京喜拼拼微信小程序-signStr参数加密

调试api：

https://api.m.jd.com/api?functionId=jxpp.category.catePageRpc.cateSkuFetch&appid=jxpp_miniprogram&t=1644911845668&loginType=undefined&loginWQBiz=&body=%7B%22fcId%22%3A2007398%2C%22pageIndex%22%3A1%2C%22pageSize%22%3A30%2C%22pvId%22%3A%22%22%2C%22page%22%3A1%2C%22buid%22%3A325%2C%22time%22%3A1644911845670%2C%22signStr%22%3A%22577f68c10d74faafa9a244c066c7f852%22%7D&channel=wxappjxpp&cv=9.2.140&clientVersion=9.2.140&client=wxappjxpp&uuid=d7277ece-e75e-b7ba-2792-6438b74dc1c427fa

程序：微信小程序

下载地址：京喜拼拼微信小程序解包-其它文档类资源-CSDN下载

一、首先分析URL

1. functionId大概是函数名字，调用的函数类什么的
2. appid 看参数顾名思义，就是给JXPP小程序调用的
3. loginType 与登录有关
4. time 调用时间-时间戳
5. body [time]时间，加密参数-signStr
6. 加密参数-uuid

二、反编译小程序（主要看signStr参数）

 追进去我们可以看到

{
            key: "dealParams",
            value: function(e) {
                var t = {
                    signKey: "kjylzdcg",
                    data: {
                        channel: d["a"].getClient(),
                        cv: d["a"].getVersion(),
                        clientVersion: d["a"].getVersion(),
                        client: d["a"].getClient(),
                        uuid: Object(B["d"])().uuid
                    }
                };
                e.body = e.body || {}, "undefined" == typeof e.body["buid"] && (e.body["buid"] = d["a"].getBusinessId()), 
                e && Object.assign(t, e), Object.assign(t.body, {
                    time: new Date().getTime()
                });
                var a = t.body || "";
                "string" != typeof a && (a = JSON.stringify(a));
                var n, i = this.getSignString(a);
                return e.body.signStr = i, n = Object.assign({}, t.data, e), n;
            }
        }, {
            key: "getSignString",
            value: function(e) {
                e = JSON.parse(e);
                var t = this.orderByAscII(e), a = this.getParamsValue(t);
                a = a.toString();
                var n = A.md5(a, "xtl_sqg_mall-^&*-damai_(789)_@#$");
                return n;
            }
        }

从上边代码中我们可以看到e.body.signStr = i，而i = this.getSignString(a)，所以加密函数就在getSignString里边

这里我们直接扣代码，补缺失参数

function getSignString(e) {
    e = JSON.parse(e);
    var t = orderByAscII(e), a = getParamsValue(t);
    console.log('a>>>>',a)
    console.log('t>>>>',t)
    a = a.toString();
    var n = A.md5(a, "xtl_sqg_mall-^&*-damai_(789)_@#$");
    return n;
};


function orderByAscII(e) {
    var t = [], a = 0;
    for (var n in e) t[a] = n, a++;
    var i = t.sort(), r = {};
    for (var o in i) r[i[o]] = e[i[o]];
    return r;
};

function getParamsValue(e) {
    var t = "";
    for (var a in e) {
        var n = e[a];
        n instanceof Object && (n = JSON.stringify(n)), void 0 != n && null != n && ("number" === typeof n || "boolean" === typeof n || "" != n ? t += "&" + n : console.log("---key---,----value----", a, n));
    }
    return t = t.substring(1, t.length), t;
};


var A = {
    md5: w,
    genGuid: P
};

function w(e, t, a) {
    return t ? a ? N(t, e) : I(t, e) : a ? C(e) : S(e);
};

function T() {
    return (65536 * (1 + Math.random()) | 0).toString(16).substring(1);
};

function P() {
    return [T() + T(), T(), T(), T(), T() + T() + T() + T()].join("-");
};

function C(e) {
    return x(k(e));
};

function S(e) {
    return j(C(e));
};

function N(e, t) {
    return _(k(e), k(t));
};

function I(e, t) {
    return j(N(e, t));
};

function _(e, t) {
    var a, n = E(e), i = [], r = [];
    for (i[15] = r[15] = void 0, n.length > 16 && (n = O(n, 8 * e.length)), a = 0; a < 16; a += 1) i[a] = 909522486 ^ n[a],
        r[a] = 1549556828 ^ n[a];
    var o = O(i.concat(E(t)), 512 + 8 * t.length);
    return y(O(r.concat(o), 640));
};

function j(e) {
    var t, a, n = "0123456789abcdef", i = "";
    for (a = 0; a < e.length; a += 1) t = e.charCodeAt(a), i += n.charAt(t >>> 4 & 15) + n.charAt(15 & t);
    return i;
};


function k(e) {
    return unescape(encodeURIComponent(e));
};

function E(e) {
    var t, a = [];
    for (a[(e.length >> 2) - 1] = void 0, t = 0; t < a.length; t += 1) a[t] = 0;
    var n = 8 * e.length;
    for (t = 0; t < n; t += 8) a[t >> 5] |= (255 & e.charCodeAt(t / 8)) << t % 32;
    return a;
};

function O(e, t) {
    var a, n, i, r, o;
    e[t >> 5] |= 128 << t % 32, e[14 + (t + 64 >>> 9 << 4)] = t;
    var c = 1732584193, s = -271733879, u = -1732584194, l = 271733878;
    for (a = 0; a < e.length; a += 16) n = c, i = s, r = u, o = l, c = g(c, s, u, l, e[a], 7, -680876936),
        l = g(l, c, s, u, e[a + 1], 12, -389564586), u = g(u, l, c, s, e[a + 2], 17, 606105819),
        s = g(s, u, l, c, e[a + 3], 22, -1044525330), c = g(c, s, u, l, e[a + 4], 7, -176418897),
        l = g(l, c, s, u, e[a + 5], 12, 1200080426), u = g(u, l, c, s, e[a + 6], 17, -1473231341),
        s = g(s, u, l, c, e[a + 7], 22, -45705983), c = g(c, s, u, l, e[a + 8], 7, 1770035416),
        l = g(l, c, s, u, e[a + 9], 12, -1958414417), u = g(u, l, c, s, e[a + 10], 17, -42063),
        s = g(s, u, l, c, e[a + 11], 22, -1990404162), c = g(c, s, u, l, e[a + 12], 7, 1804603682),
        l = g(l, c, s, u, e[a + 13], 12, -40341101), u = g(u, l, c, s, e[a + 14], 17, -1502002290),
        s = g(s, u, l, c, e[a + 15], 22, 1236535329), c = h(c, s, u, l, e[a + 1], 5, -165796510),
        l = h(l, c, s, u, e[a + 6], 9, -1069501632), u = h(u, l, c, s, e[a + 11], 14, 643717713),
        s = h(s, u, l, c, e[a], 20, -373897302), c = h(c, s, u, l, e[a + 5], 5, -701558691),
        l = h(l, c, s, u, e[a + 10], 9, 38016083), u = h(u, l, c, s, e[a + 15], 14, -660478335),
        s = h(s, u, l, c, e[a + 4], 20, -405537848), c = h(c, s, u, l, e[a + 9], 5, 568446438),
        l = h(l, c, s, u, e[a + 14], 9, -1019803690), u = h(u, l, c, s, e[a + 3], 14, -187363961),
        s = h(s, u, l, c, e[a + 8], 20, 1163531501), c = h(c, s, u, l, e[a + 13], 5, -1444681467),
        l = h(l, c, s, u, e[a + 2], 9, -51403784), u = h(u, l, c, s, e[a + 7], 14, 1735328473),
        s = h(s, u, l, c, e[a + 12], 20, -1926607734), c = v(c, s, u, l, e[a + 5], 4, -378558),
        l = v(l, c, s, u, e[a + 8], 11, -2022574463), u = v(u, l, c, s, e[a + 11], 16, 1839030562),
        s = v(s, u, l, c, e[a + 14], 23, -35309556), c = v(c, s, u, l, e[a + 1], 4, -1530992060),
        l = v(l, c, s, u, e[a + 4], 11, 1272893353), u = v(u, l, c, s, e[a + 7], 16, -155497632),
        s = v(s, u, l, c, e[a + 10], 23, -1094730640), c = v(c, s, u, l, e[a + 13], 4, 681279174),
        l = v(l, c, s, u, e[a], 11, -358537222), u = v(u, l, c, s, e[a + 3], 16, -722521979),
        s = v(s, u, l, c, e[a + 6], 23, 76029189), c = v(c, s, u, l, e[a + 9], 4, -640364487),
        l = v(l, c, s, u, e[a + 12], 11, -421815835), u = v(u, l, c, s, e[a + 15], 16, 530742520),
        s = v(s, u, l, c, e[a + 2], 23, -995338651), c = b(c, s, u, l, e[a], 6, -198630844),
        l = b(l, c, s, u, e[a + 7], 10, 1126891415), u = b(u, l, c, s, e[a + 14], 15, -1416354905),
        s = b(s, u, l, c, e[a + 5], 21, -57434055), c = b(c, s, u, l, e[a + 12], 6, 1700485571),
        l = b(l, c, s, u, e[a + 3], 10, -1894986606), u = b(u, l, c, s, e[a + 10], 15, -1051523),
        s = b(s, u, l, c, e[a + 1], 21, -2054922799), c = b(c, s, u, l, e[a + 8], 6, 1873313359),
        l = b(l, c, s, u, e[a + 15], 10, -30611744), u = b(u, l, c, s, e[a + 6], 15, -1560198380),
        s = b(s, u, l, c, e[a + 13], 21, 1309151649), c = b(c, s, u, l, e[a + 4], 6, -145523070),
        l = b(l, c, s, u, e[a + 11], 10, -1120210379), u = b(u, l, c, s, e[a + 2], 15, 718787259),
        s = b(s, u, l, c, e[a + 9], 21, -343485551), c = p(c, n), s = p(s, i), u = p(u, r),
        l = p(l, o);
    return [c, s, u, l];
};

function p(e, t) {
    var a = (65535 & e) + (65535 & t), n = (e >> 16) + (t >> 16) + (a >> 16);
    return n << 16 | 65535 & a;
};

function f(e, t) {
    return e << t | e >>> 32 - t;
};

function m(e, t, a, n, i, r) {
    return p(f(p(p(t, e), p(n, r)), i), a);
};

function g(e, t, a, n, i, r, o) {
    return m(t & a | ~t & n, e, t, i, r, o);
};

function h(e, t, a, n, i, r, o) {
    return m(t & n | a & ~n, e, t, i, r, o);
};

function v(e, t, a, n, i, r, o) {
    return m(t ^ a ^ n, e, t, i, r, o);
};

function b(e, t, a, n, i, r, o) {
    return m(a ^ (t | ~n), e, t, i, r, o);
};

function y(e) {
    var t, a = "", n = 32 * e.length;
    for (t = 0; t < n; t += 8) a += String.fromCharCode(e[t >> 5] >>> t % 32 & 255);
    return a;
};
mm = '{"fcId":2007398,"pageIndex":1,"pageSize":30,"pvId":"","page":1,"buid":325,"time":1644911845670}'

console.log(getSignString(mm))

输出结果：

 对比上边api里边signStr参数（"signStr":"577f68c10d74faafa9a244c066c7f852"），完美输出

signStr参数解密就到这里，后续会更新翻译过来的Python代码。