js逆向分析之acorn和escodegen的使用

替換之前的d形如

d("77696669")

執行代碼

const fs = require('fs');
const acorn = require('acorn');
const walk = require("acorn-walk")
const escodegen = require('escodegen');

function d(b) {
    var a, c = "";
    for (a = 0; a < b.length; a += 2) c += String.fromCharCode(parseInt(b.slice(a, a + 2), 16));
    return c
}

const content = fs.readFileSync('m301650.js');
const ast = acorn.parse(content);
walk.simple(ast, {
    CallExpression(node) {
        if (node.callee.name === 'd' && node.arguments[0].type === 'Literal') {
            node.type = 'Literal';
            node.value = d(node.arguments[0].value);
        }
    }
});
const decodedContent = escodegen.generate(ast);
fs.writeFileSync('m301650.decoded.js', decodedContent);

替換之后的

就是一個字符串

script