial: 256 });
+                    break;
+                case 'table':
+                    defaultImports[imp.module][imp.name] = new WebAssembly.Table({ initial: 0, element: 'anyfunc' });
+                    break;
+            }
+        }
+    }
+    
+    const instance = await WebAssembly.instantiate(module, defaultImports);
+    
+    return {
+        exports: instance.exports,
+        module,
+        instance,
+        imports: requiredImports,
+    };
+}
+
+/**
+ * 分析 WASM 模块的导出和导入
+ */
+async function analyzeWasm(wasmPath) {
+    const wasmBuffer = fs.readFileSync(wasmPath);
+    const module = await WebAssembly.compile(wasmBuffer);
+    
+    const exports = WebAssembly.Module.exports(module);
+    const imports = WebAssembly.Module.imports(module);
+    
+    return {
+        exports: exports.map(e => ({ name: e.name, kind: e.kind })),
+        imports: imports.map(i => ({ module: i.module, name: i.name, kind: i.kind })),
+    };
+}
+
+module.exports = { loadWasmFromFile, loadWasmFromURL, loadWasm, analyzeWasm };