某款視訊網站廣告遮蔽外掛分析
阿新 • • 發佈：2019-02-08
有一款針對視訊網站的廣告進行遮蔽的chrome外掛做的比較好，其在360瀏覽器市場上排名非常靠前。
在使用過程中發現它在頁面中插入了一段程式碼
<div class="player" id="player" err=""> <object type="application/x-shockwave-flash" data="http://opengg.guodafanli.com/swf/kafan/loader.swf" width="100%" height="100%" id="movie_player"> <param name="allowFullScreen" value="true"> <param name="allowscriptaccess" value="always"><param name="flashvars" value="VideoIDS=XODI3MzIyNzgw&ShowId=0&category=91&Cp=0&ev=2&Light=on&THX=off&unCookie=0&frame=0&pvid=1416053534395Fq3&uepflag=1&Tid=0&isAutoPlay=true&Version=/v1.0.1002&show_ce=0&winType=interior&Type=Folder&Fid=23073811&Pt=0&Ob=1&plchid=a&embedid=AjIwNjgzMDY5NQJ3d3cueW91a3UuY29tAi9pLw==&vext=bc%3D%26pid%3D1416053534395Fq3%26unCookie%3D0%26frame%3D0%26type%3D1%26fob%3D1%26fpo%3D0%26svt%3D0%26emb%3DAjIwNjgzMDY5NQJ3d3cueW91a3UuY29tAi9pLw%3D%3D%26dn%3D%E7%BD%91%E9%A1%B5%26hwc%3D1%26mtype%3Doth"> <param name="movie" value="http://static.youku.com/v1.0.0483/v/swf/loader.swf"> <div class="player_html5"> <div class="picture" style="height:100%"> <div style="line-height:460px;"> <span style="font-size:18px">您還沒有安裝flash播放器,請點選 <a href="http://www.adobe.com/go/getflash" target="_blank">這裡</a> 安裝 </span> </div> </div> </div> </object> </div>
把優酷的播放器換成了自己的播放器。
<a target=_blank href="http://opengg.guodafanli.com">http://opengg.guodafanli.com</a>在頁面開啟過程中，還要訪問下面的網址：
這個就更奇怪了，這個網站經查是註冊在
還註冊了以下的網站：
GET http://app2.522.com.cn/playlist2.php/v.youku.com/player/getPlayList/VideoIDS/XODI3MzIyNzgw/timezone/+08/version/5/source/video/Type/Folder/Fid/23073811/Pt/0/Ob/1?ctype=10&password=&n=3&ran=1731&ev=1 HTTP/1.1 Host: app2.522.com.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.101 Safari/537.36 Accept: */* Referer: http://opengg.guodafanli.com/swf/kafan/loader.swf Accept-Encoding: gzip,deflate,sdch Accept-Language: zh-CN,zh;q=0.8
以上請求返回的是以下資料，看起來是優酷的視訊分段資訊。
HTTP/1.1 200 OK Content-Type: text/html Server: Microsoft-IIS/6.0 X-Powered-By: PHP/5.2.9-2 Date: Sat, 15 Nov 2014 12:11:58 GMT Connection: close {"folder":{"total":6,"size":10,"page":1,"folderId":23073811,"ownerId":36758550,"totalPage":1},"data":[{"ct":"a","cs":"2143","logo":"http:\/\/g2.ykimg.com\/1100641F4654672BB118D00230E41601BF6739-DED1-4859-9A8E-43D3A7370507","seed":7803,"tags":["彭麗媛","g20"],"categories":"91","videoid":"206830695","vidEncoded":"XODI3MzIyNzgw","list":[{"seq":0,"vid":"206830695","vidEncoded":"XODI3MzIyNzgw","title":"彭麗媛與袋鼠親密接觸 彎腰餵食","vv":0},{"seq":1,"vid":"206798483","vidEncoded":"XODI3MTkzOTMy","title":"二十國集團領導人第九次峰會舉行 各國元首夫人與考拉親密接觸","vv":0},{"seq":2,"vid":"206787322","vidEncoded":"XODI3MTQ5Mjg4","title":"習近平抵達布里斯班出席二十國劇團領導人峰會並對澳進行國事訪問","vv":0},{"seq":3,"vid":"206725893","vidEncoded":"XODI2OTAzNTcy","title":"直播港澳臺20141114 中國借G20加強參與全球治理","vv":0},{"seq":4,"vid":"206728238","vidEncoded":"XODI2OTEyOTUy","title":"曝澳方外交祕密武器：或邀請彭麗媛抱考拉","vv":0},{"seq":5,"vid":"206765977","vidEncoded":"XODI3MDYzOTA4","title":"澳大利亞：G20峰會舉行 聚焦經濟議題[東方午新聞]","vv":0}],"list_pre":{},"list_next":{"seq":1,"vid":"206798483","vidEncoded":"XODI3MTkzOTMy","title":"二十國集團領導人第九次峰會舉行 各國元首夫人與考拉親密接觸","vv":0},"username":"新視點","userid":"36758550","title":"彭麗媛與袋鼠親密接觸 彎腰餵食","up":0,"down":0,"ts":"At6kQzJXdTc1DkNnAXuS7jA","tsup":"At6jyTFXdTc1DkNnAvGV7jA","key1":"b344a731","key2":"79d120380f053107","tt":"1","ip":712601273,"ep":"dvtCHZeoyLOU\/6BS2AwdkRWKSBEwUaxNatZXLlyozhg=","videoSource":"1","seconds":"15.00","streamfileids":{"flv":"6*17*6*6*6*13*6*5*6*6*9*43*32*26*13*19*24*37*32*5*2*43*6*13*17*6*36*43*5*32*17*19*2*41*24*5*2*6*33*62*66*36*17*33*62*32*41*13*33*26*26*24*9*33*36*37*17*13*37*26*5*37*24*9*62*6*","mp4":"6*17*6*6*6*37*6*5*6*6*9*43*32*26*13*66*9*26*32*5*2*43*6*13*17*6*36*43*5*32*17*19*2*41*24*5*2*6*33*62*66*36*17*33*62*32*41*13*33*26*26*24*9*33*36*37*17*13*37*26*5*37*24*9*62*6*","hd2":"6*17*6*6*6*5*6*5*6*6*9*43*32*26*13*66*41*36*32*5*2*43*6*13*17*6*36*43*5*32*17*19*2*41*24*5*2*6*33*62*66*36*17*33*62*32*41*13*33*26*26*24*9*33*36*37*17*13*37*26*5*37*24*9*62*6*"},"segs":{"flv":[{"no":0,"size":"537222","seconds":15,"k":"a61c7d07afc3df85282a039d","k2":"1beadcb47208021f6"}],"mp4":[{"no":0,"size":"1032773","seconds":15,"k":"740695dcee2e264e282a039d","k2":"1a99c4637b2a61d65"}],"hd2":[{"no":0,"size":"2262763","seconds":15,"k":"02554e5406a46fb8261e0294","k2":"193ff830c2a5496ec"}]},"streamsizes":{"flv":"537222","mp4":"1032773","hd2":"2262763"},"stream_ids":{"flv":"250696624","mp4":"250697769","hd2":"250698513"},"streamlogos":{"flv":1,"mp4":1,"hd2":1},"streamtypes":["flv","mp4","hd2"],"streamtypes_o":["hd2","flvhd","mp4"]}],"user":{"id":0},"verify_user":{"uid":36758550,"nick_name":"新視點","verified":1,"verified_reason":"優酷網資訊頻道官方空間","avatar":{"big":"http:\/\/g3.ykimg.com\/0130391F484AC5AEFE957A0230E416EE12E097-3338-E822-1BB2-2D5CABC2F73B","middle":"http:\/\/g3.ykimg.com\/0130391F484AC5AEFEDE9B0230E4169483C6A0-49D0-6CF7-9F58-5F615A14F12E","small":"http:\/\/g3.ykimg.com\/0130391F484AC5AEFEDE9B0230E4169483C6A0-49D0-6CF7-9F58-5F615A14F12E","large":"http:\/\/g3.ykimg.com\/0130391F484AC5AEFE957A0230E416EE12E097-3338-E822-1BB2-2D5CABC2F73B"},"verified_icon":1,"video_note":0,"reward":0,"backstage_brand":1,"user_brand":1,"followers_count":35634,"user_center":"http:\/\/i.youku.com\/u\/UMTQ3MDM0MjAw","home_url":"http:\/\/i.youku.com\/u\/UMTQ3MDM0MjAw","show_brand":1,"subscription":0},"controller":{"search_count":true,"mp4_restrict":1,"stream_mode":1,"video_capture":true,"hd3_enabled":false,"area_code":330100,"dma_code":37963,"continuous":0,"playmode":"folder","circle":false,"tsflag":true,"other_disable":false,"xplayer_disable":false,"app_disable":false,"share_disabled":false,"download_disabled":false,"pc_disabled":false,"pad_disabled":false,"mobile_disabled":false,"tv_disabled":false,"comment_disabled":false}}
在該外掛第一次執行時，會從網上下載一些指令碼，
都是經過base64加密的。
很容易解密。
主要的指令碼如下：
[ADT 3]
! Checksum: vXO2skD37egAcrKzRVhe1A
! Version: 20141102
! Title: 過濾增強指令碼
! Homepage: http://www.adtchrome.com/extension/adt-videolist.html
! Match: http
! Begin: --
if(!document.URL.match(new RegExp('(v|music)\\.baidu\\.com'))){
(function() {
Function.prototype.bind = function() {
var fn = this, args = Array.prototype.slice.call(arguments), obj = args.shift();
return function() {
return fn.apply(obj, args.concat(Array.prototype.slice.call(arguments)));
};
};
function A() {}
A.prototype = {
rules: {
'youku_loader': {
'find': /^http:\/\/static\.youku\.com\/.*(loader|player_.*)(_taobao)?\.swf/,
'replace': 'http://swf.adtchrome.com/loader.swf'
},
'youku_out': {
'find': /^http:\/\/player\.youku\.com\/player\.php\/.*sid\/(.*)/,
'replace': 'http://swf.adtchrome.com/loader.swf?VideoIDS=$1'
},
'pps_pps': {
'find': /^http:\/\/www\.iqiyi\.com\/player\/cupid\/common\/pps_flvplay_s\.swf/,
'replace': 'http://swf.adtchrome.com/pps_20140420.swf'
},
'iqiyi_1': {
'find': /^http:\/\/www\.iqiyi\.com\/player\/cupid\/common\/.+\.swf$/,
'replace': 'http://swf.adtchrome.com/iqiyi_20140624.swf'
},
'iqiyi_2': {
'find': /^http:\/\/www\.iqiyi\.com\/common\/flashplayer\/\d+\/.+\.swf$/,
'replace': 'http://swf.adtchrome.com/iqiyi_20140624.swf'
},
'iqiyi_duba': {
'find': /^http:\/\/dispatcher\.video\.qiyi\.com\/disp\/shareplayer\.swf/,
'replace': 'http://swf.adtchrome.com/iqiyi_20140624.swf'
},
'ku6': {
'find': /^http:\/\/player\.ku6cdn\.com\/default\/.*\/\d+\/(v|player|loader)\.swf/,
'replace': 'http://swf.adtchrome.com/ku6_20140420.swf'
},
'ku6_topic': {
'find': /^http:\/\/player\.ku6\.com\/inside\/(.*)\/v\.swf/,
'replace': 'http://swf.adtchrome.com/ku6_20140420.swf?vid=$1'
},
'sohu': {
'find': /^http:\/\/tv\.sohu\.com\/upload\/swf(\/p2p)?\/\d+\/Main\.swf/,
'replace': 'http://swf.adtchrome.com/sohu_20140917.swf'
},
'sohu_share': {
'find': /^http:\/\/share\.vrs\.sohu\.com\/my\/v\.swf&/,
'replace': 'http://swf.adtchrome.com/sohu_20140917.swf?'
},
'sohu_sogou' : {
'find': /^http:\/\/share\.vrs\.sohu\.com\/(\d+)\/v\.swf/,
'replace': 'http://swf.adtchrome.com/sohu_20140917.swf?vid=$1'
},
/*'letv': {
'find': /^http:\/\/player\.letvcdn\.com\/p\/.*\/newplayer\/LetvPlayer\.swf/,
'replace': 'http://swf.adtchrome.com/letv_20140716.swf'
},
'letv_topic': {
'find': /^http:\/\/player\.hz\.letv\.com\/hzplayer\.swf\/v_list=zhuanti/,
'replace': 'http://swf.adtchrome.com/letv_20140716_topic.swf'
},*/
'letv_duowan': {
'find': /^http:\/\/assets\.dwstatic\.com\/video\/vpp\.swf/,
'replace': 'http://swf.adtchrome.com/letv_duowan_20140811.swf'
}
},
_done: null,
get done() {
if(!this._done) {
this._done = new Array();
}
return this._done;
},
addAnimations: function() {
var style = document.createElement('style');
style.type = 'text/css';
style.innerHTML = 'object,embed{\
-webkit-animation-duration:.001s;-webkit-animation-name:playerInserted;\
-ms-animation-duration:.001s;-ms-animation-name:playerInserted;\
-o-animation-duration:.001s;-o-animation-name:playerInserted;\
animation-duration:.001s;animation-name:playerInserted;}\
@-webkit-keyframes playerInserted{from{opacity:0.99;}to{opacity:1;}}\
@-ms-keyframes playerInserted{from{opacity:0.99;}to{opacity:1;}}\
@-o-keyframes playerInserted{from{opacity:0.99;}to{opacity:1;}}\
@keyframes playerInserted{from{opacity:0.99;}to{opacity:1;}}';
document.getElementsByTagName('head')[0].appendChild(style);
},
animationsHandler: function(e) {
if(e.animationName === 'playerInserted') {
this.replace(e.target);
}
},
replace: function(elem) {
if(this.done.indexOf(elem) != -1) return;
this.done.push(elem);
var player = elem.data || elem.src;
if(!player) return;
var i, find, replace = false;
for(i in this.rules) {
find = this.rules[i]['find'];
if(find.test(player)) {
replace = this.rules[i]['replace'];
if('function' === typeof this.rules[i]['preHandle']) {
this.rules[i]['preHandle'].bind(this, elem, find, replace, player)();
}else{
this.reallyReplace.bind(this, elem, find, replace)();
}
break;
}
}
},
reallyReplace: function(elem, find, replace) {
elem.data && (elem.data = elem.data.replace(find, replace)) || elem.src && ((elem.src = elem.src.replace(find, replace)) && (elem.style.display = 'block'));
var b = elem.querySelector("param[name='movie']");
this.reloadPlugin(elem);
},
reloadPlugin: function(elem) {
var nextSibling = elem.nextSibling;
var parentNode = elem.parentNode;
parentNode.removeChild(elem);
var newElem = elem.cloneNode(true);
this.done.push(newElem);
if(nextSibling) {
parentNode.insertBefore(newElem, nextSibling);
} else {
parentNode.appendChild(newElem);
}
},
init: function() {
var handler = this.animationsHandler.bind(this);
document.body.addEventListener('webkitAnimationStart', handler, false);
document.body.addEventListener('msAnimationStart', handler, false);
document.body.addEventListener('oAnimationStart', handler, false);
document.body.addEventListener('animationstart', handler, false);
this.addAnimations();
}
};
new A().init();
})();
}
// 20140730
(function cnbeta() {
if (document.URL.indexOf('cnbeta.com') >= 0) {
var elms = document.body.querySelectorAll("p>embed");
Array.prototype.forEach.call(elms, function(elm) {
elm.style.marginLeft = "0px";
});
}
})();
// 20140730
(function kill_baidu() {
if (document.URL.indexOf('baidu.com') >= 0) {
var elms = document.body.querySelectorAll("#content_left>div[style='display:block !important'], #content_left>table[style='display:table !important']");
Array.prototype.forEach.call(elms, function(elm) {
elm.removeAttribute("style");
});
}
window.setTimeout(kill_baidu, 400);
})();
// 20140928
(function v_baidu() {
if (document.URL.match(/http:\/\/baidu.*fr=/)) {
var child = document.body.querySelector('div.bd>script');
child.parentNode.removeChild(child);
advTimer.last = 1;
advTimer.cur = 1;
advTimer.onbeforestop();
}
})();
// 20140922
(function kill_360() {
if (document.URL.indexOf('so.com') >= 0) {
document.getElementById("e_idea_pp").style.display = none;
}
})();什麼什麼返利的網站，可能這是外掛獲得盈利的方式吧。
通過橫向對比，當前此外掛的功能還是比較強大的，至於使用此外掛的安全性，不得而知，請大家慎重選擇吧。畢竟網際網路上沒有免費的東西。你的電腦真的是你的嗎？who knows!