http://www.spolicy.com/detail?id=64e42c4c46da919979b41299
1 调试
1.1 f12无效的调试
该网页直接按键盘f12无调试页面出来，chrome浏览器需要鼠标右键随后点击“检查"选项进入调试页面
1.2 用hook过无限DEBUG
进入调试页面后会有一个无限DEBUG
我们输入如下hook代码过点击三角过掉DEBUG
let AAA=Function.prototype.constructor
Function.prototype.constructor=function(x){
console.log(x) if(X!="debugger") { return AAA(x) }; return function(){};}
2 加密位置确定
2.1 在XHR里面进行搜索定位
这里我们发送的报文r已经是加密后的一串数字了，我们需要找到原始加密报文
经过点击多次单步调试后，发现会在一个axiosInstance处停留
经过查看混淆的代码发现他是一个response拦截器
我们需要找到requeset的拦截器，可以看到这里有8个 axiosInstance，我们在可疑处打上断点
我们可以看到在request之处断住
2.2 观察明文到密文
接下来一步很重要，
**我们需要关闭当前页面，重新打开页面，重新过无限DEBUGGER后断到request这步，我们观察最右边的e变量，现在e变量还没有data属性 **
我们再次点击一下三角按钮,可以看到出现一个data属性，这个就是我们要加密的数据
多次点击单步调试发现在此处data会变成密文，这里无法跟栈，我们需要重新debug调试
重新调试时候我们发现如下这步是加密步骤
我们还原后是,我们需要获取f['encode']方法
f['encode'](data)['finish']()['slice']()
我们进入方法
这里需要过w这个加密方法
我们点击进入
进入以后是一段webpack我们扣下这段webpack
3 最终代码
代码结构如下 我们需要补一个环境commonjsGlobal
最终js代码
window = global
commonjsGlobal = window
var _temp
!function(g) {
var r, e, t, i;
r = {
1: [function(e, t, n) {
t.exports = function(e, t) {
for (var n = Array(arguments.length - 1), o = 0, r = 2, i = !0; r < arguments.length; )
n[o++] = arguments[r++];
return new Promise((function(r, s) {
n[o] = function(e) {
if (i)
if (i = !1,
e)
s(e);
else {
for (var t = Array(arguments.length - 1), n = 0; n < t.length; )
t[n++] = arguments[n];
r.apply(null, t)
}
}
;
try {
e.apply(t || null, n)
} catch (a) {
i && (i = !1,
s(a))
}
}
))
}
}
, {}],
2: [function(e, t, n) {
n.length = function(e) {
var t = e.length;
if (!t)
return 0;
for (var n = 0; 1 < --t % 4 && "=" == (e[0 | t] || ""); )
++n;
return Math.ceil(3 * e.length) / 4 - n
}
;
for (var o = Array(64), r = Array(123), i = 0; i < 64; )
r[o[i] = i < 26 ? i + 65 : i < 52 ? i + 71 : i < 62 ? i - 4 : i - 59 | 43] = i++;
n.encode = function(e, t, n) {
for (var r, i = null, s = [], a = 0, c = 0; t < n; ) {
var l = e[t++];
switch (c) {
case 0:
s[a++] = o[l >> 2],
r = (3 & l) << 4,
c = 1;
break;
case 1:
s[a++] = o[r | l >> 4],
r = (15 & l) << 2,
c = 2;
break;
case 2:
s[a++] = o[r | l >> 6],
s[a++] = o[63 & l],
c = 0
}
8191 < a && ((i = i || []).push(String.fromCharCode.apply(String, s)),
a = 0)
}
return c && (s[a++] = o[r],
s[a++] = 61,
1 === c && (s[a++] = 61)),
i ? (a && i.push(String.fromCharCode.apply(String, s.slice(0, a))),
i.join("")) : String.fromCharCode.apply(String, s.slice(0, a))
}
;
var s = "invalid encoding";
n.decode = function(e, t, n) {
for (var o, i = n, a = 0, c = 0; c < e.length; ) {
var l = e.charCodeAt(c++);
if (61 == l && 1 < a)
break;
if ((l = r[l]) === g)
throw Error(s);
switch (a) {
case 0:
o = l,
a = 1;
break;
case 1:
t[n++] = o << 2 | (48 & l) >> 4,
o = l,
a = 2;
break;
case 2:
t[n++] = (15 & o) << 4 | (60 & l) >> 2,
o = l,
a = 3;
break;
case 3:
t[n++] = (3 & o) << 6 | l,
a = 0
}
}
if (1 === a)
throw Error(s);
return n - i
}
,
n.test = function(e) {
return /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(e)
}
}
, {}],
3: [function(e, t, n) {
(t.exports = function e(t, n) {
"string" == typeof t && (n = t,
t = g);
var o = [];
function r(t) {
if ("string" != typeof t) {
var n = i();
if (e.verbose && console.log("codegen: " + n),
n = "return " + n,
t) {
for (var s = Object.keys(t), a = Array(s.length + 1), c = Array(s.length), l = 0; l < s.length; )
a[l] = s[l],
c[l] = t[s[l++]];
return a[l] = n,
Function.apply(null, a).apply(null, c)
}
return Function(n)()
}
for (var u = Array(arguments.length - 1), d = 0; d < u.length; )
u[d] = arguments[++d];
if (d = 0,
t = t.replace(/%([%dfijs])/g, (function(e, t) {
var n = u[d++];
switch (t) {
case "d":
case "f":
return "" + +("" + n);
case "i":
return "" + Math.floor(n);
case "j":
return JSON.stringify(n);
case "s":
return "" + n
}
return "%"
}
)),
d !== u.length)
throw Error("parameter count mismatch");
return o.push(t),
r
}
function i(e) {
return "function " + (e || n || "") + "(" + (t && t.join(",") || "") + "){\n " + o.join("\n ") + "\n}"
}
return r.toString = i,
r
}
).verbose = !1
}
, {}],
4: [function(e, t, n) {
function o() {
this.t = {}
}
(t.exports = o).prototype.on = function(e, t, n) {
return (this.t[e] || (this.t[e] = [])).push({
fn: t,
ctx: n || this
}),
this
}
,
o.prototype.off = function(e, t) {
if (e === g)
this.t = {};
else if (t === g)
this.t[e] = [];
else
for (var n = this.t[e], o = 0; o < n.length; )
n[o].fn === t ? n.splice(o, 1) : ++o;
return this
}
,
o.prototype.emit = function(e) {
var t = this.t[e];
if (t) {
for (var n = [], o = 1; o < arguments.length; )
n.push(arguments[o++]);
for (o = 0; o < t.length; )
t[o].fn.apply(t[o++].ctx, n)
}
return this
}
}
, {}],
5: [function(e, t, n) {
t.exports = i;
var o = e(1)
, r = e(7)("fs");
function i(e, t, n) {
return t = "function" == typeof t ? (n = t,
{}) : t || {},
n ? !t.xhr && r && r.readFile ? r.readFile(e, (function(o, r) {
return o && "undefined" != typeof XMLHttpRequest ? i.xhr(e, t, n) : o ? n(o) : n(null, t.binary ? r : r.toString("utf8"))
}
)) : i.xhr(e, t, n) : o(i, this, e, t)
}
i.xhr = function(e, t, n) {
var o = new XMLHttpRequest;
o.onreadystatechange = function() {
if (4 !== o.readyState)
return g;
if (0 !== o.status && 200 !== o.status)
return n(Error("status " + o.status));
if (t.binary) {
if (!(e = o.response))
for (var e = [], r = 0; r < o.responseText.length; ++r)
e.push(255 & o.responseText.charCodeAt(r));
return n(null, "undefined" != typeof Uint8Array ? new Uint8Array(e) : e)
}
return n(null, o.responseText)
}
,
t.binary && ("overrideMimeType"in o && o.overrideMimeType("text/plain; charset=x-user-defined"),
o.responseType = "arraybuffer"),
o.open("GET", e),
o.send()
}
}
, {
1: 1,
7: 7
}],
6: [function(e, t, n) {
function o(e) {
function t(e, t, n, o) {
var r = t < 0 ? 1 : 0;
e(0 === (t = r ? -t : t) ? 0 < 1 / t ? 0 : 2147483648 : isNaN(t) ? 2143289344 : 34028234663852886e22 < t ? (r << 31 | 2139095040) >>> 0 : t < 11754943508222875e-54 ? (r << 31 | Math.round(t / 1401298464324817e-60)) >>> 0 : (r << 31 | 127 + (r = Math.floor(Math.log(t) / Math.LN2)) << 23 | 8388607 & Math.round(t * Math.pow(2, -r) * 8388608)) >>> 0, n, o)
}
function n(e, t, n) {
return t = 2 * ((e = e(t, n)) >> 31) + 1,
n = e >>> 23 & 255,
e &= 8388607,
255 == n ? e ? NaN : 1 / 0 * t : 0 == n ? 1401298464324817e-60 * t * e : t * Math.pow(2, n - 150) * (8388608 + e)
}
function o(e, t, n) {
d[0] = e,
t[n] = f[0],
t[n + 1] = f[1],
t[n + 2] = f[2],
t[n + 3] = f[3]
}
function c(e, t, n) {
d[0] = e,
t[n] = f[3],
t[n + 1] = f[2],
t[n + 2] = f[1],
t[n + 3] = f[0]
}
function l(e, t) {
return f[0] = e[t],
f[1] = e[t + 1],
f[2] = e[t + 2],
f[3] = e[t + 3],
d[0]
}
function u(e, t) {
return f[3] = e[t],
f[2] = e[t + 1],
f[1] = e[t + 2],
f[0] = e[t + 3],
d[0]
}
var d, f, p, h, m;
function v(e, t, n, o, r, i) {
var s, a = o < 0 ? 1 : 0;
0 === (o = a ? -o : o) ? (e(0, r, i + t),
e(0 < 1 / o ? 0 : 2147483648, r, i + n)) : isNaN(o) ? (e(0, r, i + t),
e(2146959360, r, i + n)) : 17976931348623157e292 < o ? (e(0, r, i + t),
e((a << 31 | 2146435072) >>> 0, r, i + n)) : o < 22250738585072014e-324 ? (e((s = o / 5e-324) >>> 0, r, i + t),
e((a << 31 | s / 4294967296) >>> 0, r, i + n)) : (e(4503599627370496 * (s = o * Math.pow(2, -(o = 1024 === (o = Math.floor(Math.log(o) / Math.LN2)) ? 1023 : o))) >>> 0, r, i + t),
e((a << 31 | o + 1023 << 20 | 1048576 * s & 1048575) >>> 0, r, i + n))
}
function g(e, t, n, o, r) {
return t = e(o, r + t),
r = 2 * ((o = e(o, r + n)) >> 31) + 1,
t = 4294967296 * (1048575 & o) + t,
2047 == (n = o >>> 20 & 2047) ? t ? NaN : 1 / 0 * r : 0 == n ? 5e-324 * r * t : r * Math.pow(2, n - 1075) * (t + 4503599627370496)
}
function W(e, t, n) {
p[0] = e,
t[n] = h[0],
t[n + 1] = h[1],
t[n + 2] = h[2],
t[n + 3] = h[3],
t[n + 4] = h[4],
t[n + 5] = h[5],
t[n + 6] = h[6],
t[n + 7] = h[7]
}
function y(e, t, n) {
p[0] = e,
t[n] = h[7],
t[n + 1] = h[6],
t[n + 2] = h[5],
t[n + 3] = h[4],
t[n + 4] = h[3],
t[n + 5] = h[2],
t[n + 6] = h[1],
t[n + 7] = h[0]
}
function b(e, t) {
return h[0] = e[t],
h[1] = e[t + 1],
h[2] = e[t + 2],
h[3] = e[t + 3],
h[4] = e[t + 4],
h[5] = e[t + 5],
h[6] = e[t + 6],
h[7] = e[t + 7],
p[0]
}
function C(e, t) {
return h[7] = e[t],
h[6] = e[t + 1],
h[5] = e[t + 2],
h[4] = e[t + 3],
h[3] = e[t + 4],
h[2] = e[t + 5],
h[1] = e[t + 6],
h[0] = e[t + 7],
p[0]
}
return "undefined" != typeof Float32Array ? (d = new Float32Array([-0]),
m = 128 === (f = new Uint8Array(d.buffer))[3],
e.writeFloatLE = m ? o : c,
e.writeFloatBE = m ? c : o,
e.readFloatLE = m ? l : u,
e.readFloatBE = m ? u : l) : (e.writeFloatLE = t.bind(null, r),
e.writeFloatBE = t.bind(null, i),
e.readFloatLE = n.bind(null, s),
e.readFloatBE = n.bind(null, a)),
"undefined" != typeof Float64Array ? (p = new Float64Array([-0]),
m = 128 === (h = new Uint8Array(p.buffer))[7],
e.writeDoubleLE = m ? W : y,
e.writeDoubleBE = m ? y : W,
e.readDoubleLE = m ? b : C,
e.readDoubleBE = m ? C : b) : (e.writeDoubleLE = v.bind(null, r, 0, 4),
e.writeDoubleBE = v.bind(null, i, 4, 0),
e.readDoubleLE = g.bind(null, s, 0, 4),
e.readDoubleBE = g.bind(null, a, 4, 0)),
e
}
function r(e, t, n) {
t[n] = 255 & e,
t[n + 1] = e >>> 8 & 255,
t[n + 2] = e >>> 16 & 255,
t[n + 3] = e >>> 24
}
function i(e, t, n) {
t[n] = e >>> 24,
t[n + 1] = e >>> 16 & 255,
t[n + 2] = e >>> 8 & 255,
t[n + 3] = 255 & e
}
function s(e, t) {
return (e[t] | e[t + 1] << 8 | e[t + 2] << 16 | e[t + 3] << 24) >>> 0
}
function a(e, t) {
return (e[t] << 24 | e[t + 1] << 16 | e[t + 2] << 8 | e[t + 3]) >>> 0
}
t.exports = o(o)
}
, {}],
7: [function(t, i, n) {
function r(t) {
try {
var i = eval("require")(t);
if (i && (i.length || Object.keys(i).length))
return i
} catch (t2) {}
return null
}
i.exports = r
}
, {}],
8: [function(e, t, n) {
var o = (n = n).isAbsolute = function(e) {
return /^(?:\/|\w+:)/.test(e)
}
, r = n.normalize = function(e) {
var t = (e = e.replace(/\\/g, "/").replace(/\/{2,}/g, "/")).split("/")
, n = o(e);
e = "";
n && (e = t.shift() + "/");
for (var r = 0; r < t.length; )
".." === t[r] ? 0 < r && ".." !== t[r - 1] ? t.splice(--r, 2) : n ? t.splice(r, 1) : ++r : "." === t[r] ? t.splice(r, 1) : ++r;
return e + t.join("/")
}
;
n.resolve = function(e, t, n) {
return n || (t = r(t)),
!o(t) && (e = (e = n ? e : r(e)).replace(/(?:\/|^)[^/]+$/, "")).length ? r(e + "/" + t) : t
}
}
, {}],
9: [function(e, t, n) {
t.exports = function(e, t, n) {
var o = n || 8192
, r = o >>> 1
, i = null
, s = o;
return function(n) {
return n < 1 || r < n ? e(n) : (o < s + n && (i = e(o),
s = 0),
n = t.call(i, s, s += n),
7 & s && (s = 1 + (7 | s)),
n)
}
}
}
, {}],
10: [function(e, t, n) {
n.length = function(e) {
for (var t, n = 0, o = 0; o < e.length; ++o)
(t = e.charCodeAt(o)) < 128 ? n += 1 : t < 2048 ? n += 2 : 55296 == (64512 & t) && 56320 == (64512 & e.charCodeAt(o + 1)) ? (++o,
n += 4) : n += 3;
return n
}
,
n.read = function(e, t, n) {
if (n - t < 1)
return "";
for (var o, r = null, i = [], s = 0; t < n; )
(o = e[t++]) < 128 ? i[s++] = o : 191 < o && o < 224 ? i[s++] = (31 & o) << 6 | 63 & e[t++] : 239 < o && o < 365 ? (o = ((7 & o) << 18 | (63 & e[t++]) << 12 | (63 & e[t++]) << 6 | 63 & e[t++]) - 65536,
i[s++] = 55296 + (o >> 10),
i[s++] = 56320 + (1023 & o)) : i[s++] = (15 & o) << 12 | (63 & e[t++]) << 6 | 63 & e[t++],
8191 < s && ((r = r || []).push(String.fromCharCode.apply(String, i)),
s = 0);
return r ? (s && r.push(String.fromCharCode.apply(String, i.slice(0, s))),
r.join("")) : String.fromCharCode.apply(String, i.slice(0, s))
}
,
n.write = function(e, t, n) {
for (var o, r, i = n, s = 0; s < e.length; ++s)
(o = e.charCodeAt(s)) < 128 ? t[n++] = o : (o < 2048 ? t[n++] = o >> 6 | 192 : (55296 == (64512 & o) && 56320 == (64512 & (r = e.charCodeAt(s + 1))) ? (++s,
t[n++] = (o = 65536 + ((1023 & o) << 10) + (1023 & r)) >> 18 | 240,
t[n++] = o >> 12 & 63 | 128) : t[n++] = o >> 12 | 224,
t[n++] = o >> 6 & 63 | 128),
t[n++] = 63 & o | 128);
return n - i
}
}
, {}],
11: [function(e, t, n) {
var o = e(14)
, r = e(33);
function i(e, t, n, r) {
if (t.resolvedType)
if (t.resolvedType instanceof o) {
e("switch(d%s){", r);
for (var i = t.resolvedType.values, s = Object.keys(i), a = 0; a < s.length; ++a)
t.repeated && i[s[a]] === t.typeDefault && e("default:"),
e("case%j:", s[a])("case %i:", i[s[a]])("m%s=%j", r, i[s[a]])("break");
e("}")
} else
e('if(typeof d%s!=="object")', r)("throw TypeError(%j)", t.fullName + ": object expected")("m%s=types[%i].fromObject(d%s)", r, n, r);
else {
var c = !1;
switch (t.type) {
case "double":
case "float":
e("m%s=Number(d%s)", r, r);
break;
case "uint32":
case "fixed32":
e("m%s=d%s>>>0", r, r);
break;
case "int32":
case "sint32":
case "sfixed32":
e("m%s=d%s|0", r, r);
break;
case "uint64":
c = !0;
case "int64":
case "sint64":
case "fixed64":
case "sfixed64":
e("if(util.Long)")("(m%s=util.Long.fromValue(d%s)).unsigned=%j", r, r, c)('else if(typeof d%s==="string")', r)("m%s=parseInt(d%s,10)", r, r)('else if(typeof d%s==="number")', r)("m%s=d%s", r, r)('else if(typeof d%s==="object")', r)("m%s=new util.LongBits(d%s.low>>>0,d%s.high>>>0).toNumber(%s)", r, r, r, c ? "true" : "");
break;
case "bytes":
e('if(typeof d%s==="string")', r)("util.base64.decode(d%s,m%s=util.newBuffer(util.base64.length(d%s)),0)", r, r, r)("else if(d%s.length)", r)("m%s=d%s", r, r);
break;
case "string":
e("m%s=String(d%s)", r, r);
break;
case "bool":
e("m%s=Boolean(d%s)", r, r)
}
标签：
爬虫
本文转载自: https://blog.csdn.net/qinhan1219/article/details/132449900
版权归原作者 福爱娃 所有， 如有侵权，请联系我们删除。
版权归原作者 福爱娃 所有， 如有侵权，请联系我们删除。