js逆向笔记二(获取音乐下载地址)

主要思路就是

一共需要两个加密的参数第一个参数就是对下面的decrypt_str进行一次AES_CBC加密得到encrypt_str其中的key就是随机生成的十六位字符串
然后他会再将第一次加密得到的encrypt_str作为data key还是上次加密·随机生成的十六位字符串再次加密得到我们需要的params参数

encSecKey这个参数是对我们AES_CBC加密中那个随机生成的十六位字符串进行rsa加密我们拿到的公钥是不变的所以只要我们把这个随机生成的十六位字符变成一个定值encSecKey也就确定了

decrypt_str = "{\"ids\":\"["+str(idd)+"]\",\"level\":\"standard\",\"encodeType\":\"aac\",\"csrf_token\":\"\"}"

from Crypto.Cipher import AES
import base64
from Crypto.Util.Padding import pad
import requests
from jiami import Aj
def idh():
    name = input('请输入歌名: ')
    i1x = {
        'csrf_token': "",
        'limit': "8",
        's': name
    }
    data = i1x
    aj = Aj(data)
    url = 'https://music.163.com/weapi/search/suggest/web'
    res = requests.post(url, data={'params': aj.getparams(data), 'encSecKey': aj.getenseckey()})
    print(res.json()["result"]["songs"][0]["id"])
    return res.json()["result"]["songs"][0]["id"]



def aes_cbc_encrypt_text(decrypt_text: str, key: str, iv: str) -> str:
    """
    加密AES_CBC的明文
    :param decrypt_text: 明文
    :param key: 密钥
    :param iv: 密钥偏移量
    :return: 密文
    """
    aes2 = AES.new(key.encode('utf-8'), AES.MODE_CBC, iv.encode('utf-8'))
    encrypt_text = aes2.encrypt(pad(decrypt_text.encode('utf-8'), AES.block_size, style='pkcs7'))
    encrypt_text = str(base64.encodebytes(encrypt_text), encoding='utf-8').replace("\n", "")
    return encrypt_text



idd=idh()


# AES_CBC加密模式
decrypt_str = "{\"ids\":\"["+str(idd)+"]\",\"level\":\"standard\",\"encodeType\":\"aac\",\"csrf_token\":\"\"}"

key_str = '0CoJUm6Qyw8W8jud'
iv_str = "0102030405060708"
a="ouPO61mhRSoLJEwz"
encrypt_str = aes_cbc_encrypt_text(decrypt_str, key_str, iv_str)
print(encrypt_str)
encrypt_str = aes_cbc_encrypt_text(encrypt_str, a, iv_str)
print(encrypt_str)
params=encrypt_str
encSecKey="c13dc213bd5889986ef8a7af39406c640bf77c6a5a34fe86324b648708b3af49919368a2d555771ea5453a605be7bfeaca0860696a9a9889e24a925bfeb56455f7275e534e733eaa5f94392d7b75da0701b8f38a3006bd6cd10cce66d64daa39f6dd12f970421d79b91abc8116012ee4f2dc8c7648c527abc22158b0338a9171"


url='https://music.163.com/weapi/song/enhance/player/url/v1?csrf_token='

data={
'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.54',
'params': params,
'encSecKey': encSecKey
}

res=requests.post(url,data=data)
print(res.json()['data'][0]['url'])

这是加密的过程

var bMr1x = window.asrsea(JSON.stringify(i0x), bsg8Y(["流泪", "强"]), bsg8Y(TH5M.md), bsg8Y(["爱心", "女孩", "惊恐", "大笑"]));
            e0x.data = j0x.cr0x({
                params: bMr1x.encText,
                encSecKey: bMr1x.encSecKey
            })

JSON.stringify(i0x)
'{"ids":"[32574693]","level":"standard","encodeType":"aac","csrf_token":""}'




bsg8Y(["流泪", "强"])
'010001'



bsg8Y(TH5M.md)
'00e0b509f6259df8642dbc35662901477df22677ec152b5ff68ace615bb7b725152b3ab17a876aea8a5aa76d2e417629ec4ee341f56135fccf695280104e0312ecbda92557c93870114af6c9d05c4f7f0c3685b7a46bee255932575cce10b424d813cfe4875d3e82047b97ddef52741d546b8e289dc6935b3ece0462db0a22b8e7'


bsg8Y(["爱心", "女孩", "惊恐", "大笑"])
'0CoJUm6Qyw8W8jud'


!function() {
    function a(a) {
        var d, e, b = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789", c = "";
        for (d = 0; a > d; d += 1)
            e = Math.random() * b.length,
            e = Math.floor(e),
            c += b.charAt(e);
        return c
    }
    function b(a, b) {
        var c = CryptoJS.enc.Utf8.parse(b)
          , d = CryptoJS.enc.Utf8.parse("0102030405060708")
          , e = CryptoJS.enc.Utf8.parse(a)
          , f = CryptoJS.AES.encrypt(e, c, {
            iv: d,
            mode: CryptoJS.mode.CBC
        });
        return f.toString()
    }
    function c(a, b, c) {
a='十六位随机字符串'
b='010001'
c='00e0b509f6259df8642dbc35662901477df22677ec152b5ff68ace615bb7b725152b3ab17a876aea8a5aa76d2e417629ec4ee341f56135fccf695280104e0312ecbda92557c93870114af6c9d05c4f7f0c3685b7a46bee255932575cce10b424d813cfe4875d3e82047b97ddef52741d546b8e289dc6935b3ece0462db0a22b8e7'
        var d, e;


        return setMaxDigits(131),
        d = new RSAKeyPair(b,"",c),
        e = encryptedString(d, a)
    }
    function d(d, e, f, g) {
        var h = {}
          , i = a(16);
        return h.encText = b(d, g),
        h.encText = b(h.encText, i),
        h.encSecKey = c(i, e, f),
        h
    }
    function e(a, b, d, e) {
        var f = {};
        return f.encText = c(a + e, b, d),
        f
    }
    window.asrsea = d,
    window.ecnonasr = e
}();