BiliBili热搜w_rid参数逆向

最新推荐文章于 2024-07-02 15:49:30 发布

真宇宙超级无敌暴龙战士

最新推荐文章于 2024-07-02 15:49:30 发布

阅读量585

点赞数 6

文章标签： javascript 笔记经验分享

本文链接：https://blog.csdn.net/qq_54696653/article/details/136991034

版权

1.打开开发者工具

找到热搜相对应的接口。

查看请求携带的参数，wts很眼熟，是我们的时间戳。

2.定位w_rid参数生成的位置。

通过搜索我们找到了很多w_rid相关字眼,我们统统给他们打上断点，然后刷新。

刷新后断点在md5$2函数处断住。

在控制台打印，通过观察该处即为我们w_rid参数生成位置。

此处MD5函数传入了两个参数，分别为fr和tr，经过多次测试，tr为定值，不会改变。

fr = ar.join("&") 在控制台打印ar。此处只需要更改wts。

3.继续向上跟加密函数。

此处有三目运算符，通过我们分析，最终执行 qt.bytesToHex(ir) 该函数。

至此，分析结束。

最后，附上代码。


const CryptoJS = require('crypto-js');

var Ltime = new Date();
var n =Math.floor(Ltime.getTime()/1000)

var ar= [
    "ids=2837%2C2836%2C2870%2C2953%2C2954%2C2955%2C2956%2C5672",
    "pf=0",
    `"wts=${n}"`
]

var Wt = {
    "pf": 0,
    "ids": "2837,2836,2870,2953,2954,2955,2956,5672"
}


var fr = ar.join("&")

var tr = 'ea1db124af3c7062474693fa704f4ff8'

console.log(fr)

function qtwordsToBytes(Zt) {
                for (var er = [], tr = 0; tr < Zt.length * 32; tr += 8)
                    er.push(Zt[tr >>> 5] >>> 24 - tr % 32 & 255);
                return er
}

var charenc$1 = {
    utf8: {
        stringToBytes: function(Wt) {
            return charenc$1.bin.stringToBytes(unescape(encodeURIComponent(Wt)))
        },
        bytesToString: function(Wt) {
            return decodeURIComponent(escape(charenc$1.bin.bytesToString(Wt)))
        }
    },
    bin: {
        stringToBytes: function(Wt) {
            for (var qt = [], Yt = 0; Yt < Wt.length; Yt++)
                qt.push(Wt.charCodeAt(Yt) & 255);
            return qt
        },
        bytesToString: function(Wt) {
            for (var qt = [], Yt = 0; Yt < Wt.length; Yt++)
                qt.push(String.fromCharCode(Wt[Yt]));
            return qt.join("")
        }
    }
}

charenc_1$1 = charenc$1;

var Yt = charenc_1$1.utf8


function qtbytesToWords(Zt) {
                for (var er = [], tr = 0, rr = 0; tr < Zt.length; tr++,
                rr += 8)
                    er[rr >>> 5] |= Zt[tr] << 24 - rr % 32;
                return er
}

 function trff(rr, nr, ir, or, ar, sr, lr) {
            var cr = rr + (nr & ir | ~nr & or) + (ar >>> 0) + lr;
            return (cr << sr | cr >>> 32 - sr) + nr
}

function trgg(rr, nr, ir, or, ar, sr, lr) {
            var cr = rr + (nr & or | ir & ~or) + (ar >>> 0) + lr;
            return (cr << sr | cr >>> 32 - sr) + nr
}

function trhh(rr, nr, ir, or, ar, sr, lr) {
    var cr = rr + (nr ^ ir ^ or) + (ar >>> 0) + lr;
    return (cr << sr | cr >>> 32 - sr) + nr
}

function trii(rr, nr, ir, or, ar, sr, lr) {
    var cr = rr + (ir ^ (nr | ~or)) + (ar >>> 0) + lr;
    return (cr << sr | cr >>> 32 - sr) + nr
}

function Ytrotl(Zt, er) {
                return Zt << er | Zt >>> 32 - er
}

function qtendian(Zt) {
                if (Zt.constructor == Number)
                    return Ytrotl(Zt, 8) & 16711935 | Ytrotl(Zt, 24) & 4278255360;
                for (var er = 0; er < Zt.length; er++)
                    Zt[er] = qtendian(Zt[er]);
                return Zt
}
var tr = function (rr, nr) {
            rr.constructor == String ? nr && nr.encoding === "binary" ? rr = er.stringToBytes(rr) : rr = Yt.stringToBytes(rr) : Zt(rr) ? rr = Array.prototype.slice.call(rr, 0) : !Array.isArray(rr) && rr.constructor !== Uint8Array && (rr = rr.toString());
            for (var ir = qtbytesToWords(rr), or = rr.length * 8, ar = 1732584193, sr = -271733879, lr = -1732584194, cr = 271733878, ur = 0; ur < ir.length; ur++)
                ir[ur] = (ir[ur] << 8 | ir[ur] >>> 24) & 16711935 | (ir[ur] << 24 | ir[ur] >>> 8) & 4278255360;
            ir[or >>> 5] |= 128 << or % 32,
            ir[(or + 64 >>> 9 << 4) + 14] = or;
            for (var fr = trff, mr = trgg, dr = trhh, vr = trii, ur = 0; ur < ir.length; ur += 16) {
                var hr = ar
                  , pr = sr
                  , gr = lr
                  , yr = cr;
                ar = fr(ar, sr, lr, cr, ir[ur + 0], 7, -680876936),
                cr = fr(cr, ar, sr, lr, ir[ur + 1], 12, -389564586),
                lr = fr(lr, cr, ar, sr, ir[ur + 2], 17, 606105819),
                sr = fr(sr, lr, cr, ar, ir[ur + 3], 22, -1044525330),
                ar = fr(ar, sr, lr, cr, ir[ur + 4], 7, -176418897),
                cr = fr(cr, ar, sr, lr, ir[ur + 5], 12, 1200080426),
                lr = fr(lr, cr, ar, sr, ir[ur + 6], 17, -1473231341),
                sr = fr(sr, lr, cr, ar, ir[ur + 7], 22, -45705983),
                ar = fr(ar, sr, lr, cr, ir[ur + 8], 7, 1770035416),
                cr = fr(cr, ar, sr, lr, ir[ur + 9], 12, -1958414417),
                lr = fr(lr, cr, ar, sr, ir[ur + 10], 17, -42063),
                sr = fr(sr, lr, cr, ar, ir[ur + 11], 22, -1990404162),
                ar = fr(ar, sr, lr, cr, ir[ur + 12], 7, 1804603682),
                cr = fr(cr, ar, sr, lr, ir[ur + 13], 12, -40341101),
                lr = fr(lr, cr, ar, sr, ir[ur + 14], 17, -1502002290),
                sr = fr(sr, lr, cr, ar, ir[ur + 15], 22, 1236535329),
                ar = mr(ar, sr, lr, cr, ir[ur + 1], 5, -165796510),
                cr = mr(cr, ar, sr, lr, ir[ur + 6], 9, -1069501632),
                lr = mr(lr, cr, ar, sr, ir[ur + 11], 14, 643717713),
                sr = mr(sr, lr, cr, ar, ir[ur + 0], 20, -373897302),
                ar = mr(ar, sr, lr, cr, ir[ur + 5], 5, -701558691),
                cr = mr(cr, ar, sr, lr, ir[ur + 10], 9, 38016083),
                lr = mr(lr, cr, ar, sr, ir[ur + 15], 14, -660478335),
                sr = mr(sr, lr, cr, ar, ir[ur + 4], 20, -405537848),
                ar = mr(ar, sr, lr, cr, ir[ur + 9], 5, 568446438),
                cr = mr(cr, ar, sr, lr, ir[ur + 14], 9, -1019803690),
                lr = mr(lr, cr, ar, sr, ir[ur + 3], 14, -187363961),
                sr = mr(sr, lr, cr, ar, ir[ur + 8], 20, 1163531501),
                ar = mr(ar, sr, lr, cr, ir[ur + 13], 5, -1444681467),
                cr = mr(cr, ar, sr, lr, ir[ur + 2], 9, -51403784),
                lr = mr(lr, cr, ar, sr, ir[ur + 7], 14, 1735328473),
                sr = mr(sr, lr, cr, ar, ir[ur + 12], 20, -1926607734),
                ar = dr(ar, sr, lr, cr, ir[ur + 5], 4, -378558),
                cr = dr(cr, ar, sr, lr, ir[ur + 8], 11, -2022574463),
                lr = dr(lr, cr, ar, sr, ir[ur + 11], 16, 1839030562),
                sr = dr(sr, lr, cr, ar, ir[ur + 14], 23, -35309556),
                ar = dr(ar, sr, lr, cr, ir[ur + 1], 4, -1530992060),
                cr = dr(cr, ar, sr, lr, ir[ur + 4], 11, 1272893353),
                lr = dr(lr, cr, ar, sr, ir[ur + 7], 16, -155497632),
                sr = dr(sr, lr, cr, ar, ir[ur + 10], 23, -1094730640),
                ar = dr(ar, sr, lr, cr, ir[ur + 13], 4, 681279174),
                cr = dr(cr, ar, sr, lr, ir[ur + 0], 11, -358537222),
                lr = dr(lr, cr, ar, sr, ir[ur + 3], 16, -722521979),
                sr = dr(sr, lr, cr, ar, ir[ur + 6], 23, 76029189),
                ar = dr(ar, sr, lr, cr, ir[ur + 9], 4, -640364487),
                cr = dr(cr, ar, sr, lr, ir[ur + 12], 11, -421815835),
                lr = dr(lr, cr, ar, sr, ir[ur + 15], 16, 530742520),
                sr = dr(sr, lr, cr, ar, ir[ur + 2], 23, -995338651),
                ar = vr(ar, sr, lr, cr, ir[ur + 0], 6, -198630844),
                cr = vr(cr, ar, sr, lr, ir[ur + 7], 10, 1126891415),
                lr = vr(lr, cr, ar, sr, ir[ur + 14], 15, -1416354905),
                sr = vr(sr, lr, cr, ar, ir[ur + 5], 21, -57434055),
                ar = vr(ar, sr, lr, cr, ir[ur + 12], 6, 1700485571),
                cr = vr(cr, ar, sr, lr, ir[ur + 3], 10, -1894986606),
                lr = vr(lr, cr, ar, sr, ir[ur + 10], 15, -1051523),
                sr = vr(sr, lr, cr, ar, ir[ur + 1], 21, -2054922799),
                ar = vr(ar, sr, lr, cr, ir[ur + 8], 6, 1873313359),
                cr = vr(cr, ar, sr, lr, ir[ur + 15], 10, -30611744),
                lr = vr(lr, cr, ar, sr, ir[ur + 6], 15, -1560198380),
                sr = vr(sr, lr, cr, ar, ir[ur + 13], 21, 1309151649),
                ar = vr(ar, sr, lr, cr, ir[ur + 4], 6, -145523070),
                cr = vr(cr, ar, sr, lr, ir[ur + 11], 10, -1120210379),
                lr = vr(lr, cr, ar, sr, ir[ur + 2], 15, 718787259),
                sr = vr(sr, lr, cr, ar, ir[ur + 9], 21, -343485551),
                ar = ar + hr >>> 0,
                sr = sr + pr >>> 0,
                lr = lr + gr >>> 0,
                cr = cr + yr >>> 0
            }
            return qtendian([ar, sr, lr, cr])
        }

function qtbytesToHex(Zt) {
                for (var er = [], tr = 0; tr < Zt.length; tr++)
                    er.push((Zt[tr] >>> 4).toString(16)),
                    er.push((Zt[tr] & 15).toString(16));
                return er.join("")
}

function md5$2(rr,nr=undefined) {
            if (rr == null)
                throw new Error("Illegal argument " + rr);
            var ir = qtwordsToBytes(tr(rr, nr));
            return qtbytesToHex(ir)
}

console.log( md5$2(fr + tr))

注：本人蒻媾，大佬勿喷ovo