Created
June 24, 2023 01:45
-
-
Save jluims/b07947eff6fbdd30e06936348fb53c77 to your computer and use it in GitHub Desktop.
ketsu key algorithm reverse engineered
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// NOTE: Most if not all of these console.logs were in the original obfuscated code, I commented most of them. :) | |
function generateUUID() { | |
var _0x3e34f1 = new Date().getTime(); | |
var _0x96f645 = | |
(typeof performance !== "undefined" && | |
performance.now && | |
performance.now() * 1000) || | |
0; | |
return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace( | |
/[xy]/g, | |
function (_0x396bdd) { | |
var _0x45adf8 = Math.random() * 16; | |
if (_0x3e34f1 > 0) { | |
_0x45adf8 = (_0x3e34f1 + _0x45adf8) % 16 | 0; | |
_0x3e34f1 = Math.floor(_0x3e34f1 / 16); | |
} else { | |
_0x45adf8 = (_0x96f645 + _0x45adf8) % 16 | 0; | |
_0x96f645 = Math.floor(_0x96f645 / 16); | |
} | |
return (_0x396bdd === "x" ? _0x45adf8 : (_0x45adf8 & 3) | 8).toString(16); | |
} | |
); | |
} | |
// generate a random word with letters a-z with a certain length | |
function makeWord(length) { | |
var str = ""; | |
var alphabet = "abcdefghijklmnopqrstuvwxyz"; | |
for (var i = 0; i < length; i++) { | |
str += alphabet.charAt(Math.floor(Math.random() * alphabet.length)); | |
} | |
return str; | |
} | |
var generateKetsuLink = function (urlStr) { | |
var url = new URL(urlStr); | |
var params = new URLSearchParams(url.search); | |
var key = ""; | |
var otherParams = []; | |
var paramIndex = 0; | |
for (var param of params.entries()) { | |
if (paramIndex == 0) { | |
// first parameter checked | |
key = param[1]; | |
} | |
if (paramIndex == 1) { | |
// second parameter checked | |
secondParam = param[1]; | |
} else if (paramIndex > 1) { | |
// any other parameters | |
otherParams.push(param[1]); | |
} | |
paramIndex++; | |
} | |
var hourInRussia = (new Date().getUTCHours() + 9) % 24; | |
if (hourInRussia == 0) { | |
// hour in asia has to be 1 or more now | |
hourInRussia = 1; | |
} | |
hourInRussia = hourInRussia * 2; // hour in asia multiplied by 2 | |
// var hourInAsiaDigits = ("" + hourInAsia).split(""); // turn it into a string and split it into an array of digits | |
var _0x285114 = ""; | |
for (var i = 0; i < otherParams.length; i++) { | |
var paramSplit = otherParams[i].split(""); | |
if (otherParams[i] == otherParams[hourInRussia % otherParams.length]) { | |
console.log("this one rocks" + paramSplit); | |
continue; | |
} | |
// loop through every character in the current parameter | |
var _0x509a26 = false; | |
for (var j = 0; j < paramSplit.length; j++) { | |
var letter = paramSplit[j]; | |
if (j + 4 > paramSplit.length - 1) { | |
// make sure we only loop until paramSplit.length - 4 or 5 | |
continue; | |
} | |
var _0x473ae6 = false; | |
for (var _0x136aca = 0; _0x136aca < 4; _0x136aca++) { | |
if (paramSplit[j + _0x136aca] == "-") { | |
_0x473ae6 = true; | |
break; | |
} | |
} | |
if (_0x473ae6) { | |
continue; | |
} | |
// console.log("here"); | |
var _0x5cad38 = parseInt(paramSplit[j]); | |
var _0x23026a = parseInt(paramSplit[j + 1]); | |
// console.log(_0x5cad38, _0x23026a); | |
if (isNaN(_0x5cad38) && isNaN(_0x23026a)) { | |
_0x509a26 = true; | |
for ( | |
var _0x5147de = j + 2; | |
_0x5147de < paramSplit.length; | |
_0x5147de++ | |
) { | |
var _0x166b9c = paramSplit[_0x5147de]; | |
var _0x2d16c7 = parseInt(_0x166b9c); | |
if (!isNaN(_0x2d16c7)) { | |
_0x285114 = _0x285114 + paramSplit[_0x5147de]; | |
} else { | |
break; | |
} | |
} | |
// console.log(paramSplit); | |
break; | |
} | |
} | |
if (_0x509a26) { | |
// console.log(_0x285114); | |
break; | |
} | |
} | |
var weirdNum = 0; | |
for (var i = 0; i < otherParams.length; i++) { | |
var paramSplit = otherParams[i].split(""); | |
if (otherParams[i] == otherParams[hourInRussia % otherParams.length]) { | |
// console.log("this one rocks" + paramSplit); | |
continue; | |
} | |
for (var j = 0; j < paramSplit.length; j++) { | |
var letter = paramSplit[j]; | |
var _0x3a2dc9 = parseInt(letter); | |
if (isNaN(_0x3a2dc9)) { | |
_0x3a2dc9 = 0; | |
} | |
if (j % 2 == 0) { | |
weirdNum = weirdNum + _0x3a2dc9; | |
} else { | |
weirdNum = weirdNum - _0x3a2dc9; | |
} | |
} | |
} | |
if (weirdNum < 0) { | |
weirdNum = weirdNum * -1; | |
} | |
// console.log(weirdNum); | |
var _0x4fd668 = []; | |
var _0x27ad78 = otherParams[hourInRussia % otherParams.length].split(""); | |
for (p of weirdNum.toString().split("")) { | |
_0x4fd668.push(_0x27ad78.pop()); | |
} | |
_0x4fd668.reverse(); | |
_0x4fd668 = _0x4fd668.join(""); | |
if (weirdNum == parseInt(_0x4fd668)) {// somehow this is used to check if a link is expired or not, weird. | |
// console.log("we are gucci bro"); | |
} else { | |
//window.location.href = red; | |
console.log("we not gucci"); | |
return; | |
} | |
// console.log("thisi is v", _0x285114); | |
if (_0x285114 == "0") { | |
var _0x3eedd5 = []; | |
var _0x46acdf = ""; | |
var _0x26a2ec = 10 + Math.floor(Math.random() * 6); | |
for (var i = 0; i < _0x26a2ec; i++) { | |
if (i == _0x26a2ec - 1) { | |
var _0x19e702 = generateUUID().split(""); | |
// console.log(_0x19e702.join()); | |
var _0x4951df = (otherParams.length + "").split(""); | |
for (var _0x5147de = 0; _0x5147de < _0x4951df.length; _0x5147de++) { | |
_0x19e702[_0x5147de] = _0x4951df[_0x5147de]; | |
} | |
_0x19e702[_0x4951df.length] = makeWord(1); | |
_0x46acdf = _0x19e702.join(""); | |
// console.log("important id" + _0x46acdf); | |
continue; | |
} | |
_0x3eedd5.push(generateUUID()); | |
} | |
var _0x509a26 = false; | |
for (var i = 0; i < _0x3eedd5.length; i++) { | |
var _0x6462dd = _0x3eedd5[i].split(""); | |
if (_0x3eedd5[i] == _0x3eedd5[hourInRussia % _0x3eedd5.length]) { | |
// console.log("this one rocks" + _0x3eedd5[i]); | |
continue; | |
} | |
for (var j = 0; j < _0x6462dd.length; j++) { | |
var letter = _0x6462dd[j]; | |
if (j + 1 + 2 + 1 > _0x6462dd.length - 1) { | |
continue; | |
} | |
var _0x473ae6 = false; | |
for (var _0x136aca = 0; _0x136aca < 4; _0x136aca++) { | |
if (_0x6462dd[j + _0x136aca] == "-") { | |
_0x473ae6 = true; | |
break; | |
} | |
} | |
if (_0x473ae6) { | |
continue; | |
} | |
var _0x5cad38 = parseInt(_0x6462dd[j]); | |
var _0x23026a = parseInt(_0x6462dd[j + 1]); | |
// console.log(_0x5cad38, _0x23026a); | |
if (isNaN(_0x5cad38) && isNaN(_0x23026a)) { | |
_0x509a26 = true; | |
var _0x5363ec = _0x285114.split(""); | |
for (var _0x5147de = 0; _0x5147de < _0x5363ec.length; _0x5147de++) { | |
_0x6462dd[j + 1 + (_0x5147de + 1)] = _0x5363ec[_0x5147de]; | |
} | |
if (!isNaN(parseInt(_0x6462dd[j + 1 + _0x5363ec.length + 1]))) { | |
_0x6462dd[j + 1 + _0x5363ec.length + 1] = makeWord(1); | |
} | |
_0x3eedd5[i] = _0x6462dd.join(""); | |
// console.log("THIS IS THE ID WITH THE VERSION MY G", _0x3eedd5[i]); | |
break; | |
} | |
} | |
if (_0x509a26) { | |
break; | |
} | |
} | |
if (!_0x509a26) { | |
var _0x4c919b = 0; | |
if (_0x4c919b == hourInRussia % _0x3eedd5.length) { | |
_0x4c919b = 1; | |
} | |
var _0x34c368 = _0x3eedd5[_0x4c919b].split(""); | |
_0x34c368[0] = makeWord(1); | |
_0x34c368[1] = makeWord(1); | |
for (var i = 0; i < _0x285114.split("").length; i++) { | |
_0x34c368[1 + (i + 1)] = _0x285114.split("")[i]; | |
} | |
_0x34c368[1 + _0x285114.split("").length + 1] = makeWord(1); | |
_0x3eedd5[_0x4c919b] = _0x34c368.join(""); | |
} | |
weirdNum = 0; | |
for (var i = 0; i < _0x3eedd5.length; i++) { | |
var paramSplit = _0x3eedd5[i].split(""); | |
if (_0x3eedd5[i] == _0x3eedd5[hourInRussia % _0x3eedd5.length]) { | |
// console.log("this one rocks" + paramSplit); | |
continue; | |
} | |
for (var j = 0; j < paramSplit.length; j++) { | |
var letter = paramSplit[j]; | |
var _0x3a2dc9 = parseInt(letter); | |
if (isNaN(_0x3a2dc9)) { | |
_0x3a2dc9 = 0; | |
} | |
if (j % 2 == 0) { | |
weirdNum = weirdNum - _0x3a2dc9; | |
} else { | |
weirdNum = weirdNum + _0x3a2dc9; | |
} | |
} | |
} | |
if (weirdNum < 0) { | |
weirdNum = weirdNum * -1; | |
} | |
var _0x27ad78 = _0x3eedd5[hourInRussia % _0x3eedd5.length].split(""); | |
var _0x6c401 = ("" + weirdNum).split(""); | |
for (var _0x5147de = 0; _0x5147de < _0x6c401.length; _0x5147de++) { | |
_0x27ad78.pop(); | |
} | |
_0x27ad78 = _0x27ad78.join("") + _0x6c401.join(""); | |
_0x3eedd5[hourInRussia % _0x3eedd5.length] = _0x27ad78; | |
// console.log("this is select", _0x27ad78); | |
} | |
var _0x122465 = url.search; | |
var _0x575984 = []; | |
for (var _0x694e88 = 0; _0x694e88 < _0x3eedd5.length; _0x694e88++) { | |
var _0x16e532 = makeWord(3); | |
while (_0x575984.includes(_0x16e532)) { | |
_0x16e532 = makeWord(3); | |
} | |
_0x122465 = _0x122465 + "&" + _0x16e532 + "=" + _0x3eedd5[_0x694e88]; | |
} | |
var _0x16e532 = makeWord(3); | |
while (_0x575984.includes(_0x16e532)) { | |
_0x16e532 = makeWord(3); | |
} | |
_0x122465 = _0x122465 + "&" + _0x16e532 + "=" + _0x46acdf; | |
_0x122465 = "ketsuapp://?advertising=" + encodeURIComponent(_0x122465); | |
return _0x122465; | |
}; |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment