JS逆向之融金所sign分析

篇幅有限

完整内容及源码关注公众号：ReverseCode，发送 冲

https://m.rjs.com/member/user.html#1

抓包

登录url:

POST https://m.rjs.com/japi/account/login.json

请求头：

:authority: m.rjs.com
:method: POST
:path: /japi/account/login.json
:scheme: https
accept: application/json, text/plain, */*
accept-encoding: gzip, deflate, br
accept-language: zh-CN,zh;q=0.9
content-length: 172
content-type: application/json
cookie: riskTipTimes1=1; Hm_lvt_7ff1e43d61e6b35b46f6bb33c3aba9bb=1618099071; Hm_lpvt_7ff1e43d61e6b35b46f6bb33c3aba9bb=1618099071
datatype: json
origin: https://m.rjs.com
referer: https://m.rjs.com/member/user.html
sec-ch-ua: "Google Chrome";v="89", "Chromium";v="89", ";Not\"A\\Brand";v="99"
sec-ch-ua-mobile: ?1
sec-fetch-dest: empty
sec-fetch-mode: cors
sec-fetch-site: same-origin
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.87 Safari/537.36

参数：

{"platform":"wap","session_token":"","session_id":"","data":{"userName":"15806204085","password":"123"},"sign":"b6a20a0b1c82b87d65b78b2943bb3fbc","timestamp":1618099099626}

分析

搜索japi/account/login.json 无果

搜索account/login.json

loginAction: function() {
    if (this.checkLoginKey() && this.checkLoginPwd()) {
        var e = this;
        c.Common.fajax({
            url: "account/login.json",
            easyOriginData: {
                userName: e.loginKey,
                password: e.loginPwd
            },
            success: function(t) {
                1 == t.status ? (c.Common.cookie.set("session_token_dp", t.data.sessionToken, "/", "/", 168),
                c.Common.cookie.set("platform", "wap", "/", "/", 168),
                c.Common.localStore.set("session_token_dp", t.data.sessionToken),
                c.Common.localStore.set("uid_dp", t.data.uid),
                c.Common.cookie.set("secretKey", t.data.secretKey, "/", "/", 168),
                c.Common.alert("simpleSuccess", "登录成功", 1, e.goHref, "/member-undp/index.html")) : e.alert(t.message)
            }
        })
    }
},

打上断点调试，此时并没有出现sign,说明sign应该是在fajax中生成，进入fajax中，逐步调试，t["sign"] = i(f + "&" + i(o.genSignData(t.data)) + "&" + d),这一步出现了sign进行填值，f为/account/login.json

d是""空字符串

接下来分析i(o.genSignData(t.data))中的o.genSignData(t.data),其中t.data为账户密码的对象

genSignData

i(o.genSignData(t.data))分析，先进入o.genSignData函数，拆分出来js如下

var genSignData = function(e) {
    var t = ""
      , n = [];
    for (var r in e)
        n.push(r);
    n = n.sort();
    for (var i = 0; i < n.length; i++) {
        var o = n[i]
          , s = e[o]
          , l = !1;
        if ("object" == ("undefined" == typeof s ? "undefined" : (0,
        a.default)(s))) {
            var c = "{";
            for (var u in s)
                c += u + "=" + s[u] + ", ",
                l = !0;
            l && (s = c.substring(0, c.length - 2) + "}")
        }
        "sign" != o && null !== s && void 0 !== s && "" !== s && ("object" != ("undefined" == typeof s ? "undefined" : (0,
        a.default)(s)) || l) && (t += (0 == i ? "" : "&") + o + "=" + s)
    }
    return null != t && "" != t && "&" == t.substr(0, 1) && (t = t.substr(1, t.length)),
    t
}

单独运行时报错Uncaught ReferenceError: a is not defined,打印a.default

进入a.default,该三元运算所得结果即为控制台打印结果，必然前面的是完全匹配的

 t.default = "function" == typeof s.default && "symbol" === l(a.default) ? function(e) {
    return "undefined" == typeof e ? "undefined" : l(e)
}

该l函数在上面也有定义如下

那么我们定义函数k即a.default如下,替换genSignData完成函数解密password=123&userName=15806204095

var k = function(e){
    return"undefined"==typeof e?"undefined": typeof e
}

i

i(o.genSignData(t.data))分析，接下来就是i函数的分析，进入i函数

第一次调用i函数时，先调用o函数进行加密，再调用wordsToBytes转成字节，返回bytesToHex生成16进制字符串，整体逻辑理清后进入o函数。

o

该函数中引用了n(694),n(247).utf8,n(974),n(247).bin,通过debug可知以上都生成了加密函数

这些加密函数搜索分别发现出现在了694:function，247:function等等，可以断定，这些函数其实就是作为变量在o函数中调用

扣出694,247,974的代码如下

var liu94 = function (e, t) {
        var t = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
            , n = {
                rotl: function (e, t) {
                    return e << t | e >>> 32 - t
                },
                rotr: function (e, t) {
                    return e << 32 - t | e >>> t
                },
                endian: function (e) {
                    if (e.constructor == Number)
                        return 16711935 & n.rotl(e, 8) | 4278255360 & n.rotl(e, 24);
                    for (var t = 0; t < e.length; t++)
                        e[t] = n.endian(e[t]);
                    return e
                },
                randomBytes: function (e) {
                    for (var t = []; e > 0; e--)
                        t.push(Math.floor(256 * Math.random()));
                    return t
                },
                bytesToWords: function (e) {
                    for (var t = [], n = 0, r = 0; n < e.length; n++,
                        r += 8)
                        t[r >>> 5] |= e[n] << 24 - r % 32;
                    return t
                },
                wordsToBytes: function (e) {
                    for (var t = [], n = 0; n < 32 * e.length; n += 8)
                        t.push(e[n >>> 5] >>> 24 - n % 32 & 255);
                    return t
                },
                bytesToHex: function (e) {
                    for (var t = [], n = 0; n < e.length; n++)
                        t.push((e[n] >>> 4).toString(16)),
                            t.push((15 & e[n]).toString(16));
                    return t.join("")
                },
                hexToBytes: function (e) {
                    for (var t = [], n = 0; n < e.length; n += 2)
                        t.push(parseInt(e.substr(n, 2), 16));
                    return t
                },
                bytesToBase64: function (e) {
                    for (var n = [], r = 0; r < e.length; r += 3)
                        for (var i = e[r] << 16 | e[r + 1] << 8 | e[r + 2], a = 0; a < 4; a++)
                            8 * r + 6 * a <= 8 * e.length ? n.push(t.charAt(i >>> 6 * (3 - a) & 63)) : n.push("=");
                    return n.join("")
                },
                base64ToBytes: function (e) {
                    e = e.replace(/[^A-Z0-9+\/]/gi, "");
                    for (var n = [], r = 0, i = 0; r < e.length; i = ++r % 4)
                        0 != i && n.push((t.indexOf(e.charAt(r - 1)) & Math.pow(2, -2 * i + 8) - 1) << 2 * i | t.indexOf(e.charAt(r)) >>> 6 - 2 * i);
                    return n
                }
            };
        return n;
}

var er47 = {
    utf8: {
        stringToBytes: function (e) {
            return er47.bin.stringToBytes(unescape(encodeURIComponent(e)))
        },
        bytesToString: function (e) {
            return decodeURIComponent(escape(er47.bin.bytesToString(e)))
        }
    },
    bin: {
        stringToBytes: function (e) {
            for (var t = [], n = 0; n < e.length; n++)
                t.push(255 & e.charCodeAt(n));
            return t
        },
        bytesToString: function (e) {
            for (var t = [], n = 0; n < e.length; n++)
                t.push(String.fromCharCode(e[n]));
            return t.join("")
        }
    }
};

var jiu74 = function (e, t) {
    function n(e) {
        return !!e.constructor && "function" == typeof e.constructor.isBuffer && e.constructor.isBuffer(e)
    }
    function r(e) {
        return "function" == typeof e.readFloatLE && "function" == typeof e.slice && n(e.slice(0, 0))
    }
    return function (e) {
        return null != e && (n(e) || r(e) || !!e._isBuffer)
    }
}

在o函数中改写t,r,i,a

    var t = liu94()
        , r = er47.utf8
        , i = jiu74()
        , a = er47.bin

最终只要将o函数中exports的函数return出来即可

res = function (e, n) {
    console.log(e)
    if (void 0 === e || null === e)
        throw new Error("Illegal argument " + e);
    var r = t.wordsToBytes(o(e, n));
    console.log(r)
    return n && n.asBytes ? r : n && n.asString ? a.bytesToString(r) : t.bytesToHex(r)
}
//res("password=123&userName=158062204095", undefined);
//console.log('-------->',res(origin, undefined))
return res;

由于o(e,n)中的即为o.genSignData生成的账密参数password=123&userName=15806204095，n为undefined，那么我们就可以直接调用该方法返回真正的sign。

console.log(encrypt()("/account/login.json"+"&"+encrypt()(genSignData(UP))+"&"+""));

查看抓包后的结果如下

爬虫实现

import json

import requests
import execjs

username = "15806204095"
psssword = "123"
with open(r'rjs_sign.js', encoding='utf-8', mode='r') as f:
    JsData = f.read()
sign = execjs.compile(JsData).call('request',username,psssword)
data = json.dumps({"platform":"wap","session_token":"","session_id":"","data":{"userName":username,"password":psssword},"sign":sign,"timestamp":1618153079455})
r =requests.post("https://m.rjs.com/japi/account/login.json",data)
print(r.text)

完整源码请关注微信公众号：ReverseCode，回复：JS逆向

本文由博客群发一文多发等运营工具平台 OpenWrite 发布