爱qiyi滑块（2-23，js逆向）

网址：aHR0cHM6Ly93d3cuaXFpeWkuY29tLw==

一、整体流程分析
爱qiyi整个登录滑块流程主要分五步：

1、访问dfp_pcw/sign拿到dfp参数
2、访问login.action拿到token参数
3、访问sbox_init_key拿到sig,sid,sr参数
4、访问verifycenter/initpage拿到滑块相关数据(包括图片的地址以及还原图片的数组)
5、访问verifycenter/verify，然后"msg":"成功"即通过滑块

二、根据每个包需要的参数逐个跟栈

1、dfp_pcw/sign链接，加密参数为dim和sig，主要加密方式分别为RSA和HmacSHA1,这里面会涉及到一些环境值，其他的都固定即可，有两个值是从cookie拿的，都随机一下就行,主要代码如下：

function get_data(){
    guid1 = guid() //随机 找到相应方法名扣下来就行
    generateQC0051 = generateQC005() //随机 找到相应方法名扣下来就行
    var t = '{"jn":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36","cm":"zh-CN","gu":24,"uf":1.25,"jr":[1536,864],"di":[1536,824],"zp":-480,"uh":1,"sh":1,"he":1,"zo":1,"rv":"unknown","nx":"Win32","iw":"unknown","qm":["PDF Viewer::Portable Document Format::application/pdf~pdf,text/pdf~pdf","Chrome PDF Viewer::Portable Document Format::application/pdf~pdf,text/pdf~pdf","Chromium PDF Viewer::Portable Document Format::application/pdf~pdf,text/pdf~pdf","Microsoft Edge PDF Viewer::Portable Document Format::application/pdf~pdf,text/pdf~pdf","WebKit built-in PDF::Portable Document Format::application/pdf~pdf,text/pdf~pdf"],"fk":false,"rg":false,"xy":false,"jm":false,"ba":false,"tm":[0,false,false],"hl":false,"ht":"","au":true,"mi":"'+guid1+'","cl":"PCWEB","sv":"1.0","jg":"'+generateQC0051+'","ifm":[false,null,null,null],"ex":"","dv":"off"}';
    var dim = n(o(t));  //base64
    word = "" + dim + "PCWEB" + "1.0";
    sig = HmacSHA1_Encrypt(word, 'eade56028e252b77f7a0b8792e58b9cc').toUpperCase()
    return [dim,sig]
}

2、携带dfp访问login.action链接，加密参数为pwd,加密方式为RSA,网上也有很多博客是讲这个站的pwd的，所以略过

3、sbox_init_key链接，加密参数为secure，加密方式为RSA+SHA256，这个RSA我扣的办法是导出关键函数，加密位置如下

注意，这里会有两个随机字符串(f 和 s)，这个我当时找了半天才找到，下面是他们的生成方式（这俩两个字符串是后面生成aeskey和hmackey的关键）

function getRandom(e) {
	var x = ["A", "B", "C", "D", "E", "F", "G", "H", "I", "J", "K", "L", "M", "N", "O", "P", "Q", "R", "S", "T", "U", "V", "W", "X", "Y", "Z", "a", "b", "c", "d", "e", "f", "g", "h", "i", "j", "k", "l", "m", "n", "o", "p", "q", "r", "s", "t", "u", "v", "w", "x", "y", "z", "0", "1", "2", "3", "4", "5", "6", "7", "8", "9"];
    var t = (x = x || [0, 1, 2, 3, 4, 5, 6, 7, 8, 9])["length"];
    r = (new Date).getTime() + Math["ceil"](10 * Math["random"]() * x["length"]);
    for (var _ = "", i = 0; i < e; i++) {
        var n = Math["ceil"]((r = (9301 * r + 49297) % 233280) / 233280 * t) - 1;
        _ += x[n = t < (n = n < 0 ? 0 : n) ? t : n]
    }
    return _
}
 f = getRandom(32);
 c = getRandom(64);

4、访问initpage链接，这里的加密参数是 cryptSrcData和cryptVersion ,这里的加密会涉及到上面提到的aeskey和hmackey,加密位置如下：

cryptSrcData生成方式如下：

    extend = {
        "dfp":dfp,
        "ptid":"01010021010000000000",
        "agentType":"1",
        "deviceId":"....",
        "cellphoneNumber":phone,
        "areaCode":"86"
    }

    var ee = {
        "t": time_,
        "token": token,
        "width": 290,
        "height": 170,
        "clientVersion": 1,
        "riskData": JSON.stringify(data), //这里是一些鼠标轨迹，稍微仿造一下即可
        "dfp": dfp,
        "extend": JSON.stringify(extend)
    };
    var e = AES_Encrypt(JSON.stringify(ee),aeskey,"qwertyuiopasdfgh");
    var cryptSrcData = e + "|" + HmacSHA256_Encrypt(e, hmackey);

cryptVersion生成方式如下：

cryptVersion = 'web|20180418xkdewxe3dkxu9|' + sid

5、拿到滑块数据后，发现是乱序的还得根据所放回的数组进行还原，还原主要思路如下：

至于这个pic_list是怎么来的，打个canvas断点去看下网站是怎么做的就知道了

三、请求验证
注：verifycenter/verify链接所需要的参数和initpage链接的基本一样的，只是轨迹那里需要变化，就不多说啦，这个站轨迹检测还是比较严格的，收工，拜拜！