xhs（x红书）x-s参数逆向[2023.12.14]

1.提要

2.算法还原

算法还原一大特点就是，打日志，一般来说，这种加密算法基本大多数关键的操作就是数据之间的位运算操作，所以一般断点都打在所有的位运算操作的位置，比如：

断点的写法参考：

讯享网

打印出的日志be like:

此后便是无穷的逆推过程，比较掉头发的，这里提供关键的思路步骤，给热爱技术的朋友提供参考（想想自己到处寻找灵感的时候，多么希望能有一篇文章能够指点迷津，现在自己弄出来了，必然给诸君共享）

xhs.js:290 X + - => X- xhs.js:290 X- + s => X-s xhs.js:290 X + Y => XY xhs.js:290 XY + W => XYW xhs.js:290 XYW + _ => XYW_ xhs.js:290 XYW_ + eyJzaWduU3ZuIjoiNTEiLCJzaWduVHlwZSI6IngxIiwiYXBwSWQiOiJ4aHMtcGMtd2ViIiwic2lnblZlcnNpb24iOiIxIiwicGF5bG9hZCI6Ijk1ZWViZmQzZTY3OWE1YzU4ZGMzMTE0ZDg3ZTgzOTVlNGVhODA4YTZiZGU5Y2E3YjljYWVhYjgzZGExNDA5MjQzMDJmNjQ1ZTFiYzcxM2QwMGFkZDdhMzYwODdlNTJlMmM5ZTNiZmRhMWZhYTFlYjkwZDc0YWEzMWI1NGM3MmNkMGQ3NGFhMzFiNTRjNzJjZGFjNDg5YjlkYThjZTVlNDhmNGFmYjlhY2ZjM2VhMjZmZTBiMjY2YTZiNGNjM2NiNTczZGE2MDA2NjZlNWM3ZTY5ZTg3NmUwZWMyZmY3Y2Q1NGQ3YTlkMTE3YmFhZWEyNWJiMjlmZDJkNWE1NjIyNTllZWM2MGQ1NDljN2I4NjgyYjUyNjVhMGEyOTBlMzdmZDJkNjRkOWNhMzJhNGJkYWNkNTRmY2M4YzkwZWY4NzcwZTNkYWRmODZjMzE2NGExYWEzMWNjODFjOWZmYTQ5MDNmNTA5ODZkZWY1MjQ1ZjY1OWNkOGNhY2Y2MzhlMWRmNiJ9 => XYW_eyJzaWduU3ZuIjoiNTEiLCJzaWduVHlwZSI6IngxIiwiYXBwSWQiOiJ4aHMtcGMtd2ViIiwic2lnblZlcnNpb24iOiIxIiwicGF5bG9hZCI6Ijk1ZWViZmQzZTY3OWE1YzU4ZGMzMTE0ZDg3ZTgzOTVlNGVhODA4YTZiZGU5Y2E3YjljYWVhYjgzZGExNDA5MjQzMDJmNjQ1ZTFiYzcxM2QwMGFkZDdhMzYwODdlNTJlMmM5ZTNiZmRhMWZhYTFlYjkwZDc0YWEzMWI1NGM3MmNkMGQ3NGFhMzFiNTRjNzJjZGFjNDg5YjlkYThjZTVlNDhmNGFmYjlhY2ZjM2VhMjZmZTBiMjY2YTZiNGNjM2NiNTczZGE2MDA2NjZlNWM3ZTY5ZTg3NmUwZWMyZmY3Y2Q1NGQ3YTlkMTE3YmFhZWEyNWJiMjlmZDJkNWE1NjIyNTllZWM2MGQ1NDljN2I4NjgyYjUyNjVhMGEyOTBlMzdmZDJkNjRkOWNhMzJhNGJkYWNkNTRmY2M4YzkwZWY4NzcwZTNkYWRmODZjMzE2NGExYWEzMWNjODFjOWZmYTQ5MDNmNTA5ODZkZWY1MjQ1ZjY1OWNkOGNhY2Y2MzhlMWRmNiJ9 xhs.js:290 X + - => X- xhs.js:290 X- + t => X-t xhs.js:577 {X-s: 'XYW_eyJzaWduU3ZuIjoiNTEiLCJzaWduVHlwZSI6IngxIiwiYX…5MDNmNTA5ODZkZWY1MjQ1ZjY1OWNkOGNhY2Y2MzhlMWRmNiJ9', X-t: 39} 

2.1 ey……J9的生成

ey……J9呢是charAt产生的，如下：

讯享网text复制代码xhs.js:490 56 '>>' 2 '=>' 14 xhs.js:278 56 '&' 3 '=>' 0 xhs.js:384 0 '<<' 4 '=>' 0 xhs.js:490 99 '>>' 4 '=>' 6 xhs.js:426 0 '|' 6 '=>' 6 xhs.js:278 99 '&' 15 '=>' 3 xhs.js:384 3 '<<' 2 '=>' 12 xhs.js:490 97 '>>' 6 '=>' 1 xhs.js:426 12 '|' 1 '=>' 13 xhs.js:278 97 '&' 63 '=>' 33 xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + A => charA xhs.js:290 charA + t => charAt xhs.js:290 eyJzaWduU3ZuIjoiNTEiLCJzaWduVHlwZSI6IngxIiwiYXBwSWQiOiJ4aHMtcGMtd2ViIiwic2lnblZlcnNpb24iOiIxIiwicGF5bG9hZCI6Ijk1ZWViZmQzZTY3OWE1YzU4ZGMzMTE0ZDg3ZTgzOTVlNGVhODA4YTZiZGU5Y2E3YjljYWVhYjgzZGExNDA5MjQzMDJmNjQ1ZTFiYzcxM2QwMGFkZDdhMzYwODdlNTJlMmM5ZTNiZmRhMWZhYTFlYjkwZDc0YWEzMWI1NGM3MmNkMGQ3NGFhMzFiNTRjNzJjZGFjNDg5YjlkYThjZTVlNDhmNGFmYjlhY2ZjM2VhMjZmZTBiMjY2YTZiNGNjM2NiNTczZGE2MDA2NjZlNWM3ZTY5ZTg3NmUwZWMyZmY3Y2Q1NGQ3YTlkMTE3YmFhZWEyNWJiMjlmZDJkNWE1NjIyNTllZWM2MGQ1NDljN2I4NjgyYjUyNjVhMGEyOTBlMzdmZDJkNjRkOWNhMzJhNGJkYWNkNTRmY2M4YzkwZWY4NzcwZTNkYWRmODZjMzE2NGExYWEzMWNjODFjOWZmYTQ5MDNmNTA5ODZkZWY1MjQ1ZjY1OWNk + O => eyJzaWduU3ZuIjoiNTEiLCJzaWduVHlwZSI6IngxIiwiYXBwSWQiOiJ4aHMtcGMtd2ViIiwic2lnblZlcnNpb24iOiIxIiwicGF5bG9hZCI6Ijk1ZWViZmQzZTY3OWE1YzU4ZGMzMTE0ZDg3ZTgzOTVlNGVhODA4YTZiZGU5Y2E3YjljYWVhYjgzZGExNDA5MjQzMDJmNjQ1ZTFiYzcxM2QwMGFkZDdhMzYwODdlNTJlMmM5ZTNiZmRhMWZhYTFlYjkwZDc0YWEzMWI1NGM3MmNkMGQ3NGFhMzFiNTRjNzJjZGFjNDg5YjlkYThjZTVlNDhmNGFmYjlhY2ZjM2VhMjZmZTBiMjY2YTZiNGNjM2NiNTczZGE2MDA2NjZlNWM3ZTY5ZTg3NmUwZWMyZmY3Y2Q1NGQ3YTlkMTE3YmFhZWEyNWJiMjlmZDJkNWE1NjIyNTllZWM2MGQ1NDljN2I4NjgyYjUyNjVhMGEyOTBlMzdmZDJkNjRkOWNhMzJhNGJkYWNkNTRmY2M4YzkwZWY4NzcwZTNkYWRmODZjMzE2NGExYWEzMWNjODFjOWZmYTQ5MDNmNTA5ODZkZWY1MjQ1ZjY1OWNkO xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + A => charA xhs.js:290 charA + t => charAt xhs.js:290 eyJzaWduU3ZuIjoiNTEiLCJzaWduVHlwZSI6IngxIiwiYXBwSWQiOiJ4aHMtcGMtd2ViIiwic2lnblZlcnNpb24iOiIxIiwicGF5bG9hZCI6Ijk1ZWViZmQzZTY3OWE1YzU4ZGMzMTE0ZDg3ZTgzOTVlNGVhODA4YTZiZGU5Y2E3YjljYWVhYjgzZGExNDA5MjQzMDJmNjQ1ZTFiYzcxM2QwMGFkZDdhMzYwODdlNTJlMmM5ZTNiZmRhMWZhYTFlYjkwZDc0YWEzMWI1NGM3MmNkMGQ3NGFhMzFiNTRjNzJjZGFjNDg5YjlkYThjZTVlNDhmNGFmYjlhY2ZjM2VhMjZmZTBiMjY2YTZiNGNjM2NiNTczZGE2MDA2NjZlNWM3ZTY5ZTg3NmUwZWMyZmY3Y2Q1NGQ3YTlkMTE3YmFhZWEyNWJiMjlmZDJkNWE1NjIyNTllZWM2MGQ1NDljN2I4NjgyYjUyNjVhMGEyOTBlMzdmZDJkNjRkOWNhMzJhNGJkYWNkNTRmY2M4YzkwZWY4NzcwZTNkYWRmODZjMzE2NGExYWEzMWNjODFjOWZmYTQ5MDNmNTA5ODZkZWY1MjQ1ZjY1OWNkO + G => eyJzaWduU3ZuIjoiNTEiLCJzaWduVHlwZSI6IngxIiwiYXBwSWQiOiJ4aHMtcGMtd2ViIiwic2lnblZlcnNpb24iOiIxIiwicGF5bG9hZCI6Ijk1ZWViZmQzZTY3OWE1YzU4ZGMzMTE0ZDg3ZTgzOTVlNGVhODA4YTZiZGU5Y2E3YjljYWVhYjgzZGExNDA5MjQzMDJmNjQ1ZTFiYzcxM2QwMGFkZDdhMzYwODdlNTJlMmM5ZTNiZmRhMWZhYTFlYjkwZDc0YWEzMWI1NGM3MmNkMGQ3NGFhMzFiNTRjNzJjZGFjNDg5YjlkYThjZTVlNDhmNGFmYjlhY2ZjM2VhMjZmZTBiMjY2YTZiNGNjM2NiNTczZGE2MDA2NjZlNWM3ZTY5ZTg3NmUwZWMyZmY3Y2Q1NGQ3YTlkMTE3YmFhZWEyNWJiMjlmZDJkNWE1NjIyNTllZWM2MGQ1NDljN2I4NjgyYjUyNjVhMGEyOTBlMzdmZDJkNjRkOWNhMzJhNGJkYWNkNTRmY2M4YzkwZWY4NzcwZTNkYWRmODZjMzE2NGExYWEzMWNjODFjOWZmYTQ5MDNmNTA5ODZkZWY1MjQ1ZjY1OWNkOG xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + A => charA xhs.js:290 charA + t => charAt xhs.js:290 eyJzaWduU3ZuIjoiNTEiLCJzaWduVHlwZSI6IngxIiwiYXBwSWQiOiJ4aHMtcGMtd2ViIiwic2lnblZlcnNpb24iOiIxIiwicGF5bG9hZCI6Ijk1ZWViZmQzZTY3OWE1YzU4ZGMzMTE0ZDg3ZTgzOTVlNGVhODA4YTZiZGU5Y2E3YjljYWVhYjgzZGExNDA5MjQzMDJmNjQ1ZTFiYzcxM2QwMGFkZDdhMzYwODdlNTJlMmM5ZTNiZmRhMWZhYTFlYjkwZDc0YWEzMWI1NGM3MmNkMGQ3NGFhMzFiNTRjNzJjZGFjNDg5YjlkYThjZTVlNDhmNGFmYjlhY2ZjM2VhMjZmZTBiMjY2YTZiNGNjM2NiNTczZGE2MDA2NjZlNWM3ZTY5ZTg3NmUwZWMyZmY3Y2Q1NGQ3YTlkMTE3YmFhZWEyNWJiMjlmZDJkNWE1NjIyNTllZWM2MGQ1NDljN2I4NjgyYjUyNjVhMGEyOTBlMzdmZDJkNjRkOWNhMzJhNGJkYWNkNTRmY2M4YzkwZWY4NzcwZTNkYWRmODZjMzE2NGExYWEzMWNjODFjOWZmYTQ5MDNmNTA5ODZkZWY1MjQ1ZjY1OWNkOG + N => eyJzaWduU3ZuIjoiNTEiLCJzaWduVHlwZSI6IngxIiwiYXBwSWQiOiJ4aHMtcGMtd2ViIiwic2lnblZlcnNpb24iOiIxIiwicGF5bG9hZCI6Ijk1ZWViZmQzZTY3OWE1YzU4ZGMzMTE0ZDg3ZTgzOTVlNGVhODA4YTZiZGU5Y2E3YjljYWVhYjgzZGExNDA5MjQzMDJmNjQ1ZTFiYzcxM2QwMGFkZDdhMzYwODdlNTJlMmM5ZTNiZmRhMWZhYTFlYjkwZDc0YWEzMWI1NGM3MmNkMGQ3NGFhMzFiNTRjNzJjZGFjNDg5YjlkYThjZTVlNDhmNGFmYjlhY2ZjM2VhMjZmZTBiMjY2YTZiNGNjM2NiNTczZGE2MDA2NjZlNWM3ZTY5ZTg3NmUwZWMyZmY3Y2Q1NGQ3YTlkMTE3YmFhZWEyNWJiMjlmZDJkNWE1NjIyNTllZWM2MGQ1NDljN2I4NjgyYjUyNjVhMGEyOTBlMzdmZDJkNjRkOWNhMzJhNGJkYWNkNTRmY2M4YzkwZWY4NzcwZTNkYWRmODZjMzE2NGExYWEzMWNjODFjOWZmYTQ5MDNmNTA5ODZkZWY1MjQ1ZjY1OWNkOGN xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + A => charA xhs.js:290 charA + t => charAt xhs.js:290 eyJzaWduU3ZuIjoiNTEiLCJzaWduVHlwZSI6IngxIiwiYXBwSWQiOiJ4aHMtcGMtd2ViIiwic2lnblZlcnNpb24iOiIxIiwicGF5bG9hZCI6Ijk1ZWViZmQzZTY3OWE1YzU4ZGMzMTE0ZDg3ZTgzOTVlNGVhODA4YTZiZGU5Y2E3YjljYWVhYjgzZGExNDA5MjQzMDJmNjQ1ZTFiYzcxM2QwMGFkZDdhMzYwODdlNTJlMmM5ZTNiZmRhMWZhYTFlYjkwZDc0YWEzMWI1NGM3MmNkMGQ3NGFhMzFiNTRjNzJjZGFjNDg5YjlkYThjZTVlNDhmNGFmYjlhY2ZjM2VhMjZmZTBiMjY2YTZiNGNjM2NiNTczZGE2MDA2NjZlNWM3ZTY5ZTg3NmUwZWMyZmY3Y2Q1NGQ3YTlkMTE3YmFhZWEyNWJiMjlmZDJkNWE1NjIyNTllZWM2MGQ1NDljN2I4NjgyYjUyNjVhMGEyOTBlMzdmZDJkNjRkOWNhMzJhNGJkYWNkNTRmY2M4YzkwZWY4NzcwZTNkYWRmODZjMzE2NGExYWEzMWNjODFjOWZmYTQ5MDNmNTA5ODZkZWY1MjQ1ZjY1OWNkOGN + h => eyJzaWduU3ZuIjoiNTEiLCJzaWduVHlwZSI6IngxIiwiYXBwSWQiOiJ4aHMtcGMtd2ViIiwic2lnblZlcnNpb24iOiIxIiwicGF5bG9hZCI6Ijk1ZWViZmQzZTY3OWE1YzU4ZGMzMTE0ZDg3ZTgzOTVlNGVhODA4YTZiZGU5Y2E3YjljYWVhYjgzZGExNDA5MjQzMDJmNjQ1ZTFiYzcxM2QwMGFkZDdhMzYwODdlNTJlMmM5ZTNiZmRhMWZhYTFlYjkwZDc0YWEzMWI1NGM3MmNkMGQ3NGFhMzFiNTRjNzJjZGFjNDg5YjlkYThjZTVlNDhmNGFmYjlhY2ZjM2VhMjZmZTBiMjY2YTZiNGNjM2NiNTczZGE2MDA2NjZlNWM3ZTY5ZTg3NmUwZWMyZmY3Y2Q1NGQ3YTlkMTE3YmFhZWEyNWJiMjlmZDJkNWE1NjIyNTllZWM2MGQ1NDljN2I4NjgyYjUyNjVhMGEyOTBlMzdmZDJkNjRkOWNhMzJhNGJkYWNkNTRmY2M4YzkwZWY4NzcwZTNkYWRmODZjMzE2NGExYWEzMWNjODFjOWZmYTQ5MDNmNTA5ODZkZWY1MjQ1ZjY1OWNkOGNh 

那么是谁的charAt呢，又是at几呢？

往上寻找ey……J9最初产生的地方看看：

{"signSvn":"51","signType":"x1","appId":"xhs-pc-web","signVersion":"1","payload":"95eebfd3e679a5c58dc3114d87e8395e4ea808a6bde9ca7b9caeab83daf645e1bc713d00add7a36087e52e2c9e3bfda1faa1eb90d74aa31b54c72cd0d74aa31b54c72cdac489b9da8ce5e48f4afb9acfc3ea26fe0b266a6b4cc3cb573dae5c7e69e876e0ec2ff7cd54d7a9d117baaea25bb29fd2d5aeec60d549c7b8682b5265a0a290e37fd2d64d9ca32a4bdacd54fcc8c90ef8770e3dadf86c3164a1aa31cc81c9ffa4903f50986def5245f659cd8cacf638e1df6"} xhs.js:290 l + e => le xhs.js:290 le + n => len xhs.js:290 len + g => leng xhs.js:290 leng + t => lengt xhs.js:290 lengt + h => length xhs.js:290 s + t => st xhs.js:290 st + a => sta xhs.js:290 sta + c => stac xhs.js:290 stac + k => stack xhs.js:290 stack + O => stackO xhs.js:290 stackO + u => stackOu xhs.js:290 stackOu + t => stackOut xhs.js:290 stackOut + p => stackOutp xhs.js:290 stackOutp + u => stackOutpu xhs.js:290 stackOutpu + t => stackOutput xhs.js:290 s + t => st xhs.js:290 st + a => sta xhs.js:290 sta + c => stac xhs.js:290 stac + k => stack xhs.js:290 stack + O => stackO xhs.js:290 stackO + u => stackOu xhs.js:290 stackOu + t => stackOut xhs.js:290 stackOut + p => stackOutp xhs.js:290 stackOutp + u => stackOutpu xhs.js:290 stackOutpu + t => stackOutput xhs.js:290 l + e => le xhs.js:290 le + n => len xhs.js:290 len + g => leng xhs.js:290 leng + t => lengt xhs.js:290 lengt + h => length xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + C => charC xhs.js:290 charC + o => charCo xhs.js:290 charCo + d => charCod xhs.js:290 charCod + e => charCode xhs.js:290 charCode + A => charCodeA xhs.js:290 charCodeA + t => charCodeAt xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + C => charC xhs.js:290 charC + o => charCo xhs.js:290 charCo + d => charCod xhs.js:290 charCod + e => charCode xhs.js:290 charCode + A => charCodeA xhs.js:290 charCodeA + t => charCodeAt xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + C => charC xhs.js:290 charC + o => charCo xhs.js:290 charCo + d => charCod xhs.js:290 charCod + e => charCode xhs.js:290 charCode + A => charCodeA xhs.js:290 charCodeA + t => charCodeAt xhs.js:290 s + h => sh xhs.js:290 sh + o => sho xhs.js:290 sho + u => shou xhs.js:290 shou + l => shoul xhs.js:290 shoul + d => should xhs.js:290 should + J => shouldJ xhs.js:290 shouldJ + o => shouldJo xhs.js:290 shouldJo + k => shouldJok xhs.js:290 shouldJok + e => shouldJoke xhs.js:290 shouldJoke + r => shouldJoker xhs.js:490 123 '>>' 2 '=>' 30 xhs.js:278 123 '&' 3 '=>' 3 xhs.js:384 3 '<<' 4 '=>' 48 xhs.js:490 34 '>>' 4 '=>' 2 xhs.js:426 48 '|' 2 '=>' 50 xhs.js:278 34 '&' 15 '=>' 2 xhs.js:384 2 '<<' 2 '=>' 8 xhs.js:490 115 '>>' 6 '=>' 1 xhs.js:426 8 '|' 1 '=>' 9 xhs.js:278 115 '&' 63 '=>' 51 xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + A => charA xhs.js:290 charA + t => charAt xhs.js:290 + e => e xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + A => charA xhs.js:290 charA + t => charAt xhs.js:290 e + y => ey xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + A => charA xhs.js:290 charA + t => charAt xhs.js:290 ey + J => eyJ xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + A => charA xhs.js:290 charA + t => charAt xhs.js:290 eyJ + z => eyJz 

猜测123、34等那几个数可能是{“signSVn……这个长传的charCodeAt产生，验证：

果然，3个一组，产生4个数，这四个数作为charat的参数，那么是谁的charat呢？这个就继续往上翻到signsvn……产生的地方看看：

讯享网xhs.js:290 ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0+/ + = => ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0+/= xhs.js:290 s + t => st xhs.js:290 st + a => sta xhs.js:290 sta + c => stac xhs.js:290 stac + k => stack xhs.js:290 stack + I => stackI xhs.js:290 stackI + n => stackIn xhs.js:290 stackIn + p => stackInp xhs.js:290 stackInp + u => stackInpu xhs.js:290 stackInpu + t => stackInput xhs.js:290 l + e => le xhs.js:290 le + n => len xhs.js:290 len + g => leng xhs.js:290 leng + t => lengt xhs.js:290 lengt + h => length xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + C => charC xhs.js:290 charC + o => charCo xhs.js:290 charCo + d => charCod xhs.js:290 charCod + e => charCode xhs.js:290 charCode + A => charCodeA xhs.js:290 charCodeA + t => charCodeAt xhs.js:286 0 '%' 4 '=>' 0 xhs.js:290 s + h => sh xhs.js:290 sh + o => sho xhs.js:290 sho + u => shou xhs.js:290 shou + l => shoul xhs.js:290 shoul + d => should xhs.js:290 should + J => shouldJ xhs.js:290 shouldJ + o => shouldJo xhs.js:290 shouldJo + k => shouldJok xhs.js:290 shouldJok + e => shouldJoke xhs.js:290 shouldJoke + r => shouldJoker xhs.js:290 f + r => fr xhs.js:290 fr + o => fro xhs.js:290 fro + m => from xhs.js:290 from + C => fromC xhs.js:290 fromC + h => fromCh xhs.js:290 fromCh + a => fromCha xhs.js:290 fromCha + r => fromChar xhs.js:290 fromChar + C => fromCharC xhs.js:290 fromCharC + o => fromCharCo xhs.js:290 fromCharCo + d => fromCharCod xhs.js:290 fromCharCod + e => fromCharCode xhs.js:290 + { => { xhs.js:290 l + e => le xhs.js:290 le + n => len xhs.js:290 len + g => leng xhs.js:290 leng + t => lengt xhs.js:290 lengt + h => length xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + C => charC xhs.js:290 charC + o => charCo xhs.js:290 charCo + d => charCod xhs.js:290 charCod + e => charCode xhs.js:290 charCode + A => charCodeA xhs.js:290 charCodeA + t => charCodeAt xhs.js:286 1 '%' 4 '=>' 1 xhs.js:290 f + r => fr xhs.js:290 fr + o => fro xhs.js:290 fro + m => from xhs.js:290 from + C => fromC xhs.js:290 fromC + h => fromCh xhs.js:290 fromCh + a => fromCha xhs.js:290 fromCha + r => fromChar xhs.js:290 fromChar + C => fromCharC xhs.js:290 fromCharC + o => fromCharCo xhs.js:290 fromCharCo + d => fromCharCod xhs.js:290 fromCharCod + e => fromCharCode xhs.js:290 { + " => {" xhs.js:290 l + e => le xhs.js:290 le + n => len xhs.js:290 len + g => leng xhs.js:290 leng + t => lengt xhs.js:290 lengt + h => length xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + C => charC xhs.js:290 charC + o => charCo xhs.js:290 charCo + d => charCod xhs.js:290 charCod + e => charCode xhs.js:290 charCode + A => charCodeA xhs.js:290 charCodeA + t => charCodeAt xhs.js:286 2 '%' 4 '=>' 2 xhs.js:290 f + r => fr xhs.js:290 fr + o => fro xhs.js:290 fro + m => from xhs.js:290 from + C => fromC xhs.js:290 fromC + h => fromCh xhs.js:290 fromCh + a => fromCha xhs.js:290 fromCha + r => fromChar xhs.js:290 fromChar + C => fromCharC xhs.js:290 fromCharC + o => fromCharCo xhs.js:290 fromCharCo + d => fromCharCod xhs.js:290 fromCharCod + e => fromCharCode xhs.js:290 {" + s => {"s xhs.js:290 l + e => le xhs.js:290 le + n => len xhs.js:290 len + g => leng xhs.js:290 leng + t => lengt xhs.js:290 lengt + h => length xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + C => charC xhs.js:290 charC + o => charCo xhs.js:290 charCo + d => charCod xhs.js:290 charCod + e => charCode xhs.js:290 charCode + A => charCodeA xhs.js:290 charCodeA + t => charCodeAt xhs.js:286 3 '%' 4 '=>' 3 xhs.js:290 f + r => fr xhs.js:290 fr + o => fro xhs.js:290 fro + m => from xhs.js:290 from + C => fromC xhs.js:290 fromC + h => fromCh xhs.js:290 fromCh + a => fromCha xhs.js:290 fromCha + r => fromChar xhs.js:290 fromChar + C => fromCharC xhs.js:290 fromCharC + o => fromCharCo xhs.js:290 fromCharCo + d => fromCharCod xhs.js:290 fromCharCod + e => fromCharCode xhs.js:290 {"s + i => {"si xhs.js:290 l + e => le xhs.js:290 le + n => len xhs.js:290 len + g => leng xhs.js:290 leng + t => lengt xhs.js:290 lengt + h => length xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + C => charC xhs.js:290 charC + o => charCo xhs.js:290 charCo + d => charCod xhs.js:290 charCod + e => charCode xhs.js:290 charCode + A => charCodeA xhs.js:290 charCodeA + t => charCodeAt xhs.js:286 4 '%' 4 '=>' 0 xhs.js:290 s + h => sh xhs.js:290 sh + o => sho xhs.js:290 sho + u => shou xhs.js:290 shou + l => shoul xhs.js:290 shoul + d => should xhs.js:290 should + J => shouldJ xhs.js:290 shouldJ + o => shouldJo xhs.js:290 shouldJo + k => shouldJok xhs.js:290 shouldJok + e => shouldJoke xhs.js:290 shouldJoke + r => shouldJoker xhs.js:290 f + r => fr xhs.js:290 fr + o => fro xhs.js:290 fro + m => from xhs.js:290 from + C => fromC xhs.js:290 fromC + h => fromCh xhs.js:290 fromCh + a => fromCha xhs.js:290 fromCha + r => fromChar xhs.js:290 fromChar + C => fromCharC xhs.js:290 fromCharC + o => fromCharCo xhs.js:290 fromCharCo + d => fromCharCod xhs.js:290 fromCharCod + e => fromCharCode xhs.js:290 {"si + g => {"sig xhs.js:290 l + e => le xhs.js:290 le + n => len xhs.js:290 len + g => leng xhs.js:290 leng + t => lengt xhs.js:290 lengt + h => length xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + C => charC xhs.js:290 charC + o => charCo xhs.js:290 charCo + d => charCod xhs.js:290 charCod + e => charCode xhs.js:290 charCode + A => charCodeA xhs.js:290 charCodeA + t => charCodeAt xhs.js:286 5 '%' 4 '=>' 1 xhs.js:290 f + r => fr xhs.js:290 fr + o => fro xhs.js:290 fro + m => from xhs.js:290 from + C => fromC xhs.js:290 fromC + h => fromCh xhs.js:290 fromCh + a => fromCha xhs.js:290 fromCha + r => fromChar xhs.js:290 fromChar + C => fromCharC xhs.js:290 fromCharC + o => fromCharCo xhs.js:290 fromCharCo + d => fromCharCod xhs.js:290 fromCharCod + e => fromCharCode xhs.js:290 {"sig + n => {"sign 

注释:这里就很明显的可以看出，非常类似汇编的感觉，进行处理之前，先把需要的参数入栈，然后取指、执行，也就是它自己实现了解释器，对很长的字节码进行解释执行，我叫它vmp不过分把？

验证一下：

xhs.js:490 123 '>>' 2 '=>' 30 xhs.js:278 123 '&' 3 '=>' 3 xhs.js:384 3 '<<' 4 '=>' 48 xhs.js:490 34 '>>' 4 '=>' 2 xhs.js:426 48 '|' 2 '=>' 50 xhs.js:278 34 '&' 15 '=>' 2 xhs.js:384 2 '<<' 2 '=>' 8 xhs.js:490 115 '>>' 6 '=>' 1 xhs.js:426 8 '|' 1 '=>' 9 xhs.js:278 115 '&' 63 '=>' 51 xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + A => charA xhs.js:290 charA + t => charAt xhs.js:290 + e => e xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + A => charA xhs.js:290 charA + t => charAt xhs.js:290 e + y => ey xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + A => charA xhs.js:290 charA + t => charAt xhs.js:290 ey + J => eyJ xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + A => charA xhs.js:290 charA + t => charAt xhs.js:290 eyJ + z => eyJz xhs.js:290 l + e => le xhs.js:290 le + n => len xhs.js:290 len + g => leng xhs.js:290 leng + t => lengt xhs.js:290 lengt + h => length xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + C => charC xhs.js:290 charC + o => charCo xhs.js:290 charCo + d => charCod xhs.js:290 charCod + e => charCode xhs.js:290 charCode + A => charCodeA xhs.js:290 charCodeA + t => charCodeAt xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + C => charC xhs.js:290 charC + o => charCo xhs.js:290 charCo + d => charCod xhs.js:290 charCod + e => charCode xhs.js:290 charCode + A => charCodeA xhs.js:290 charCodeA + t => charCodeAt xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + C => charC xhs.js:290 charC + o => charCo xhs.js:290 charCo + d => charCod xhs.js:290 charCod + e => charCode xhs.js:290 charCode + A => charCodeA xhs.js:290 charCodeA + t => charCodeAt xhs.js:290 s + h => sh xhs.js:290 sh + o => sho xhs.js:290 sho + u => shou xhs.js:290 shou + l => shoul xhs.js:290 shoul + d => should xhs.js:290 should + J => shouldJ xhs.js:290 shouldJ + o => shouldJo xhs.js:290 shouldJo + k => shouldJok xhs.js:290 shouldJok + e => shouldJoke xhs.js:290 shouldJoke + r => shouldJoker 

产生了eyJz后面的一样：

{"signSvn:……每三个char一组，产生4个数，这四个数作为charAt的参数产生ey……这也就验证了，为什么每次都是XYW_ey……开头，因为{"对应的charCode为123、34,

还原JS为，简单一点可以直接base64，用js还原逼格高，哈哈

讯享网function getXYW(payload) { 
    let in1 = `{"signSvn":"51","signType":"x1","payload":"${ 
     payload}"}` let XYW = "XYW_" let iter = [] for (let i = 0; i < in1.length; i=i+3) { 
    let num1 = in1[i].charCodeAt(0) let num2 = in1[i+1] === undefined ? undefined :in1[i+1].charCodeAt(0) let num3 = in1[i+2] === undefined ? undefined :in1[i+2].charCodeAt(0) iter.push(num1 >> 2) num2 && iter.push(((num1 & 3) << 4) | (num2 >> 4)) num3 && iter.push(((num2 & 15) << 2) | (num3 >> 6)) num3 && iter.push(num3 & 63) } for (i of iter){ 
    let code = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0+/=" XYW+=code.charAt(i) } return { 
    "X-s":XYW, "X-t":now } } 

3.2 payload的算法

由上面的signSvn串得知下一步需要逆推payload串，还是一样的思路，去payload串最开始产生的地方看看线索。(nam sayin……，这种逆向就是这种，一步一步逆推，为什么我一直做着这种繁琐、掉头发、还没有很好的变现渠道的事情？还不是因为逆向出来了收获一点成就感而已，喜欢和人博弈的感觉，但是，这又有什么意义呢？一些胡言乱语………^_）
本次日志的payload为"95eebfd3e679a5c58dc3114d87e8395e4ea808a6bde9ca7b9caeab83daf645e1bc713d00add7a36087e52e2c9e3bfda1faa1eb90d74aa31b54c72cd0d74aa31b54c72cdac489b9da8ce5e48f4afb9acfc3ea26fe0b266a6b4cc3cb573dae5c7e69e876e0ec2ff7cd54d7a9d117baaea25bb29fd2d5aeec60d549c7b8682b5265a0a290e37fd2d64d9ca32a4bdacd54fcc8c90ef8770e3dadf86c3164a1aa31cc81c9ffa4903f50986def5245f659cd8cacf638e1df6"

xhs.js:290 •î¿Óæy¥ÅÃM‡è9^N¨¦½éÊ{œ®«ƒÚ $0/d^ÇÐ Ýz6~RâÉã¿Úª¹ tª1µLrÍ tª1µLrͬH›¨Î^Hô¯¹¬ü>¢oà²f¦´Ì<µsÚ`fåÇ枇nÂÿ|ÕMz{ªê%»)ý-ZV"YîÆ Tœ{†‚µ&Z )7ý-dÙÊ2¤½¬ÕOÌŒï‡pãÚ߆ÃJ£ÈŸúIõ †Þõ$_e + œØÊÏcŽö => •î¿Óæy¥ÅÃM‡è9^N¨¦½éÊ{œ®«ƒÚ $0/d^ÇÐ Ýz6~RâÉã¿Úª¹ tª1µLrÍ tª1µLrͬH›¨Î^Hô¯¹¬ü>¢oà²f¦´Ì<µsÚ`fåÇ枇nÂÿ|ÕMz{ªê%»)ý-ZV"YîÆ Tœ{†‚µ&Z )7ý-dÙÊ2¤½¬ÕOÌŒï‡pãÚ߆ÃJ£ÈŸúIõ †Þõ$_eœØÊÏcŽö xhs.js:290 184 '+' 8 '=>' 192 xhs.js:290 + •î¿Óæy¥ÅÃM‡è9^N¨¦½éÊ{œ®«ƒÚ $0/d^ÇÐ Ýz6~RâÉã¿Úª¹ tª1µLrÍ tª1µLrͬH›¨Î^Hô¯¹¬ü>¢oà²f¦´Ì<µsÚ`fåÇ枇nÂÿ|ÕMz{ªê%»)ý-ZV"YîÆ Tœ{†‚µ&Z )7ý-dÙÊ2¤½¬ÕOÌŒï‡pãÚ߆ÃJ£ÈŸúIõ †Þõ$_eœØÊÏcŽö => •î¿Óæy¥ÅÃM‡è9^N¨¦½éÊ{œ®«ƒÚ $0/d^ÇÐ Ýz6~RâÉã¿Úª¹ tª1µLrÍ tª1µLrͬH›¨Î^Hô¯¹¬ü>¢oà²f¦´Ì<µsÚ`fåÇ枇nÂÿ|ÕMz{ªê%»)ý-ZV"YîÆ Tœ{†‚µ&Z )7ý-dÙÊ2¤½¬ÕOÌŒï‡pãÚ߆ÃJ£ÈŸúIõ †Þõ$_eœØÊÏcŽö xhs.js:290 e + n => en xhs.js:290 en + c => enc xhs.js:290 enc + r => encr xhs.js:290 encr + y => encry xhs.js:290 encry + p => encryp xhs.js:290 encryp + t => encrypt xhs.js:290 l + e => le xhs.js:290 le + n => len xhs.js:290 len + g => leng xhs.js:290 leng + t => lengt xhs.js:290 lengt + h => length xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + C => charC xhs.js:290 charC + o => charCo xhs.js:290 charCo + d => charCod xhs.js:290 charCod + e => charCode xhs.js:290 charCode + A => charCodeA xhs.js:290 charCodeA + t => charCodeAt xhs.js:490 149 '>>' 4 '=>' 9 xhs.js:278 149 '&' 15 '=>' 5 xhs.js:290 9 + 5 => 95 xhs.js:290 + 95 => 95 xhs.js:290 l + e => le xhs.js:290 le + n => len xhs.js:290 len + g => leng xhs.js:290 leng + t => lengt xhs.js:290 lengt + h => length xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + C => charC xhs.js:290 charC + o => charCo xhs.js:290 charCo + d => charCod xhs.js:290 charCod + e => charCode xhs.js:290 charCode + A => charCodeA xhs.js:290 charCodeA + t => charCodeAt xhs.js:490 238 '>>' 4 '=>' 14 xhs.js:278 238 '&' 15 '=>' 14 xhs.js:290 e + e => ee xhs.js:290 95 + ee => 95ee xhs.js:290 l + e => le xhs.js:290 le + n => len xhs.js:290 len + g => leng xhs.js:290 leng + t => lengt xhs.js:290 lengt + h => length xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + C => charC xhs.js:290 charC + o => charCo xhs.js:290 charCo + d => charCod xhs.js:290 charCod + e => charCode xhs.js:290 charCode + A => charCodeA xhs.js:290 charCodeA + t => charCodeAt xhs.js:490 191 '>>' 4 '=>' 11 xhs.js:278 191 '&' 15 '=>' 15 xhs.js:290 b + f => bf xhs.js:290 95ee + bf => 95eebf 

看该日志，有了一些经验的话，就猜测:

验证下呗：

果然是正确的，那么:

讯享网9 => 9 5 => 5 11 => b 14 => e 15 => f 

//这个把类似的都看一遍的话就比较容易看出来了，其实就是10以内的数直接转string，大于等于10的模10取余，从’a’右偏余数个位置，比如11%10=1 => *(&a+1) = b(取地址的写法都出来了……理解就行，严格取地址偏移的话，应该是+span，span是js中char所占的位宽)

js还原代码：

function get_payload(lm){ 
    let payload = "" for (let i = 0; i < lm.length; i++){ 
    let code = lm.charCodeAt(i) let nums = [code >> 4,code & 15] let num; for (num of nums){ 
    if (num >= 10){ 
    payload += String.fromCharCode(num % 10 + 97) }else{ 
    payload += num } } } return payload } 

2.3 乱码的由来

老办法，我们来到乱码产生的第一个位置，寻找线索：

讯享网xhs.js:290 eDE9MzQ3YzI2NmM0MDk0MGExZmU2MjNhMmQ2OGUyZTY2Njk7eDI9MHwwfDB8MXwwfDB8MXwwfDB8MHwxfDB8MHwwfDA7eDM9MTg4YWFmOTI2OTBjZmpncWxmNnJvNjBmbWQ1d3Qwa2N6aGQzbHQ3MnA1MDAwMDI1NDc4Mjt4ND0xNjg2OTg3NzM1MDM5Ow= + = => eDE9MzQ3YzI2NmM0MDk0MGExZmU2MjNhMmQ2OGUyZTY2Njk7eDI9MHwwfDB8MXwwfDB8MXwwfDB8MHwxfDB8MHwwfDA7eDM9MTg4YWFmOTI2OTBjZmpncWxmNnJvNjBmbWQ1d3Qwa2N6aGQzbHQ3MnA1MDAwMDI1NDc4Mjt4ND0xNjg2OTg3NzM1MDM5Ow== xhs.js:290 l + e => le xhs.js:290 le + n => len xhs.js:290 len + g => leng xhs.js:290 leng + t => lengt xhs.js:290 lengt + h => length xhs.js:290 s + t => st xhs.js:290 st + a => sta xhs.js:290 sta + c => stac xhs.js:290 stac + k => stack xhs.js:290 stack + O => stackO xhs.js:290 stackO + u => stackOu xhs.js:290 stackOu + t => stackOut xhs.js:290 stackOut + p => stackOutp xhs.js:290 stackOutp + u => stackOutpu xhs.js:290 stackOutpu + t => stackOutput xhs.js:290 s + t => st xhs.js:290 st + a => sta xhs.js:290 sta + c => stac xhs.js:290 stac + k => stack xhs.js:290 stack + I => stackI xhs.js:290 stackI + n => stackIn xhs.js:290 stackIn + p => stackInp xhs.js:290 stackInp + u => stackInpu xhs.js:290 stackInpu + t => stackInput xhs.js:290 s + t => st xhs.js:290 st + a => sta xhs.js:290 sta + c => stac xhs.js:290 stac + k => stack xhs.js:290 stack + O => stackO xhs.js:290 stackO + u => stackOu xhs.js:290 stackOu + t => stackOut xhs.js:290 stackOut + p => stackOutp xhs.js:290 stackOutp + u => stackOutpu xhs.js:290 stackOutpu + t => stackOutput xhs.js:290 s + h => sh xhs.js:290 sh + o => sho xhs.js:290 sho + u => shou xhs.js:290 shou + l => shoul xhs.js:290 shoul + d => should xhs.js:290 should + J => shouldJ xhs.js:290 shouldJ + o => shouldJo xhs.js:290 shouldJo + k => shouldJok xhs.js:290 shouldJok + e => shouldJoke xhs.js:290 shouldJoke + r => shouldJoker xhs.js:290 x + 1 => x1 xhs.js:290 5 + 1 => 51 xhs.js:290 e + n => en xhs.js:290 en + c => enc xhs.js:290 enc + r => encr xhs.js:290 encr + y => encry xhs.js:290 encry + p => encryp xhs.js:290 encryp + t => encrypt xhs.js:290 s + t => st xhs.js:290 st + a => sta xhs.js:290 sta + c => stac xhs.js:290 stac + k => stack xhs.js:290 stack + I => stackI xhs.js:290 stackI + n => stackIn xhs.js:290 stackIn + p => stackInp xhs.js:290 stackInp + u => stackInpu xhs.js:290 stackInpu + t => stackInput xhs.js:290 d + e => de xhs.js:290 de + c => dec xhs.js:290 dec + r => decr xhs.js:290 decr + y => decry xhs.js:290 decry + p => decryp xhs.js:290 decryp + t => decrypt xhs.js:290 s + t => st xhs.js:290 st + a => sta xhs.js:290 sta + c => stac xhs.js:290 stac + k => stack xhs.js:290 stack + I => stackI xhs.js:290 stackI + n => stackIn xhs.js:290 stackIn + p => stackInp xhs.js:290 stackInp + u => stackInpu xhs.js:290 stackInpu + t => stackInput xhs.js:290 s + t => st xhs.js:290 st + a => sta xhs.js:290 sta + c => stac xhs.js:290 stac + k => stack xhs.js:290 stack + I => stackI xhs.js:290 stackI + n => stackIn xhs.js:290 stackIn + p => stackInp xhs.js:290 stackInp + u => stackInpu xhs.js:290 stackInpu + t => stackInput xhs.js:290 stackInput + 2 => stackInput2 xhs.js:290 s + t => st xhs.js:290 st + a => sta xhs.js:290 sta + c => stac xhs.js:290 stac + k => stack xhs.js:290 stack + I => stackI xhs.js:290 stackI + n => stackIn xhs.js:290 stackIn + p => stackInp xhs.js:290 stackInp + u => stackInpu xhs.js:290 stackInpu + t => stackInput xhs.js:290 stackInput + 2 => stackInput2 xhs.js:290 l + e => le xhs.js:290 le + n => len xhs.js:290 len + g => leng xhs.js:290 leng + t => lengt xhs.js:290 lengt + h => length xhs.js:290 l + e => le xhs.js:290 le + n => len xhs.js:290 len + g => leng xhs.js:290 leng + t => lengt xhs.js:290 lengt + h => length xhs.js:290 e + n => en xhs.js:290 en + c => enc xhs.js:290 enc + r => encr xhs.js:290 encr + y => encry xhs.js:290 encry + p => encryp xhs.js:290 encryp + t => encrypt xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + C => charC xhs.js:290 charC + o => charCo xhs.js:290 charCo + d => charCod xhs.js:290 charCod + e => charCode xhs.js:290 charCode + A => charCodeA xhs.js:290 charCodeA + t => charCodeAt xhs.js:384 101 '<<' 24 '=>'  xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + C => charC xhs.js:290 charC + o => charCo xhs.js:290 charCo + d => charCod xhs.js:290 charCod + e => charCode xhs.js:290 charCode + A => charCodeA xhs.js:290 charCodeA + t => charCodeAt xhs.js:384 68 '<<' 16 '=>'  xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + C => charC xhs.js:290 charC + o => charCo xhs.js:290 charCo + d => charCod xhs.js:290 charCod + e => charCode xhs.js:290 charCode + A => charCodeA xhs.js:290 charCodeA + t => charCodeAt xhs.js:384 69 '<<' 8 '=>' 17664 xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + C => charC xhs.js:290 charC + o => charCo xhs.js:290 charCo + d => charCod xhs.js:290 charCod + e => charCode xhs.js:290 charCode + A => charCodeA xhs.js:290 charCodeA + t => charCodeAt xhs.js:426  '|'  '=>'  xhs.js:426  '|' 17664 '=>'  xhs.js:426  '|' 57 '=>'  xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + C => charC xhs.js:290 charC + o => charCo xhs.js:290 charCo + d => charCod xhs.js:290 charCod + e => charCode xhs.js:290 charCode + A => charCodeA xhs.js:290 charCodeA + t => charCodeAt xhs.js:384 77 '<<' 24 '=>'  xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + C => charC xhs.js:290 charC + o => charCo xhs.js:290 charCo + d => charCod xhs.js:290 charCod + e => charCode xhs.js:290 charCode + A => charCodeA xhs.js:290 charCodeA + t => charCodeAt xhs.js:384 122 '<<' 16 '=>'  xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + C => charC xhs.js:290 charC + o => charCo xhs.js:290 charCo + d => charCod xhs.js:290 charCod + e => charCode xhs.js:290 charCode + A => charCodeA xhs.js:290 charCodeA + t => charCodeAt xhs.js:384 81 '<<' 8 '=>' 20736 xhs.js:290 c + h => ch xhs.js:290 ch + a => cha xhs.js:290 cha + r => char xhs.js:290 char + C => charC xhs.js:290 charC + o => charCo xhs.js:290 charCo + d => charCod xhs.js:290 charCod + e => charCode xhs.js:290 charCode + A => charCodeA xhs.js:290 charCodeA + t => charCodeAt xhs.js:426  '|'  '=>'  xhs.js:426  '|' 20736 '=>'  xhs.js:426  '|' 51 '=>'  xhs.js:282  '>>>' 4 '=>'  xhs.js:531  '^'  '=>'  xhs.js:278  '&'  '=>'  xhs.js:531  '^'  '=>'  xhs.js:384  '<<' 4 '=>' - xhs.js:531  '^' - '=>' - xhs.js:282 - '>>>' 16 '=>' 54692 xhs.js:531 54692 '^'  '=>'  xhs.js:278  '&' 65535 '=>' 33175 xhs.js:531  '^' 33175 '=>'  xhs.js:384 33175 '<<' 16 '=>' - xhs.js:531 - '^' - '=>'  xhs.js:282  '>>>' 2 '=>'  xhs.js:531  '^'  '=>'  xhs.js:278  '&'  '=>'  xhs.js:531  '^'  '=>'  xhs.js:384  '<<' 2 '=>'  xhs.js:531  '^'  '=>'  xhs.js:282  '>>>' 8 '=>'  xhs.js:531  '^'  '=>'  xhs.js:278  '&'  '=>'  xhs.js:531  '^'  '=>'  xhs.js:384  '<<' 8 '=>'  xhs.js:531  '^'  '=>'  xhs.js:282  '>>>' 1 '=>'  xhs.js:531  '^'  '=>'  xhs.js:278  '&'  '=>'  xhs.js:531  '^'  '=>'  xhs.js:384  '<<' 1 '=>'  xhs.js:531  '^'  '=>'  xhs.js:384  '<<' 1 '=>' - xhs.js:282  '>>>' 31 '=>' 0 xhs.js:426 - '|' 0 '=>' - xhs.js:384  '<<' 1 '=>'  xhs.js:282  '>>>' 31 '=>' 0 xhs.js:426  '|' 0 '=>'  xhs.js:290 0 '+' 1 '=>' 1 xhs.js:290 0 '+' 2 '=>' 2 xhs.js:531  '^'  '=>'  xhs.js:282  '>>>' 4 '=>'  xhs.js:384  '<<' 28 '=>' 0 xhs.js:426  '|' 0 '=>'  xhs.js:290 0 '+' 1 '=>' 1 xhs.js:531  '^'  '=>'  xhs.js:282  '>>>' 24 '=>' 10 xhs.js:278 10 '&' 63 '=>' 10 xhs.js:282  '>>>' 16 '=>' 2676 xhs.js:278 2676 '&' 63 '=>' 52 xhs.js:426 - '|'  '=>' - xhs.js:282  '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 25 xhs.js:426 - '|' 0 '=>' - xhs.js:278  '&' 63 '=>' 41 xhs.js:426 - '|' 64 '=>' - xhs.js:282  '>>>' 24 '=>' 28 xhs.js:278 28 '&' 63 '=>' 28 xhs.js:426 - '|' 0 '=>' - xhs.js:282  '>>>' 16 '=>' 7205 xhs.js:278 7205 '&' 63 '=>' 37 xhs.js:426 - '|'  '=>' - xhs.js:282  '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 21 xhs.js:426 - '|'  '=>' - xhs.js:278  '&' 63 '=>' 29 xhs.js:426 - '|' 2 '=>' - xhs.js:531 - '^' - '=>'  xhs.js:290 0 '+' 2 '=>' 2 xhs.js:531  '^'  '=>'  xhs.js:282  '>>>' 4 '=>'  xhs.js:384  '<<' 28 '=>' - xhs.js:426  '|' - '=>' - xhs.js:290 2 '+' 1 '=>' 3 xhs.js:531 - '^'  '=>' - xhs.js:282  '>>>' 24 '=>' 46 xhs.js:278 46 '&' 63 '=>' 46 xhs.js:282  '>>>' 16 '=>' 11886 xhs.js:278 11886 '&' 63 '=>' 46 xhs.js:426 32768 '|' 8321 '=>' 41089 xhs.js:282  '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 48 xhs.js:426 41089 '|'  '=>'  xhs.js:278  '&' 63 '=>' 19 xhs.js:426  '|' 4160 '=>'  xhs.js:282 - '>>>' 24 '=>' 166 xhs.js:278 166 '&' 63 '=>' 38 xhs.js:426  '|'  '=>'  xhs.js:282 - '>>>' 16 '=>' 42605 xhs.js:278 42605 '&' 63 '=>' 45 xhs.js:426  '|' 512 '=>'  xhs.js:282 - '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 54 xhs.js:426  '|'  '=>'  xhs.js:278 - '&' 63 '=>' 30 xhs.js:426  '|'  '=>'  xhs.js:531  '^'  '=>'  xhs.js:290 2 '+' 2 '=>' 4 xhs.js:531  '^'  '=>'  xhs.js:282  '>>>' 4 '=>'  xhs.js:384  '<<' 28 '=>'  xhs.js:426  '|'  '=>'  xhs.js:290 4 '+' 1 '=>' 5 xhs.js:531  '^'  '=>'  xhs.js:282  '>>>' 24 '=>' 75 xhs.js:278 75 '&' 63 '=>' 11 xhs.js:282  '>>>' 16 '=>' 19244 xhs.js:278 19244 '&' 63 '=>' 44 xhs.js:426 - '|'  '=>' - xhs.js:282  '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 10 xhs.js:426 - '|'  '=>' - xhs.js:278  '&' 63 '=>' 31 xhs.js:426 - '|'  '=>' - xhs.js:282  '>>>' 24 '=>' 36 xhs.js:278 36 '&' 63 '=>' 36 xhs.js:426 - '|'  '=>' - xhs.js:282  '>>>' 16 '=>' 9304 xhs.js:278 9304 '&' 63 '=>' 24 xhs.js:426 - '|'  '=>' - xhs.js:282  '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 43 xhs.js:426 - '|'  '=>' - xhs.js:278  '&' 63 '=>' 9 xhs.js:426 - '|'  '=>' - xhs.js:531  '^' - '=>' - xhs.js:290 4 '+' 2 '=>' 6 xhs.js:531 - '^'  '=>' - xhs.js:282 - '>>>' 4 '=>'  xhs.js:384 - '<<' 28 '=>' 0 xhs.js:426  '|' 0 '=>'  xhs.js:290 6 '+' 1 '=>' 7 xhs.js:531  '^'  '=>'  xhs.js:282 - '>>>' 24 '=>' 163 xhs.js:278 163 '&' 63 '=>' 35 xhs.js:282 - '>>>' 16 '=>' 41857 xhs.js:278 41857 '&' 63 '=>' 1 xhs.js:426  '|' 8321 '=>'  xhs.js:282 - '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 12 xhs.js:426  '|'  '=>'  xhs.js:278 - '&' 63 '=>' 4 xhs.js:426  '|'  '=>'  xhs.js:282  '>>>' 24 '=>' 51 xhs.js:278 51 '&' 63 '=>' 51 xhs.js:426  '|'  '=>'  xhs.js:282  '>>>' 16 '=>' 13303 xhs.js:278 13303 '&' 63 '=>' 55 xhs.js:426  '|'  '=>'  xhs.js:282  '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 27 xhs.js:426  '|'  '=>'  xhs.js:278  '&' 63 '=>' 44 xhs.js:426  '|'  '=>'  xhs.js:531  '^'  '=>'  xhs.js:290 6 '+' 2 '=>' 8 xhs.js:531  '^'  '=>'  xhs.js:282  '>>>' 4 '=>'  xhs.js:384  '<<' 28 '=>' - xhs.js:426  '|' - '=>' - xhs.js:290 8 '+' 1 '=>' 9 xhs.js:531 - '^'  '=>' - xhs.js:282  '>>>' 24 '=>' 54 xhs.js:278 54 '&' 63 '=>' 54 xhs.js:282  '>>>' 16 '=>' 13897 xhs.js:278 13897 '&' 63 '=>' 9 xhs.js:426 - '|'  '=>' - xhs.js:282  '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 51 xhs.js:426 - '|'  '=>' - xhs.js:278  '&' 63 '=>' 45 xhs.js:426 - '|'  '=>' - xhs.js:282 - '>>>' 24 '=>' 249 xhs.js:278 249 '&' 63 '=>' 57 xhs.js:426 - '|'  '=>' - xhs.js:282 - '>>>' 16 '=>' 63931 xhs.js:278 63931 '&' 63 '=>' 59 xhs.js:426 - '|'  '=>' - xhs.js:282 - '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 32 xhs.js:426 - '|'  '=>' - xhs.js:278 - '&' 63 '=>' 27 xhs.js:426 - '|'  '=>' - xhs.js:531 - '^' - '=>'  xhs.js:290 8 '+' 2 '=>' 10 xhs.js:531  '^'  '=>'  xhs.js:282  '>>>' 4 '=>'  xhs.js:384  '<<' 28 '=>'  xhs.js:426  '|'  '=>'  xhs.js:290 10 '+' 1 '=>' 11 xhs.js:531  '^'  '=>'  xhs.js:282  '>>>' 24 '=>' 14 xhs.js:278 14 '&' 63 '=>' 14 xhs.js:282  '>>>' 16 '=>' 3710 xhs.js:278 3710 '&' 63 '=>' 62 xhs.js:426 32 '|' 8192 '=>' 8224 xhs.js:282  '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 11 xhs.js:426 8224 '|'  '=>'  xhs.js:278  '&' 63 '=>' 17 xhs.js:426  '|'  '=>'  xhs.js:282  '>>>' 24 '=>' 11 xhs.js:278 11 '&' 63 '=>' 11 xhs.js:426  '|' 1024 '=>'  xhs.js:282  '>>>' 16 '=>' 2873 xhs.js:278 2873 '&' 63 '=>' 57 xhs.js:426  '|'  '=>'  xhs.js:282  '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 62 xhs.js:426  '|'  '=>'  xhs.js:278  '&' 63 '=>' 12 xhs.js:426  '|' 2 '=>'  xhs.js:531  '^'  '=>'  xhs.js:290 10 '+' 2 '=>' 12 xhs.js:531  '^'  '=>'  xhs.js:282  '>>>' 4 '=>'  xhs.js:384  '<<' 28 '=>'  xhs.js:426  '|'  '=>'  xhs.js:290 12 '+' 1 '=>' 13 xhs.js:531  '^'  '=>'  xhs.js:282  '>>>' 24 '=>' 52 xhs.js:278 52 '&' 63 '=>' 52 xhs.js:282  '>>>' 16 '=>' 13433 xhs.js:278 13433 '&' 63 '=>' 57 xhs.js:426  '|' 8320 '=>'  xhs.js:282  '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 56 xhs.js:426  '|' 16384 '=>'  xhs.js:278  '&' 63 '=>' 34 xhs.js:426  '|'  '=>'  xhs.js:282  '>>>' 24 '=>' 75 xhs.js:278 75 '&' 63 '=>' 11 xhs.js:426  '|' 1024 '=>'  xhs.js:282  '>>>' 16 '=>' 19225 xhs.js:278 19225 '&' 63 '=>' 25 xhs.js:426  '|'  '=>'  xhs.js:282  '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 11 xhs.js:426  '|'  '=>'  xhs.js:278  '&' 63 '=>' 27 xhs.js:426  '|'  '=>'  xhs.js:531  '^'  '=>'  xhs.js:290 12 '+' 2 '=>' 14 xhs.js:531  '^'  '=>'  xhs.js:282  '>>>' 4 '=>'  xhs.js:384  '<<' 28 '=>' 0 xhs.js:426  '|' 0 '=>'  xhs.js:290 14 '+' 1 '=>' 15 xhs.js:531  '^'  '=>'  xhs.js:282  '>>>' 24 '=>' 114 xhs.js:278 114 '&' 63 '=>' 50 xhs.js:282  '>>>' 16 '=>' 29282 xhs.js:278 29282 '&' 63 '=>' 34 xhs.js:426  '|'  '=>'  xhs.js:282  '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 14 xhs.js:426  '|'  '=>'  xhs.js:278  '&' 63 '=>' 32 xhs.js:426  '|'  '=>'  xhs.js:282  '>>>' 24 '=>' 9 xhs.js:278 9 '&' 63 '=>' 9 xhs.js:426  '|'  '=>'  xhs.js:282  '>>>' 16 '=>' 2424 xhs.js:278 2424 '&' 63 '=>' 56 xhs.js:426  '|'  '=>'  xhs.js:282  '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 27 xhs.js:426  '|'  '=>'  xhs.js:278  '&' 63 '=>' 9 xhs.js:426  '|'  '=>'  xhs.js:531  '^'  '=>'  xhs.js:290 14 '+' 2 '=>' 16 xhs.js:531  '^'  '=>'  xhs.js:282  '>>>' 4 '=>'  xhs.js:384  '<<' 28 '=>'  xhs.js:426  '|'  '=>'  xhs.js:290 16 '+' 1 '=>' 17 xhs.js:531  '^'  '=>'  xhs.js:282  '>>>' 24 '=>' 111 xhs.js:278 111 '&' 63 '=>' 47 xhs.js:282  '>>>' 16 '=>' 28620 xhs.js:278 28620 '&' 63 '=>' 12 xhs.js:426 - '|' 129 '=>' - xhs.js:282  '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 46 xhs.js:426 - '|'  '=>' - xhs.js:278  '&' 63 '=>' 19 xhs.js:426 - '|' 4160 '=>' - xhs.js:282  '>>>' 24 '=>' 107 xhs.js:278 107 '&' 63 '=>' 43 xhs.js:426 - '|'  '=>' - xhs.js:282  '>>>' 16 '=>' 27528 xhs.js:278 27528 '&' 63 '=>' 8 xhs.js:426 - '|'  '=>' - xhs.js:282  '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 14 xhs.js:426 - '|'  '=>' - xhs.js:278  '&' 63 '=>' 42 xhs.js:426 - '|'  '=>' - xhs.js:531  '^' - '=>' - xhs.js:290 16 '+' 2 '=>' 18 xhs.js:531 - '^'  '=>' - xhs.js:282 - '>>>' 4 '=>'  xhs.js:384 - '<<' 28 '=>' - xhs.js:426  '|' - '=>' - xhs.js:290 18 '+' 1 '=>' 19 xhs.js:531 - '^'  '=>' - xhs.js:282 - '>>>' 24 '=>' 244 xhs.js:278 244 '&' 63 '=>' 52 xhs.js:282 - '>>>' 16 '=>' 62496 xhs.js:278 62496 '&' 63 '=>' 32 xhs.js:426  '|'  '=>'  xhs.js:282 - '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 41 xhs.js:426  '|'  '=>'  xhs.js:278 - '&' 63 '=>' 49 xhs.js:426  '|'  '=>'  xhs.js:282 - '>>>' 24 '=>' 223 xhs.js:278 223 '&' 63 '=>' 31 xhs.js:426  '|'  '=>'  xhs.js:282 - '>>>' 16 '=>' 57094 xhs.js:278 57094 '&' 63 '=>' 6 xhs.js:426  '|'  '=>'  xhs.js:282 - '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 20 xhs.js:426  '|'  '=>'  xhs.js:278 - '&' 63 '=>' 57 xhs.js:426  '|'  '=>'  xhs.js:531  '^'  '=>'  xhs.js:290 18 '+' 2 '=>' 20 xhs.js:531  '^'  '=>'  xhs.js:282  '>>>' 4 '=>'  xhs.js:384  '<<' 28 '=>' - xhs.js:426  '|' - '=>' - xhs.js:290 20 '+' 1 '=>' 21 xhs.js:531 - '^'  '=>' - xhs.js:282  '>>>' 24 '=>' 13 xhs.js:278 13 '&' 63 '=>' 13 xhs.js:282  '>>>' 16 '=>' 3454 xhs.js:278 3454 '&' 63 '=>' 62 xhs.js:426  '|' 8192 '=>'  xhs.js:282  '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 60 xhs.js:426  '|'  '=>'  xhs.js:278  '&' 63 '=>' 11 xhs.js:426  '|'  '=>'  xhs.js:282 - '>>>' 24 '=>' 192 xhs.js:278 192 '&' 63 '=>' 0 xhs.js:426  '|'  '=>'  xhs.js:282 - '>>>' 16 '=>' 49280 xhs.js:278 49280 '&' 63 '=>' 0 xhs.js:426  '|' 520 '=>'  xhs.js:282 - '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 62 xhs.js:426  '|'  '=>'  xhs.js:278 - '&' 63 '=>' 43 xhs.js:426  '|'  '=>'  xhs.js:531 - '^'  '=>' - xhs.js:290 20 '+' 2 '=>' 22 xhs.js:531 - '^'  '=>' - xhs.js:282 - '>>>' 4 '=>'  xhs.js:384 - '<<' 28 '=>'  xhs.js:426  '|'  '=>'  xhs.js:290 22 '+' 1 '=>' 23 xhs.js:531  '^'  '=>'  xhs.js:282 - '>>>' 24 '=>' 211 xhs.js:278 211 '&' 63 '=>' 19 xhs.js:282 - '>>>' 16 '=>' 54093 xhs.js:278 54093 '&' 63 '=>' 13 xhs.js:426 0 '|' 0 '=>' 0 xhs.js:282 - '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 4 xhs.js:426 0 '|'  '=>'  xhs.js:278 - '&' 63 '=>' 4 xhs.js:426  '|'  '=>'  xhs.js:282  '>>>' 24 '=>' 73 xhs.js:278 73 '&' 63 '=>' 9 xhs.js:426  '|'  '=>'  xhs.js:282  '>>>' 16 '=>' 18722 xhs.js:278 18722 '&' 63 '=>' 34 xhs.js:426  '|'  '=>'  xhs.js:282  '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 4 xhs.js:426  '|'  '=>'  xhs.js:278  '&' 63 '=>' 56 xhs.js:426  '|' 0 '=>'  xhs.js:531  '^'  '=>'  xhs.js:290 22 '+' 2 '=>' 24 xhs.js:531  '^'  '=>'  xhs.js:282  '>>>' 4 '=>'  xhs.js:384  '<<' 28 '=>'  xhs.js:426  '|'  '=>'  xhs.js:290 24 '+' 1 '=>' 25 xhs.js:531  '^'  '=>'  xhs.js:282  '>>>' 24 '=>' 48 xhs.js:278 48 '&' 63 '=>' 48 xhs.js:282  '>>>' 16 '=>' 12289 xhs.js:278 12289 '&' 63 '=>' 1 xhs.js:426 32800 '|' 8321 '=>' 41121 xhs.js:282  '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 7 xhs.js:426 41121 '|'  '=>'  xhs.js:278  '&' 63 '=>' 19 xhs.js:426  '|' 4160 '=>'  xhs.js:282  '>>>' 24 '=>' 86 xhs.js:278 86 '&' 63 '=>' 22 xhs.js:426  '|'  '=>'  xhs.js:282  '>>>' 16 '=>' 22160 xhs.js:278 22160 '&' 63 '=>' 16 xhs.js:426  '|'  '=>'  xhs.js:282  '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 20 xhs.js:426  '|'  '=>'  xhs.js:278  '&' 63 '=>' 24 xhs.js:426  '|'  '=>'  xhs.js:531 - '^'  '=>' - xhs.js:290 24 '+' 2 '=>' 26 xhs.js:531 - '^'  '=>' - xhs.js:282 - '>>>' 4 '=>'  xhs.js:384 - '<<' 28 '=>'  xhs.js:426  '|'  '=>'  xhs.js:290 26 '+' 1 '=>' 27 xhs.js:531  '^'  '=>'  xhs.js:282 - '>>>' 24 '=>' 182 xhs.js:278 182 '&' 63 '=>' 54 xhs.js:282 - '>>>' 16 '=>' 46635 xhs.js:278 46635 '&' 63 '=>' 43 xhs.js:426 - '|' 1 '=>' - xhs.js:282 - '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 43 xhs.js:426 - '|' 16400 '=>' - xhs.js:278 - '&' 63 '=>' 26 xhs.js:426 - '|' 0 '=>' - xhs.js:282  '>>>' 24 '=>' 124 xhs.js:278 124 '&' 63 '=>' 60 xhs.js:426 - '|' 65540 '=>' - xhs.js:282  '>>>' 16 '=>' 31984 xhs.js:278 31984 '&' 63 '=>' 48 xhs.js:426 - '|'  '=>' - xhs.js:282  '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 21 xhs.js:426 - '|'  '=>' - xhs.js:278  '&' 63 '=>' 50 xhs.js:426 - '|'  '=>' - xhs.js:531  '^' - '=>' - xhs.js:290 26 '+' 2 '=>' 28 xhs.js:531 - '^'  '=>' - xhs.js:282 - '>>>' 4 '=>'  xhs.js:384 - '<<' 28 '=>' - xhs.js:426  '|' - '=>' - xhs.js:290 28 '+' 1 '=>' 29 xhs.js:531 - '^'  '=>' - xhs.js:282 - '>>>' 24 '=>' 206 xhs.js:278 206 '&' 63 '=>' 14 xhs.js:282 - '>>>' 16 '=>' 52751 xhs.js:278 52751 '&' 63 '=>' 15 xhs.js:426 32 '|'  '=>'  xhs.js:282 - '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 57 xhs.js:426  '|'  '=>'  xhs.js:278 - '&' 63 '=>' 42 xhs.js:426  '|'  '=>'  xhs.js:282 - '>>>' 24 '=>' 160 xhs.js:278 160 '&' 63 '=>' 32 xhs.js:426  '|' 65536 '=>'  xhs.js:282 - '>>>' 16 '=>' 41082 xhs.js:278 41082 '&' 63 '=>' 58 xhs.js:426  '|' 520 '=>'  xhs.js:282 - '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 43 xhs.js:426  '|'  '=>'  xhs.js:278 - '&' 63 '=>' 25 xhs.js:426  '|' 2048 '=>'  xhs.js:531 - '^'  '=>' - xhs.js:290 28 '+' 2 '=>' 30 xhs.js:531 - '^'  '=>' - xhs.js:282 - '>>>' 4 '=>'  xhs.js:384 - '<<' 28 '=>' - xhs.js:426  '|' - '=>' - xhs.js:290 30 '+' 1 '=>' 31 xhs.js:531 - '^'  '=>' - xhs.js:282 - '>>>' 24 '=>' 189 xhs.js:278 189 '&' 63 '=>' 61 xhs.js:282 - '>>>' 16 '=>' 48584 xhs.js:278 48584 '&' 63 '=>' 8 xhs.js:426 - '|' 0 '=>' - xhs.js:282 - '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 23 xhs.js:426 - '|'  '=>' - xhs.js:278 - '&' 63 '=>' 45 xhs.js:426 - '|'  '=>' - xhs.js:282 - '>>>' 24 '=>' 231 xhs.js:278 231 '&' 63 '=>' 39 xhs.js:426 - '|' 1024 '=>' - xhs.js:282 - '>>>' 16 '=>' 59348 xhs.js:278 59348 '&' 63 '=>' 20 xhs.js:426 - '|'  '=>' - xhs.js:282 - '>>>' 8 '=>'  xhs.js:278  '&' 63 '=>' 31 xhs.js:426 - '|'  '=>' - xhs.js:278 - '&' 63 '=>' 10 xhs.js:426 - '|' 0 '=>' - xhs.js:531 - '^' - '=>'  xhs.js:290 30 '+' 2 '=>' 32 xhs.js:290 0 '+' 3 '=>' 3 xhs.js:282  '>>>' 1 '=>'  xhs.js:384  '<<' 31 '=>' - xhs.js:426  '|' - '=>' - xhs.js:282 - '>>>' 1 '=>'  xhs.js:384 - '<<' 31 '=>' - xhs.js:426  '|' - '=>' - xhs.js:282 - '>>>' 1 '=>'  xhs.js:531  '^' - '=>' - xhs.js:278 - '&'  '=>'  xhs.js:531 - '^'  '=>' - xhs.js:384  '<<' 1 '=>'  xhs.js:531 - '^'  '=>' - xhs.js:282 - '>>>' 8 '=>'  xhs.js:531  '^' - '=>' - xhs.js:278 - '&'  '=>'  xhs.js:531 - '^'  '=>' - xhs.js:384  '<<' 8 '=>'  xhs.js:531 - '^'  '=>' - xhs.js:282 - '>>>' 2 '=>'  xhs.js:531  '^' - '=>' - xhs.js:278 - '&'  '=>'  xhs.js:531 - '^'  '=>' - xhs.js:384  '<<' 2 '=>'  xhs.js:531 - '^'  '=>' - xhs.js:282 - '>>>' 16 '=>' 43981 xhs.js:531 43981 '^' - '=>' - xhs.js:278 - '&' 65535 '=>' 52819 xhs.js:531 - '^' 52819 '=>' - xhs.js:384 52819 '<<' 16 '=>' - xhs.js:531 - '^' - '=>'  xhs.js:282  '>>>' 4 '=>'  xhs.js:531  '^' - '=>' - xhs.js:278 - '&'  '=>'  xhs.js:531 - '^'  '=>' - xhs.js:384  '<<' 4 '=>' - xhs.js:531  '^' - '=>' - xhs.js:290 f + r => fr xhs.js:290 fr + o => fro xhs.js:290 fro + m => from xhs.js:290 from + C => fromC xhs.js:290 fromC + h => fromCh xhs.js:290 fromCh + a => fromCha xhs.js:290 fromCha + r => fromChar xhs.js:290 fromChar + C => fromCharC xhs.js:290 fromCharC + o => fromCharCo xhs.js:290 fromCharCo + d => fromCharCod xhs.js:290 fromCharCod + e => fromCharCode xhs.js:282 - '>>>' 24 '=>' 149 xhs.js:282 - '>>>' 16 '=>' 38382 xhs.js:278 38382 '&' 255 '=>' 238 xhs.js:282 - '>>>' 8 '=>'  xhs.js:278  '&' 255 '=>' 191 xhs.js:278 - '&' 255 '=>' 211 xhs.js:282 - '>>>' 24 '=>' 230 xhs.js:282 - '>>>' 16 '=>' 59001 xhs.js:278 59001 '&' 255 '=>' 121 xhs.js:282 - '>>>' 8 '=>'  xhs.js:278  '&' 255 '=>' 165 xhs.js:278 - '&' 255 '=>' 197 xhs.js:290 + •î¿Óæy¥Å => •î¿Óæy¥Å 

从日志最后那里看到fromCharCode，看一下乱码的字符对应的charcode是啥：

最终搞出来了，附上成功截图

需要交流：