请求头参数加密分析思路

请求头参数加密字样

通过url中关键字搜索定位到改函数


单步调试找到生成函数，并抠出函数

把抠出的js代码稍作改写

运行提示缺失missjson函数，继续补环境抠出missjson函数

运行继续报缺失missjson函数

再次执行js代码，正确输出

实现方式一：完整js代码如下

function missjson(input) {
    var keyStr = "ABCDEFGHIJKLMNOP" + "QRSTUVWXYZabcdef" + "ghijklmnopqrstuv" + "wxyz0123456789+/" + "=";
    var output = "";
    var chr1, chr2, chr3 = "";
    var enc1, enc2, enc3, enc4 = "";
    var i = 0;
    do {
        chr1 = input.charCodeAt(i++);
        chr2 = input.charCodeAt(i++);
        chr3 = input.charCodeAt(i++);
        enc1 = chr1 >> 2;
        enc2 = ((chr1 & 3) << 4) | (chr2 >> 4);
        enc3 = ((chr2 & 15) << 2) | (chr3 >> 6);
        enc4 = chr3 & 63;
        if (isNaN(chr2)) {
            enc3 = enc4 = 64;
        } else if (isNaN(chr3)) {
            enc4 = 64;
        }
        output = output + keyStr.charAt(enc1) + keyStr.charAt(enc2) + keyStr.charAt(enc3) + keyStr.charAt(enc4);
        chr1 = chr2 = chr3 = "";
        enc1 = enc2 = enc3 = enc4 = "";
    } while (i < input.length);

    return output;
}


function getResCode()  {
    var time = Math.floor(new Date().getTime() / 1000);
    return missjson("" + time);
}


console.log(getResCode())

实现方式二：用python实现

完整python代码：

# -*- coding: utf-8 -*-
import time
import base64
import math
time1 = math.floor(time.time() * 1000)
mcode = base64.b64encode(str(time1).encode()).decode()
print(mcode)