aaencode颜文字加密JS分析，并使用PHP进行编码解码
0x01 前言
今天在看一个网站JS代码的时候发现，JS代码为一串颜文字，而且还能被解析使用，搜索后得知为aaencode加密，此加密能把js代码转化成颜文字。
原作者的aaencode编码地址 https://utf-8.jp/public/aaencode.html
0x02编码过程
网页源码里可以查看到具体的编码过程，摘录如下。
function aaencode( text )
{
var t;
var b = [
"(c^_^o)",
"(ﾟΘﾟ)",
"((o^_^o) - (ﾟΘﾟ))",
"(o^_^o)",
"(ﾟｰﾟ)",
"((ﾟｰﾟ) + (ﾟΘﾟ))",
"((o^_^o) +(o^_^o))",
"((ﾟｰﾟ) + (o^_^o))",
"((ﾟｰﾟ) + (ﾟｰﾟ))",
"((ﾟｰﾟ) + (ﾟｰﾟ) + (ﾟΘﾟ))",
"(ﾟДﾟ) .ﾟωﾟﾉ",
"(ﾟДﾟ) .ﾟΘﾟﾉ",
"(ﾟДﾟ) ['c']",
"(ﾟДﾟ) .ﾟｰﾟﾉ",
"(ﾟДﾟ) .ﾟДﾟﾉ",
"(ﾟДﾟ) [ﾟΘﾟ]"
];
var r = "ﾟωﾟﾉ= /｀ｍ´）ﾉ ~┻━┻ //*´∇｀*/ ['_']; o=(ﾟｰﾟ) =_=3; c=(ﾟΘﾟ) =(ﾟｰﾟ)-(ﾟｰﾟ); ";
if( /ひだまりスケッチ×(365|３５６)\s*来週も見てくださいね[!！]/.test( text ) ){
r += "X=_=3; ";
r += "\r\n\r\n X / _ / X < \"来週も見てくださいね!\";\r\n\r\n";
}
r += "(ﾟДﾟ) =(ﾟΘﾟ)= (o^_^o)/ (o^_^o);"+
"(ﾟДﾟ)={ﾟΘﾟ: '_' ,ﾟωﾟﾉ : ((ﾟωﾟﾉ==3) +'_') [ﾟΘﾟ] "+
",ﾟｰﾟﾉ :(ﾟωﾟﾉ+ '_')[o^_^o -(ﾟΘﾟ)] "+
",ﾟДﾟﾉ:((ﾟｰﾟ==3) +'_')[ﾟｰﾟ] }; (ﾟДﾟ) [ﾟΘﾟ] =((ﾟωﾟﾉ==3) +'_') [c^_^o];"+
"(ﾟДﾟ) ['c'] = ((ﾟДﾟ)+'_') [ (ﾟｰﾟ)+(ﾟｰﾟ)-(ﾟΘﾟ) ];"+
"(ﾟДﾟ) ['o'] = ((ﾟДﾟ)+'_') [ﾟΘﾟ];"+
"(ﾟoﾟ)=(ﾟДﾟ) ['c']+(ﾟДﾟ) ['o']+(ﾟωﾟﾉ +'_')[ﾟΘﾟ]+ ((ﾟωﾟﾉ==3) +'_') [ﾟｰﾟ] + "+
"((ﾟДﾟ) +'_') [(ﾟｰﾟ)+(ﾟｰﾟ)]+ ((ﾟｰﾟ==3) +'_') [ﾟΘﾟ]+"+
"((ﾟｰﾟ==3) +'_') [(ﾟｰﾟ) - (ﾟΘﾟ)]+(ﾟДﾟ) ['c']+"+
"((ﾟДﾟ)+'_') [(ﾟｰﾟ)+(ﾟｰﾟ)]+ (ﾟДﾟ) ['o']+"+
"((ﾟｰﾟ==3) +'_') [ﾟΘﾟ];(ﾟДﾟ) ['_'] =(o^_^o) [ﾟoﾟ] [ﾟoﾟ];"+
"(ﾟεﾟ)=((ﾟｰﾟ==3) +'_') [ﾟΘﾟ]+ (ﾟДﾟ) .ﾟДﾟﾉ+"+
"((ﾟДﾟ)+'_') [(ﾟｰﾟ) + (ﾟｰﾟ)]+((ﾟｰﾟ==3) +'_') [o^_^o -ﾟΘﾟ]+"+
"((ﾟｰﾟ==3) +'_') [ﾟΘﾟ]+ (ﾟωﾟﾉ +'_') [ﾟΘﾟ]; "+
"(ﾟｰﾟ)+=(ﾟΘﾟ); (ﾟДﾟ)[ﾟεﾟ]='\\\\'; "+
"(ﾟДﾟ).ﾟΘﾟﾉ=(ﾟДﾟ+ ﾟｰﾟ)[o^_^o -(ﾟΘﾟ)];"+
"(oﾟｰﾟo)=(ﾟωﾟﾉ +'_')[c^_^o];"+//TODO
"(ﾟДﾟ) [ﾟoﾟ]='\\\"';"+
"(ﾟДﾟ) ['_'] ( (ﾟДﾟ) ['_'] (ﾟεﾟ+";
r += "(ﾟДﾟ)[ﾟoﾟ]+ ";
for( var i = 0; i < text.length; i++ ){
n = text.charCodeAt( i );
t = "(ﾟДﾟ)[ﾟεﾟ]+";
if( n <= 127 ){
t += n.toString( 8 ).replace( /[0-7]/g, function(c){ return b[ c ] + "+ "; } );
}else{
var m = /[0-9a-f]{4}$/.exec( "000" + n.toString(16 ) )[0];
t += "(oﾟｰﾟo)+ " + m.replace( /[0-9a-f]/gi, function(c){ return b[ parseInt( c,16 ) ] + "+ "; } );
}
r += t;
}
r += "(ﾟДﾟ)[ﾟoﾟ]) (ﾟΘﾟ)) ('_');";
return r;
}
0x03 PHP加解密脚本
<?php
//实现两个PHP没有的JS常用函数，兼容中文。
function charCodeAt($str, $index)
{
$char = mb_substr($str, $index, 1, 'UTF-8');
if (mb_check_encoding($char, 'UTF-8'))
{
$ret = mb_convert_encoding($char, 'UTF-32BE', 'UTF-8');
return hexdec(bin2hex($ret));
}
else
{
return null;
}
}
function uchr ($codes) {
if (is_scalar($codes)) $codes= func_get_args();
$str= '';
foreach ($codes as $code){
$buf = html_entity_decode('&#'.$code.';',ENT_NOQUOTES,'UTF-8');
$buf == '&#'.$code.';' && ($buf = mb_convert_encoding('&#' . intval($code) . ';', 'UTF-8', 'HTML-ENTITIES'));
$str.= $buf;
}
return $str;
}
$b = [
"(c^_^o)",
"(ﾟΘﾟ)",
"((o^_^o) - (ﾟΘﾟ))",
"(o^_^o)",
"(ﾟｰﾟ)",
"((ﾟｰﾟ) + (ﾟΘﾟ))",
"((o^_^o) +(o^_^o))",
"((ﾟｰﾟ) + (o^_^o))",
"((ﾟｰﾟ) + (ﾟｰﾟ))",
"((ﾟｰﾟ) + (ﾟｰﾟ) + (ﾟΘﾟ))",
"(ﾟДﾟ) .ﾟωﾟﾉ",
"(ﾟДﾟ) .ﾟΘﾟﾉ",
"(ﾟДﾟ) ['c']",
"(ﾟДﾟ) .ﾟｰﾟﾉ",
"(ﾟДﾟ) .ﾟДﾟﾉ",
"(ﾟДﾟ) [ﾟΘﾟ]"
];
//编码的过程
function aaencode($text){
global $b;
$r = "ﾟωﾟﾉ= /｀ｍ´）ﾉ ~┻━┻ //*´∇｀*/ ['_']; o=(ﾟｰﾟ) =_=3; c=(ﾟΘﾟ) =(ﾟｰﾟ)-(ﾟｰﾟ); ";
if(preg_match('/ひだまりスケッチ×(365|３５６)\s*来週も見てくださいね[!！]/', $text)){
$r .= "X=_=3; ";
$r .= "\r\n\r\n X / _ / X < \"来週も見てくださいね!\";\r\n\r\n";
}
$r .= "(ﾟДﾟ) =(ﾟΘﾟ)= (o^_^o)/ (o^_^o);".
"(ﾟДﾟ)={ﾟΘﾟ: '_' ,ﾟωﾟﾉ : ((ﾟωﾟﾉ==3) +'_') [ﾟΘﾟ] ".
",ﾟｰﾟﾉ :(ﾟωﾟﾉ+ '_')[o^_^o -(ﾟΘﾟ)] ".
",ﾟДﾟﾉ:((ﾟｰﾟ==3) +'_')[ﾟｰﾟ] }; (ﾟДﾟ) [ﾟΘﾟ] =((ﾟωﾟﾉ==3) +'_') [c^_^o];".
"(ﾟДﾟ) ['c'] = ((ﾟДﾟ)+'_') [ (ﾟｰﾟ)+(ﾟｰﾟ)-(ﾟΘﾟ) ];".
"(ﾟДﾟ) ['o'] = ((ﾟДﾟ)+'_') [ﾟΘﾟ];".
"(ﾟoﾟ)=(ﾟДﾟ) ['c']+(ﾟДﾟ) ['o']+(ﾟωﾟﾉ +'_')[ﾟΘﾟ]+ ((ﾟωﾟﾉ==3) +'_') [ﾟｰﾟ] + ".
"((ﾟДﾟ) +'_') [(ﾟｰﾟ)+(ﾟｰﾟ)]+ ((ﾟｰﾟ==3) +'_') [ﾟΘﾟ]+".
"((ﾟｰﾟ==3) +'_') [(ﾟｰﾟ) - (ﾟΘﾟ)]+(ﾟДﾟ) ['c']+".
"((ﾟДﾟ)+'_') [(ﾟｰﾟ)+(ﾟｰﾟ)]+ (ﾟДﾟ) ['o']+".
"((ﾟｰﾟ==3) +'_') [ﾟΘﾟ];(ﾟДﾟ) ['_'] =(o^_^o) [ﾟoﾟ] [ﾟoﾟ];".
"(ﾟεﾟ)=((ﾟｰﾟ==3) +'_') [ﾟΘﾟ]+ (ﾟДﾟ) .ﾟДﾟﾉ+".
"((ﾟДﾟ)+'_') [(ﾟｰﾟ) + (ﾟｰﾟ)]+((ﾟｰﾟ==3) +'_') [o^_^o -ﾟΘﾟ]+".
"((ﾟｰﾟ==3) +'_') [ﾟΘﾟ]+ (ﾟωﾟﾉ +'_') [ﾟΘﾟ]; ".
"(ﾟｰﾟ)+=(ﾟΘﾟ); (ﾟДﾟ)[ﾟεﾟ]='\\\\'; ".
"(ﾟДﾟ).ﾟΘﾟﾉ=(ﾟДﾟ+ ﾟｰﾟ)[o^_^o -(ﾟΘﾟ)];".
"(oﾟｰﾟo)=(ﾟωﾟﾉ +'_')[c^_^o];".
"(ﾟДﾟ) [ﾟoﾟ]='\\\"';".
"(ﾟДﾟ) ['_'] ( (ﾟДﾟ) ['_'] (ﾟεﾟ+";
$r .= "(ﾟДﾟ)[ﾟoﾟ]+ ";
for( $i = 0; $i < mb_strlen($text); $i++ ){
$n = charCodeAt($text,$i);
$t = "(ﾟДﾟ)[ﾟεﾟ]+";
if( $n <= 127 ){
$t .= preg_replace_callback('/[0-7]/', function($c)use ($b){
return $b[$c[0]]."+ ";
}, ((string)decoct($n)));
}else{
if(preg_match('/[0-9a-f]{4}$/', '000'.((string)dechex($n)),$result)){
$m = $result[0];
}else{
$m = '';
}
$t .= "(oﾟｰﾟo)+ " . preg_replace_callback('/[0-9a-f]/i',function($c)use ($b){
return $b[ hexdec($c[0]) ] . "+ ";
},$m);
}
$r .= $t;
}
$r .= "(ﾟДﾟ)[ﾟoﾟ]) (ﾟΘﾟ)) ('_');";
return $r;
}
//解码的过程
function aadecode($text){
global $b;
$text = strtr($text, ["(ﾟДﾟ)[ﾟoﾟ]) (ﾟΘﾟ)) ('_');" => '']);
for($i=0;$i<count($b);$i++){
$buf = $b[$i];
if($i <=7){
//8进制逆向
$str = (($i));
$text = strtr($text, [$buf."+ "=>$str]);
}else{
//16进制逆向
$text = strtr($text, [$buf."+ " => dechex($i)]);
}
}
$text = preg_replace_callback('/\(ﾟДﾟ\)\[ﾟεﾟ\]\+(\d+)/', function($c){
return uchr(octdec($c[1]));
}, $text);
$text = preg_replace_callback('/\(ﾟДﾟ\)\[ﾟεﾟ\]\+\(oﾟｰﾟo\)\+\s+([0-9a-f]{4})/', function($c){
return uchr(hexdec($c[1]));
}, $text);
$pre = [
"ﾟωﾟﾉ= /｀ｍ´）ﾉ ~┻━┻ //*´∇｀*/ ['_']; o=(ﾟｰﾟ) =_=3; c=(ﾟΘﾟ) =(ﾟｰﾟ)-(ﾟｰﾟ); ",
"X=_=3; ",
"\r\n\r\n X / _ / X < \"来週も見てくださいね!\";\r\n\r\n",
"(ﾟДﾟ) =(ﾟΘﾟ)= (o^_^o)/ (o^_^o);",
"(ﾟДﾟ)={ﾟΘﾟ: '_' ,ﾟωﾟﾉ : ((ﾟωﾟﾉ==3) +'_') [ﾟΘﾟ] ",
",ﾟｰﾟﾉ :(ﾟωﾟﾉ+ '_')[o^_^o -(ﾟΘﾟ)] ",
",ﾟДﾟﾉ:((ﾟｰﾟ==3) +'_')[ﾟｰﾟ] }; (ﾟДﾟ) [ﾟΘﾟ] =((ﾟωﾟﾉ==3) +'_') [c^_^o];",
"(ﾟДﾟ) ['c'] = ((ﾟДﾟ)+'_') [ (ﾟｰﾟ)+(ﾟｰﾟ)-(ﾟΘﾟ) ];",
"(ﾟДﾟ) ['o'] = ((ﾟДﾟ)+'_') [ﾟΘﾟ];",
"(ﾟoﾟ)=(ﾟДﾟ) ['c']+(ﾟДﾟ) ['o']+(ﾟωﾟﾉ +'_')[ﾟΘﾟ]+ ((ﾟωﾟﾉ==3) +'_') [ﾟｰﾟ] + ",
"((ﾟДﾟ) +'_') [(ﾟｰﾟ)+(ﾟｰﾟ)]+ ((ﾟｰﾟ==3) +'_') [ﾟΘﾟ]+",
"((ﾟｰﾟ==3) +'_') [(ﾟｰﾟ) - (ﾟΘﾟ)]+(ﾟДﾟ) ['c']+",
"((ﾟДﾟ)+'_') [(ﾟｰﾟ)+(ﾟｰﾟ)]+ (ﾟДﾟ) ['o']+",
"((ﾟｰﾟ==3) +'_') [ﾟΘﾟ];(ﾟДﾟ) ['_'] =(o^_^o) [ﾟoﾟ] [ﾟoﾟ];",
"(ﾟεﾟ)=((ﾟｰﾟ==3) +'_') [ﾟΘﾟ]+ (ﾟДﾟ) .ﾟДﾟﾉ+",
"((ﾟДﾟ)+'_') [(ﾟｰﾟ) + (ﾟｰﾟ)]+((ﾟｰﾟ==3) +'_') [o^_^o -ﾟΘﾟ]+",
"((ﾟｰﾟ==3) +'_') [ﾟΘﾟ]+ (ﾟωﾟﾉ +'_') [ﾟΘﾟ]; ",
"(ﾟｰﾟ)+=(ﾟΘﾟ); (ﾟДﾟ)[ﾟεﾟ]='\\\\'; ",
"(ﾟДﾟ).ﾟΘﾟﾉ=(ﾟДﾟ+ ﾟｰﾟ)[o^_^o -(ﾟΘﾟ)];",
"(oﾟｰﾟo)=(ﾟωﾟﾉ +'_')[c^_^o];",
"(ﾟДﾟ) [ﾟoﾟ]='\\\"';",
"(ﾟДﾟ) ['_'] ( (ﾟДﾟ) ['_'] (ﾟεﾟ+",
"(ﾟДﾟ)[ﾟoﾟ]+ ",
];
$rA = [];
foreach($pre as $val){
$rA[$val] = '';
}
$text = strtr($text,$rA);
return $text;
}
//加密
$crytext = aaencode('console.log("唐宋元明清");');
echo $crytext;//ﾟωﾟﾉ= /｀ｍ´）ﾉ ~┻━┻ //*´∇｀*/ ['_']; o=(ﾟｰﾟ)......
//解密
echo aadecode($crytext);//console.log("唐宋元明清");
参考链接：https://my.oschina.net/u/2366984/blog/1621119
