hello_js_reverse_skill/templates/vm-sandbox/utils/sandbox.js

/**
 * VM 沙箱模块
 * 用于执行服务端返回的混淆 JS 代码，提取动态生成的 Cookie/Token
 */

const vm = require('vm');

function createSandbox(options = {}) {
    const cookies = {};
    const logs = [];
    
    const sandbox = {
        window: null,
        self: null,
        globalThis: null,
        top: null,
        parent: null,
        
        document: {
            cookie: options.initialCookie || '',
            createElement: (tag) => ({
                tagName: tag.toUpperCase(), style: {}, src: '',
                setAttribute: () => {}, getAttribute: () => null,
                appendChild: () => {}, innerHTML: '',
            }),
            getElementById: () => null,
            getElementsByTagName: (tag) => tag === 'script' ? [1, 2, 3] : [],
            getElementsByClassName: () => [],
            querySelector: () => null,
            querySelectorAll: () => [],
            head: { appendChild: () => {} },
            body: { appendChild: () => {} },
            location: { href: options.url || 'https://example.com' },
            referrer: '',
            readyState: 'complete',
        },
        
        navigator: {
            userAgent: options.userAgent || 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
            appCodeName: 'Mozilla', appName: 'Netscape', appVersion: '5.0',
            platform: 'MacIntel', language: 'zh-CN', languages: ['zh-CN', 'zh', 'en'],
            cookieEnabled: true, onLine: true, webdriver: false,
            plugins: { length: 3 }, mimeTypes: { length: 4 },
            hardwareConcurrency: 8, maxTouchPoints: 0,
        },
        
        location: {
            href: options.url || 'https://example.com',
            protocol: 'https:', host: 'example.com',
            hostname: 'example.com', pathname: '/', search: '', hash: '',
            origin: 'https://example.com',
        },
        
        screen: { width: 1920, height: 1080, availWidth: 1920, availHeight: 1055, colorDepth: 24, pixelDepth: 24 },
        
        setTimeout: (fn, ms) => setTimeout(fn, Math.min(ms || 0, 3000)),
        setInterval: (fn, ms) => { /* 不执行定时器避免死循环 */ return -1; },
        clearTimeout, clearInterval,
        
        String, Array, Object, Math, Date, RegExp, JSON, Map, Set,
        parseInt, parseFloat, isNaN, isFinite, NaN, Infinity, undefined,
        encodeURIComponent, decodeURIComponent, encodeURI, decodeURI,
        escape, unescape,
        Error, TypeError, RangeError, SyntaxError, ReferenceError,
        ArrayBuffer, Uint8Array, Int32Array, Float64Array, DataView,
        Promise, Proxy, Reflect, Symbol, Number, Boolean,
        
        btoa: (str) => Buffer.from(str, 'binary').toString('base64'),
        atob: (b64) => Buffer.from(b64, 'base64').toString('binary'),
        
        console: {
            log: (...args) => logs.push(args.join(' ')),
            warn: () => {}, error: () => {}, info: () => {},
            debug: () => {}, trace: () => {}, clear: () => {},
        },
        
        XMLHttpRequest: class {
            open() {} setRequestHeader() {} send() {
                this.readyState = 4; this.status = 200; this.responseText = '{}';
                if (this.onreadystatechange) this.onreadystatechange();
            }
            addEventListener(e, fn) { this['on' + e] = fn; }
        },
    };
    
    sandbox.window = sandbox;
    sandbox.self = sandbox;
    sandbox.globalThis = sandbox;
    sandbox.top = sandbox;
    sandbox.parent = sandbox;
    sandbox.frames = sandbox;
    
    // Cookie 拦截
    Object.defineProperty(sandbox.document, 'cookie', {
        get() {
            return Object.entries(cookies).map(([k, v]) => `${k}=${v}`).join('; ');
        },
        set(val) {
            const mainPart = val.split(';')[0];
            const eqIdx = mainPart.indexOf('=');
            if (eqIdx > 0) {
                const name = mainPart.substring(0, eqIdx).trim();
                const value = mainPart.substring(eqIdx + 1).trim();
                cookies[name] = value;
            }
        },
        configurable: true,
    });
    
    if (options.initialCookie) {
        options.initialCookie.split(';').forEach(pair => {
            const [k, ...rest] = pair.trim().split('=');
            if (k) cookies[k.trim()] = rest.join('=');
        });
    }
    
    return { sandbox, cookies, logs };
}

/**
 * 执行混淆 JS 代码并提取 Cookie
 * @param {string} code - 混淆的 JS 代码
 * @param {Object} options - 配置选项
 * @returns {Object} { cookies, logs, success }
 */
function executeAndExtractCookie(code, options = {}) {
    const { sandbox, cookies, logs } = createSandbox(options);
    vm.createContext(sandbox);
    
    try {
        vm.runInContext(code, sandbox, {
            timeout: options.timeout || 5000,
            filename: 'dynamic.js',
        });
        
        return {
            success: true,
            cookies: { ...cookies },
            cookieString: Object.entries(cookies).map(([k, v]) => `${k}=${v}`).join('; '),
            logs,
        };
    } catch (error) {
        return {
            success: false,
            error: error.message,
            cookies: { ...cookies },
            logs,
        };
    }
}

module.exports = { createSandbox, executeAndExtractCookie };