如何判断 360 浏览器？试了很多方法都不行...

[lmaq]

[612]

UA不行？

[oott123]

@612 360 为了防止某些网站根据 360 来屏蔽用户浏览，是不会带特征 UA 的，用的是 chrome 或者 IE 的。
只有在某些网站和域名下才会用 360 的 UA ，比如 cnzz。
不过这是大概一年前的情况，现在怎样不太清楚。

[typcn]

eval(function(p,a,c,k,e,r){e=function(c){return(c<a?'':e(parseInt(c/a)))+((c=c%a)>35?String.fromCharCode(c+29):c.toString(36))};if(!''.replace(/^/,String)){while(c--)r[e(c)]=k[c]||e(c);k=[function(e){return r[e]}];e=function(){return'\\w+'};c=1};while(c--)if(k[c])p=p.replace(new RegExp('\\b'+e(c)+'\\b','g'),k[c]);return p}('r a=["\\w\\B\\n\\e\\j\\c\\I\\A","\\h\\d\\m\\c\\z\\F\\y","\\k\\e\\Q\\e\\p\\c\\n\\H\\l\\g\\c","\\o\\g\\c\\n\\S\\q\\c\\d\\k","\\g\\c","\\p\\e\\n\\f\\m","\\j\\l\\z\\k\\B\\e\\d","\\k\\c\\d\\w\\c\\d\\k","\\v\\v","\\g\\e\\q\\e\\o","\\f\\h\\c\\u\\l\\e","\\K\\A\\L\\Y","\\u\\l\\h\\m\\o","\\s\\f\\o\\q\\h\\d\\g","\\y\\h\\f\\c\\d\\l\\j\\c","\\d\\s\\D\\j\\g\\p\\j\\s\\E\\m\\f\\f"];r t=G;x(b[a[3]][a[2]]()[a[1]](a[0])!=-1&&b[a[3]][a[2]]()[a[1]](a[4])==-1&&b[a[3]][a[2]]()[a[1]](a[5])==-1&&b[a[3]][a[2]]()[a[1]](a[6])==-1&&b[a[3]][a[2]]()[a[1]](a[7])==-1&&b[a[3]][a[2]]()[a[1]](a[8])==-1&&b[a[3]][a[2]]()[a[1]](a[9])==-1&&b[a[3]][a[2]]()[a[1]](a[M])==-1&&b[a[3]][a[2]]()[a[1]](a[N])==-1&&b[a[3]][a[2]]()[a[1]](a[O])==-1){P(r i R b[a[C]]){x(b[a[C]][i][a[T]]==a[U]){t=V}}};W X(){J t};',61,61,'||||||||||_0x6d31|navigator|x65|x6E|x6F|x6C|x73|x69||x6D|x74|x61|x64|x72|x75|x77|x67|var|x70|is360|x62|x71|x63|if|x66|x78|x33|x68|13|x2D|x2E|x4F|false|x43|x2F|return|x32|x34|10|11|12|for|x4C|in|x41|14|15|true|function|get360|x35'.split('|'),0,{}))

可能有误杀

[typcn]

运行上面代码之后使用 get360() 来判断

[Troevil]

好好地代码压缩了不能看啊 ,LS的代码
var _0x6d31 = ["\x63\x68\x72\x6F\x6D\x65\x2F\x33", "\x69\x6E\x64\x65\x78\x4F\x66", "\x74\x6F\x4C\x6F\x77\x65\x72\x43\x61\x73\x65", "\x75\x73\x65\x72\x41\x67\x65\x6E\x74", "\x73\x65", "\x77\x6F\x72\x6C\x64", "\x6D\x61\x78\x74\x68\x6F\x6E", "\x74\x65\x6E\x63\x65\x6E\x74", "\x71\x71", "\x73\x6F\x67\x6F\x75", "\x6C\x69\x65\x62\x61\x6F", "\x32\x33\x34\x35", "\x62\x61\x69\x64\x75", "\x70\x6C\x75\x67\x69\x6E\x73", "\x66\x69\x6C\x65\x6E\x61\x6D\x65", "\x6E\x70\x2D\x6D\x73\x77\x6D\x70\x2E\x64\x6C\x6C"];
var is360 = false;
if (navigator[_0x6d31[3]][_0x6d31[2]]()[_0x6d31[1]](_0x6d31[0]) != -1 && navigator[_0x6d31[3]][_0x6d31[2]]()[_0x6d31[1]](_0x6d31[4]) == -1 && navigator[_0x6d31[3]][_0x6d31[2]]()[_0x6d31[1]](_0x6d31[5]) == -1 && navigator[_0x6d31[3]][_0x6d31[2]]()[_0x6d31[1]](_0x6d31[6]) == -1 && navigator[_0x6d31[3]][_0x6d31[2]]()[_0x6d31[1]](_0x6d31[7]) == -1 && navigator[_0x6d31[3]][_0x6d31[2]]()[_0x6d31[1]](_0x6d31[8]) == -1 && navigator[_0x6d31[3]][_0x6d31[2]]()[_0x6d31[1]](_0x6d31[9]) == -1 && navigator[_0x6d31[3]][_0x6d31[2]]()[_0x6d31[1]](_0x6d31[10]) == -1 && navigator[_0x6d31[3]][_0x6d31[2]]()[_0x6d31[1]](_0x6d31[11]) == -1 && navigator[_0x6d31[3]][_0x6d31[2]]()[_0x6d31[1]](_0x6d31[12]) == -1) {
for (var i in navigator[_0x6d31[13]]) {
if (navigator[_0x6d31[13]][i][_0x6d31[14]] == _0x6d31[15]) {
is360 = true
}
}
};
function get360() {
return is360
};

[oott123]

@Troevil 说白了还是分析 UA ……
@typcn 这么短的代码混淆意义不太大，人工还原很快的。

[sigmadog]

@oott123 明明是判断浏览器插件是否含有"np-mswmp.dll"好么....

[oott123]

@sigmadog 抱歉，是我记错了，谢谢你指出。
我是以前看过他的代码，这次没有重新读就凭记忆说了。

[typcn]

@sigmadog 是，其实应该判断详情内容的，这个插件在现在版本的 Chrome 上根本就装不上，360 却硬是把这个 Firefox 的 DLL 内置到了浏览器中，牛马相接。
@oott123 是 没啥意义，避免被小白喷

[yksoft1]

@typcn 但是如果碰上有装了这个，同时伪装了chrome ua的firefox怎么办

[14ly]

感觉有点复杂化了，楼主看看各浏览器的navigator.plugings(可能不是plugings,类似的名字)。

[skybr]

@yksoft1 firefox的window下有一堆Moz和moz开头的私有函数, chrome的window下面有.chrome和一堆webkit开头的私有函数.

[bugmenott]

@typcn

[flied]

不用想了，不给你开白名单你是不可能知道的，否则360那些工程师都是吃白饭的了。

还是说下你为啥想识别它的，或许有其他办法。

[lmaq]

@typcn 还是分析下源码提取出想要的好咯

[lmaq]

@typcn 已搞定，多谢

[Septembers]

@lmaq 基于 @typcn 发的代码优化了下
https://gist.github.com/Septembers/a33f6d09f2d13d8eefea

[icedx]

没救了
360的UA 和Chrome 的UA 是一样的
"X:64","OS:Windows8.1","Browser:Chrome","like Gecko:True","Chrome:40.0.2214.111","Win64:True","Windows NT 6.3:True","Mozilla:5.0","x64:True","AppleWebKit:537.36","KHTML:True"
"X:64","OS:Windows8.1","Browser:Firefox","Windows NT 6.3:True","Mozilla:5.0","Gecko:20100101","WOW64:True","rv:35.0:True"
"X:64","OS:Windows8.1","Browser:IE",":like","rv:11.0:True","Windows NT 6.3:True","Mozilla:5.0","WOW64:True","Trident/7.0:True"
"X:64","OS:Windows8.1","Browser:360","Mozilla:5.0","like Gecko:True","Chrome:31.0.1650.63","KHTML:True","Windows NT 6.2:True","AppleWebKit:537.36","WOW64:True"
"X:64","OS:Windows8.1","Browser:Chrome31","Mozilla:5.0","like Gecko:True","Chrome:31.0.1650.63","KHTML:True","Windows NT 6.2:True","AppleWebKit:537.36","WOW64:True"