抓包分析

image-20260118231521507

加密参数为R和S

image-20260118231704270

从堆栈上打上断点,此处,执行后就获得了值

image-20260118231826064

寻找发现beforeSend即为加密函数

image-20260118232204388

进去后还是熟悉的流程函数,执行到第二步可以看到一个值出来了

image-20260118232958548

_0xfcd8a0[_0x34e6a4(0x1ab)](_0x1e5c29) === _0x1e5c29()

代码流程分析可写为

1
2
3
4
5
6
7
8
9
var _0x454710 =  "0123456789abcdef"
var _0xee3b28 = [];
for (var _0x20183e = 0x0; _0x20183e < 0x20 ; _0x20183e++) {
_0xee3b28[_0x20183e] = _0x454710["substr"](Math["floor"](Math["random"]()*16),1);
}
_0xee3b28[0xe] = '\x34'
_0xee3b28[0x13] = _0x454710["substr"](((_0xee3b28[0x13]&0x3)|0x8), 0x1)
_0xee3b28[0x8] = _0xee3b28[0xd] = _0xee3b28[0x12] = _0xee3b28[0x17]
var _0x4b1861 = _0xee3b28["join"]('');

image-20260118235314701

image-20260118235439913

生成值长度一致,因为是随机值计算得出,结果不同正常

image-20260118235615178

全局查看_0x350b3a值,发现最后赋值为R

同样,到case7,发现另一个值S

image-20260118235845816

拆解var _0x3104de = _0xfcd8a0[_0x34e6a4(0x234)](mmm, _0xfcd8a0[_0x34e6a4(0x220)](_0xfcd8a0['\x52\x75\x6a\x76\x5a'](_0x3f9dab, _0x350b3a), _0x2059bf))

实际为:mmm(R+page值+时间戳)

image-20260119000142300

image-20260119000225340

image-20260119000343281

S值32位,让我想到了老朋友md5,测试确实如此

image-20260119225427668

image-20260119225435465

直接代结果

image-20260120000422927

请求会有很多次失败,记得加一个多次请求

当然扣代码一样能实现对应的效果:代码折叠后能看到mmm函数的位置

image-20260120215408686

扣除mmm后直接缺啥补啥

image-20260120220319555

image-20260120220332938

更多内容也在公众号更新:码字的秃猴

tuhou