【简单】猿人学web第一届第16题 js-逆向 windows蜜罐 / webpack初体验

Spider小郭

于 2024-09-03 17:47:17 发布

阅读量246

点赞数 6

分类专栏：猿人学Web端爬虫攻防刷题平台文章标签： javascript python 爬虫

本文链接：https://blog.csdn.net/m0_69843492/article/details/141791239

版权

猿人学Web端爬虫攻防刷题平台专栏收录该内容

15 篇文章 0 订阅

订阅专栏

数据接口分析

https://match.yuanrenxue.cn/api/match/16

请求参数需要携带 page 页码，m 和 t 字段，m为加密参数，t 目测是一个时间戳

加密参数还原

查看数据接口对应的 window.request 栈

r 对象里携带了请求参数

手动解混淆后的代码

p_s = Date['parse'](new Date)['toString']();
var r = {};
r['page'] = window['page'];  // 页码信息
// t[e(528)] = function(e, t) {return e(t)}
r.m = btoa(p_s);
r.t = p_s;;

btoa 是改写过的

改写过的值

未改写过的值

还原加密参数

btoa 方法

查看 btoa 定义的位置

还原 btoa 函数的 AST 代码

// 字符串解密
var _0x34e7 = ["split","ABHICESQWK","FKByN","U987654321","lmHcG","dICfr","Szksx","Bgrij","iwnNJ","jihgfdecba","GfTek","gfdecbaZXY","constructo","QIoXW","jLRMs","AqLWq","0zyxwvutsr","TKgNw","eMnqD","thjIz","btoa","MNPQRSTWXY","oPsqh","niIlq","evetF","LVZVH","fYWEX","kmnprstwxy","aYkvo","tsrqpomnlk","HfLqY","aQCDK","lGBLj","test","3210zyxwvu","QWK2Fi","return /\" ","hsJtK","jdwcO","SlFsj","OWUOc","LCaAn","[^ ]+)+)+[","FAVYf","2Fi+987654","floor","join","EuwBW","OXYrZ","charCodeAt","SkkHG","iYuJr","GwoYF","kPdGe","cVCcp","INQRH","INVALID_CH","charAt","push","apply","lalCJ","kTcRS","+ this + \"","ykpOn","gLnjm","gmBaq","kukBH","dvEWE","SFKLi","^([^ ]+( +","qpomnlkjih","^ ]}","pHtmC","length"]
var l = function (e, t) {
    return _0x34e7[e -= 188]
}
function repStr(path, name) {
    if (path.get('id').isIdentifier() && path.get('init').isIdentifier({name})) {
        let name = path.node.id.name;
        let binding = path.scope.getBinding(name);
        if (binding) {
            let refPath = binding.referencePaths;
            for (const idx in refPath) {
                let parentPath = refPath[idx].parentPath;
                if (parentPath.isCallExpression() && parentPath.get('arguments').length === 1) {
                    let CallArg = parentPath.node.arguments[0].value;
                    parentPath.replaceWith(types.StringLiteral(l(CallArg)))
                } else if (parentPath.isVariableDeclarator()) {
                    let name = path.node.id.name;
                    repStr(parentPath, name)
                }
            }
        }
    }
}
traverse(ast, {
    VariableDeclarator(path) {
        repStr(path, 'u')
    }
})

// 逗号表达式
traverse(ast, {
    VariableDeclaration(path) {
        if (path.get('declarations').length > 1) {
            let kind = path.node.kind
            let declarations = path.node.declarations
            let nodeList = []
            for (const idx in declarations) {
                let newNode = types.variableDeclaration(kind, [declarations[idx]])
                nodeList.push(newNode)
            }
            path.replaceWithMultiple(nodeList)
        }
    },
    SequenceExpression(path) {
        if (path.get('expressions').length > 1) {
            let expressions = path.node.expressions;
            let nodeList = [];
            for (const idx in expressions) {
                nodeList.push(expressions[idx])
            }
            path.replaceWithMultiple(nodeList)
            path.skip()
        }
    },
    ReturnStatement(path) {
        if (path.node.argument && path.get('argument.expressions').length > 1) {
            let expressions = path.node.argument.expressions;
            let nodeList = expressions.slice(0, -1);
            let retNOde = types.returnStatement(expressions[expressions.length - 1])
            nodeList.push(retNOde)
            path.replaceWithMultiple(nodeList)
        }
    }
})

// 字符串相加
function addStr(path) {
    if (path.get('left').isStringLiteral() && path.get('right').isStringLiteral()) {
        let left = path.node.left.value;
        let right = path.node.right.value;
        let result = left + right
        path.replaceWith(types.stringLiteral(result))
    } else if (path.get('left').isBinaryExpression() && path.get('right').isStringLiteral()) {
        path.traverse({
            BinaryExpression(path_) {
                addStr(path_)
            }
        })
    }
}
for (let i = 0; i < 2; i++) {
    traverse(ast, {
        BinaryExpression(path) {
            addStr(path)
        }
    })
}

// 花指令
function addObj(path, newObj) {
    let name = path.node.id.name;
    let binding = path.scope.getBinding(name);
    if (binding) {
        let refPath = binding.referencePaths;
        for (const idx in refPath) {
            let grandPath = refPath[idx].parentPath.parentPath;
            if(grandPath.isAssignmentExpression()){
                let key;
                if(grandPath.node.left.computed === false){
                    key = grandPath.node.left.property.name;
                }else{
                    key = grandPath.node.left.property.value;
                }
                newObj[key] = grandPath.get('right');
            }else if(grandPath.isVariableDeclaration()){
                repObj(grandPath, newObj)
            }
        }
        for (const idx in refPath) {
            let grandPath = refPath[idx].parentPath.parentPath;
            grandPath.remove()
        }
        path.remove()
    }
}
function repObj(path, newObj) {
    let name = path.node.declarations[0].id.name;
    let binding = path.scope.getBinding(name);
    if(binding){
        let refPath = binding.referencePaths.reverse();
        for(const idx in refPath){
            let parPath = refPath[idx].parentPath;
            if(parPath.isMemberExpression()){
                let key
                if(parPath.node.computed === false){
                    key = parPath.node.property.name;
                }else{
                    key = parPath.node.property.value;
                }
                if(newObj[key].isStringLiteral() || newObj[key].isTemplateLiteral()){
                    parPath.replaceWith(newObj[key].node);
                }else if (newObj[key].isFunctionExpression() && newObj[key].get('body.body').length === 1){
                    let returnStatement = newObj[key].get('body.body')[0].get('argument');
                    let grandPath = parPath.parentPath;
                    if(returnStatement.isBinaryExpression() || returnStatement.isLogicalExpression()){
                        let operator = returnStatement.node.operator;
                        let callArg = grandPath.node.arguments;
                        let newNode = returnStatement.isBinaryExpression()
                            ? types.binaryExpression(operator, callArg[0], callArg[1])
                            : types.logicalExpression(operator, callArg[0], callArg[1]) ;
                        grandPath.replaceWith(newNode);
                    }else if(returnStatement.isCallExpression()){
                        let callArg = grandPath.node.arguments;
                        let newNode = types.CallExpression(callArg[0], callArg.slice(1))
                        grandPath.replaceWith(newNode);
                    }
                }else{
                    console.log('未处理的类型', newObj[key].type)
                    console.log(newObj[key].toString())
                }
            }
        }
    }
}
traverse(ast, {
    VariableDeclarator(path) {
        if (path.get('init').isObjectExpression()) {
            let newObj = {};
            addObj(path, newObj)
        }
    }
})

扣好的 btoa 代码

function btoa(e) {
  let f = "U9876543210zyxwvutsrqpomnlkjihgfdecbaZXYWVUTSRQPONABHICESQWK2Fi+9876543210zyxwvutsrqpomnlkjihgfdecbaZXYWVUTSRQPONABHICESQWK2Fi"
  if (/([^\u0000-\u00ff])/.test(e)) throw new Error("INVALID_CHARACTER_ERR");
  for (l = 0, c = [], void 0; l < e["length"];) {
    var o;
    var a;
    var s;
    var l;
    var c;
    switch (a = e["charCodeAt"](l), s = l % 6) {
      case 0:
        c["push"](f["charAt"](a >> 2));
        break;
      case 1:
          c["push"](f["charAt"]((2 & o) << 3 | a >> 4));
        break;
      case 2:
        c["push"](f["charAt"]((15 & o) << 2 | a >> 6));
        c["push"](f["charAt"](a & 63));
        break;
      case 3:
        c["push"](f["charAt"](a >> 3));
        break;
      case 4:
        c.push(f["charAt"]((o & 4) << 6 | a >> 6));
        break;
      case 5:
        c["push"](f["charAt"]((o & 15) << 4 | a >> 8));
        c.push(f.charAt(a & 63));
    }
    o = a;
    l++;
  }
  0 == s ? "FAVYf" === "LVZVH" || (c["push"](f["charAt"]((o & 3) << 4)), c.push("FM")) : s == 1 && (c["push"](f["charAt"]((15 & o) << 2)), c["push"]("K"))
  return d(15) + md5(c["join"]("")) + d(10);
}

md5 方法

还原 md5 函数内的 ast 代码

// 安装 babel 库:  npm install @babel/core
const fs = require('fs');

const traverse = require('@babel/traverse').default; // 用于遍历 AST 节点
const types = require('@babel/types');  // 用于判断， 生成 AST 节点

const parser = require('@babel/parser');  // 将js代码解析成ast节点
const generator = require('@babel/generator').default;  // 将ast节点转换成js代码

// 读取(路径记得改)
const ast_code = fs.readFileSync('demo.js', {
    encoding: 'utf-8'
});

let ast = parser.parse(ast_code);  // 将js代码解析成ast语法树


// 这里插入解析规则 ==============================================================================================================================================================================

// 字符串解密
let _0x4c28 = ["Rtsed","SUrST","nsaps","vyNVU","2|29|23|64","0|43|57|4|","NNXUu","nCrbn","wQPIq","XBcOb","39|40|47|6","ljkOt","yMPhx","TXzzv","0123456789","fmdcS","iXQwu","grCxb","3|6|1|4|7|","wKeAM","Iekey","opqrstuvwx","|7|17","BQgZQ","BtzmV","jZUAt","HYhpy","Yvoqt","VyzBI","NNVLf","dbmfK","0|58|16|32","UAFHv","WNIsZ","2|1|4|3|5|","JFqRJ","zObVA","d24fb0d696","XfWkD","MFmWH","lZISZ","WzbFA","kaQlD","3f7d28e17f","eSwEi","YpeFX","kZhzK","KxKIe","LAIPf","LjyKQ","YLwOK","iqfMz","51|8|0|65|","JRihE","nqEyg","|37|22|27|","ZXsFi","goEwl","|31|63|48|","wvVCN","wnDlW","Myvqp","UlhBp","fwCDC","charAt","Lmhlz","WQCAS","UXeVn","KIXRL","HiEZt","WNzfT","lNWda","tsNzQ","18|38|15|2","ucisR","wWwRM","LzcOo","yWGcu","PlAEw","ihcci","hBKtU","rvloG","xcQTI","uhJgH","vRqUp","EQEzR","abc","QgSUn","0|45|44|19","WMqBp","koePJ","jGSEC","IKbhW","wEOgn","|49|71|11|","xgzfr","ABCDEF","DdHPB","aFxRD","sFtiw","concat","YhaCC","YVBwM","abYok","2|28|6|36|","NLOsy","bRLIN","xGAWc","length","zYRlD","14|67|61|3","bolvy","pagBT","mdsJQ","4|69|41|26","kaXPV","IWxBE","pviAr","5|0|2","lvwPz","YcDFe","yGmJD","FcYqi","AAZoR","|46|5|3|50","PnITs","ABCDEFGHIJ","charCodeAt","KLMNOPQRST","prrXX","FDiNG","split","oBesn","9|24|10|56","VaXsK","fromCharCo","FDfcp","rrdPR","HHkBN","89+/","mfuQZ","PbrnX","FcXlo","rNapo","fEXNi","qtIDJ","60|53|21|5"]
var n = function(e, t) {
    return _0x4c28[e -= 0]
};
function repStr(path, name, func) {
    if (path.get('id').isIdentifier() && path.get('init').isIdentifier({name})) {
        let name = path.node.id.name;
        let binding = path.scope.getBinding(name);
        if (binding) {
            let refPath = binding.referencePaths;
            for (const idx in refPath) {
                let parentPath = refPath[idx].parentPath;
                if (parentPath.isCallExpression() && parentPath.get('arguments').length === 1) {
                    let CallArg = parentPath.node.arguments[0].value;
                    parentPath.replaceWith(types.StringLiteral(func(CallArg)))
                } else if (parentPath.isVariableDeclarator()) {
                    let name = path.node.id.name;
                    repStr(parentPath, name, func)
                }
            }
        }
    }
}
traverse(ast, {
    VariableDeclarator(path) {
        repStr(path, 'n', n)
    }
})

// 逗号表达式
traverse(ast, {
    VariableDeclaration(path) {
        if (path.get('declarations').length > 1) {
            let kind = path.node.kind
            let declarations = path.node.declarations
            let nodeList = []
            for (const idx in declarations) {
                let newNode = types.variableDeclaration(kind, [declarations[idx]])
                nodeList.push(newNode)
            }
            path.replaceWithMultiple(nodeList)
        }
    },
    SequenceExpression(path) {
        if (path.get('expressions').length > 1) {
            let expressions = path.node.expressions;
            let nodeList = [];
            for (const idx in expressions) {
                nodeList.push(expressions[idx])
            }
            path.replaceWithMultiple(nodeList)
            path.skip()
        }
    },
    ReturnStatement(path) {
        if (path.node.argument && path.get('argument.expressions').length > 1) {
            let expressions = path.node.argument.expressions;
            let nodeList = expressions.slice(0, -1);
            let retNOde = types.returnStatement(expressions[expressions.length - 1])
            nodeList.push(retNOde)
            path.replaceWithMultiple(nodeList)
        }
    }
})

// 字符串相加
function addStr(path) {
    if (path.get('left').isStringLiteral() && path.get('right').isStringLiteral()) {
        let left = path.node.left.value;
        let right = path.node.right.value;
        let result = left + right
        path.replaceWith(types.stringLiteral(result))
    } else if (path.get('left').isBinaryExpression() && path.get('right').isStringLiteral()) {
        path.traverse({
            BinaryExpression(path_) {
                addStr(path_)
            }
        })
    }
}
for (let i = 0; i < 2; i++) {
    traverse(ast, {
        BinaryExpression(path) {
            addStr(path)
        }
    })
}

// 花指令
function addObj(path, newObj) {
    let name = path.node.id.name;
    let binding = path.scope.getBinding(name);
    if (binding) {
        let refPath = binding.referencePaths;
        for (const idx in refPath) {
            let grandPath = refPath[idx].parentPath.parentPath;
            if(grandPath.isAssignmentExpression()){
                let key;
                if(grandPath.node.left.computed === false){
                    key = grandPath.node.left.property.name;
                }else{
                    key = grandPath.node.left.property.value;
                }
                newObj[key] = grandPath.get('right');
            }else if(grandPath.isVariableDeclaration()){
                repObj(grandPath, newObj)
            }
        }
        for (const idx in refPath) {
            let grandPath = refPath[idx].parentPath.parentPath;
            grandPath.remove()
        }
        path.remove()
    }
}
function repObj(path, newObj) {
    let name = path.node.declarations[0].id.name;
    let binding = path.scope.getBinding(name);
    if(binding){
        let refPath = binding.referencePaths.reverse();
        for(const idx in refPath){
            let parPath = refPath[idx].parentPath;
            if(parPath.isMemberExpression()){
                let key
                if(parPath.node.computed === false){
                    key = parPath.node.property.name;
                }else{
                    key = parPath.node.property.value;
                }
                if(newObj[key].isStringLiteral() || newObj[key].isTemplateLiteral()){
                    parPath.replaceWith(newObj[key].node);
                }else if (newObj[key].isFunctionExpression() && newObj[key].get('body.body').length === 1){
                    let returnStatement = newObj[key].get('body.body')[0].get('argument');
                    let grandPath = parPath.parentPath;
                    if(returnStatement.isBinaryExpression() || returnStatement.isLogicalExpression()){
                        let operator = returnStatement.node.operator;
                        let callArg = grandPath.node.arguments;
                        let newNode = returnStatement.isBinaryExpression()
                            ? types.binaryExpression(operator, callArg[0], callArg[1])
                            : types.logicalExpression(operator, callArg[0], callArg[1]) ;
                        grandPath.replaceWith(newNode);
                    }else if(returnStatement.isCallExpression()){
                        let callArg = grandPath.node.arguments;
                        let newNode = types.CallExpression(callArg[0], callArg.slice(1))
                        grandPath.replaceWith(newNode);
                    }
                }else{
                    console.log('未处理的类型', newObj[key].type)
                    console.log(newObj[key].toString())
                }
            }
        }
    }
}
traverse(ast, {
    VariableDeclarator(path) {
        if (path.get('init').isObjectExpression()) {
            let newObj = {};
            if(path.get('init.properties').length > 0){
                let properties = path.get('init.properties')
                for(const idx in properties){
                    let key;
                    if(properties[idx].get('key').isIdentifier()){
                        key = properties[idx].node.key.name;
                    }else{
                        key = properties[idx].node.key.value;
                    }
                    newObj[key] = properties[idx].get('value')
                }
            }
            addObj(path, newObj)
        }
    }
})

// ==============================================================================================================================================================================
js_code = generator(ast, {
    compact: false,  // 是否压缩，默认 false
}).code  // 将ast节点转换成js代码

// 写入（路径记得改）
fs.writeFileSync('New_demo.js', js_code, {
    encoding: 'utf-8',
})

扣好的 md5 代码

function md5(e) {
  function o(e, n) {
    for (o = "3|6|1|4|7|5|0|2"["split"]("|"), a = 0, void 0;;) {
      var r;
      var o;
      var a;
      switch (o[a++]) {
        case "0":
          for (var d = 0; d < e.length; d += 16)
            for (p = "14|67|61|30|43|57|4|9|24|10|56|55|13|12|60|53|21|54|69|41|26|49|71|11|35|68|33|42|28|6|36|51|8|0|65|18|38|15|20|45|44|19|37|22|27|25|34|1|2|39|40|47|62|29|23|64|46|5|3|50|31|63|48|52|59|66|70|58|16|32|7|17"["split"]("|"), h = 0, void 0;;) {
            var p;
            var h;
            switch (p[h++]) {
              case "0":
                w = l(w, b, x, T, e[d + 2], 9, -51403784);
                continue;
              case "1":
                x = u(x, T, w, b, e[d + 6], 23, 76029189);
                continue;
              case "2":
                b = u(b, x, T, w, e[d + 9], 4, -640364487);
                continue;
              case "3":
                T = c(T, w, b, x, e[d + 10], 15, -1051523);
                continue;
              case "4":
                T = s(T, w, b, x, e[d + 2], 17, 606105819);
                continue;
              case "5":
                w = c(w, b, x, T, e[d + 3], 10, -1894446606);
                continue;
              case "6":
                w = l(w, b, x, T, e[d + 14], 9, -1019803690);
                continue;
              case "7":
                T = f(T, v);
                continue;
              case "8":
                b = l(b, x, T, w, e[d + 13], 5, -1444681467);
                continue;
              case "9":
                x = s(x, T, w, b, e[d + 3], 22, -1044525330);
                continue;
              case "10":
                w = s(w, b, x, T, e[d + 5], 12, 1200080426);
                continue;
              case "11":
                x = l(x, T, w, b, e[d + 0], 20, -373897302);
                continue;
              case "12":
                w = s(w, b, x, T, e[d + 9], 12, -1958435417);
                continue;
              case "13":
                b = s(b, x, T, w, e[d + 8], 7, 1770035416);
                continue;
              case "14":
                var m = b;
                continue;
              case "15":
                w = u(w, b, x, T, e[d + 8], 11, -2022574463);
                continue;
              case "16":
                b = f(b, m);
                continue;
              case "17":
                w = f(w, g);
                continue;
              case "18":
                x = l(x, T, w, b, e[d + 12], 20, -1921207734);
                continue;
              case "19":
                w = u(w, b, x, T, e[d + 4], 11, 1272893353);
                continue;
              case "20":
                T = u(T, w, b, x, e[d + 11], 16, 1839030562);
                continue;
              case "21":
                b = s(b, x, T, w, e[d + 12], 7, 1804550682);
                continue;
              case "22":
                x = u(x, T, w, b, e[d + 10], 23, -1094730640);
                continue;
              case "23":
                T = c(T, w, b, x, e[d + 14], 15, -1416354905);
                continue;
              case "24":
                b = s(b, x, T, w, e[d + 4], 7, -176418897);
                continue;
              case "25":
                w = u(w, b, x, T, e[d + 0], 11, -358537222);
                continue;
              case "26":
                b = l(b, x, T, w, e[d + 1], 5, -165796510);
                continue;
              case "27":
                b = u(b, x, T, w, e[d + 13], 4, 681279174);
                continue;
              case "28":
                b = l(b, x, T, w, e[d + 9], 5, 568446438);
                continue;
              case "29":
                w = c(w, b, x, T, e[d + 7], 10, 11261161415);
                continue;
              case "30":
                var g = w;
                continue;
              case "31":
                b = c(b, x, T, w, e[d + 8], 6, 1873313359);
                continue;
              case "32":
                x = f(x, y);
                continue;
              case "33":
                T = l(T, w, b, x, e[d + 15], 14, -660478335);
                continue;
              case "34":
                T = u(T, w, b, x, e[d + 3], 16, -722881979);
                continue;
              case "35":
                b = l(b, x, T, w, e[d + 5], 5, -701520691);
                continue;
              case "36":
                T = l(T, w, b, x, e[d + 3], 14, -187363961);
                continue;
              case "37":
                T = u(T, w, b, x, e[d + 7], 16, -155497632);
                continue;
              case "38":
                b = u(b, x, T, w, e[d + 5], 4, -378558);
                continue;
              case "39":
                w = u(w, b, x, T, e[d + 12], 11, -421815835);
                continue;
              case "40":
                T = u(T, w, b, x, e[d + 15], 16, 530742520);
                continue;
              case "41":
                x = s(x, T, w, b, e[d + 15], 22, 1236531029);
                continue;
              case "42":
                x = l(x, T, w, b, e[d + 4], 20, -405537848);
                continue;
              case "43":
                b = s(b, x, T, w, e[d + 0], 7, -680976936);
                continue;
              case "44":
                b = u(b, x, T, w, e[d + 1], 4, -1530992060);
                continue;
              case "45":
                x = u(x, T, w, b, e[d + 14], 23, -35311556);
                continue;
              case "46":
                b = c(b, x, T, w, e[d + 12], 6, 1700485571);
                continue;
              case "47":
                x = u(x, T, w, b, e[d + 2], 23, -995338651);
                continue;
              case "48":
                T = c(T, w, b, x, e[d + 6], 15, -1560198380);
                continue;
              case "49":
                w = l(w, b, x, T, e[d + 6], 9, -1069501632);
                continue;
              case "50":
                x = c(x, T, w, b, e[d + 1], 21, -2054922799);
                continue;
              case "51":
                x = l(x, T, w, b, e[d + 8], 20, 1163531501);
                continue;
              case "52":
                x = c(x, T, w, b, e[d + 13], 21, 1309151649);
                continue;
              case "53":
                x = s(x, T, w, b, e[d + 11], 22, -1990404162);
                continue;
              case "54":
                w = s(w, b, x, T, e[d + 13], 12, -40341101);
                continue;
              case "55":
                x = s(x, T, w, b, e[d + 7], 22, -45705983);
                continue;
              case "56":
                T = s(T, w, b, x, e[d + 6], 17, -1473231341);
                continue;
              case "57":
                w = s(w, b, x, T, e[d + 1], 12, -389564586);
                continue;
              case "58":
                x = c(x, T, w, b, e[d + 9], 21, -343485551);
                continue;
              case "59":
                b = c(b, x, T, w, e[d + 4], 6, -145523070);
                continue;
              case "60":
                T = s(T, w, b, x, e[d + 10], 17, -42063);
                continue;
              case "61":
                var v = T;
                continue;
              case "62":
                b = c(b, x, T, w, e[d + 0], 6, -198630844);
                continue;
              case "63":
                w = c(w, b, x, T, e[d + 15], 10, -30611744);
                continue;
              case "64":
                x = c(x, T, w, b, e[d + 5], 21, -57434055);
                continue;
              case "65":
                T = l(T, w, b, x, e[d + 7], 14, 1735328473);
                continue;
              case "66":
                w = c(w, b, x, T, e[d + 11], 10, -1120210379);
                continue;
              case "67":
                var y = x;
                continue;
              case "68":
                w = l(w, b, x, T, e[d + 10], 9, 38016083);
                continue;
              case "69":
                T = s(T, w, b, x, e[d + 14], 17, -1502002290);
                continue;
              case "70":
                T = c(T, w, b, x, e[d + 2], 15, 718787259);
                continue;
              case "71":
                T = l(T, w, b, x, e[d + 11], 14, 643717713);
                continue;
            }
            break;
          }
          continue;
        case "1":
          var b = 1732584193;
          continue;
        case "2":
          return Array(b, x, T, w);
        case "3":
          e[n >> 5] |= 128 << n % 32;
          continue;
        case "4":
          var x = -271733879;
          continue;
        case "5":
          var w = 271733878;
          continue;
        case "6":
          e[(n + 64 >>> 9 << 4) + 14] = n;
          continue;
        case "7":
          var T = -1732584194;
          continue;
      }
      break;
    }
  }
  function a(e, n, r, o, a, s) {
    return f(d(f(f(n, e), f(o, s)), a), r);
  }
  function s(e, n, r, o, s, l, u) {
    return a(n & r | ~n & o, e, n, s, l, u);
  }
  function l(e, n, r, o, s, l, u) {
    return a(n & o | r & ~o, e, n, s, l, u);
  }
  function u(e, n, r, o, s, l, u) {
    return a(n ^ r ^ o, e, n, s, l, u);
  }
  function c(e, n, r, o, s, l, u) {
    return a(r ^ (n | ~o), e, n, s, l, u);
  }
  function f(e, n) {
    var o = (65535 & e) + (n & 65535);
    var a = (e >> 16) + (n >> 16) + (o >> 16);
    return a << 16 | o & 65535;
  }
  function d(e, n) {
    return e << n | e >>> 32 - n;
  }
  function p(e) {
    for (r = Array(), o = (1 << 16) - 1, a = 0, void 0; a < e["length"] * 16; a += 16) {
      var n;
      var r;
      var o;
      var a;
      r[a >> 5] |= (e["charCodeAt"](a / 16) & o) << a % 32;
    }
    return r;
  }
  function h(e) {
    for (r = "0123456789abcdef", o = "", a = 0, void 0; a < e["length"] * 4; a++) {
      var n;
      var r;
      var o;
      var a;
      o += r["charAt"](15 & e[a >> 2] >> a % 4 * 8 + 4) + r["charAt"](15 & e[a >> 2] >> a % 4 * 8);
    }
    return o;
  }
  return function (e) {
    return h(o(p(e), 16 * e["length"]));
  }(e);
}

d 方法

d 代码很短手动还原即可

function d(e) {
    for (var o = "1|3|0|4|2|5"['split']("|"), a = 0; ; ) {
        switch (o[a++]) {
        case "0":
            var s = l['length'];
            continue;
        case "1":
            e = e || 32;
            continue;
        case "2":
            for (i = 0; i < e; i++)
                c += l['charAt'](Math['floor'](Math.random() * s));
            continue;
        case "3":
            var l = 'ABCDEFGHJKMNPQRSTWXYZabcdefhijkmnprstwxyz2345678';
            continue;
        case "4":
            var c = "";
            continue;
        case "5":
            return c
        }
        break
    }
}

验证加密结果

btoa, md5 传入相同的参数会返回一样的结果
d 使用了 Math.random()，想验证的话可以重写 Math.random() 返回固定的值即可

验证 btoa 方法将断点打在 btoa 方法的 return 语句上即可

先查看浏览器传进来的时间戳

执行 md5(c[“join”](“”))

浏览器

nodejs

python 代码

import requests
import execjs

headers = {
    "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36",
}
cookies = {
    "sessionid": "你的sessionid",
}


def call_js(file_name, func_name, *args):
    with open(file_name, mode='r', encoding='utf-8') as f:
        js_code = execjs.compile(f.read())
    return js_code.call(func_name, *args)


def send_match16(page_):
    url = "https://match.yuanrenxue.cn/api/match/16"
    sdk = call_js('16.js', 'sdk')
    params = {
        "page": f"{page_}",
        "m": sdk['m'],
        "t": sdk["t"]
    }
    response = requests.get(url, headers=headers, cookies=cookies, params=params)
    print(response.json())
    return response.json()['data']


if __name__ == '__main__':
    nums = 0
    for page in range(1, 6):
        nums_list = send_match16(page)
        for num in nums_list:
            nums += num['value']
        print('page: ', page, 'nums: ', nums)

js 代码

let p_s = Date['parse'](new Date)['toString']();
function d(e) {
    for (var o = "1|3|0|4|2|5"['split']("|"), a = 0; ; ) {
        switch (o[a++]) {
        case "0":
            var s = l['length'];
            continue;
        case "1":
            e = e || 32;
            continue;
        case "2":
            for (i = 0; i < e; i++)
                c += l['charAt'](Math['floor'](Math.random() * s));
            continue;
        case "3":
            var l = 'ABCDEFGHJKMNPQRSTWXYZabcdefhijkmnprstwxyz2345678';
            continue;
        case "4":
            var c = "";
            continue;
        case "5":
            return c
        }
        break
    }
}
function btoa(e) {
  let f = "U9876543210zyxwvutsrqpomnlkjihgfdecbaZXYWVUTSRQPONABHICESQWK2Fi+9876543210zyxwvutsrqpomnlkjihgfdecbaZXYWVUTSRQPONABHICESQWK2Fi"
  if (/([^\u0000-\u00ff])/.test(e)) throw new Error("INVALID_CHARACTER_ERR");
  for (l = 0, c = [], void 0; l < e["length"];) {
    var o;
    var a;
    var s;
    var l;
    var c;
    switch (a = e["charCodeAt"](l), s = l % 6) {
      case 0:
        c["push"](f["charAt"](a >> 2));
        break;
      case 1:
          c["push"](f["charAt"]((2 & o) << 3 | a >> 4));
        break;
      case 2:
        c["push"](f["charAt"]((15 & o) << 2 | a >> 6));
        c["push"](f["charAt"](a & 63));
        break;
      case 3:
        c["push"](f["charAt"](a >> 3));
        break;
      case 4:
        c.push(f["charAt"]((o & 4) << 6 | a >> 6));
        break;
      case 5:
        c["push"](f["charAt"]((o & 15) << 4 | a >> 8));
        c.push(f.charAt(a & 63));
    }
    o = a;
    l++;
  }
  0 == s ? "FAVYf" === "LVZVH" || (c["push"](f["charAt"]((o & 3) << 4)), c.push("FM")) : s == 1 && (c["push"](f["charAt"]((15 & o) << 2)), c["push"]("K"))
  return d(15) + md5(c["join"]("")) + d(10);
}
function md5(e) {
  function o(e, n) {
    for (o = "3|6|1|4|7|5|0|2"["split"]("|"), a = 0, void 0;;) {
      var r;
      var o;
      var a;
      switch (o[a++]) {
        case "0":
          for (var d = 0; d < e.length; d += 16)
            for (p = "14|67|61|30|43|57|4|9|24|10|56|55|13|12|60|53|21|54|69|41|26|49|71|11|35|68|33|42|28|6|36|51|8|0|65|18|38|15|20|45|44|19|37|22|27|25|34|1|2|39|40|47|62|29|23|64|46|5|3|50|31|63|48|52|59|66|70|58|16|32|7|17"["split"]("|"), h = 0, void 0;;) {
            var p;
            var h;
            switch (p[h++]) {
              case "0":
                w = l(w, b, x, T, e[d + 2], 9, -51403784);
                continue;
              case "1":
                x = u(x, T, w, b, e[d + 6], 23, 76029189);
                continue;
              case "2":
                b = u(b, x, T, w, e[d + 9], 4, -640364487);
                continue;
              case "3":
                T = c(T, w, b, x, e[d + 10], 15, -1051523);
                continue;
              case "4":
                T = s(T, w, b, x, e[d + 2], 17, 606105819);
                continue;
              case "5":
                w = c(w, b, x, T, e[d + 3], 10, -1894446606);
                continue;
              case "6":
                w = l(w, b, x, T, e[d + 14], 9, -1019803690);
                continue;
              case "7":
                T = f(T, v);
                continue;
              case "8":
                b = l(b, x, T, w, e[d + 13], 5, -1444681467);
                continue;
              case "9":
                x = s(x, T, w, b, e[d + 3], 22, -1044525330);
                continue;
              case "10":
                w = s(w, b, x, T, e[d + 5], 12, 1200080426);
                continue;
              case "11":
                x = l(x, T, w, b, e[d + 0], 20, -373897302);
                continue;
              case "12":
                w = s(w, b, x, T, e[d + 9], 12, -1958435417);
                continue;
              case "13":
                b = s(b, x, T, w, e[d + 8], 7, 1770035416);
                continue;
              case "14":
                var m = b;
                continue;
              case "15":
                w = u(w, b, x, T, e[d + 8], 11, -2022574463);
                continue;
              case "16":
                b = f(b, m);
                continue;
              case "17":
                w = f(w, g);
                continue;
              case "18":
                x = l(x, T, w, b, e[d + 12], 20, -1921207734);
                continue;
              case "19":
                w = u(w, b, x, T, e[d + 4], 11, 1272893353);
                continue;
              case "20":
                T = u(T, w, b, x, e[d + 11], 16, 1839030562);
                continue;
              case "21":
                b = s(b, x, T, w, e[d + 12], 7, 1804550682);
                continue;
              case "22":
                x = u(x, T, w, b, e[d + 10], 23, -1094730640);
                continue;
              case "23":
                T = c(T, w, b, x, e[d + 14], 15, -1416354905);
                continue;
              case "24":
                b = s(b, x, T, w, e[d + 4], 7, -176418897);
                continue;
              case "25":
                w = u(w, b, x, T, e[d + 0], 11, -358537222);
                continue;
              case "26":
                b = l(b, x, T, w, e[d + 1], 5, -165796510);
                continue;
              case "27":
                b = u(b, x, T, w, e[d + 13], 4, 681279174);
                continue;
              case "28":
                b = l(b, x, T, w, e[d + 9], 5, 568446438);
                continue;
              case "29":
                w = c(w, b, x, T, e[d + 7], 10, 11261161415);
                continue;
              case "30":
                var g = w;
                continue;
              case "31":
                b = c(b, x, T, w, e[d + 8], 6, 1873313359);
                continue;
              case "32":
                x = f(x, y);
                continue;
              case "33":
                T = l(T, w, b, x, e[d + 15], 14, -660478335);
                continue;
              case "34":
                T = u(T, w, b, x, e[d + 3], 16, -722881979);
                continue;
              case "35":
                b = l(b, x, T, w, e[d + 5], 5, -701520691);
                continue;
              case "36":
                T = l(T, w, b, x, e[d + 3], 14, -187363961);
                continue;
              case "37":
                T = u(T, w, b, x, e[d + 7], 16, -155497632);
                continue;
              case "38":
                b = u(b, x, T, w, e[d + 5], 4, -378558);
                continue;
              case "39":
                w = u(w, b, x, T, e[d + 12], 11, -421815835);
                continue;
              case "40":
                T = u(T, w, b, x, e[d + 15], 16, 530742520);
                continue;
              case "41":
                x = s(x, T, w, b, e[d + 15], 22, 1236531029);
                continue;
              case "42":
                x = l(x, T, w, b, e[d + 4], 20, -405537848);
                continue;
              case "43":
                b = s(b, x, T, w, e[d + 0], 7, -680976936);
                continue;
              case "44":
                b = u(b, x, T, w, e[d + 1], 4, -1530992060);
                continue;
              case "45":
                x = u(x, T, w, b, e[d + 14], 23, -35311556);
                continue;
              case "46":
                b = c(b, x, T, w, e[d + 12], 6, 1700485571);
                continue;
              case "47":
                x = u(x, T, w, b, e[d + 2], 23, -995338651);
                continue;
              case "48":
                T = c(T, w, b, x, e[d + 6], 15, -1560198380);
                continue;
              case "49":
                w = l(w, b, x, T, e[d + 6], 9, -1069501632);
                continue;
              case "50":
                x = c(x, T, w, b, e[d + 1], 21, -2054922799);
                continue;
              case "51":
                x = l(x, T, w, b, e[d + 8], 20, 1163531501);
                continue;
              case "52":
                x = c(x, T, w, b, e[d + 13], 21, 1309151649);
                continue;
              case "53":
                x = s(x, T, w, b, e[d + 11], 22, -1990404162);
                continue;
              case "54":
                w = s(w, b, x, T, e[d + 13], 12, -40341101);
                continue;
              case "55":
                x = s(x, T, w, b, e[d + 7], 22, -45705983);
                continue;
              case "56":
                T = s(T, w, b, x, e[d + 6], 17, -1473231341);
                continue;
              case "57":
                w = s(w, b, x, T, e[d + 1], 12, -389564586);
                continue;
              case "58":
                x = c(x, T, w, b, e[d + 9], 21, -343485551);
                continue;
              case "59":
                b = c(b, x, T, w, e[d + 4], 6, -145523070);
                continue;
              case "60":
                T = s(T, w, b, x, e[d + 10], 17, -42063);
                continue;
              case "61":
                var v = T;
                continue;
              case "62":
                b = c(b, x, T, w, e[d + 0], 6, -198630844);
                continue;
              case "63":
                w = c(w, b, x, T, e[d + 15], 10, -30611744);
                continue;
              case "64":
                x = c(x, T, w, b, e[d + 5], 21, -57434055);
                continue;
              case "65":
                T = l(T, w, b, x, e[d + 7], 14, 1735328473);
                continue;
              case "66":
                w = c(w, b, x, T, e[d + 11], 10, -1120210379);
                continue;
              case "67":
                var y = x;
                continue;
              case "68":
                w = l(w, b, x, T, e[d + 10], 9, 38016083);
                continue;
              case "69":
                T = s(T, w, b, x, e[d + 14], 17, -1502002290);
                continue;
              case "70":
                T = c(T, w, b, x, e[d + 2], 15, 718787259);
                continue;
              case "71":
                T = l(T, w, b, x, e[d + 11], 14, 643717713);
                continue;
            }
            break;
          }
          continue;
        case "1":
          var b = 1732584193;
          continue;
        case "2":
          return Array(b, x, T, w);
        case "3":
          e[n >> 5] |= 128 << n % 32;
          continue;
        case "4":
          var x = -271733879;
          continue;
        case "5":
          var w = 271733878;
          continue;
        case "6":
          e[(n + 64 >>> 9 << 4) + 14] = n;
          continue;
        case "7":
          var T = -1732584194;
          continue;
      }
      break;
    }
  }
  function a(e, n, r, o, a, s) {
    return f(d(f(f(n, e), f(o, s)), a), r);
  }
  function s(e, n, r, o, s, l, u) {
    return a(n & r | ~n & o, e, n, s, l, u);
  }
  function l(e, n, r, o, s, l, u) {
    return a(n & o | r & ~o, e, n, s, l, u);
  }
  function u(e, n, r, o, s, l, u) {
    return a(n ^ r ^ o, e, n, s, l, u);
  }
  function c(e, n, r, o, s, l, u) {
    return a(r ^ (n | ~o), e, n, s, l, u);
  }
  function f(e, n) {
    var o = (65535 & e) + (n & 65535);
    var a = (e >> 16) + (n >> 16) + (o >> 16);
    return a << 16 | o & 65535;
  }
  function d(e, n) {
    return e << n | e >>> 32 - n;
  }
  function p(e) {
    for (r = Array(), o = (1 << 16) - 1, a = 0, void 0; a < e["length"] * 16; a += 16) {
      var n;
      var r;
      var o;
      var a;
      r[a >> 5] |= (e["charCodeAt"](a / 16) & o) << a % 32;
    }
    return r;
  }
  function h(e) {
    for (r = "0123456789abcdef", o = "", a = 0, void 0; a < e["length"] * 4; a++) {
      var n;
      var r;
      var o;
      var a;
      o += r["charAt"](15 & e[a >> 2] >> a % 4 * 8 + 4) + r["charAt"](15 & e[a >> 2] >> a % 4 * 8);
    }
    return o;
  }
  return function (e) {
    return h(o(p(e), 16 * e["length"]));
  }(e);
}

// 定义 sdk 方便 python 调用
function sdk(){
  return {
    m: btoa(p_s),
    t: p_s
  }
}

Spider小郭

关注

6
点赞
踩
1

收藏

觉得还不错? 一键收藏
0
评论
【简单】猿人学web第一届第16题 js-逆向 windows蜜罐 / webpack初体验

数据接口分析https://match.yuanrenxue.cn/api/match/16请求参数需要携带 page 页码，m 和 t 字段，m为加密参数，t 目测是一个时间戳加密参数还原查看数据接口对应的 window.request 栈r 对象里携带了请求参数手动解混淆后的代码p_s = Date['parse'](new Date)['toString']();var r = {};r['page'] = window['page']; // 页码信息
复制链接

扫一扫