最新PDD商家端Anti-Content参数逆向分析与纯算法还原_pdd anti_content(1)

1. 写在前面

H5目前这个参数好像是已经不再做校验了？所以再去分析的话意义并不大了。而且它那个界面真的是巨难用！为此，我单独去注册了一个商家版的！只为还原最真实的场景。目前最新的anti_content是0aq开头的，相比较于早期的老版本不再需要参数去参与加密，纯算法扣出来还原之后可在本地Node环境下直接调用生成，并且算法通用于所有接口…

2. 接口分析

这个商家后台管理，确实功能做的挺丰富，我这边主要是新注册的，然后数据基本都是空的，所以文章中能够直观测试的接口比较少，但是扣出来的算法确实是通用的！因为有朋友跟粉丝一直在做这块，算法也是给他们进行了测试，下面是一位粉丝使用易语言调用的结果，如下所示：

首先，我们找到商品管理下面的商品列表，发个包监听一下请求：

这里如果Anti-Content参数不对或者你不携带，得到的结果均会如下：

{"error\_code":54001,"error\_msg":"操作太过频繁，请稍后再试！","result":{"verifyAuthToken":"一堆字符"}}

H5就不一样，你不携带现在照样给你数据，压根好像都不做参数检验了～

3. 断点分析

首先我们使用关键词参数全局搜索大法整一下，搜索出来的结果不多，如下：

可以全部下个断，然后重新刷新页面，这里的话我们可以看到anti_content已经生成

往上看在**.then的上方，这行代码return !kt.a || s && s(n) ? Promise.resolve(c(t.rawFetch, l).catch((function() {}**，异步调用？

这里确实是一个异步，是一个Promise的链式调用。调用了**c(t.rawFetch, l)**函数，这个函数返回的是一个Promise对象，就是一个复合条件表达式，包含了逻辑运算跟Promise异步操作

上面的断点异步调用，难度并不大，稍微调式一下就能够看到核心的加密代码了，那剩下的就是扣代码！！！

4. 扣JS代码

接下来就到了核心阶段，扣取Webpack代码，整个加密逻辑大部分都在一个JS文件内，我们需要花时间去调试分析，梳理清楚模块加载顺序，然后把整个加密算法还原出来

把加密核心JS代码扣取下来，这里你不需要去改，直接拿我这个就可用！！如下所示：

function o(e) {
    return (o = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function(e) {
        return typeof e
    } : function(e) {
        return e && "function" == typeof Symbol && e.constructor === Symbol && e !== Symbol.prototype ? "symbol" : typeof e
    })(e)
}

为了避免多次调用 typeof、Symbol，我们同样使用自执行函数的方式定义，这样做可以提高代码的性能，因为它避免了重复计算，如下所示：

"3": function(e, t, n) {
  "use strict";
  (function(e) {
      var t, r, a = "function" == typeof Symbol && "symbol" == o(Symbol.iterator) ? function(e) {
              return o(e)
          } : function(e) {
              return e && "function" == typeof Symbol && e.constructor === Symbol && e !== Symbol.prototype ? "symbol" : o(e)
          }, i = n(12),
          s = n(13).crc32,
          d = ["fSohrCk0cG==", "W4FdMmotWRve", "W7bJWQ1CW6C=", "W5K6bCooW6i=", "dSkjW7tdRSoB", "jtxcUfRcRq==", "ALj2WQRdQG==", "W5BdSSkqWOKH", "lK07WPDy", "f8oSW6VcNrq=", "eSowCSkoaa==", "d8oGW7BcPIO=", "m0FcRCkEtq==", "qv3cOuJdVq==", "iMG5W5BcVa==", "W73dVCo6WPD2", "W6VdKmkOWO8w", "zueIB8oz", "CmkhWP0nW5W=", "W7ldLmkSWOfh", "W5FdIqdcJSkO", "aCkBpmoPyG==", "l27dICkgWRK=", "s05AWR7cTa==", "bttcNhdcUW==", "gJldK8kHFW==", "W5Sso8oXW4i=", "FgC0W7hcNmoqwa==", "xmkPhdDl", "e14kWRzQ", "BNFcVxpdPq==", "z1vadK0=", "W7yOiCk2WQ0=", "qLb7lg0=", "t8o6BwhcOq==", "gmk6lYD9WPdcHSoQqG==", "oqldGmkiCq==", "rmo+uKlcSW==", "dSoIWOVdQ8kC", "iXSUsNu=", "W5ipW4S7WRS=", "WPtcTvOCtG==", "A3CcAmoS", "lCotW6lcMba=", "iuGzWPLz", "WQVdPmoKeSkR", "W4ydoCkqWQ4=", "jCobW47cNXC=", "W4tdJCkNWOCJ", "hCo/W7ZcSJ8=", "BNuZW6NcMG==", "b8kFW6hdN8oN", "W4SpoCkXWQK=", "cXddOmkDFa==", "W63dHSoyWQft", "W6ldSmk0WRj4", "A2bHWOtcHeeMyq==", "f3VcSSk/xG==", "qg1u", "ftyivga=", "DCkhpsfe", "WR3cKmo3oMWEw8kK", "yev3", "W4xdMKSejbm=", "W797WOL7W4m=", "W6xdOCkKWQXw", "gcCUye0=", "W7WXkmomb8kT", "c8kIesD0", "WOTpEW==", "ySo3E8oVWPy=", "iNyhW5lcNLNcG8kYWQu=", "W7JdMSkfWRnD", "FfijW5tcHW==", "xCokW54Zzq==", "W77dUsi=", "W5FdHfa6eq==", "E1FcQvVdSG==", "eZ/dNCo4AG==", "CgPmWQZdKa==", "A8oLECoJWPS=", "oCoSW7VcTJC=", "mCoADa==", "W7DXuSouDq==", "ic3dQCo8ua==", "rN3cIa==", "W6/dJ8kPWRGQ", "W4xdLYlcPmkc", "F3JcPvZdLa==", "xCk8iHn4", "qg15", "W5/dL8oOWPr4", "hW41C3C=", "sSoZzwxcPW==", "ywdcUvNdUW==", "t0TzWQpdIG==", "lv7dJSoIjq==", "W5Tzxq==", "W6DnWQK=", "W5mGaCkFWRC=", "W6LmWO5+W6C=", "WR7dQmoJa8k+", "emkFW4ddOmob", "imk8imoNEa==", "W4ZdP8kaWPvc", "F8k4WO40W4e=", "cSoHE8k9cG==", "jw4TW5dcSW==", "wuJcOKRdTa==", "swNcQx/dGG==", "aCkSiCoMEq==", "W6pdS8owWQTH", "WRFdQmonjmkT", "cKBdGCkpWOm=", "oCoWW4VcPIa=", "WQddSSoUjmks", "c8kdW5JdM8oE", "W7b0AGvl", "sCk4WOylW60=", "nXNdSmkXvW==", "W67dRSkjWOqj", "W44EcCohW6O=", "W6ddPmkpWRHN", "W7tdVIVcOSkR", "qg3dVG==", "W7Ofcmofda==", "WRDmW5VcLq==", "CSoRW4W4Aq==", "mmo0WP3dVmkj", "i8omW6ZcPd8=", "CSkaWQyvW4m=", "ACkMWQCLW4q=", "W5pdOCk0WRv3", "W7yDW44SWP8=", "WRP8W5dcNmkd", "ymkNaID5", "cfeTWRT6", "W6WdbmkmWO0=", "eSo3WQldVCkU", "W5flwZrl", "WPVcTe4tWQu=", "DuCPumok", "hLpcKCksqXe=", "g3hdUCkoWRu=", "sL0sW6JcPW==", "lf7dL8oOpG==", "w8k4WPWJW7u=", "i08mW5dcUW==", "kb/dU8klsW==", "WOhcMSoW", "W5LnfG==", "F8kJWQmxW6m=", "W5ldU0CDca==", "eKRdKmkoWPG=", "tmouW60=", "gSkrW7JdVSor", "WPNcP8oc", "DhLAmLW=", "sSo0EfdcQq==", "W6ygW689WQq=", "W6CPimkIWQa=", "WRJdLmoynSkY", "W5iimCkDWRa=", "oMhdN8kPWRHV", "eNqQWQHn", "bmkakSoHW4u=", "W4PxEbvN", "WQhcQxSWyW==", "xCoKEW==", "guBcISk2yG==", "nviRW4BcSq==", "m3tcVmkXCJ9YWQyXd8kuWQfJW71fWPmnWRj+WR1tW6WbW4PDdCkrkLbDs8ozWR4gySoyv20rWO3dJJpdIh9DWPhcGCoctKFcN8kTW6nHvbLRkg9MeKhdHCoP", "W7iZfmolW4q=", "p1JdGSk4WPW=", "ns3cTuhcMSk6u8kj",