关于超星学习通视频加密分析

学校又有新的课程要观看了,没办法,只能上才艺了

对于像这种网课类的观看,发送的数据请求一般都是ajax,携带的关键参数大致如下

当前的观看时间
当前观看的课程章节id
当前课程的id

随便找了一个课程,发送的数据如下

因为我已经分析过了,就直接告诉大家,发送数据的参数只有enc是不断变化的,且用js加密生成,objectid和ontherinfo针对当前所看的课程章节是不变的,
观看其他的课程就会发生相对的变化,好了,通过单词的字面意思大致知道意思,接下来我们就要分析enc是怎么生成的,好模拟发送对应的请求

找js的方法有很多,这里就不介绍了,网上一大堆方法,我这里通过发送对应的ajax的initiator找到了相关的js文件

我这里为了方便观看,直接提取出关键的js代码

var format = "[{0}][{1}][{2}][{3}][{4}][{5}][{6}][{7}]"
var clipTime = (params.startTime || "0") + "_" + (params.endTime || params.duration);
var enc = Ext.String.format(format, params.clazzId, params.userid, params.jobid ? params.jobid : "", params.objectId, currentTimeSec * 1000, "d_yHJ!$pdA~5", params.duration * 1000, clipTime);
var rurl = [params.reportUrl, "/", params.dtoken, "?clazzId=", params.clazzId, "&playingTime=", currentTimeSec, "&duration=", params.duration, "&clipTime=", clipTime, "&objectId=", params.objectId, "&otherInfo=", params.otherInfo, "&jobid=", params.jobid, "&userid=", params.userid, "&isdrag=", isdrag, "&view=pc", "&enc=", md5(enc), "&rt=", params.rt, "&dtype=Audio", "&_t=", new Date().getTime()].join("");

为了更方便的观看数据,我已经提前打好了断点,拿到了数据,可以看到enc其实是拿对应的参数进行字符串的拼接,然后做md5签名
我们已经知道了enc是怎么生成的,然后我们需要知道其他的参数怎么来的,前面已经说过,既然这些参数是不变的,那么一般都会在页面刚加载的时候就已经生成了
我们对其中任一一个固定的值进行全文检索

 mArg = {"attachments":[{"headOffset":139000,"jobid":"1581681271463334","otherInfo":"nodeId_305814262-cpi_67960467","isPassed":false,"property":{"jobid":"1581681271463334","switchwindow":"true","size":1025113278,"fastforward":"true","hsize":"977.62 MB","module":"insertvideo","name":"3.5 从“全面建设小康”到“全面建成小康”.mp4","mid":"9733390305491581681270487","type":".mp4","objectid":"9c3a5a79e7d0473b06409f9bb566acad","_jobid":"1581681271463334"},"mid":"9733390305491581681270487","playTime":139000,"job":true,"type":"video","objectId":"9c3a5a79e7d0473b06409f9bb566acad"}],"defaults":{"fid":"1982","isFiled":0,"ignoreVideoCtrl":0,"reportUrl":"https://mooc1-1.chaoxing.com/multimedia/log/a/67960467","userid":"82506971","reportTimeInterval":60,"initdataUrl":"https://mooc1-1.chaoxing.com/richvideo/initdatawithviewer","knowledgeid":305814262,"qnenc":"4d74ade22640d3418796027099215e30","defenc":"9e694cf3bbb44d0d9764fa88acfb3dd5","clazzId":25967418,"cardid":274708987,"imageUrl":"https://p.ananas.chaoxing.com/star3/origin/3a7c4e2929905646967168696f78ff01.png","lastmodifytime":1588505782000,"state":0,"courseid":211852763,"subtitleUrl":"https://mooc1-1.chaoxing.com/richvideo/subtitle"},"control":true};