Introduction#
This tutorial is only for learning and communication purposes. We hope the author will update the measures promptly after seeing it.
Please note that this theme is packaged by the author for one-on-one use, so it is possible to trace back to the original purchaser of the theme through the cracked version. Please use it with caution.
Respect the genuine version and combat piracy. Everyone has a responsibility.
Hope certain individuals will be ashamed of themselves.
Preview#
Since the server has deleted this theme, the theme images are provided by group members.
Structure#
From a rough browse, you can see that there are many external JS files. Due to performance or encryption issues, only a few JS files are encrypted. The characteristic is that they start with var vip='Bobs9'.
Processing#
After AST processing, the deobfuscated files can be obtained.
These JS files have many difficult-to-understand characteristics, such as infinite debugger code at the end of the JS files.
To be honest, it's not very useful. Many methods can solve it, and it's placed at the end, which may be a problem with the obfuscation tool.
Approach#
After scanning the deobfuscated code roughly, I found the place where the domain name is verified. The following is the code, where the processed content of the domain name has been replaced with aaaaa, and the regular expression has been replaced with bbbbbbbbbbb.
In simple terms, certain characters of the domain name are replaced with specific characters, and the specific characters are removed during verification.
[[0, 0, 0, 0, 0], ["aaaaaaaaaaaa;aaaaaaaaa;aaaaaa".replace(new RegExp("[bbbbbbbbbbb]", "g"), "").split(";"), false]
This is much simpler. Just bypass the logic and write the result into the source code.
Search for 0x0,0x0,0x0,0x0,0x0], in the original JS file and change the content after it to , [["your domain name","your domain name"],false], before the next array [function(,.
=[[0x0,0x0,0x0,0x0,0x0],[["your domain name","your domain name"],false]
Follow the above steps to operate on all obfuscated JS files.
Communication Group#
If you have any questions that need to be answered, please pay first. Please transfer to the following address.
Tron Network TTTTTTLuVcPQdCsYJuAa13Sc4527wYCZ4D
Questions include how to crack, why the above method doesn't work, can you provide the theme file, how to operate at xx place, can you provide the cracked version, etc.