攻防世界数据逆向 2023

https://adworld.xctf.org.cn/contest/list?rwNmOdr=1697354606875 

目录

请求数据参数加密

cookie加密

响应数据解密

代码

---

请求数据参数加密

我们可以根据请求的关键字qmze1yzvhyzcyyjr获取到对应的加密地方

可以看到使用了函数_0x1dc70进行了加密

cookie加密

该步骤需要每次清空cookie在刷新页面

响应数据解密

_0x354c5e 为解密方法

解密的数据

 

代码

攻防世界数据加密_解密_cookie加密三合一半扣.js 

(function(_0x8f34ce, _0x5baa14) {
    var _0x1b8713 = a0_0x271d
        , _0x170cce = _0x8f34ce();
    while (!![]) {
        try {
            var _0x1f2ba7 = -parseInt(_0x1b8713(0x251)) / 0x1 * (parseInt(_0x1b8713(0x154)) / 0x2) + parseInt(_0x1b8713(0x51a)) / 0x3 + parseInt(_0x1b8713(0x429)) / 0x4 + -parseInt(_0x1b8713(0x1eb)) / 0x5 + -parseInt(_0x1b8713(0x4ae)) / 0x6 + -parseInt(_0x1b8713(0x515)) / 0x7 + parseInt(_0x1b8713(0x312)) / 0x8;
            if (_0x1f2ba7 === _0x5baa14)
                break;
            else
                _0x170cce['push'](_0x170cce['shift']());
        } catch (_0x410a65) {
            _0x170cce['push'](_0x170cce['shift']());
        }
    }
}(a0_0x336b, 0xe7824))
function a0_0x271d(_0x292048, _0x2f714d) {
    var _0x4536c5 = a0_0x336b();
    return a0_0x271d = function(_0x23dda2, _0x46f270) {
        _0x23dda2 = _0x23dda2 - 0xa2;
        var _0x3e6be8 = _0x4536c5[_0x23dda2];
        return _0x3e6be8;
    }
        ,
        a0_0x271d(_0x292048, _0x2f714d);
}
function a0_0x336b() {
    var _0x41e5ff = ['MS\x20Outlook', '.td-tags-and-social-wrapper-box', 'atanh', 'console', 'getMilliseconds', '#social-tools', '(.{1,', 'a[href^=\x22http://www.trizer.pl/?utm_source\x22]', 'skipNull', 'debugger_proof', 'Wechat', 'Marlett', 'Arguments', 'Generator\x20is\x20already\x20executing.', 'WebKit', 'a[href^=\x22http://promo.vador.com/\x22]', 'nonceToken\x20parse\x20error', 'POST', 'offsetHeight', '#N-ad-article-rightRail-1', '#CoockiesPage', 'xhnjc3odeyndrhmj', 'password', 'DERTaggedObject', 'telstr', 'getPublicKey', 'zeroPadding', 'QHBrowser', 'tagConstructed', 'parseNumbers', 'a[href^=\x22http://www.installads.net/\x22]', 'str', 'uris', 'setPrivate', 'DERAbstractString', '#mod-social-share-2', '[href^=\x22https://r88.vn/\x22]', '.sponsorit', 'getValueHex', 'call', 'UCShellJava', 'getStorageUpdates', 'concat', 'setASN1Object', 'parseInteger', 'document', 'createDynamicsCompressor', 'rdmje1ymjkyzrknj', 'SeleniumIDE', 'Silk/', 'Firefox\x20Focus', 'append', 'addTo', 'setByDate', 'arrayFormatSeparator', 'file:', 'subTo', 'getExtension', 'DERUTF8String', 'send', 'engine', 'attachEvent', 'Lucida\x20Bright', 'SeaMonkey', 'delayFallback', 'Levenim\x20MT', 'ucweb', 'exports', '#ad_300X250', 'reduce', 'Century\x20Gothic', 'multiplyTo', 'ARNO\x20PRO', 'EMBEDDED_PDV', 'location', 'toRadix', 'a[href*=\x22//playdsb.com/kr\x22]', '\x20(constructed)', '2302608PbjBgf', '#inlineShare', '#pgeldiz', 'DERAbstractTime', 'EOC', '3796767YkUQAW', 'tag', 'platform', '#adcontainer_recherche', '#Ads_google_02', '360SE', 'textContent', '2000', 'divideAndRemainder', 'hostname', 'mimeTypes', 'RTCEncodedAudioFrame', 'chrome', 'revokeObjectURL', 'div.holidAds', 'a[href*=\x22.yabovip2027.com/\x22]', 'isCenter', '#taboola-below-article', '#Iklan-Melayang', '0123456789abcdefghijklmnopqrstuvwxyz', '[header:', 'search', 'extract', 'Mobile', 'Linux', 'mutationObserver', 'hTLV', 'a[href^=\x22http://www.eis.de/index.phtml?refid=\x22]', '#publiEspecial', 'parseStringBMP', '.werbung3', '[]=', 'getDate', 'xor', '6.5', 'convert', 'Failed\x20to\x20construct\x20\x27TextDecoder\x27:\x20the\x20\x27fatal\x27\x20option\x20is\x20unsupported.', 'abs', 'Invalid\x20attempt\x20to\x20iterate\x20non-iterable\x20instance.\x0aIn\x20order\x20to\x20be\x20iterable,\x20non-array\x20objects\x20must\x20have\x20a\x20[Symbol.iterator]()\x20method.', 'a[href^=\x22https://go.alvexo.com/\x22]', 'decrypt', 'Safari', 'removeEventListener', 'MetaSr', 'A[href*=\x22http://interactive.forthnet.gr/click?\x22]', 'rest', 'Netscape', 'Vrinda', 'a[href*=\x22//febrare.ru/\x22]', '.zergnet-recommend', 'superclass', 'index', '.youtube-social', 'write', 'Symbian', '-----END\x20RSA\x20PRIVATE\x20KEY-----', 'seq', '\x0a\x20\x20', 'div[class^=\x22app_gdpr\x22]', 'Adr', 'DERInteger', 'div[id^=\x22crt-\x22][data-criteo-id]', 'a[href^=\x22/magazin/\x22]', 'notifications', 'setByInteger', 'screen', 'getFreshValueHex', '_values', 'clone', 'BlackBerry', 'span', 'YAHOO.lang.extend\x20failed,\x20please\x20check\x20that\x20all\x20dependencies\x20are\x20included.', 'vendor', '[object\x20Blob]', 'cos', 'responseTextAccessorGet', 'hpwOS', 'malformed\x20oid\x20string:\x20', 'remainder', 'join', 'subtract', 'key', '1px', 'revert', '9.5', '#taotaole', 'CSSMozDocumentRule', 'pop', 'knee', 'a[href^=\x22//telegram.me/share/url?\x22]', 'hash', 'timeZone', 'parseTime', 'msSetImmediate', 'a[href*=\x22://chikidiki.ru\x22]', 'SimHei', 'log', 'WebOS', '[object\x20String]', 'availTop', 'a[href=\x22http://www.salidzini.lv/\x22][style=\x22display:\x20block;\x20width:\x2088px;\x20height:\x2031px;\x20overflow:\x20hidden;\x20position:\x20relative;\x22]', '.BlockNag__Card', 'select-multiple', 'Gill\x20Sans', 'stringify', 'Expected\x20the\x20arguments\x20to\x20be\x20of\x20type\x20`string`', 'timestamp', 'like\x20Mac\x20OS\x20X', 'dMultiply', 'clear', 'mpl', 'converter', 'hasPublicKeyProperty', 'ftp', 'getLowestSetBit', 'pick', 'empty', 'comma', 'Sogou', 'null', 'BatteryManager', 'BankGothic\x20Md\x20BT', 'qmze1yzvhyzcyyjr', 'slashes', 'assign', 'signum', 'mousemove', 'Pristina', 'maxTouchPoints', 'MediaSettingsRange', 'DERBitString', 'DingTalk', 'click', 'debug', 'ONE', 'exclude', 'toPrettyString', '#mgid_iframe', '[id^=\x22sklikReklama\x22]', 'toLowerCase', 'parseKey', 'GeneralString', 'Arial\x20Unicode\x20MS', 'trys', 'getTimezoneOffset', 'connect', 'round', '#AD_banner_bottom', '[href^=\x22https://zbet.vn/\x22]', '.img-kosana', '480', 'formatDate', '[title=\x22ALIENBOLA\x22\x20i]', 'a[href^=\x22http://advmanager.techfun.pl/redirect/\x22]', 'multiplyUpperTo', 'mmMwWLliI0O&1', 'clearBit', 'Meiryo\x20UI', 'Windows', 'a[href^=\x22http://adserv.ontek.com.tr/\x22]', 'prototype', 'getPrivateBaseKeyB64', 'timeout', '.bumq', 'iPhone', 'copyTo', 'ul.adsmodern', 'response', 'head', 'DERSequence', '.geminiLB1Ad', 'content', 'CSSPrimitiveValue', 'integerToByteHex', 'compareTo', 'sqrTo', 'absolute', 'matches', 'trim', '8.1', '3041300d060960864801650304020205000430', 'responseXML', 'toByteArray', '(min-monochrome:\x200)', 'isExplicit', 'obfuscator', 'square', 'hasPrivateKeyProperty', 'languages', 'Vivaldi', 'Unrecognized\x20time:\x20', 'return\x20this', 'zoom', 'Invalid\x20RSA\x20public\x20key', 'disconnect', 'shiftRight', '#reklamni-box', 'parseFragmentIdentifier', 'toUTCString', 'exception', 'toString', 'getPrivateKey', 'mulTo', 'baiduboxapp', 'Huawei', '[object\x20Intl]', 'ins.daum_ddn_area', 'ASN1Object', '\x20(encapsulates)', 'high', 'split', 'some', 'ENUMERATED', 'squareTo', 'default_key_size', 'Taobao', 'MSIE', 'return', 'Monotype\x20Corsiva', '2HFyoQv', 'ontransitioncancel', 'a[href^=\x22http://g1.v.fwmrm.net/ad/\x22]', 'Yandex', 'checkbox', 'A[href*=\x22adman.otenet.gr/click?\x22]', 'Chrome', 'HONOR', 'table', 'getTime', '(-webkit-min-device-pixel-ratio:\x202),\x20(min-device-pixel-ratio:\x202),\x20(min-resolution:\x20192dpi)', 'unicode-1-1-utf-8', '#backkapat', 'parseOID', 'indexedDB', 'IqiyiApp', 'getKey', '.wp_adblock_detect', 'setByBigInteger', 'rtt', 'lastIndexOf', 'webkitTemporaryStorage', 'Ubuntu', 'a[href*=\x22doktor-se.onelink.me\x22]', '.ylamainos', 'QihooBrowser', 'generateAsync', '/cutntllmtlhyjnim', 'div[class$=\x22-hide\x22][zoompage-fontsize][style=\x22display:\x20block;\x22]', '0123456789ABCDEF', 'gen', 'floor', 'tagClass', 'IEMobile', 'lang', 'Gecko/', 'port', '(((.+)+)+)+$', 'asn1Array', 'a[href^=\x22http://izlenzi.com/campaign/\x22]', 'querySelector', 'Futura\x20Md\x20BT', 'one_time_token', 'fromRadix', 'position', 'symbol', 'utc', 'a[href^=\x22https://l.profitshare.ro/\x22]', 'Konqueror', 'tagNumber', 'en2uwnjgxodjhogi', 'value\x20hex\x20must\x20be\x20even\x20length:\x20n=', 'setBit', 'Invalid\x20attempt\x20to\x20destructure\x20non-iterable\x20instance.\x0aIn\x20order\x20to\x20be\x20iterable,\x20non-array\x20objects\x20must\x20have\x20a\x20[Symbol.iterator]()\x20method.', 'navigator.permissions.query\x20is\x20not\x20a\x20function', 'removeChild', 'webkitFullscreenElement', 'getPEMStringFromHex', 'Nexus\x207', 'separator', 'DERGeneralizedTime', 'get', 'VideotexString', '#ShowCookie', 'AliApp(TB', 'crypto', 'Trident', '#advertentie', 'selenium-ide-indicator', 'DOMRectList', 'TRAJAN\x20PRO', 'text', 'Base64\x20encoding\x20incomplete:\x20at\x20least\x202\x20bits\x20missing', 'MSStream', 'unused\x20bits\x20shall\x20be\x20from\x200\x20to\x207:\x20u\x20=\x20', 'Edge', 'devicePixelRatio', '12.0', 'Copy\x20the\x20text\x20below\x20to\x20get\x20the\x20debug\x20data:\x0a\x0a```\x0auserAgent:\x20', 'gentime', 'HarmonyOS', 'Invalid\x20tag\x20value.', 'Minion\x20Pro', 'redirect', 'setValueHex', 'url', 'now', 'mod', 'SCRIPTINA', 'Unsupported\x20decode\x20mode', 'amp-embed[type=\x22zen\x22]', 'block', 'Letter\x20Gothic', 'version', 'charCodeAt', 'destination', 'Menlo', 'shiftLeft', 'isWebview', 'includes', 'checked', 'DERNumericString', 'decryptPrivateLong', 'disabled', 'important', '#cookieconsentdiv', 'canvas_id', 'Franklin\x20Gothic', 'common2345', 'protect', 'setValueOidString', 'atan', 'this.hV\x20is\x20null\x20or\x20undefined.', 'getHexStringValue', 'expires', 'onmozfullscreenchange', 'slashesCount', 'triangle', 'onload', 'Private_', 'DateTimeFormat', 'MS\x20Mincho', 'fromString', 'modPowInt', 'auth', '.ctpl-fullbanner', 'Invalid\x20RSA\x20private\x20key', 'a[href^=\x22http://click.hotlog.ru/\x22]', 'EOC\x20is\x20not\x20supposed\x20to\x20be\x20actual\x20content.', 'Google', 'RTCPeerConnectionIceEvent', 'stringifyUrl', 'positions', 'X11', 'ops', 'only\x20base\x2010\x20is\x20supported', '[href^=\x22https://aff.sendhub.pl/\x22]', 'string', 'HELV', 'Weibo', '1.2.840.113549.1.1.1', 'GET', '-apple-system-body', 'UTC', 'decode', 'A\x20key\x20was\x20already\x20set,\x20overriding\x20existing.', '.appguide-wrap[onclick*=\x22bcebos.com\x22]', 'negate', 'appVersion', 'system-ui', 'getString', '6509230ZHcIOq', 'label', 'Edg/', 'cpuClass', 'setPrivateKey', 'oid', 'modInt', 'done', 'buf', '__proto__', 'application/hwepass2001.installepass2001', 'addEventListener', 'ratio', '5.0', '#bannerfloat22', 'body', 'ontouchstart', 'Haettenschweiler', 'userAgent', 'millerRabin', '.boxstartwerbung', 'ftp:', 'MSCSSMatrix', 'Invalid\x20string.\x20Length\x20must\x20be\x20a\x20multiple\x20of\x204', 'replace', 'utf-8', '_f6e3e4150', 'nowrap', '#navbar_notice_50', 'arrayFormat', 'Invalid\x20attempt\x20to\x20spread\x20non-iterable\x20instance.\x0aIn\x20order\x20to\x20be\x20iterable,\x20non-array\x20objects\x20must\x20have\x20a\x20[Symbol.iterator]()\x20method.', 'key\x20of\x20param\x20shall\x20be\x20only\x20one.', 'bin', 'then', 'a[href^=\x22http://www.hw-area.com/?dp=\x22]', 'LN2', 'a[title^=\x22Like\x20us\x20on\x20Facebook\x22]', 'decodeLength', 'fullscreenElement', 'REAL', 'a[href^=\x22https://ya-distrib.ru/r/\x22]', 'webkitResolveLocalFileSystemURL', '.widget-feedburner-counter', 'Object', 'MiuiBrowser', 'oncomplete', '.bannergroup_werbung', 'random', '.sklik', 'denied', 'showModalDialog', 'Calibri', 'a[title=\x227naga\x20poker\x22\x20i]', 'UCWEB', 'href', 'BaiduHD', 'Futura\x20Bk\x20BT', 'Pad', 'SET', '.adstekst', 'pow', 'DERPrintableString', '.5px\x20dotted\x20transparent', 'max', 'length', 'value', 'connection', '4.0', 'http:', 'Requesting\x20byte\x20offset\x20', 'DERObjectIdentifier', '\x20is\x20not\x20a\x20constructor\x20or\x20null', 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/', 'a[href^=\x22https://ad.letmeads.com/\x22]', 'lShiftTo', 'TeletexString', '.adblocker-root', '.popup-social', 'webkitPersistentStorage', 'rec2020', 'mozFullScreenElement', 'about:blank', '#DO_CC_PANEL', 'contextmenu', '\x0atimeBetweenLoadAndGet:\x20', '00000000', 'browser', 'throw', 'MicroMessenger', 'UNMASKED_RENDERER_WEBGL', 'BIT\x20STRINGs\x20with\x20unused\x20bits\x20cannot\x20encapsulate.', '(prefers-reduced-motion:\x20', 'base64', 'devtools', '(inverted-colors:\x20', 'sortflag', 'https', '(color-gamut:\x20', 'no-preference', '#qoo-counter', 'amp-embed[type=\x22taboola\x22]', 'fontFamily', '1587407oHqReh', 'canvas', 'hidden', 'DERAbstractStructured', 'header', 'oprt', 'getPrivateBaseKey', 'deviceMemory', 'username', '__zGN8gK3T', 'setString', 'parseBitString', 'img[alt=\x22Hostingas\x20Serveriai.lt\x22]', 'top', 'getEncodedHex', 'a[href*=\x22.aflam.info\x22]', 'posContent', 'substring', 'none', 'browserType', 'QQBrowser', 'Batang', 'ASN1Util', 'setProperty', 'RENDERER', '#ad-p3', 'Message\x20too\x20long\x20for\x20RSA', 'responseText', 'jsonToASN1HEX', 'iOS', 'encryptPublicLong', '#piao_div_0[style*=\x22width:140px;\x22]', 'catch', 'map', '\x20on\x20a\x20stream\x20of\x20length\x20', 'Unsupported\x20encode\x20mode', '.alert-info[data-block-track*=\x22CookieNotice\x22]', '(max-monochrome:\x20', 'Lucida\x20Sans', 'error', 'bind', 'coc_coc_browser', 'a[href^=\x22//afftrk.altex.ro/Counter/Click\x22]', '.ads_rechts', 'fogq4n2exnzc0otg', 'hexDigits', 'Application_', 'parsePropertiesFrom', 'parseOctetString', 'ihmzq1nmrhy2m5mt', 'chunkSize', 'setAttribute', '#ads-google-middle_rectangle-group', 'EUROSTILE', 'dblclick', 'responseAccessorGet', 'SourceBufferType', 'class', '8.7', 'Blink', 'charAt', 'article.category-samarbete', 'oidHexToInt', 'date', 'parseStringISO', 'trimLeft', 'a[href^=\x22http://www.rssad.jp/\x22]', 'VERSION', 'query', 'break', '.as-oil', 'Serifa', 'array', 'invDigit', 'Set', '\x5c$1', 'A[href*=\x22ad.netmedia.hu\x22]', 'browserLanguage', 'divRemTo', 'propertyIsEnumerable', 'Agency\x20FB', 'matchMedia', 'DERTeletexString', 'DIV.agores300', 'freeze', 'listen', 'KHTML/', 'Counter', '#Kolom-Iklan-728', 'Unexpected\x20syntax\x20\x27', 'A[href*=\x22http://pay4results24.eu\x22]', 'running', 'a[href*=\x22weborama.fr/fcgi-bin/\x22]', 'mt2', '\x0a```', 'A[href^=\x22/framework/resources/forms/ads.aspx\x22]', 'getLengthHexFromValue', 'reset', 'message', 'toDataURL', 'NULL', '.cc5278_banner_ad', 'adblock2345', '.zonepub', '[class*=\x22_adLeaderboard\x22]', 'SNEBUY-APP', 'a[href^=\x22https://xltube.nl/click/\x22]', 'offsetParent', 'getMinutes', 'OID', '9.1', 'whiteSpace', 'dAddOffset', 'a[href*=macau-uta-popup]', 'div', 'stop', 'octstr', 'hexDump', 'openDatabase', '2345chrome', 'SEQUENCE', 'undefined\x20key:\x20', 'cosh', 'pos', 'createOscillator', '(prefers-color-scheme:\x20dark)', 'UTF8String', 'encode', 'startRendering', 'slice', '.etsy-tweet', 'Qiyu', 'safari', 'nextBytes', 'not', 'ascii', 'valueOf', 'navigator.deviceMemory\x20is\x20undefined', 'exec', 'NumericString', 'ignoreBOM', 'detect', 'cli_priv_key', '\x20byte)\x0a', 'modPow', 'tanh', 'and', 'expm1', 'Apple', 'clamp', 'encoding', '#cemp_doboz', 'MediaQueryList.matches\x20is\x20undefined', 'availWidth', 'localStorage', 'setByASN1ObjectArray', 'testBit', 'Presto', 'pathname', '13.0', 'com.douban.frodo', 'LBBROWSER', 'localDateToUTC', 'RIM', 'a[href^=\x22https://www.tipico.com/?affiliateId=\x22]', 'TABLE.advright', '.hs-sosyal', 'acos', 'yandex', '.kadr', 'detachEvent', 'cookie', 'ws:', 'drShiftTo', 'bool', '__crWeb', '\x0acomponents:\x20', 'VivoBrowser', 'parentNode', 'obj', 'parseUrl', 'Arora', '(forced-colors:\x20', 'a[href^=\x22https://blackfridaysales.ro/trk/shop/\x22]', 'setPublicKey', 'a[href^=\x22https://adserver.html.it/\x22]', 'ia5str', 'permission', 'defineProperty', 'attributes', 'stack', '{}.constructor(\x22return\x20this\x22)(\x20)', 'osVersion', '28543768eIIULG', 'Mobi', 'TextEncoder', 'botName', 'iframe', 'createElement', 'isASCII', '0001', 'exitFullscreen', 'suspended', '#divAgahi', 'Chrome\x20OS', 'img[alt=\x22Reklaminis\x20skydelis\x22]', 'GOTHAM', 'intValue', 'msSaveBlob', '#ad-after', 'state', 'application/mozilla-npqihooquicklogin', 'wss:', 'WEBGL_debug_renderer_info', 'display', 'DOM\x20blockers\x20debug:\x0a```', 'Expected\x20`encodedURI`\x20to\x20be\x20of\x20type\x20`string`,\x20got\x20`', 'getOwnPropertySymbols', '#SidebarIklan-wrapper', 'webdriver', 'forEach', 'tnmq3mzbjntaxn2q', 'RegExp\x20out\x20of\x20sync', '5.3', '#ea_intext_div', 'newFalseArray', 'EXTERNAL', 'Focus', 'parent', 'anti_replay', 'XMLHttpRequest', 'multiply', 'bigIntToMinTwosComplementsHex', 'application/asx', 'eventClickCount', 'substr', '3021300906052b2403020105000414', 'iPad', 'sessionStorage', 'fragmentIdentifier', 'addedNodes', 'PMingLiU', 'webkitOfflineAudioContext', 'withMillis', 'GraphicString', 'device', 'start', 'explicit', ',length:', 'stream', '__gCrWeb', 'getRandomValues', 'a[href=\x22http://www.salidzini.lv/\x22][style=\x22display:\x20block;\x20width:\x20120px;\x20height:\x2040px;\x20overflow:\x20hidden;\x20position:\x20relative;\x22]', 'colorDepth', 'monospace', 'sub', 'msPointerEnabled', 'offsetWidth', 'mulAdd', 'application/vnd.chromium.remoting-viewer', '.feedburnerFeedBlock', 'exp', 'BOOLEAN', 'getContext', 'BotdError', 'hexByte', 'SharedWorker', 'strict', 'width', 'Reflect', 'A[href*=\x22http://axiabanners.exodus.gr/\x22]', 'type', 'fromNumber', '3020300c06082a864886f70d020205000410', 'function', 'Arabic\x20Typesetting', 'add', 'div.logly-lift-adz', '#ad-zone-2', 'buffer', '.ModuleTemplateCookieIndicator', 'bigint', 'equals', 'KHTML', 'webkit', 'Chromium', 'newObject', 'Suning', '2345Explorer', 'getResponseHeader', 'Illegal\x20character\x20at\x20offset\x20', '0500', 'sort', 'isModified', 'toHexString', 'posStart', 'fromCharCode', 'tan', 'divide', 'release', 'Opera', 'A[href*=\x22daserver.ultraweb.hu\x22]', 'msMaxTouchPoints', ',v=', 'wordwrap', 'getFullYear', 'visibility', 'Mb2345Browser', '.werbung-skyscraper2', 'plugins', 'OCTET_STRING', 'cookietest=1;\x20SameSite=Strict;\x20expires=Thu,\x2001-Jan-1970\x2000:00:01\x20GMT', 'Quark', 'mmMwWLliI0fiflO&1', 'puffinDevice', 'iterator', 'AliApp(AP', '\x27)\x20is\x20invalid.', 'rwNmOdr', 'window.devicePixelRatio\x20is\x20undefined', '5.9', 'OBJECT_IDENTIFIER', 'asin', '#queTooltip', 'active', 'TouchEvent', 'MediaSource', 'application/gameplugin', 'skipEmptyString', 'WebKitMediaKeys', 'extractProtocol', '11.0', 'Class\x20extends\x20value\x20', '.ads300s', 'BIT_STRING', 'Clarendon', 'isEven', 'isNaN', 'NET\x20CLR', 'appendChild', '.quangcao', 'style', 'wxwork/', '[title=\x22Subscribe\x20to\x20our\x20blog\x22]', 'childList', 'audio_id', 'ZWAdobeF', '\x0afingerprintId:\x20', 'keys', 'fromInt', 'appName', 'Microsoft\x20Uighur', 'navigator.connection\x20is\x20undefined', 'attack', 'HUAWEI/', 'request', 'wss', 'serializer', 'Tablet', 'gcda', '#cookies-policy-sticky', 'outerHeight', 'default_public_exponent', 'A[href*=\x22/hth107.com/\x22]', '[object\x20Array]', 'Module', 'dlShiftTo', 'number', 'mouseClick', 'ObjectDescriptor', 'toUpperCase', 'setByBinaryString', 'fromByteArray', '302d300d06096086480165030402040500041c', 'bitLength', '#kauli_yad_1', 'enc', 'numstr', 'outerWidth', 'open', 'audio', 'src', '#onlajny-stickers', 'a[href^=\x22https://app.readpeak.com/ads\x22]', '(prefers-contrast:\x20', 'UniversalString', 'Iceweasel', '9.0', 'audioId', 'undefined', 'https:', 'Windows\x20Phone', 'samsungAr', 'dmp1', '.open.pushModal', 'EdgeHTML', '\x20elem)', '%C2', 'buildID', 'isUniversal', 'ELEMENT_NODE', 'setHexValueIncludingUnusedBits', '\x20UBrowser', 'less', 'log1p', 'DERUTCTime', 'origin', 'int', 'getHours', 'browserEngine', 'ZERO', 'getMonth', 'textSizeAdjust', 'asn1Object', 'apply', 'bitwiseTo', 'false', 'a[href*=\x22/clickthrgh.asp?\x22]', 'IA5String', 'Map', 'coeff', 'MT\x20Extra', 'posEnd', 'fatal', 'webkitRequestFullscreen', 'gopher', 'getSeconds', 'doPublic', 'QupZilla', 'contentWindow', 'Maxthon', 'splice', 'div[data-widget_id=\x22ml6EJ074\x22]', 'Lunascape', 'Epiphany', 'push', 'parse', '.frontpageAdvM', 'setStringHex', 'MeeGo', 'div#skapiec_ad', 'replaceState', 'BIDUBrowser', '#ad-fullbanner2', 'filter', 'PrintableString', 'verify', 'Android', 'OPR', 'getPublicKeyB64', 'height', 'true', 'hex', '.o--cookies--container', 'requestIdleCallback', 'changeBit', '#adblock-honeypot', 'Content-Type', 'oscpu', 'readyState', 'a[href*=\x22//utimg.ru/\x22]', '#feedback-tab', 'Firefox', 'a[href*=\x22dubizzle.com/ar/?utm_source=\x22]', 'low', '[object\x20FormData]', 'onloadAccessor', 'setKey', '#ceneo-placeholder-ceneo-12', 'msIndexedDB', 'responseXMLAccessorGet', 'td#freenet_table_ads', '3535968sBuTTc', 'object', '#mgid_iframe1', 'selected', '@@iterator', 'nodeName', 'availLeft', '#vipAdmarktBannerBlock', 'errorTrace\x20signal\x20unexpected\x20behaviour', 'acosh', 'default', 'doPrivate', 'load', '360EE', 'border', 'left', 'Helvetica\x20Neue', 'modInverse', 'DEREnumerated', 'events', 'Macintosh', '#quangcaomb', 'DEROctetString', 'x509', 'flipBit', 'webgl', 'forced', 'DERSet', 'Failed\x20to\x20decode:\x20the\x20\x27stream\x27\x20option\x20is\x20unsupported.', 'simplify', 'gcd', '%[a-f0-9]{2}', '__yb', 'host', 'Kindle', '[object\x20Function]', 'getPrototypeOf', 'isEOC', 'Failed\x20to\x20encode:\x20the\x20\x27stream\x27\x20option\x20is\x20unsupported.', 'callback', '-----BEGIN\x20RSA\x20PRIVATE\x20KEY-----\x0a', '\x20UTC', 'analyseEvent', 'onerror', '.optimonk-iframe-container', 'MS\x20UI\x20Gothic', '9.9', '-----BEGIN\x20PUBLIC\x20KEY-----\x0a', 'renderedBuffer', 'setRequestHeader', 'BMPString', '#issuem-leaky-paywall-articles-zero-remaining-nag', 'radio', 'gw_pub_key', 'bracket', 'getOwnPropertyDescriptor', 'utf8str', 'div[id^=\x22smi2adblock\x22]', 'TextDecoder', 'create', 'a[href*=\x22booraq.org\x22]', 'constructor', 'A[href*=\x22ad.eval.hu\x22]', '.BetterJsPopOverlay', 'getPublicBaseKey', 'next', 'DERBoolean', '3.2.1', 'text/html', 'sign', '(no\x20elem)', '-----END\x20PUBLIC\x20KEY-----', 'setValueName', 'onmousemove', 'rShiftTo', 'indexOf', 'asinh', 'multiplyLowerTo', 'WechatWork', 'FxiOS', 'hasOwnProperty', 'setPrototypeOf', 'isProbablePrime', 'setUnusedBitsAndHexValue', 'enum', '10.0', 'test', 'sans-serif', ',sub:', 'getPrivateKeyB64', 'isArray', 'application/360softmgrplugin', 'bitCount', 'meta[name=\x27xxx\x27]', 'Baidu', 'components', 'protocol', 'CrOS', 'target', 'byteLength', 'sans-serif-thin', 'loaded', 'a[href^=\x22https://affiliazioniads.snai.it/\x22]', 'from', 'DERIA5String', 'sqrt', 'Notification', 'toStringTag', 'http', 'DERNull', 'getBoundingClientRect', 'sent', 'sortFlag', 'serif', 'GeneralizedTime', 'extend', 'match', 'baidubrowser', 'webkitSpeechGrammar', 'min', 'a[href*=\x22casinopro.se\x22][target=\x22_blank\x22]', '[href^=\x22http://ads.glispa.com/\x22]', 'Too\x20high\x20value', 'WEBGL_debug_renderer_info\x20extension\x20is\x20null', 'all', 'webkitTextSizeAdjust', '__esModule', '#adbody', 'Intl', 'dmq1', 'mozInnerScreenX', '#xenium_hot_offers', '.yandex-rtb-block', '9306570sYnQvQ', '#Publicidade', 'setByBooleanArray', '.incomplete', 'name', 'FreeBSD', 'set', 'asn1', 'getPublicBaseKeyB64', '6.3', 'encrypt', 'availHeight', 'typeName', 'msFullscreenElement', 'MacIntel', '#semilo-lrectangle', '__edgeTrackingPreventionStatistics', 'warn', 'Debian', 'userLanguage', '3021300906052b0e03021a05000414', 'getParameter', 'shift', 'amp-auto-ads', 'resolvedOptions'];
    a0_0x336b = function() {
        return _0x41e5ff;
    }
    ;
    return a0_0x336b();
}
window = global
seach_data = "event_status=&event_type=&isSearch=false&page=3&page_size=20&search="

代码后续见第二篇