海运的博客

查看监听的事件，chrome有相应扩展，firefox可以使用书签版：
http://www.sprymedia.co.uk/article/Visual+Event+2
记录JS执行过程调用的函数：
https://addons.mozilla.org/zh-CN/firefox/addon/fireflow/

chrome开发者工具和firebug可以在html栏选择相应的标签，然后在右侧窗口查看对应的事件。

参考：
http://stackoverflow.com/questions/570960/how-to-debug-javascript-jquery-event-bindings-with-firebug-or-similar-tool
http://stackoverflow.com/questions/446892/how-to-find-event-listeners-on-a-dom-node
http://www.it165.net/pro/html/201406/16397.html

初始化注册鼠标事件和注册提交id submit点击事件，鼠标事件记录的数据于注册提交时通过j.reportAq函数提交，和注册提交的数据相差时间很小，估计用于事后是否非法注册判断。

init: function() {
  //绑定鼠标事件
  j.bindMouseClickEvent();
  //绑定点击事件，当注册提交时触发
  $.e.add($('submit'), 'click', function() {
    if (p) {
      p = false;
      var a = dataArr0.length,
        b = parseInt(a / 50),
        c = a % 50;
      if (b > 0)
        for (var d = 0; d < b; d++) j.reportAq(j.dataToStrity(dataArr0.slice(50 * d, 50 * d + 50), 0));
      c > 0 && j.reportAq(j.dataToStrity(dataArr0.slice(50 * b, a - 1), 0));
      dataArr1.length && j.reportAq(j.dataToStrity(dataArr1, 1));
      dataArr2.length && j.reportAq(j.dataToStrity(dataArr2, 2));
      dataArr3.length && j.reportAq(j.dataToStrity(dataArr3, 3));
      e = (new Date).getTime();
      l.length = 0;
      n = new Date;
      for (a = 0; a < dataSet.length; a++) j.initData(dataSet[a]);
      for (a = 0; a < dataArrSet.length; a++) dataArrSet[a].length = 0
    }
  })
}
};

注册的鼠标事件，一般只会触发移动和单击事件：

bindMouseClickEvent: function() {
  //当鼠标移动时触发的事件
  document.onmousemove = function(a) {
    a = a || window.event;
    new Date - n > 200 && (n = new Date, j.addTargetData(a, 0, new d(0), 0, 0))
  };
  document.onmouseout = function(a) {
    a = a || window.event;
    new Date - n > 200 && (n = new Date, j.addTargetData(a, 0, new d(0), 0, 0))
  };
  document.onmouseover = function(a) {
    a = a || window.event;
    new Date - n > 200 && (n = new Date, j.addTargetData(a, 0, new d(0), 0, 0))
  };
  document.onclick = function(c) {
    c = c || window.event;
    c.target = c.srcElement ? c.srcElement : c.target;
    if (l.length > 0) var e = new Date - l[l.length - 1];
    c.target && a[c.target.id] ? j.addTargetData(c, 1, new d(1), b[c.target.id], e) : j.addTargetData(c, 1, new d(1), b.none, e)
  };
  document.ondblclick =
    function(c) {
      c = c || window.event;
      c.target = c.srcElement ? c.srcElement : c.target;
      var e;
      j.isIE() ? (e = new Date - l[l.length - 1], l.pop()) : (e = new Date - l[l.length - 2], l.pop(), l.pop(), dataArr1.pop());
      dataArr1.pop();
      c.target && typeof a[c.target.id] != 'undefined' ? j.addTargetData(c, 2, new d(2), b[c.target.id], e) : j.addTargetData(c, 2, new d(2), b.none, e)
    };
  document.oncontextmenu = function(c) {
    c = c || window.event;
    c.target = c.srcElement ? c.srcElement : c.target;
    var e = new Date - l[l.length - 1];
    l.pop();
    dataArr1.pop();
    c.target && typeof a[c.target.id] !=
      'undefined' ? j.addTargetData(c, 3, new d(3), b[c.target.id], e) : j.addTargetData(c, 3, new d(3), b.none, e)
  };
  document.onmousedown = function() {
    l.push(new Date)
  };
  document.onmouseup = function() {}
},

记录的数据通过addTargetData保存至dataArr数组，移动事件为dataArr0，点击事件为dataArr1，等。

addTargetData: function(a, b, c, d, f) {
    a = a || window.event;
    point = j.getMousePoint(a);
    c.recordCnt += 1;
    c.xSeries = point.x;
    c.ySeries = point.y;
    c.elementIDSeries = d;
    c.clickGapSeries = f;
    c.browserHeightSeries = j.getBrowser().winHeight;
    c.browserWidthSeries = j.getBrowser().winWidth;
    c.gapLog = (new Date).getTime() - e;
    j.addTargetArrData(b, c)
  },

  addTargetArrData: function(a, b) {
    switch (a) {
      case 0:
        dataArr0.push(b);
        break;
      case 1:
        dataArr1.push(b);
        break;
      case 2:
        dataArr2.push(b);
        break;
      case 3:
        dataArr3.push(b)
    }
  },

添加用户名输入时的键盘事件，当输入时按下每个键时会激发index.addAq函数，传入html id和键值，输入完成时index.reportAq(this)提交键盘事件记录的数据：

$.e.add($('nick'), 'keydown', function(a) {
  index.current_error_dom = 'nick_keydown_start';
  a = a.keyCode;
  index.nickExceed = $.str.getBytes(this.value) == 24 && a != index.keyCode.DEL &&
    a != index.keyCode.BACK ? true : false;
  index.addAq(this.id, a);
  index.current_error_dom = 'nick_keydown_end'
});

  $.e.add($('nick'), 'blur', function() {
    index.current_error_dom = 'nick_blur_start';
    $('nick_bg').className = 'bg_txt';
    if (!index.isChangingTab() && (index.hideInfo('nick_info'), index.chkNick())) {
      var a = indexType2RegType(index.type);
      index.ajaxChkNick($('nick').value, a)
    }
    index.reportAq(this);
    index.current_error_dom = 'nick_blur_end'
  });

addAq函数将键值和id对应的aq_input对象值和时间保存至数组aq_array：

aq_input: {
    nick: 1,
    phone_num: 2,
    self_email: 3,
    other_email: 4,
    password: 5,
    password_again: 6,
    sex_1: 7,
    sex_2: 8,
    birthday_type_value: 9,
    year_value: 10,
    month_value: 11,
    day_value: 12,
    country_value: 13,
    province_value: 14,
    city_value: 15,
    code: 16
  },
//a为html id，b为键盘值或固定值，
addAq: function(a, b) {
    var c = (new Date).getTime();
    index.aq_array.push(b + '|' + index.aq_input[a] + '|' + c)
  },

reportAq组合index.aq_array内的数据并提交：

 reportAq: function(a) {
    var b = new Image;
    index.aq_array.length == 0 && index.addAq(a.id, 0);
    a = index.aq_cgi + index.aq_array.join('&');
    b.src = a
  },

var domBtn = $('login_button');
查看登录框form，无默认onsubmit事件，然后查看登录提交按钮链接：

<a class="login_button" href="javascript:void(0);" hidefocus="true"><input tabindex="6" value="登 录" class="btn" id="login_button" type="submit"></a>

链接为javascript:void(0)为死链接， 也无onclick事件，可见提交操作是通过绑定事件来实现的，通过id login_button查找绑定的事件：

<input type="submit" id="login_button" class="btn" value="登 录" tabindex="6">

定义到变量domBtn：

var domBtn = $('login_button');

可见点击登录按钮后执行的函数为pt.plogin.submit(e)：

add(domBtn, 'click', function(e) {
  e.preventDefault();
  if (pt.plogin.needShowNewVc == true) {
    pt.plogin.showVC()
  } else {
    pt.plogin.submit(e)
  }
});

最终分析到密码加密过程位于函数，调试使用firebug设置函数处为断点，鼠标悬停变量处显示相应信息：

var b = pt.plogin.getSubmitUrl('login');
//然后，d为明文密码，salt为qq号，vcode为验证码
f.p = $.Encryption.getEncryption(d, pt.plogin.salt, f.verifycode, pt.plogin.armSafeEdit.isSafe);

JS执行流程：

pt.plogin.auth();
pt.plogin.init();
pt.plogin.bindEvent();

$.e.add(domBtn, 'click', function(e) {
  e && e.preventDefault();
  if (pt.plogin.needShowNewVc == true) {
    pt.plogin.showVC()
  } else {
    pt.plogin.submit(e)
  }
});

通过v8，windows下需自行编译：

d8 a.js -- a b c
d8 a.js --js-arguments a b c

获取参数：

print(arguments[0]);

通过spidermonkey，获取参数同上：

js a.js a b c

通过Nodejs，底层基于v8，官网有windows安装包：

node a.js a b c

获取命令参数：

var arguments = process.argv.splice(2);
console.log(arguments[1]);

v8和spidermonkey都有相应的php扩展，在windows下通过进程调用执行js并获取结果：

<?php
$lastline = exec("node a.js aa bb", $res, $ret);
print_r($res);
echo $lastline;
echo $ret;