myfreemp3 token逆向

2023年5月8日 23点07分 ( js已压缩)

搜 _0x22c560 定位

//加密密钥
encodeKey = "yGz4n9XE9xYy2Oj5Ub7E6u9a5p5aIWZYe53Orq5wE5UgnjbWq0410WTvmLBO1Z2N"
//解密密钥
decodeKey = "pW8jg/mke6cO1F4CTuaiswhZfQGzMyq5NJRLPVIvDxlA7=E3YrSUoH0b2BXKn9td+"

//加密函数
function encode(t) {
    return t.split("").map((function (t, s) {
        return (t.charCodeAt(0) ^ (encodeKey.charCodeAt(Math.floor(s % encodeKey.length))))
    }))
}

//解密函数
function decode(e) {
    var s, o, a, i, l, c, u, d, f = 0, h = "";
    do {
        for (var y = '0|6|2|4|7|5|1|8|3'.split("|"), g = 0; ;) {
            switch (y[g++]) {
                case "0":
                    s = e[f++];
                    continue;
                case "1":
                    c = 63 & (d >> 6);
                    continue;
                case "2":
                    a = e[f++];
                    continue;
                case "3":
                    h += decodeKey.charAt(i) + decodeKey.charAt(l) + decodeKey.charAt(c) + decodeKey.charAt(u);
                    continue;
                case "4":
                    d = ((s << 16) | (o << 8)) | a;
                    continue;
                case "5":
                    l = (d >> 12) & 63;
                    continue;
                case "6":
                    o = e[f++];
                    continue;
                case "7":
                    i = (d >> 18) & 63;
                    continue;
                case "8":
                    u = (d & 63);
                    continue
            }
            break
        }
    } while (f < e.length);
    var v = e.length % 3;
    return ((v ? h.slice(0, (v - 3)) : h) + "===".slice(v || 3))
}


//传入压缩的json作为参数
function encryption(json) {
    return decode(encode(encodeURIComponent(json)))
}

python

# @File : te.py
# @IDE  : PyCharm
# @Author   :@Alpha
# @E-mail   :Alpha@qq.com
# @DateTime  :  2023/1/6 11:17 @星期五
# @REMARKS  :  Test
import hashlib
import json

import js2py

ctx = js2py.EvalJs()
with open("emm.js", 'r', encoding='UTF-8') as file:
    result = file.read()
    ctx.execute(result)


def token(dic: dict):
    json_ = json.dumps(dic, separators=(',', ':'), ensure_ascii=False)
    encryption = str(ctx.encryption(json_))
    md5_hash = hashlib.md5()
    md5_hash.update(encryption.encode('utf-8'))
    return "20230327." + md5_hash.hexdigest()


params = {"id": "11301", "_t": 1683560109037}
print(token(params))

Java

package myfreemp3;

import com.alibaba.fastjson2.JSONObject;
import org.junit.Test;

import javax.script.Invocable;
import javax.script.ScriptEngine;
import javax.script.ScriptEngineManager;
import javax.script.ScriptException;
import java.io.FileNotFoundException;
import java.io.FileReader;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;

/**
 * @author @Alpha
 * @e-mail Alpha2048@qq.com
 * @date 2023/5/8 14:17 @星期一
 * @Description :
 */
public class TokenTest {
    public static ScriptEngine engine = (new ScriptEngineManager()).getEngineByName("JavaScript");
    public static Invocable invocable;

    static {
        try {
            engine.eval(new FileReader("token.js"));
            invocable = (Invocable) engine;
        } catch (ScriptException | FileNotFoundException e) {
            throw new RuntimeException(e);
        }
    }

    @Test
    public void token() throws ScriptException, NoSuchMethodException, NoSuchAlgorithmException {
        JSONObject json = new JSONObject();
        json.put("id", "11301");
        json.put("_t", 1683560109037L);
        Object encryption = invocable.invokeFunction("encryption", json.toJSONString());
        System.out.println("20230327." + md5(encryption.toString()));
    }

    public static String md5(String input) throws NoSuchAlgorithmException {
        MessageDigest md = MessageDigest.getInstance("MD5");
        // 将待哈希的字符串转换为字节数组并计算哈希值
        byte[] hashBytes = md.digest(input.getBytes());
        // 将哈希值转换为十六进制字符串
        StringBuilder sb = new StringBuilder();
        for (byte b : hashBytes) {
            sb.append(String.format("%02x", b));
        }
        return sb.toString();
    }
}

有问题评论或私信