内容字号:默认大号超大号

段落设置:段首缩进取消段首缩进

字体设置:切换到微软雅黑切换到宋体

智联招聘验证码校验请求:MmEwMD

2017-03-24 14:09 出处:清屏网 人气: 评论(0

写在前面

本人没有深入钻研过前端技术,JS属于亚文盲水平,这篇分析的目的是分享解决解决问题的思路。

  • 提出假设,证明它或推翻它,如果推翻,就再提出一个新的假设。该走的弯路,一米都不能少
  • 抛开所有不可能的,剩下的,不管多么匪夷所思,那都是事实
  • 坚信JS是纯客户端逻辑,理论上一定可破解,需要的是时间和耐心
  • 凡是不能杀死你的,最终都会让你更强

问题描述

智联招聘企业端登陆,输入验证码后,点击验证按钮,抓包获得以下请求

https://passport.zhaopin.com/chk/verify?callback=jsonpCallback&MmEwMD=12quxKHKjs0Ueapv9t.fUcurtt8lkuPKNW.iigEyOYlrTOxwONa0ImcCQ8gvRZic3MnqU1WUPdIESozanNi1FCB38raqp0l5vVLXlYgSCIWxh6rR.3q0lK304tlBMH49LDm8FUL4hkfboCm_lhWv9qO7coH_FfFRY1fC8xIZ7_NljGkOJvIWaaUFwhGF2SVwN58UkzX6GuABWNvbUzzVVq5Kzj45tS_p4U2fo.re9LOuwPpp99H5bLKIgmNsI_RALV39ujuLsqhbHTJAgCtQeZzOkhMbjJKciuKPp97TkbIpDpGr_ZqTBghcjRgr_gz1CkGCCoUTn24dIPfVB0tTDenbTTuOot.rT_RmTiIsA0zY5ac445PXgJZXaXHxrV_ASY0

问题:如何构建MmEwMD参数?

初步分析

查看智联招聘login页面的相关JS文件,分析query param的构建方法

scripts/chk/captcha.js

从上图中我们可以看到调用JQuery的$.ajax方法来发送请求,发送的url只有 callback 一个query param,并没有看到 MmEwMD 的踪迹,说明不是在zhilian自己的JS文件中加这个参数,猜测是给JQuery加了 prefilter 或者 beforeSend 之类的钩子

构建本地JS Debug环境

  • 通过 wget 抓取html和相关资源文件

    wget --mirror --page-requisites --adjust-extension --no-parent --convert-links --directory-prefix=sousers https://passport.zhaopin.com/org/login
  • 使用python启动simple web server

    python -m SimpleHTTPServer 8081
  • 访问本地login页面

    http://localhost:8081/org/login.html
  • 智联招聘使用的JQuery版本是1.7.1,我们从官网下载非min版本方便debug。下载完成后放到script目录下,然后修改login.html中include script代码

    http://code.jquery.com/jquery-1.7.1.js

Debug JQuery

// Do send the request
// This may raise an exception which is actually
// handled in jQuery.ajax (so no try/catch here)
xhr.send( ( s.hasContent && s.data ) || null );

从 scripts/chk/captcha.js 的 $.ajax 入手一路debug进去,直到上面这行代码,我们inspector xhr对象发现,并没有任何JQuery的钩子,此时,我们怀疑xhr (XMLHttpRequest) 被hook了。

验证方法如下:

在浏览器console中执行以下代码

var xhr = new window.XMLHttpRequest();
xhr.open('POST','/hello',true);
xhr.send('abc');

出现了以下请求,说明在当前页面中的xhr肯定被hook了,同时解除对JQuery的怀疑。

POST http://localhost:8081/hello?MmEwMD=1zXMRFfiFy00rBpdSoJ2cJ4EvS6mQ1dvl5jZLrqB…oRVu5t.x8Y3GVQLmqdG.lmuE2snbEk.YHif4rmHwOtKQoTiHpODCa6HikgWg1X2S._aq8rKTLr

分析Login HTML

Login页面的html中有三段非常有趣的代码

第一段代码是:

<meta name="renderer" content="webkit"><meta id="9DhefwqGPrzGxEp9hPaoag" content="{qqqkkGZAkCAGc60cEqNGqD3DD5aef8al4605kUdZ}FH00lxmQZlsYUWYqfYOapWmqyrK0HMVZCsczHJ90Xl1mUHYqzYOqpHmqJrYVhVAAsUfwWmYqV102mqmgDsaJppYakV2QoUGAwKTymDYgwsSNpK2aFV9aopaAtK07pqmQFVqSKlSlwVrEmXq5_s8RWy24CUi0pdmIbVHfKySoNVi3mzq5CJ1489597716416YipgfCWy.0N5u81OO.MzYPhz_sUNCdYZHoc64qqqVqDASVkfQJYZ6Vkm8J20yqqqqqqqqqqqqqqqqKBgyFY2AtnVVvvzAyQm_MlqqqiR9xU82xnVUwUIqc80{BxLZUzp12oHeoyld0p5rxyaOOYIxVTlI6A8eodlHZm_QVjSuSpeRHS9IK1wlE0YUqYiNonVowpZyknf8pmx0Qa0I3sZfoSlvkcJJKa6kpYWRHCVGkl3W8iplVtALfc1VJxa07kPgqEa9Nk10HhAh1CI9DpmpzDfqr0k130qqqr0qqqqqqqqqqqqqqqq">

关键字: 9DhefwqGPrzGxEp9hPaoag

  • 好消息是这套机制不是智联独创的,别的网站也有用。
  • 坏消息是网上的资料非常非常非常稀少

第二段代码是:

<script type="text/javascript" src="/4QbVtADbnLVIc/d.FxJzG50F.js?D9PVtGL=5aef8a"></script>

https://passport.zhaopin.com/4QbVtADbnLVIc/d.FxJzG50F.js?D9PVtGL=5aef8a

关键字: FxJzG50F

  • 和上面情形差不多,有别的网站在用,但资料非常稀缺
  • 差不多可以推断出这个JS是用来做混淆的

第三段代码是:

<script type="text/javascript">var _$qk=window,_$rL=top,_$vH,_$vy,_$nX,_$x5,_$an=String.fromCharCode,_$xU=[],_$ch,_$xF,_$nh,_$su,_$oR,_$l7,_$h4,_$xR=_$qk.Error;var _$kO,_$wL,_$wA;var _$gg=1;_$gf();_$qk[_$an(101,118,97,108)]

// 内容太多,文章的最后会帖一个完整版

</script>
  • 这段代码的是经过混淆的JS,并且每次请求login页面,拿到的JS内容都会变化,意味每次会随机用于混淆的变量名和函数名,真是太贱了。
  • 接下来我们挑选一个版本,然后解剖下这段JS究竟在做什么

做到这一步,已经产生了一些敬畏之心,既然搜了这么多冷门的关键字,不妨搜一下主角 MmEwMD

关键字: MmEwMD

百度终于比谷歌牛逼了一回,谷歌完全搜不到,百度可以搜到一条论坛信息,时间还挺近的,是有人在论坛上求助咪咕的login请求问题,再一次印证了这东西不是智联原创,但网络上相关资料非常稀少,可能是一个非公开,非开源的东西

分析被混淆过的outer.js

由于代码有500多行,我将完整代码贴在文章最后的附录中,我们称这个js为 outer.js

为了debug这个混淆过的 outer.js 文件,我们需要:

  • 在login.html文件中注释掉这段JS的 <script>...</script>
  • 将format后的JS保存到文件中放到script/outer.js
  • 在login.html中include这个JS文件

准备工作完成后,开始debug这个JS,初步猜想,这个JS中应该有一个callback函数,当点击验证按钮的时候,可以到这个函数中。我们给所有的function的入口出都打上断点,但按下验证按钮后,居然没有一个function被触发,这说明callback函数不在这些function中!

经过逐行跟踪,我们猜测callback function的代码,以及inject hook的代码可能都是运行过程中产生的,然后通过 eval() 或者 window['execScript'] 之类的来动态加载的,最后我们定位到下面这个函数

outer.js line 405~417

function _$tx(_$dq) {
    if (_$dq === undefined || _$dq === "") return;
    var _$dL = _$h1[_$k1][_$ls],
        _$kD;
    if (!_$jr) _$jr = _$dL.push;
    if (_$h1[_$o4]) _$kD = _$h1[_$o4](_$dq);
    else {
       var _$sD = _$h1[_$bn];
       _$kD = _$sD[_$hm](_$h1, _$dq);
    }
    if (_$jr !== _$dL.push) _$dL.push = _$jr;
    return _$kD;
}

window["execScript"]动态加载代码

  • _$dq 里面就是被动态加载的代码,接下来我们将debug这段被动态加载的代码。
  • 我们将他保存为 inner.js ,完整代码参见最下面的附录(有2000多行,太长贴不下,分了卷一和卷二)
  • 做到这一步已经有些心力憔悴,因为我们不知道前方会有几层迭代,会不会不停地产生动态代码并且加载

字符串变量替换表

在分析 outer.js 过程中,我们发了一张字符串和混淆变量之间的对应关系表,将下面这段代码执行后,可以得到以下变量定义(完整定义请见附录),这里定义了 inner.js 用到的所有全局变量,对我们分析2000+行的 inner.js 非常有帮助

...
_$eS = "XMLHttpRequest",
_$ml = "send",
_$ij = "MmEwMD",
...
outer.js line 52

_$h1[_$w6(101, 118, 97, 108)](_$kw("FSSBBIl1UgzbN7N`use strict`document`localStorage`globalStorage`sessionStorage`indexedDB`mozIndexedDB`webkitIndexedDB`msIndexedDB`name`top`vdFm`unload`prototype`get`call`set`openDatabase`EkcP`windowData`sessionData`globalData`localData`userData`dbData`idbData`tests`function`setItem`getItem`div`userdata_el`addBehavior`style`behavior`url(#default#userdata)`setAttribute`save`load`getAttribute`transaction`executeSql`CREATE TABLE IF NOT EXISTS `EkcP_t`id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, `name TEXT NOT NULL, `value TEXT NOT NULL, `UNIQUE (name)`INSERT OR REPLACE INTO `(name, value) `VALUES(?, ?)`SELECT value FROM ` WHERE name=?`rows`length`item`value`open`onerror`onupgradeneeded`target`result`createObjectStore`onsuccess`objectStoreNames`contains`readwrite`objectStore`put`close`vlaue`escape`indexOf`substr`string`split`charAt`substring`unescape`location`host`replace`getElementById`createElement`visibility`hidden`position`absolute`id`body`appendChild`slice`concat`splice`floor`t__`B_`fontList`$b_onBridgeReady`$b_callHandler`$b_setup`$b_platform`android`iframe`display`none`documentElement`cb_`getTime`src`jbscheme://`stringify`jbscheme://queue_has_message`$b_fetchQueue`$b_onNativeResponse`navigator`platform`test`Uint8Array`subarray`lastIndexOf`XMLHttpRequest`send`Microsoft.XMLHTTP`Array`charCodeAt`from`language`browserLanguage`zh-CN`_tCbyRDtiXFzNibfz8bwLXK67X84O5PPj58BL8FVX1uL.4I9XE6LNLoLBNH2fFUb23dbfxd9B_obGFdbPxMvG.v2f4B9X4B9BRUN944bOjVf`alert`apply`GET`href`responseType`arraybuffer`setRequestHeader`X-sOYOcALfiiw`onreadystatechange`readyState`status`response`VBArray`responseBody`toArray`MmEwMD`Math`ceil`JSON`0000`toString`number`null`boolean`object`[object Array]`hasOwnProperty`%20`addEventListener`on`attachEvent`random`assert failed with condition: `assert failed: ` is not same as `acceleration`accelerationIncludingGravity`alpha`beta`gamma`battery`getBattery`then`level`charging`chargingTime`Infinity`$_YWTU`$_cDro`isNaN`keyCode`button`offsetX`offsetY`touches`screenX`screenY`clientX`clientY`userAgent`standalone`$PreUCBrowserClassic,UCBrowserMessageCenter`__firefox__,_firefox_ReaderMode`__mttCreateFrame,mttCumstomJS`__crWeb,__gCrWeb`MicroMessenger`SeMobFillFormTool,SogouMse`Sogou`ApplePaySession`Safari`PointerEvent`MSPointerEvent`msCredentials`webkitPersistentStorage`browser_parameters,item`FaveIconJavaInterface,jesion` OPR/`chrome`runtime`webstore`onautocomplete`PerformanceObserver`PerformanceObserverEntryList`Entity`AnalyserNode`external`AddSearchProvider`dumpAll`MozAppearance`$_ts`DeviceStorage`controllers`UCWebExt,ucweb`qb_bridge,qbbookshelf`dolphin,dolphininfo,dolphinmeta`safari`pushNotification`orientation`callPhantom,_phantom`$hook$,$$logger,$$lsp,$$lsrb`netsparker,__ns`hp_identifier`spi_hooked,mozAnimationStartTime,mozIndexedDB,mozRequestAnimationFrame`Gamepad`c[`a[b](`WebXMLogMsg_UNIQUE_`stack`pop`Object.InjectedScript.evaluate`@debugger`evaluate`setInterval`eval`var a = new Date(); debugger; new Date() - a > 100;`$_ck`_Selenium_IDE_Recorder,_selenium,callSelenium`__driver_evaluate,__webdriver_evaluate,__selenium_evaluate,__fxdriver_evaluate,__driver_unwrapped,__webdriver_unwrapped,__selenium_unwrapped,__fxdriver_unwrapped,__webdriver_script_func,__webdriver_script_fn`selenium`webdriver`driver`match`cache_`http`script`http://security.riversecurity.com/4QbVtADbnLVIc/jW39ezbWPr.js`$_fh0`$_f0`$_f1`round`$_fr`$_fpn1`except`innerHTML`bb82kj`fonts`Count`removeChild`3jeALeSsa6`<EMBED id=4rJFe6jNL52p height=1 type=application/x-shockwave-flash width=1 src=/4QbVtADbnLVIc/4rJFe6jNL52p.js>`4rJFe6jNL52p`GetVariable`undefined`/:user_fonts`clearInterval`message`filename`lineno`appVersion`languages`plugins`mimeTypes`type`description`screen`getTimezoneOffset`devicePixelRatio`safari,ontouchstart,sidebar,localStorage,clipboardData,sessionStorage,indexedDB,openDatabase,standalone,$PreUCBrowserClassic,UCBrowserMessageCenter,__firefox__,_firefox_ReaderMode,__mttCreateFrame,mttCustomJS,__crWeb,__gCrWeb,MicroMessenger,SogouMse,ucweb,qb_bridge,FaveIconJavaInterface,jesion,dophin,orientation`canvas`getContext`width`height`2d`ActiveXObject`textBaseline`font`fillStyle`#f82`fillRect`#17e`fillText`rgba(240,110,53,0.4)`toDataURL`connection`mozConnection`webkitConnection`bluetooth`cellular`ethernet`wifi`wimax`; expires=`toGMTString`Stolen Via Net: Cookie key length is incorrect.`cookie`; `ShockwaveFlash.ShockwaveFlash`AcroPDF.PDF`PDF.PdfCtrl`QuickTime.QuickTime`rmocx.RealPlayer G2 Control`rmocx.RealPlayer G2 Control.1`RealPlayer.RealPlayer(tm) ActiveX Control (32-bit)`RealVideo.RealVideo(tm) ActiveX Control (32-bit)`RealPlayer`SWCtl.SWCtl`WMPlayer.OCX`AgControl.AgControl`Skype.Detection`getElementsByTagName`<!--[if gt IE `]><i></i><![endif]-->`/*@cc_on!@*/false`_$`FSSBA`Z8XHj`protocol`https:`443`80`webgl`experimental-webgl`attribute vec2 attrVertex;varying vec2 varyinTexCoordinate;uniform vec2 uniformOffset;void main(){varyinTexCoordinate=attrVertex+uniformOffset;gl_Position=vec4(attrVertex,0,1);}`precision mediump float;varying vec2 varyinTexCoordinate;void main() {gl_FragColor=vec4(varyinTexCoordinate,0,1);}`createBuffer`bindBuffer`ARRAY_BUFFER`Float32Array`bufferData`STATIC_DRAW`itemSize`numItems`createProgram`createShader`VERTEX_SHADER`shaderSource`compileShader`FRAGMENT_SHADER`attachShader`linkProgram`useProgram`vertexPosAttrib`getAttribLocation`attrVertex`offsetUniform`getUniformLocation`uniformOffset`enableVertexAttribArray`vertexPosArray`vertexAttribPointer`FLOAT`uniform2f`drawArrays`TRIANGLE_STRIP`getShaderPrecisionFormat`HIGH_FLOAT`MEDIUM_FLOAT`LOW_FLOAT`HIGH_INT`MEDIUM_INT`LOW_INT`rangeMin`rangeMax`precision`toUpperCase`getParameter`getSupportedExtensions`getExtension`MediaStreamTrack`getSources`mediaDevices`enumerateDevices`deviceId`mousedown`mouseup`mousemove`keydown`touchstart`touchmove`touchend`click`input`scroll`driver-evaluate`webdriver-evaluate`selenium-evaluate`error`DeviceMotionEvent`devicemotion`DeviceOrientationEvent`deviceorientation`./`pathname`log`+=`submit`tagName`form`jquery`//`HTMLElement`nodeType`nodeName`document-fragment`application/x-shockwave-flash`enabledPlugin`toLowerCase`FSSBB`qrcklmDoExthWJiHAp1sVYKU3RFMQw8IGfPO92bvLNj.7zXBaSnu0TC6gy_4Ze5d`setTimeout`___ts___`removeItem`__#classType`console`wP3dxhyJgpbC6tVm_ewcCO`9DhefwqGPrzGxEp9hPaoag`content`parentElement`abort`dispatchEvent`removeEventListener`getAllResponseHeaders`getResponseHeader`overrideMimeType`responseText`responseXML`statusText`NaN`trim`http://`https://`port`http:`hostname`search`&T=`/4QbVtADbnLVIc/jW39ezbWPr.js?`; path=/`$_turi`$_ttarg`$_tk1`$_tk2", "u5hjh9kviEjLezmgc6cpmbvokWnIlIbcqZfSiWsjhBn1ljmwbwlLk1lso4bnhmdPk3lOiolBl7jweAb3mkfAiUdzlVn9kVfEdqdLkDsDg6mhnhkCnSlDhqhsf0jefxnUjPgyjEceaHmziFh3hPhbpQvif7o2rUeqlTkXdDsPi4i2bLeaepiMjVtHbvhKh5gnqmhwi0cIgGf9eBkRb2eQxOiZk6lHkqkycwnwfsoGtbqcfPkBirjXeSmldTo1mnvxlMe1i7mQjgbarvkgoee7nAdUg1mMcspahGa0hYijsHhfjYhdechCkFi3n2ocoseiqAjBnJdAtJcmoZppcMubwqfXe4mjb0hoesfLbkdBlcmfjDeokudffHc9dajNhRasizn0kJdjj0kpmchhodlkqCjjbrjaf8nEeClWn5fcktcSingOkkpxc2kGhTklgxmBi8pbvLdWe9pKuGlNfgdhgsnqaqeunpcLlydeooicuZqufhjoeEdXg0kAqIj6fJcnjdllcxi5pmfocvkEbopyjbfOm1kKoLembMg9a4ckkLilarpzluu2l4uNcYkfiAjif6iIgLdbkUhLcrhglPmWmxjIofmFa2aPoEm0t9hnigcobhoCgCrKommPp8krefk8cNgQnWn6dkflmZcAjxiwkiiht6o7qldrnVbsaFqDqtoaawcfrGnHeGc3h6qedvhvqrnLmXbHojgufaiJbbbgqfqSnCkTpfgmdmgJdQlEeZqnfdpTkjgZq5rgc8ghdujAmVhzl5kQfupqqoqLeLeHd6iQqOf1b9rxrrmDjUrpgElmjQphj5hMoVe0p4qgldnnrHbTtEruqBrcptm7eUtlp5dGjfoNrYiRripebUeDeViHsdpDr5rWhVaNohpApdoPpPggrmiTjvd0sUsge6qXdKe3ucdOpHfn"));;

分析动态加载的inner.js

由于inner.js还是被混淆过的,肉眼实在太难看懂逻辑,所以我们需要通过debug来理解:

  • 将inner.js格式化后保存
  • 在login.html中include inner.js
  • 在outer.js中将动态加载的代码注释掉
    function _$tx(_$dq) {
      if (_$dq === undefined || _$dq === "") return;
      var _$dL = _$h1[_$k1][_$ls],
          _$kD;
      if (!_$jr) _$jr = _$dL.push;
      if (_$h1[_$o4]) _$kD = _$h1[_$o4](_$dq);
      else {
        // var _$sD = _$h1[_$bn];  // DON'T exec script
        // _$kD = _$sD[_$hm](_$h1, _$dq);   // DON'T exec script
      }
      if (_$jr !== _$dL.push) _$dL.push = _$jr;
      return _$kD;
    }

心中默默祈祷:

  • 不要再生成动态代码
  • 找到hook XMLHttpRequest 的断点
  • 找到 MmEwMD 生成的function的断点

从字符串变量映射表出发,顺藤摸瓜,找到计算 MmEwMD 的代码

_$ij = "MmEwMD"
inner.js line 1290

var _$vf = _$ij;;
inner.js line 2011 ~ 2019

function _$vk(_$sh, _$ng) {
    var _$mT = [];
    var _$n7 = _$g2(6);
    if (_$n7) {
        _$mT = _$mT[_$hK](_$ng);
        _$mT.push(_$oQ(_$sh) ? 1 : 0);
        return _$vf + '=' + _$n7 + _$ra(_$mT);
    } else return _$vf + '=';
}

MmEwMD计算逻辑

  • 传入参数 _$ng 是一个常量 [47, 104, 63, 191, 69, 148, 99, 71, 130, 101, 12, 4, 232, 188, 109, 80]
  • _$ra(_$mT) 和 _$g2(6) 的函数定义都有

根据XMLHttpRequest变量,顺藤摸瓜找到挂钩子的地方

_$eS = "XMLHttpRequest"
inner.js line 2228 ~ 2252

function _$ao() {
    _$ts();
    var _$sh = _$h1[_$hg];
    if (_$sh) _$h1[_$hg] = function(_$n7, _$ou) {
        if (_$n7 === _$dT) return _$eF(new _$sh(_$n7));
        else {
            if (_$ou) return new _$sh(_$n7, _$ou);
            return new _$sh(_$n7);
        }
    };
    var _$ng = _$h1[_$eS];
    if (_$ng) {
        var _$mT = _$ng[_$lI];
        if (_$mT) {
            _$af = _$mT[_$hq];
            _$sM = _$mT[_$ml];
            _$mT[_$hq] = function() {
                arguments[1] = _$ct(arguments[1]);
                return _$af[_$ba](this, arguments);
            };
        } else _$h1[_$eS] = function() {
            return _$eF(new _$ng());
        };
    }
}

模拟JS执行

  • 如果JS函数逻辑足够简单,可以考虑翻译成相应的Java代码
  • 如果JS运算逻辑太多,可以用Java的ScriptEngine来模拟执行(速度略慢)
    • https://docs.oracle.com/javase/7/docs/api/javax/script/ScriptEngine.html
  • Python可以用pyv8来模拟执行
    • http://saerdna.github.io/posts/technology/install_pyv8_in_mac-zh.html
    • https://github.com/emmetio/pyv8-binaries

附录

inner.js

  • 卷一 http://www.jianshu.com/p/3e53ffcde889
  • 卷二 http://www.jianshu.com/p/43b12a1e0719

outer.js

var _$h1 = window,
    _$sE = top,
    _$ve, _$uK, _$aI, _$x4, _$w6 = String.fromCharCode,
    _$tA = [],
    _$gp, _$wY, _$a7, _$u6, _$do, _$nO, _$rj, _$xI = _$h1.Error;
var _$vl, _$tv, _$wl;
var _$sK = 1;
_$cV();
_$h1[_$w6(101, 118, 97, 108)](_$kw(_$pI('mScBdId1eg4by76`TeugShBfzo.rNcva2COdfAI`wtMiRgUsYisepuH`Juhsxro_m`karh`l0gGtJSFr}ne`oremihar[o)elavpnyisclut`acslre `allcdlwvt` phnt`moOacienmrtnCop`JehTdmPo`tlsston`epvTls$lt#`_omatSeooaee`___suger@eeaaultv`.hprrtSgetcijeIntmeeb``SOBe`nr`ao``rcttt`p:`oxtcdconriSiene esyaokopppyirdAxAfSOFjrcb.un`emtTdec`iAtaecaeuatl`vd`beg$M`tt`bos`uo`tcilg`fnorCsatCedo`rphl``opli``tsneltNfNizeU liBhScFiutoe`a5`Za_lgrCp0aneafXn7tjoLeba9(P{Gn8tQvFc3dK]V`1xAzi5WFtqEcDlt___`rgmrvtIlec`l_sc_a`sayretcIneo`euwe3ixtysgmbd6aV`_owtCc`latce'), _$pI('o5bjp96vgEzLSWZjcBI1IjWwE7Vw9AV3zkUAnm4Ps31OLowBkmnllnbhqsfiejmickchmhvubllikllkodbhifdmlbnekjfl')));
_$uh();
var _$xP = _$u5;
var _$xF = 'T';
var _$xL = 'D';;;;;;

function _$iG(_$dq) {
    var _$dL = [],
        _$kD, _$sD, _$g6, _$mh = '?' [_$kv](0);
    for (_$kD = 0; _$kD < _$dq[_$hj];) {
        _$sD = _$dq[_$kD];
        if (_$sD < 0x80) _$g6 = _$sD;
        else if (_$sD < 0xc0) _$g6 = _$mh;
        else if (_$sD < 0xe0) {
            _$g6 = ((_$sD & 0x3F) << 6) | (_$dq[_$kD + 1] & 0x3F);
            _$kD++;
        } else if (_$sD < 0xf0) {
            _$g6 = ((_$sD & 0x0F) << 12) | ((_$dq[_$kD + 1] & 0x3F) << 6) | (_$dq[_$kD + 2] & 0x3F);
            _$kD += 2;
        } else if (_$sD < 0xf8) {
            _$g6 = _$mh;
            _$kD += 3;
        } else if (_$sD < 0xfc) {
            _$g6 = _$mh;
            _$kD += 4;
        } else if (_$sD < 0xfe) {
            _$g6 = _$mh;
            _$kD += 5;
        } else _$g6 = _$mh;
        _$kD++;
        _$dL.push(_$g6);
    }
    return _$sv(_$dL);
}
_$nv();
var _$jr;

function _$tf(_$dq) {
    for (var _$dL, _$kD, _$sD = _$dq[_$hj] - 1; _$sD > 0; _$sD--) {
        _$dL = Math[_$h9](_$ox() * _$sD);
        _$kD = _$dq[_$sD];
        _$dq[_$sD] = _$dq[_$dL];
        _$dq[_$dL] = _$kD;
    }
    return _$dq;
}

function _$oO(_$dq, _$dL, _$kD, _$sD) {
    var _$g6 = Math.floor((_$dL + _$kD) / 2);
    if (_$sD > 0) {
        _$sD--;
        if (_$g6 - _$dL >= 3) _$oO(_$dq, _$dL, _$g6, _$sD);
        if (_$kD - _$g6 >= 3) _$oO(_$dq, _$g6, _$kD, _$sD);
    }
    for (var _$mh = _$dL; _$mh < _$g6; _$mh += 2) {
        var _$nh = _$dq[_$mh];
        var _$kC = _$kD - 1 - (_$mh - _$dL);
        _$dq[_$mh] = _$dq[_$kC];
        _$dq[_$kC] = _$nh;
    }
}

function _$jy(_$dq) {
    var _$dL = [],
        _$kD;
    _$dq = _$vn(_$dq);
    for (_$kD = 0; _$kD < _$dq[_$hj]; _$kD++) _$dL.push(_$dq[_$kv](_$kD));
    return _$dL;
}

function _$hI() {
    return _$vm('89WAWfqylo03krrflqAAopqIHfLshfrzloGAlrqtlkEAtfrBlk3Atpq9kfQ38SqacG3AxpGekPqAFAyykGVi1pqEDqrwxrrWlkwpUrrHkfGW1GyAkGZ5oqgKkOAAoOg3DlWiAGgccPLihGg4llzx1mEXk9WiYYJFk2NxqaOVkjat.Sheoigi4mHQUFpsgO_SDhEiyq4skzTx4SOhkBg5da_vkjZV42h61IrsdG49H.W5Tq4Nk.7iLl6hl40iZYCAxL75uq4GkzZ39k_MkLE5gu4bVgG5uPMfVy95ns4zUwfw_s_QoJmUgO4qHNq5dk4rYyQ54mH7HzV5al8WVhAt5s4.V_Ss2s_Kryxs5Tt0lXl5dmDIVywszThdH.JsOu47V4JsbYI71MesgmjwHBS17VbVmHab2qjvcLL.LfiFxNwxzYCDH7952puMmJ7sXAOVlZWb22kiljm10fPODWwsNV8QV_ps0mokkEEsal8pDhwsjAPYcxRxzTiCczAwilSXcVamsSTlV6z1Rr2PVvRsAAz9skq13qmTVD31KmJQVOlRIYril9eAVp2LcVGwxmxdcuLhWp2fsowKQmxM1Dr11VRIVKQxkTrRlSJQMa2hcpeKQ9fODYyDIf2CYfGmKfx1Vr9xYfTQlf3RmGTtqY7RoA25Vr0R3p2jDUgxRpxGx6SAqVaAxCpQhA25pPRWmqlTYbExDmJOrKE1Rq2zosypo0a6rAAwqp0rUDqm32aVVceEmGY4DsREx03FVCAspS2hUmZjqYaKt9xAH1NlVspDcnNHlnGv1TrixaqxlazUrYYWxYWhxnamkSVhlPTDVA0I1mq1mA2Rr1QxqalRrQL1nABdrwwQ_fieoIqvymuaUWWxXptCYBRW4rhgUJNQdmkJl.0xzqvGsHzDZlMzc_ZY.PInst0hymkB1h7Y5Ao9xZ0heTonqIQ1_aUlkRrQ6mu3qILvPmoixdgwe2upVWNQ2mkw1irQ22uKVJZsnaDYlzaj5YoFxZSQ_Go2m8EhPlPBl59wyfC0V_NQ22HSp.Aj.mn7H5WYGlnKx4NWbTuOl_QYXS62siYAvYoGsx2WdYo2tLRAflF0l5msfmiSmQLmOTiSpjJAnSUwV7A1.Vutl.avjfCgsWwp6GKucZzDurKztNmD01Imx_qv0aBDpzrpPrH3V_psfftPlgZvGaLzYPLGYGSfh1AtYrEzlvQDHYlNmcV1h2mHDbZtJANbm1Vz1pYXmcVc8TQGYOat8nrMq9NKtSp_AV9Y3qxDcvyhoVeRYvwKrlzAl9QtFfxZAKAgsmpkhpJH8pxnlGGzInrGrv9Wk2mRr9gtpcT2qGZzkAxErb3VFa3YqGmrp2z8cbGiRSAK1Cq8J108qGRhDfEcAKLWiTl8lOqFIP0vkrfrJAaIAsTUW2QjmKWYJaS0DGwVD10mmqGzkYpylPqtMm3wYOgWYc0ImqLcsc0SklZGDfVUD9GVA97Bmqfh197.cGEDK2A8VAyhmP0okl0tcAxAlOLcUl7rhA0VEA3eklat0ShVmwmrzpsCrzEt016fkiqYXmMUAMSh00X5KeRHjn6mq.A1Z0D6rByV7loGkBVtT2MY15L1dGFzsZmpSr4yh3zr0r1orLaVnqM3A3mVPGh0VRpHSAuCYXpKOYMVhRGE5mMRmw0WeaFAh8GGg1FQs5914fK8mxG1vTsJYxRr2AjgmxyV_VdLlLqcdfKtq.lW9m8eqXTH2l5VhMwpX2DIrLGi5aFJYE3G_r.ThI7F52DjY.eK.qt5AFyH_mFSkxYMna_arjE1PYoIqLJha16QczrYNatcqjGtjqF6mE0FOPCqYtNV.P6qiWWtLVoKlzwH0m8TYj0D.a_Vq7Sr0ptUhopiwpJfcnasw9N0sO7kY2racnLsKAQZlu0s3pY_D0YiWnSvYTGos2rTlTTqYAzIY0xAW2rycuZHiqTDhDrq3AzaAo3srGWEqTRUqSYqY0TqwpYpkpZYQYYtmr37saQsqSWk1AWrEYays2wR1GyFFf7slaZh82qIk0AosqQDs2aMtp7wrCqYcSedsGlkDAWxkUYKDqW5rCTYMq0SYa0MIG7msb9MHpQqrSGhkfJzc6ahMYVzAcyUtVLGoCyKw2QvcTlopfVPDuA7c2rs1997KO9cl07MpAQohqWYoVgoKP7hqlLUDSyqiYqNkYL7YmVmEplkrppQqa3omqeDqTAYqGizD_9k0GXdr_wqBVjX1BVMZ2MkmMzq.2kDo_fY60.kEQSY7T1fcMfUTrB9hHyi7AiBD5zU5V4zVt0sz1n0mM7M2aXEVEfUbmUvVWaYdGHnmJLonlcWcgyASrKhcdE7faHi1NasSmMOmwSi9fUIYexqgfBNl5yqeY8VceeY_A8ckRWhznDLYI7hXqHuc_GJ.1uyr_af5sbLVxGMOPDpYhWsPm8fVtaJLVkdmHgMd0chYM7s4mcZ1Xaoem1pYBwULpUUD4zALG6mc_yKSpKeYZxYTpUllgpYGA8PEMSUCYK.c_NiSPoomQrUNnuFc_2t2rXNsz7JXp1tY3LhvG8AmJGP3pqLYuLAQ2wQYvGEhqpJmvxVVGAjkbfsHafAqDTKtqrGlD9BpPeymOpxHnZjmnZU3l2khuaQKqqfrDTKtVTf1UqiQY2e1UEBUcxqcql3kAfJYvlipVJdA6wsKTpqhCJK8fRMrl3E1AptoDyxK2YRVSekQVTEmawYDmYI1YQU1TRjKsTk8pGdYbQqo2VGVaWqkmYXAn9Bc0T611ViRTAbroYJ390PYU2Yq0WmcDqPIAgxVaGiITW0lq33lYYOYoEPYGGxkPyYhY9VYGqiDmJimPEBEAqhlcVEqTplE9YYKmVsDrE31YWLrrzYx2pRsspRl228hTgKx29GkPQAhS3AEBgKuacG1Q73LPh0YI3Aj9iTKMxJBrupKFYYBmbbEX0BdrOWoHaP6YHLm.exu2vjrWTRgnhZsQ33XrOYrtVW7PtlK8eReGk.mdSxCnh7ELNx0chpkzNR5G1FmX2sPqunkWq3_2UnV5a32T8wV5VPOm1mkWwknP5JAerx2qOeY3Ss.mK9rxJKypPtkjJR2Y1UkxG3zctUkHgENG_fcx3WZTKmKFQKfYHCYNNVGAu5ltWWZYiLDhaKgqnb');
}

function _$a3(_$dq, _$dL) {
    return _$dq[_$jL](0, _$dL[_$hj]) === _$dL;
}

function _$rZ(_$dq, _$dL) {
    var _$kD = _$dq[_$dL] & 0xf0;
    if ((_$kD & 0x80) === 0) return 1;
    if ((_$kD & 0xc0) === 0x80) return 2;
    if ((_$kD & 0xe0) === 0xc0) return 3;
    if ((_$kD & 0xf0) === 0xe0) return 4;;
}

function _$iP(_$dq, _$dL) {
    if (_$h1._$xr) return;
    if (_$dL !== _$rj && !_$dL) return;
    console[_$mb](_$dq);
}

function _$uh() {
    _$ve = _$io;
    _$ve = _$ve[_$lI]('');
    _$uK = _$h1[_$lB];
    _$aI = _$sE[_$l7];
    _$ox = _$h1[_$cp][_$jw];
    _$do = _$h1[_$eA];
    _$nO = _$h1[_$b3];
    _$x4 = _$h1[_$mk];
    _$a7 = _$h1[_$fA];
    if (_$a7) try {
        _$a7[_$iU] = _$iU;
        _$a7[_$dz](_$iU);
        _$a7[_$lV] = _$fA;
    } catch (_$dq) {
        _$a7 = _$rj;
    }
    if (!_$vl && !_$tv) {
        _$tv = 0;
        _$vl = 0;
        _$wl = 0;
    }
    _$h1[_$n9] = _$h1[_$n9] || (function() {
        var _$dL = {};
        _$dL[_$mb] = function() {};
        return _$dL;
    })();
    if (!_$x4) {
        _$x4 = new Object();
        _$h1[_$mk] = _$x4;
    }
    _$u6 = _$x0(_$kV);
}

function _$hy(_$dq, _$dL) {
    var _$kD = _$dq[_$dL];
    if ((_$kD & 0x80) === 0) return _$kD;
    if ((_$kD & 0xc0) === 0x80) return ((_$kD & 0x3f) << 8) | _$dq[_$dL + 1];
    if ((_$kD & 0xe0) === 0xc0) return ((_$kD & 0x1f) << 16) | (_$dq[_$dL + 1] << 8) | _$dq[_$dL + 2];
    if ((_$kD & 0xf0) === 0xe0) return ((_$kD & 0xf) << 24) | (_$dq[_$dL + 1] << 16) | (_$dq[_$dL + 2] << 8) | _$dq[_$dL + 3];;
}

function _$uI(_$dq, _$dL) {
    for (var _$kD = 0; _$kD < _$dL[_$hj]; _$kD++) _$dq.push(_$dL[_$kD]);
}

function _$eW(_$kD) {
    var _$sD = _$pk();
    _$bi();
    _$kD = _$x0(_$kD);
    var _$g6 = 0;
    _$sD = _$pk();
    var _$mh = parseInt(_$vm('Wegm_A7'));
    var _$nh = _$ez,
        _$kC = 'u',
        _$nS = '?',
        _$lD = 'E',
        _$hq = "^";
    var _$hs = _$hI();;

    function _$dq(_$f7, _$o2) {
        var _$rU, _$eq;
        for (var _$lT = 0; _$lT < _$f7; _$lT++) {
            _$rU = _$vi();
            _$eq = _$rU[1];
            switch (_$rU[0]) {
                case 0:
                    _$o2.push(_$fx[_$eq]);
                    break;
                case 1:
                    _$dL(_$eq, _$o2);
                    break;
                case 2:
                    _$dq(_$eq, _$o2);
                    break;
                case 3:
                    _$dq(_$eq, _$o2);
                    break;
                case 4:
                    ;
                    _$o2.push(_$hs[_$eq]);
                    break;
                case 5:
                    _$o2.push(_$f0);
                    _$o2.push(_$qk(_$xW(_$rT(_$fx[_$eq]))));
                    _$o2.push(_$kC + _$hq);
                    break;
                case 6:
                    if (_$eq === 0) {
                        _$o2.push(_$kC);
                        _$o2.push(_$jP);
                        _$o2.push(_$kC);
                    } else if (_$eq === 1) {
                        _$o2.push(_$kC);
                        _$o2.push(_$gy);
                        _$o2.push(_$kC);
                    } else if (_$eq === 2) {
                        var _$kX = _$h1[_$cp][_$h9]((_$pk() - _$cH) / 1000);
                        _$sO = _$sO + _$h1[_$cp][_$h9](_$h1[_$cp][_$mb](_$kX / 5.88 + 1));
                        _$o2.push(_$kC);
                        _$o2.push(_$qk(_$sO[_$vo]()));
                        _$o2.push(_$kC);
                    } else _$o2.push(_$nh);
                    break;
                case 7:
                    ;
                    _$o2.push(_$hs[_$eq + _$mh]);
                    break;
                default:
                    ;
            }
        }
    }
    _$sD = _$pk();
    var _$f0 = _$qk(_$tY(function() {
        return _$xZ;
    }) + '("');
    var _$je = _$h3();;

    function _$iF() {
        var _$f7 = _$hy(_$kD, _$g6);
        _$g6 += _$rZ(_$kD, _$g6);
        return _$f7;
    }
    var _$fx = _$pQ();
    _$sD = _$pk();
    _$je = _$h3();;

    function _$hb() {
        var _$f7 = _$iF();
        return _$hP(_$f7);
    }
    var _$nU = _$iF();
    var _$jP = _$hb();
    var _$gy = _$hs[_$mg](_$mh * 2, _$nU * 2);
    _$hs = _$q9(_$hs, 2);;

    function _$hP(_$f7) {
        var _$o2 = _$g6;
        _$g6 += _$f7;
        if (_$f7 < 10240) return String[_$kW][_$nI](null, _$kD[_$jL](_$o2, _$g6));
        else return _$sv(_$kD, _$o2, _$g6);
    }
    var _$jE = _$qk(_$c6);
    for (var _$ce = 0; _$ce < _$hs[_$hj]; _$ce++) _$hs[_$ce] = _$jE + _$hs[_$ce];
    var _$aH = parseInt(_$pI('972'));
    if (_$aH >= 0 && _$h1[_$rT(_$hs[_$aH])]) _$tf(_$hs);;

    function _$vi() {
        var _$f7 = _$h3();
        if (_$f7 < 8) return [_$f7, _$iF()];
        else return [_$f7 & 0x7, ((_$f7 >>> 3) & 0x1F) - 1];
    };
    _$sD = _$pk();
    _$je = _$h3();;

    function _$dL(_$f7, _$o2) {
        var _$rU = _$iF(),
            _$eq, _$lT, _$kX = [],
            _$dD = [],
            _$sP;
        for (_$eq = 0; _$eq < _$f7; _$eq++) {
            _$lT = _$iF();
            _$sP = [];
            _$dq(_$lT, _$sP);
            _$kX.push(_$sP);
        }
        for (_$eq = 0; _$eq < _$rU; _$eq++) {
            _$lT = _$iF();
            _$sP = [];
            _$dq(_$lT, _$sP);
            _$dD.push(_$sP);
        };
        _$tf(_$kX);
        _$eq = 0;
        var _$i4 = 0;
        var _$i2 = _$ox() % (_$rU - _$eq + 1) % (_$f7 - _$i4);
        for (var _$bL = 0; _$bL < _$rU; _$bL++) {
            if (_$i2 < 0 && _$i4 < _$f7) {
                _$i2 = _$ox() % (_$rU - _$eq) % (_$f7 - _$i4);
                _$o2.push(_$nS);
                _$uI(_$o2, _$kX[_$i4]);
                _$i4++;
            }
            _$uI(_$o2, _$dD[_$bL]);
            _$i2--;
            _$eq++;
        }
        while (_$i4 < _$f7) {
            _$uI(_$o2, _$kX[_$i4]);
            _$i4++;
        }
    }
    var _$mz = [];
    _$dq(_$iF(), _$mz);
    _$sD = _$pk();;

    function _$h3() {
        return _$kD[_$g6++];
    }
    _$tx(_$rT(_$mz.join('')));;

    function _$pQ() {
        var _$f7, _$o2, _$rU, _$eq;
        _$o2 = _$iF();
        _$f7 = _$iF();
        _$rU = _$hP(_$f7);
        var _$lT = _$rU[_$lI](_$lD);
        _$o2 = _$iF();
        for (var _$kX = 0; _$kX < _$o2; _$kX++) {
            _$eq = _$iF();
            _$lT.push(_$hP(_$eq));
        }
        return _$lT;
    }
    return;;;;
}

function _$rT(_$dq) {
    var _$dL = _$dq[_$hj],
        _$kD = new Array(_$dL),
        _$sD, _$g6;
    for (_$sD = 0; _$sD < _$dL; _$sD++) {
        _$g6 = _$dq[_$kv](_$sD);
        _$kD[_$sD] = _$gp[_$g6];
    }
    return _$kD.join('');
}

function _$cZ() {
    var _$dq = 'ef ghi  jklmnoL U3F9\\_XM?Ep  q rs1PW\');A0@.7I<JDC=:RV85-O6]t uv[ QG#`^BY,/K$%&S(2!"4+TH>*ZNacbd';
    for (var _$dL = 0; _$dL < 32; _$dL++) _$tA[_$dL] = 0;
    for (_$dL = 0; _$dL < _$dq.length; _$dL++) _$tA[_$dL + 32] = _$dq.charCodeAt(_$dL) - 33;
}

function _$am(_$dq) {
    if (!_$a7) return;
    if (typeof _$dq === _$bw) _$dq = String(_$dq);
    _$dq = _$lL + _$xW(_$dq);
    return _$a7[_$dq];
}

function _$nl(_$dq, _$dL) {
    if (!_$a7) return;
    if (typeof _$dq === _$bw) _$dq = String(_$dq);
    var _$kD = _$am(_$dq);
    if (_$kD) _$dL = parseInt(_$kD) + _$dL;
    _$dq = _$lL + _$xW(_$dq);
    _$a7[_$dq] = _$dL;
}

function _$pk() {
    return new Date()[_$mw]();
}

function _$kw(_$dq, _$dL) {
    _$dq = _$dq.split('`');
    _$dL = _$q9(_$dL, 2);
    var _$kD = _$w6(95, 36);
    for (var _$sD = 0; _$sD < _$dL.length; _$sD++) _$dL[_$sD] = _$kD + _$dL[_$sD];;
    var _$g6 = [_$w6(118, 97, 114, 32)];
    for (var _$sD = 0; _$sD < _$dq.length; _$sD++) {
        if (_$sD > 0) _$g6.push(',');
        _$g6.push(_$dL[_$sD] + '="' + _$dq[_$sD] + '"');
    }
    _$g6.push(';');
    return _$g6.join('');
}

function _$xW(_$dq, _$dL) {
    if (typeof _$dq === _$iE) _$dq = _$jy(_$dq);
    if (!_$dL) _$dL = _$ve;
    var _$kD = '',
        _$sD;
    for (_$sD = 0; _$sD < _$dq[_$hj]; _$sD = _$sD + 3) {
        _$kD += _$dL[_$dq[_$sD] >> 2];
        _$kD += _$dL[((_$dq[_$sD] & 3) << 4) | (_$dq[_$sD + 1] >> 4)];
        if (_$dq[_$sD + 1] !== _$rj) _$kD += _$dL[((_$dq[_$sD + 1] & 15) << 2) | (_$dq[_$sD + 2] >> 6)];
        else {}
        if (_$dq[_$sD + 2] !== _$rj) _$kD += _$dL[_$dq[_$sD + 2] & 63];
    }
    return _$kD;
}

function _$dd(_$dq) {
    var _$dL = _$xI && new _$xI();
    if (_$dL) {
        var _$kD = _$dL[_$qZ];
        if (!_$kD) return;
        var _$sD = _$kD[_$vo]();
        var _$g6 = _$sD[_$lI]('\n');
        _$sD = _$g6[_$fS]();
        if (_$sD === '' && _$g6[_$hj] > 0) _$sD = _$g6[_$fS]();
        if (_$sD[_$iW](_$sj) !== -1 || _$a3(_$sD, _$hB) || _$sD === _$n1) {
            _$nl(_$dq, 1);
            return true;
        }
    }
}

function _$vn(_$dq) {
    return unescape(encodeURIComponent(_$dq));
}

function _$tx(_$dq) {
    if (_$dq === undefined || _$dq === "") return;
    var _$dL = _$h1[_$k1][_$ls],
        _$kD;
    if (!_$jr) _$jr = _$dL.push;
    if (_$h1[_$o4]) _$kD = _$h1[_$o4](_$dq);
    else {
       // var _$sD = _$h1[_$bn];
       // _$kD = _$sD[_$hm](_$h1, _$dq);
    }
    if (_$jr !== _$dL.push) _$dL.push = _$jr;
    return _$kD;
}

function _$nv() {
    _$v1 = 0;
    _$x4._$wP = _$pk();
    _$cH = _$x4._$wP;
    _$c1 = _$vm('si3iLGcItE0oNnXthJ03Npb6rLZ.GA6chzZjN66hIEr42A.Dq.qYLsjqHG');
    _$c1 = _$c1[_$lI]('`');
    _$qv = _$pI('14');
    _$sO = _$vm('Heliyq7');
    _$sO = parseInt(_$sO);
    _$dN(4, 0);
    _$dN(2, _$dd(7));
    _$a6 = _$pI('2');
    var _$dq = _$x4[_$lO];
    if (_$dq) {
        _$x4[_$lO] = false;
        _$eW(_$dq);
    }
    _$x4._$w8 = _$pk();
    if (_$x4._$w8 - _$x4._$wP > 12000) {
        _$dN(1, 1);
        _$nl(13, 1);
    } else _$dN(1, 0);
    _$dN(8, 0);
    _$dN(16, 0);
}

function _$xZ(_$dq) {
    var _$dL = _$x0(_$dq);
    return _$iG(_$dL);
}

function _$vm(_$dq) {
    return _$iG(_$xR(_$dq), _$dN(2, _$dd(9)));
}

function _$bi() {
    _$bZ = _$h1[_$bn][_$vo]()[_$dP](/[\r\n\s]/g, "") !== _$k3;
}

function _$qk(_$dq) {
    var _$dL = _$dq[_$hj],
        _$kD = new Array(_$dL),
        _$sD, _$g6;
    for (_$sD = 0; _$sD < _$dL; _$sD++) {
        _$g6 = _$dq[_$kv](_$sD);
        if (_$g6 >= 32 && _$g6 < 127) _$kD[_$sD] = _$wY[_$g6 - 32];
        else _$kD[_$sD] = _$dq[_$lj](_$sD);
    }
    return _$kD.join('');
}

function _$x0(_$dq) {
    var _$dL = _$dq[_$hj],
        _$kD = new Array(Math[_$h9](_$dL * 3 / 4));
    var _$sD, _$g6, _$mh, _$nh;
    var _$kC = 0,
        _$nS = 0,
        _$lD = _$dL - 3;
    for (_$kC = 0; _$kC < _$lD; _$kC = _$kC + 4) {
        _$sD = _$tA[_$dq[_$kv](_$kC)];
        _$g6 = _$tA[_$dq[_$kv](_$kC + 1)];
        _$mh = _$tA[_$dq[_$kv](_$kC + 2)];
        _$nh = _$tA[_$dq[_$kv](_$kC + 3)];
        _$kD[_$nS++] = (_$sD << 2) | (_$g6 >> 4);
        _$kD[_$nS++] = ((_$g6 & 15) << 4) | (_$mh >> 2);
        _$kD[_$nS++] = ((_$mh & 3) << 6) | _$nh;
    }
    if (_$kC < _$dL) {
        _$sD = _$tA[_$dq[_$kv](_$kC)];
        _$g6 = _$tA[_$dq[_$kv](_$kC + 1)];
        _$kD[_$nS++] = (_$sD << 2) | (_$g6 >> 4);
        if (_$kC + 2 < _$dL) {
            _$mh = _$tA[_$dq[_$kv](_$kC + 2)];
            _$kD[_$nS++] = ((_$g6 & 15) << 4) | (_$mh >> 2);
        }
    }
    return _$kD;
}

function _$wn(_$dq, _$dL) {
    if (!_$dq) {
        if (_$a7 && _$a7.$d === '1') debugger;
        if (_$dL) throw _$dL;
        else throw _$bc + _$dq;
    }
}

function _$xR(_$dq) {
    var _$dL = _$x0(_$dq),
        _$kD = (_$dL[0] << 8) + _$dL[1],
        _$sD = _$dL[_$hj],
        _$g6;
    for (_$g6 = 2; _$g6 < _$sD; _$g6 += 2) {
        _$dL[_$g6] ^= (_$kD >> 8) & 0xFF;
        if (_$g6 + 1 < _$sD) _$dL[_$g6 + 1] ^= _$kD & 0xFF;
        _$kD++;
    }
    return _$dL[_$jL](2);
}

function _$cV() {
    if (_$q9) /$/.test(_$cZ());
    var _$dq = new Array(32);
    for (var _$dL = 0; _$dL < 32; _$dL++) _$dq[_$dL] = _$dL;
    _$dq = _$sv(_$dq).split('');
    var _$kD = new Array(129);
    for (var _$dL = 127; _$dL < 256; _$dL++) _$kD[_$dL - 127] = _$dL;
    _$kD = _$sv(_$kD).split('');
    _$gp = 'I-M3DJ0rcufq%d\\1]B:b&yTo2<>HFn};X |9v`[(V#A~Z*5.Cm^OWR{SN/E6pU)K$ztL@8e,jax\'7!lQg4s+w"k?P=i_GYh'.split('');
    _$gp = _$dq.concat(_$gp.concat(_$kD));
    _$wY = 'AmuI`,4kG^Msg!OY&/8#qN[leC2?9y:wdJ1P$Z<|; %_c"XSxoUW6]HT@}LF.0R{Ei3(-f*p~zhvnQ=7\\+\'rb)Dtj5aVB>K'.split('');
}

function _$dN(_$dq, _$dL) {
    _$vl |= _$dq;
    if (_$dL) {
        if (_$dq == 2) _$nz(3);
        _$tv |= _$dq;
    }
}

function _$tY(_$dq) {
    return _$dq[_$vo]()[_$fE](/{\s*return\s*([A-Za-z0-9$_-]+);?\s*}/)[1];
}

function _$sv(_$dq, _$dL, _$kD) {
    _$dL = _$dL || 0;
    if (_$kD === _$rj) _$kD = _$dq.length;
    var _$sD = [],
        _$g6;
    while (true) {
        _$g6 = _$dL + 40960;
        if (_$g6 >= _$kD) {
            _$sD.push(_$w6.apply(null, _$dq.slice(_$dL, _$kD)));
            break;
        } else {
            _$sD.push(_$w6.apply(null, _$dq.slice(_$dL, _$g6)));
            _$dL = _$g6;
        }
    }
    return _$sD.join('');
}

function _$q9(_$dq, _$dL) {
    var _$kD = _$dq.length,
        _$sD = new Array(Math.ceil(_$dq.length / _$dL)),
        _$g6 = 0,
        _$mh = 0;
    for (; _$mh < _$kD; _$mh += _$dL, _$g6++) _$sD[_$g6] = _$dq.substr(_$mh, _$dL);
    return _$sD;
}

function _$pI(_$dq) {
    var _$dL = _$dq.split('');
    _$oO(_$dL, 0, _$dL.length, 2);
    return _$dL.join('');
}

字符串变量替换表

var _$u5 = "FSSBBIl1UgzbN7N",
    _$hj = "use strict",
    _$h9 = "document",
    _$kv = "localStorage",
    _$iE = "globalStorage",
    _$jL = "sessionStorage",
    _$ez = "indexedDB",
    _$mg = "mozIndexedDB",
    _$c6 = "webkitIndexedDB",
    _$cp = "msIndexedDB",
    _$mb = "name",
    _$vo = "top",
    _$kW = "vdFm",
    _$nI = "unload",
    _$lI = "prototype",
    _$bc = "get",
    _$qZ = "call",
    _$fS = "set",
    _$iW = "openDatabase",
    _$sj = "EkcP",
    _$hB = "windowData",
    _$n1 = "sessionData",
    _$lj = "globalData",
    _$mw = "localData",
    _$bw = "userData",
    _$lL = "dbData",
    _$k1 = "idbData",
    _$ls = "tests",
    _$o4 = "function",
    _$bn = "setItem",
    _$hm = "getItem",
    _$dP = "div",
    _$k3 = "userdata_el",
    _$lO = "addBehavior",
    _$io = "style",
    _$lB = "behavior",
    _$l7 = "url(#default#userdata)",
    _$jw = "setAttribute",
    _$eA = "save",
    _$b3 = "load",
    _$mk = "getAttribute",
    _$fA = "transaction",
    _$iU = "executeSql",
    _$dz = "CREATE TABLE IF NOT EXISTS ",
    _$lV = "EkcP_t",
    _$n9 = "id INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT, ",
    _$kV = "name TEXT NOT NULL, ",
    _$fE = "value TEXT NOT NULL, ",
    _$dq = "UNIQUE (name)",
    _$dL = "INSERT OR REPLACE INTO ",
    _$kD = "(name, value) ",
    _$sD = "VALUES(?, ?)",
    _$g6 = "SELECT value FROM ",
    _$mh = " WHERE name=?",
    _$nh = "rows",
    _$kC = "length",
    _$nS = "item",
    _$lD = "value",
    _$hq = "open",
    _$hs = "onerror",
    _$f0 = "onupgradeneeded",
    _$je = "target",
    _$fx = "result",
    _$nU = "createObjectStore",
    _$jP = "onsuccess",
    _$gy = "objectStoreNames",
    _$jE = "contains",
    _$ce = "readwrite",
    _$aH = "objectStore",
    _$mz = "put",
    _$iF = "close",
    _$h3 = "vlaue",
    _$hP = "escape",
    _$hb = "indexOf",
    _$pQ = "substr",
    _$vi = "string",
    _$f7 = "split",
    _$o2 = "charAt",
    _$rU = "substring",
    _$eq = "unescape",
    _$lT = "location",
    _$kX = "host",
    _$dD = "replace",
    _$sP = "getElementById",
    _$i4 = "createElement",
    _$i2 = "visibility",
    _$bL = "hidden",
    _$ea = "position",
    _$ep = "absolute",
    _$iM = "id",
    _$jV = "body",
    _$tH = "appendChild",
    _$bv = "slice",
    _$hK = "concat",
    _$h5 = "splice",
    _$gn = "floor",
    _$qm = "t__",
    _$hw = "B_",
    _$i0 = "fontList",
    _$cI = "$b_onBridgeReady",
    _$gG = "$b_callHandler",
    _$f9 = "$b_setup",
    _$eB = "$b_platform",
    _$kR = "android",
    _$b2 = "iframe",
    _$eQ = "display",
    _$xO = "none",
    _$iZ = "documentElement",
    _$k6 = "cb_",
    _$lH = "getTime",
    _$kq = "src",
    _$ky = "jbscheme://",
    _$cw = "stringify",
    _$nw = "jbscheme://queue_has_message",
    _$fs = "$b_fetchQueue",
    _$oG = "$b_onNativeResponse",
    _$tb = "navigator",
    _$qc = "platform",
    _$fP = "test",
    _$kB = "Uint8Array",
    _$ir = "subarray",
    _$jX = "lastIndexOf",
    _$eS = "XMLHttpRequest",
    _$ml = "send",
    _$dT = "Microsoft.XMLHTTP",
    _$o1 = "Array",
    _$mn = "charCodeAt",
    _$vx = "from",
    _$lM = "language",
    _$e1 = "browserLanguage",
    _$i7 = "zh-CN",
    _$mQ = "_tCbyRDtiXFzNibfz8bwLXK67X84O5PPj58BL8FVX1uL.4I9XE6LNLoLBNH2fFUb23dbfxd9B_obGFdbPxMvG.v2f4B9X4B9BRUN944bOjVf",
    _$jg = "alert",
    _$ba = "apply",
    _$rv = "GET",
    _$kg = "href",
    _$oe = "responseType",
    _$e7 = "arraybuffer",
    _$nA = "setRequestHeader",
    _$dU = "X-sOYOcALfiiw",
    _$g1 = "onreadystatechange",
    _$mM = "readyState",
    _$cs = "status",
    _$pa = "response",
    _$hG = "VBArray",
    _$a0 = "responseBody",
    _$hY = "toArray",
    _$ij = "MmEwMD",
    _$sH = "Math",
    _$hf = "ceil",
    _$jY = "JSON",
    _$hd = "0000",
    _$ec = "toString",
    _$hC = "number",
    _$kF = "null",
    _$i3 = "boolean",
    _$n2 = "object",
    _$oc = "[object Array]",
    _$os = "hasOwnProperty",
    _$ei = "%20",
    _$qA = "addEventListener",
    _$jB = "on",
    _$nJ = "attachEvent",
    _$dA = "random",
    _$tJ = "assert failed with condition: ",
    _$cm = "assert failed: ",
    _$oZ = " is not same as ",
    _$pp = "acceleration",
    _$cM = "accelerationIncludingGravity",
    _$ub = "alpha",
    _$wq = "beta",
    _$fX = "gamma",
    _$e4 = "battery",
    _$mj = "getBattery",
    _$b0 = "then",
    _$ho = "level",
    _$es = "charging",
    _$fL = "chargingTime",
    _$bk = "Infinity",
    _$dB = "$_YWTU",
    _$lc = "$_cDro",
    _$mf = "isNaN",
    _$jD = "keyCode",
    _$eo = "button",
    _$ku = "offsetX",
    _$df = "offsetY",
    _$fH = "touches",
    _$c9 = "screenX",
    _$da = "screenY",
    _$jN = "clientX",
    _$hR = "clientY",
    _$as = "userAgent",
    _$iz = "standalone",
    _$n0 = "$PreUCBrowserClassic,UCBrowserMessageCenter",
    _$kJ = "__firefox__,_firefox_ReaderMode",
    _$dj = "__mttCreateFrame,mttCumstomJS",
    _$j0 = "__crWeb,__gCrWeb",
    _$kp = "MicroMessenger",
    _$mc = "SeMobFillFormTool,SogouMse",
    _$hh = "Sogou",
    _$od = "ApplePaySession",
    _$lk = "Safari",
    _$qC = "PointerEvent",
    _$jj = "MSPointerEvent",
    _$br = "msCredentials",
    _$ja = "webkitPersistentStorage",
    _$f8 = "browser_parameters,item",
    _$nE = "FaveIconJavaInterface,jesion",
    _$eC = " OPR/",
    _$lW = "chrome",
    _$n5 = "runtime",
    _$fc = "webstore",
    _$kt = "onautocomplete",
    _$cS = "PerformanceObserver",
    _$in = "PerformanceObserverEntryList",
    _$gO = "Entity",
    _$kk = "AnalyserNode",
    _$px = "external",
    _$c2 = "AddSearchProvider",
    _$kG = "dumpAll",
    _$hT = "MozAppearance",
    _$kl = "$_ts",
    _$gx = "DeviceStorage",
    _$mB = "controllers",
    _$i8 = "UCWebExt,ucweb",
    _$pb = "qb_bridge,qbbookshelf",
    _$vL = "dolphin,dolphininfo,dolphinmeta",
    _$dW = "safari",
    _$e9 = "pushNotification",
    _$pK = "orientation",
    _$uG = "callPhantom,_phantom",
    _$lN = "$hook$,$$logger,$$lsp,$$lsrb",
    _$fg = "netsparker,__ns",
    _$dh = "hp_identifier",
    _$gs = "spi_hooked,mozAnimationStartTime,mozIndexedDB,mozRequestAnimationFrame",
    _$nq = "Gamepad",
    _$aq = "c[",
    _$eu = "a[b](",
    _$np = "WebXMLogMsg_UNIQUE_",
    _$cL = "stack",
    _$ly = "pop",
    _$de = "Object.InjectedScript.evaluate",
    _$oo = "@debugger",
    _$ic = "evaluate",
    _$uZ = "setInterval",
    _$qu = "eval",
    _$fh = "var a = new Date(); debugger; new Date() - a > 100;",
    _$jo = "$_ck",
    _$eE = "_Selenium_IDE_Recorder,_selenium,callSelenium",
    _$dX = "__driver_evaluate,__webdriver_evaluate,__selenium_evaluate,__fxdriver_evaluate,__driver_unwrapped,__webdriver_unwrapped,__selenium_unwrapped,__fxdriver_unwrapped,__webdriver_script_func,__webdriver_script_fn",
    _$g0 = "selenium",
    _$kA = "webdriver",
    _$qI = "driver",
    _$j6 = "match",
    _$fJ = "cache_",
    _$cn = "http",
    _$jd = "script",
    _$ll = "http://security.riversecurity.com/4QbVtADbnLVIc/jW39ezbWPr.js",
    _$cx = "$_fh0",
    _$i5 = "$_f0",
    _$pm = "$_f1",
    _$fo = "round",
    _$cv = "$_fr",
    _$kE = "$_fpn1",
    _$bo = "except",
    _$py = "innerHTML",
    _$jb = "bb82kj",
    _$fO = "fonts",
    _$m1 = "Count",
    _$kK = "removeChild",
    _$oL = "3jeALeSsa6",
    _$em = "<EMBED id=4rJFe6jNL52p height=1 type=application/x-shockwave-flash width=1 src=/4QbVtADbnLVIc/4rJFe6jNL52p.js>",
    _$bM = "4rJFe6jNL52p",
    _$g9 = "GetVariable",
    _$a4 = "undefined",
    _$ck = "/:user_fonts",
    _$kL = "clearInterval",
    _$il = "message",
    _$ar = "filename",
    _$pz = "lineno",
    _$lu = "appVersion",
    _$u2 = "languages",
    _$l4 = "plugins",
    _$uN = "mimeTypes",
    _$cY = "type",
    _$kf = "description",
    _$iA = "screen",
    _$ji = "getTimezoneOffset",
    _$f6 = "devicePixelRatio",
    _$iI = "safari,ontouchstart,sidebar,localStorage,clipboardData,sessionStorage,indexedDB,openDatabase,standalone,$PreUCBrowserClassic,UCBrowserMessageCenter,__firefox__,_firefox_ReaderMode,__mttCreateFrame,mttCustomJS,__crWeb,__gCrWeb,MicroMessenger,SogouMse,ucweb,qb_bridge,FaveIconJavaInterface,jesion,dophin,orientation",
    _$gL = "canvas",
    _$db = "getContext",
    _$kU = "width",
    _$hL = "height",
    _$cr = "2d",
    _$hg = "ActiveXObject",
    _$lP = "textBaseline",
    _$mW = "font",
    _$mx = "fillStyle",
    _$jI = "#f82",
    _$of = "fillRect",
    _$mF = "#17e",
    _$a2 = "fillText",
    _$aP = "rgba(240,110,53,0.4)",
    _$oE = "toDataURL",
    _$m0 = "connection",
    _$t9 = "mozConnection",
    _$hn = "webkitConnection",
    _$ig = "bluetooth",
    _$co = "cellular",
    _$bh = "ethernet",
    _$oC = "wifi",
    _$gC = "wimax",
    _$rK = "; expires=",
    _$om = "toGMTString",
    _$mP = "Stolen Via Net: Cookie key length is incorrect.",
    _$p8 = "cookie",
    _$kr = "; ",
    _$ef = "ShockwaveFlash.ShockwaveFlash",
    _$k8 = "AcroPDF.PDF",
    _$cN = "PDF.PdfCtrl",
    _$gQ = "QuickTime.QuickTime",
    _$nW = "rmocx.RealPlayer G2 Control",
    _$n6 = "rmocx.RealPlayer G2 Control.1",
    _$dk = "RealPlayer.RealPlayer(tm) ActiveX Control (32-bit)",
    _$fl = "RealVideo.RealVideo(tm) ActiveX Control (32-bit)",
    _$mZ = "RealPlayer",
    _$cA = "SWCtl.SWCtl",
    _$jx = "WMPlayer.OCX",
    _$iw = "AgControl.AgControl",
    _$ki = "Skype.Detection",
    _$ih = "getElementsByTagName",
    _$t6 = "<!--[if gt IE ",
    _$o7 = "]><i></i><![endif]-->",
    _$ql = "/*@cc_on!@*/false",
    _$dr = "_$",
    _$nV = "FSSBA",
    _$bs = "Z8XHj",
    _$aF = "protocol",
    _$qD = "https:",
    _$qt = "443",
    _$oa = "80",
    _$aw = "webgl",
    _$cf = "experimental-webgl",
    _$rG = "attribute vec2 attrVertex;varying vec2 varyinTexCoordinate;uniform vec2 uniformOffset;void main(){varyinTexCoordinate=attrVertex+uniformOffset;gl_Position=vec4(attrVertex,0,1);}",
    _$nH = "precision mediump float;varying vec2 varyinTexCoordinate;void main() {gl_FragColor=vec4(varyinTexCoordinate,0,1);}",
    _$eG = "createBuffer",
    _$c3 = "bindBuffer",
    _$h6 = "ARRAY_BUFFER",
    _$qe = "Float32Array",
    _$dv = "bufferData",
    _$hv = "STATIC_DRAW",
    _$qr = "itemSize",
    _$nL = "numItems",
    _$mX = "createProgram",
    _$bH = "createShader",
    _$oj = "VERTEX_SHADER",
    _$gu = "shaderSource",
    _$fa = "compileShader",
    _$iJ = "FRAGMENT_SHADER",
    _$bb = "attachShader",
    _$bg = "linkProgram",
    _$qf = "useProgram",
    _$qS = "vertexPosAttrib",
    _$nC = "getAttribLocation",
    _$kT = "attrVertex",
    _$pf = "offsetUniform",
    _$gm = "getUniformLocation",
    _$dm = "uniformOffset",
    _$gJ = "enableVertexAttribArray",
    _$dQ = "vertexPosArray",
    _$lE = "vertexAttribPointer",
    _$eZ = "FLOAT",
    _$qn = "uniform2f",
    _$fd = "drawArrays",
    _$pT = "TRIANGLE_STRIP",
    _$kj = "getShaderPrecisionFormat",
    _$gZ = "HIGH_FLOAT",
    _$q5 = "MEDIUM_FLOAT",
    _$rg = "LOW_FLOAT",
    _$c8 = "HIGH_INT",
    _$gh = "MEDIUM_INT",
    _$du = "LOW_INT",
    _$jA = "rangeMin",
    _$mV = "rangeMax",
    _$hz = "precision",
    _$l5 = "toUpperCase",
    _$kQ = "getParameter",
    _$fu = "getSupportedExtensions",
    _$pq = "getExtension",
    _$qo = "MediaStreamTrack",
    _$qL = "getSources",
    _$eL = "mediaDevices",
    _$eH = "enumerateDevices",
    _$d6 = "deviceId",
    _$iQ = "mousedown",
    _$qO = "mouseup",
    _$f1 = "mousemove",
    _$b9 = "keydown",
    _$rx = "touchstart",
    _$rr = "touchmove",
    _$mD = "touchend",
    _$jU = "click",
    _$rp = "input",
    _$gE = "scroll",
    _$lm = "driver-evaluate",
    _$jQ = "webdriver-evaluate",
    _$ph = "selenium-evaluate",
    _$j5 = "error",
    _$hM = "DeviceMotionEvent",
    _$oV = "devicemotion",
    _$e0 = "DeviceOrientationEvent",
    _$p4 = "deviceorientation",
    _$qg = "./",
    _$ld = "pathname",
    _$nn = "log",
    _$rH = "+=",
    _$bT = "submit",
    _$tE = "tagName",
    _$ru = "form",
    _$qB = "jquery",
    _$rc = "//",
    _$pt = "HTMLElement",
    _$m7 = "nodeType",
    _$eU = "nodeName",
    _$tl = "document-fragment",
    _$p5 = "application/x-shockwave-flash",
    _$dG = "enabledPlugin",
    _$jf = "toLowerCase",
    _$oN = "FSSBB",
    _$rY = "qrcklmDoExthWJiHAp1sVYKU3RFMQw8IGfPO92bvLNj.7zXBaSnu0TC6gy_4Ze5d",
    _$iR = "setTimeout",
    _$ri = "___ts___",
    _$pe = "removeItem",
    _$bU = "__#classType",
    _$eD = "console",
    _$eV = "wP3dxhyJgpbC6tVm_ewcCO",
    _$iH = "9DhefwqGPrzGxEp9hPaoag",
    _$sd = "content",
    _$pD = "parentElement",
    _$r5 = "abort",
    _$rW = "dispatchEvent",
    _$hV = "removeEventListener",
    _$aN = "getAllResponseHeaders",
    _$oh = "getResponseHeader",
    _$pA = "overrideMimeType",
    _$pd = "responseText",
    _$oP = "responseXML",
    _$pP = "statusText",
    _$gg = "NaN",
    _$rm = "trim",
    _$iT = "http://",
    _$jv = "https://",
    _$d0 = "port",
    _$sU = "http:",
    _$sg = "hostname",
    _$e6 = "search",
    _$qX = "&T=",
    _$dK = "/4QbVtADbnLVIc/jW39ezbWPr.js?",
    _$e3 = "; path=/",
    _$uc = "$_turi",
    _$dO = "$_ttarg",
    _$pH = "$_tk1",
    _$fn = "$_tk2";
分享给小伙伴们:
本文标签: MmEwMD验证码

相关文章

发表评论愿您的每句评论,都能给大家的生活添色彩,带来共鸣,带来思索,带来快乐。

CopyRight © 2015-2016 QingPingShan.com , All Rights Reserved.