js逆向核心:扣代码

 

 扣代码的三个阶段：

1 缺啥补啥。稳扎稳打

2 见文知义，化繁为简

3 了然于胸 如履平地

网站 http://www.python-spider.com/challenge/2

我们先用油猴脚本注入hookcookie的函数，找到cookie生成的地方

 

 

我们把他复制下来，放入一个js文件里面

 

 

 

run运行，报啥错。缺啥补啥，比如说a是一个对象

 

 

我们可以复制HWsQG全局查找，

 

 

a找到了，复制一下，放到js里面，在运行

 

 

缺少_$ob 我们戍边放到上面，出现显示是个函数，我们点进去，复制放进去，补到最后的结果，就是运行不报错了

我们打印输出cookie

 

 正是我们想要的，我们把他做成函数，用python的execjs调用

　代码

function SDK_1() {
    window = this

    function md5_ii(a, b, c, d, x, s, t) {
        return md5_cmn(c ^ (b | (~d)), a, b, x, s, t);
    }

    function md5_hh(a, b, c, d, x, s, t) {
        return md5_cmn(b ^ c ^ d, a, b, x, s, t);
    }

    function md5_gg(a, b, c, d, x, s, t) {
        return md5_cmn((b & d) | (c & (~d)), a, b, x, s, t);
    }

    function bit_rol(num, cnt) {
        return (num << cnt) | (num >>> (32 - cnt));
    }

    function safe_add(x, y) {
        var lsw = (x & 0xFFFF) + (y & 0xFFFF);
        var msw = (x >> 16) + (y >> 16) + (lsw >> 16);
        return (msw << 16) | (lsw & 0xFFFF);
    }

    function md5_ff(a, b, c, d, x, s, t) {
        return md5_cmn((b & c) | ((~b) & d), a, b, x, s, t);
    }

    function md5_cmn(q, a, b, x, s, t) {
        return safe_add(bit_rol(safe_add(safe_add(a, q), safe_add(x, t)), s), b);
    }

    function hex_md5(s) {
        return binl2hex(core_md5(str2binl(s), s.length * chrsz));
    }

    var chrsz = 8
    var b64pad = ""

    function str2binl(str) {
        var bin = Array();
        var mask = (1 << chrsz) - 1;
        for (var i = 0; i < str.length * chrsz; i += chrsz)
            bin[i >> 5] |= (str.charCodeAt(i / chrsz) & mask) << (i % 32);
        return bin;
    }

    function core_md5(x, len) {
        /* append padding */
        x[len >> 5] |= 0x80 << ((len) % 32);
        x[(((len + 64) >>> 9) << 4) + 14] = len;

        var a = 1732584193;
        var b = -271733879;
        var c = -1732584194;
        var d = 271733878;

        for (var i = 0; i < x.length; i += 16) {
            var olda = a;
            var oldb = b;
            var oldc = c;
            var oldd = d;

            a = md5_ff(a, b, c, d, x[i + 0], 7, -680876936);
            d = md5_ff(d, a, b, c, x[i + 1], 12, -389564586);
            c = md5_ff(c, d, a, b, x[i + 2], 17, 606105819);
            b = md5_ff(b, c, d, a, x[i + 3], 22, -1044525330);
            a = md5_ff(a, b, c, d, x[i + 4], 7, -176418897);
            d = md5_ff(d, a, b, c, x[i + 5], 12, 1200080426);
            c = md5_ff(c, d, a, b, x[i + 6], 17, -1473231341);
            b = md5_ff(b, c, d, a, x[i + 7], 22, -45705983);
            a = md5_ff(a, b, c, d, x[i + 8], 7, 1770035416);
            d = md5_ff(d, a, b, c, x[i + 9], 12, -1958414417);
            c = md5_ff(c, d, a, b, x[i + 10], 17, -42063);
            b = md5_ff(b, c, d, a, x[i + 11], 22, -1990404162);
            a = md5_ff(a, b, c, d, x[i + 12], 7, 1804603682);
            d = md5_ff(d, a, b, c, x[i + 13], 12, -40341101);
            c = md5_ff(c, d, a, b, x[i + 14], 17, -1502002290);
            b = md5_ff(b, c, d, a, x[i + 15], 22, 1236535329);

            a = md5_gg(a, b, c, d, x[i + 1], 5, -165796510);
            d = md5_gg(d, a, b, c, x[i + 6], 9, -1069501632);
            c = md5_gg(c, d, a, b, x[i + 11], 14, 643717713);
            b = md5_gg(b, c, d, a, x[i + 0], 20, -373897302);
            a = md5_gg(a, b, c, d, x[i + 5], 5, -701558691);
            d = md5_gg(d, a, b, c, x[i + 10], 9, 38016083);
            c = md5_gg(c, d, a, b, x[i + 15], 14, -660478335);
            b = md5_gg(b, c, d, a, x[i + 4], 20, -405537848);
            a = md5_gg(a, b, c, d, x[i + 9], 5, 568446438);
            d = md5_gg(d, a, b, c, x[i + 14], 9, -1019803690);
            c = md5_gg(c, d, a, b, x[i + 3], 14, -187363961);
            b = md5_gg(b, c, d, a, x[i + 8], 20, 1163531501);
            a = md5_gg(a, b, c, d, x[i + 13], 5, -1444681467);
            d = md5_gg(d, a, b, c, x[i + 2], 9, -51403784);
            c = md5_gg(c, d, a, b, x[i + 7], 14, 1735328473);
            b = md5_gg(b, c, d, a, x[i + 12], 20, -1926607734);

            a = md5_hh(a, b, c, d, x[i + 5], 4, -378558);
            d = md5_hh(d, a, b, c, x[i + 8], 11, -2022574463);
            c = md5_hh(c, d, a, b, x[i + 11], 16, 1839030562);
            b = md5_hh(b, c, d, a, x[i + 14], 23, -35309556);
            a = md5_hh(a, b, c, d, x[i + 1], 4, -1530992060);
            d = md5_hh(d, a, b, c, x[i + 4], 11, 1272893353);
            c = md5_hh(c, d, a, b, x[i + 7], 16, -155497632);
            b = md5_hh(b, c, d, a, x[i + 10], 23, -1094730640);
            a = md5_hh(a, b, c, d, x[i + 13], 4, 681279174);
            d = md5_hh(d, a, b, c, x[i + 0], 11, -358537222);
            c = md5_hh(c, d, a, b, x[i + 3], 16, -722521979);
            b = md5_hh(b, c, d, a, x[i + 6], 23, 76029189);
            a = md5_hh(a, b, c, d, x[i + 9], 4, -640364487);
            d = md5_hh(d, a, b, c, x[i + 12], 11, -421815835);
            c = md5_hh(c, d, a, b, x[i + 15], 16, 530742520);
            b = md5_hh(b, c, d, a, x[i + 2], 23, -995338651);

            a = md5_ii(a, b, c, d, x[i + 0], 6, -198630844);
            d = md5_ii(d, a, b, c, x[i + 7], 10, 1126891415);
            c = md5_ii(c, d, a, b, x[i + 14], 15, -1416354905);
            b = md5_ii(b, c, d, a, x[i + 5], 21, -57434055);
            a = md5_ii(a, b, c, d, x[i + 12], 6, 1700485571);
            d = md5_ii(d, a, b, c, x[i + 3], 10, -1894986606);
            c = md5_ii(c, d, a, b, x[i + 10], 15, -1051523);
            b = md5_ii(b, c, d, a, x[i + 1], 21, -2054922799);
            a = md5_ii(a, b, c, d, x[i + 8], 6, 1873313359);
            d = md5_ii(d, a, b, c, x[i + 15], 10, -30611744);
            c = md5_ii(c, d, a, b, x[i + 6], 15, -1560198380);
            b = md5_ii(b, c, d, a, x[i + 13], 21, 1309151649);
            a = md5_ii(a, b, c, d, x[i + 4], 6, -145523070);
            d = md5_ii(d, a, b, c, x[i + 11], 10, -1120210379);
            c = md5_ii(c, d, a, b, x[i + 2], 15, 718787259);
            b = md5_ii(b, c, d, a, x[i + 9], 21, -343485551);

            a = safe_add(a, olda);
            b = safe_add(b, oldb);
            c = safe_add(c, oldc);
            d = safe_add(d, oldd);
        }
        return Array(a, b, c, d);

    }

    var hexcase = 0

    function binl2hex(binarray) {
        var hex_tab = hexcase ? "0123456789ABCDEF" : "0123456789abcdef";
        var str = "";
        for (var i = 0; i < binarray.length * 4; i++) {
            str += hex_tab.charAt((binarray[i >> 2] >> ((i % 4) * 8 + 4)) & 0xF) +
                hex_tab.charAt((binarray[i >> 2] >> ((i % 4) * 8)) & 0xF);
        }
        return str;
    }

    var _$oa = [
        "WFpLV0k=",
        "Y29pRlM=",
        "YXpEbnE=",
        "OyBwYXRoPS8=",
        "RER6V2o=",
        "cGZkekg=",
        "Z2dlcg==",
        "WEpaVEs=",
        "aW5pdA==",
        "VXdNUUw=",
        "bVVvd0U=",
        "amtsS3A=",
        "Y2hhaW4=",
        "TEFDT0Y=",
        "cm91bmQ=",
        "SGRETEU=",
        "VGpsR04=",
        "TUtHaFk=",
        "TlNsalk=",
        "S2h5YUc=",
        "ZGVidQ==",
        "d25MZ3A=",
        "bHFvT0M=",
        "c2lnbj0=",
        "V3pZd3A=",
        "Y1JFV3Q=",
        "dXdQYUs=",
        "T1RFR2M=",
        "T1hMZ04=",
        "TndnQlc=",
        "SHNRVGQ=",
        "dXRmc3o=",
        "Y291bnRlcg==",
        "UHVLTlI=",
        "R29IeVM=",
        "TU9QeWY=",
        "bG9n",
        "d01oYVU=",
        "aUh5RWQ=",
        "cmVsb2Fk",
        "a1lucGw=",
        "bG92WVk=",
        "Uk1CdVo=",
        "bmdtb3k=",
        "TWhZd2g=",
        "dGVzdA==",
        "b1pjVXI=",
        "WU54dEQ=",
        "aGxoVEE=",
        "cXNSZnY=",
        "XCtcKyAqKD86W2EtekEtWl8kXVswLTlhLXpBLVpfJF0qKQ==",
        "bVJZSWc=",
        "ZnVuY3Rpb24gKlwoICpcKQ==",
        "dVZ3emc=",
        "T0VIZHo=",
        "c3RhdGVPYmplY3Q=",
        "Y2JyRFU=",
        "bGVuZ3Ro",
        "dGJ1elA=",
        "a1p6dXQ=",
        "YXBwbHk=",
        "aW5wdXQ=",
        "S05zbWI=",
        "TEFkVmE=",
        "ZGhvTUg=",
        "Q21BbUQ=",
        "SmlmQ0o=",
        "c3RyaW5n",
        "YWN0aW9u",
        "U05nV3E=",
        "Y29va2ll",
        "Y29uc3RydWN0b3I=",
        "SXlMaWE=",
        "d2hpbGUgKHRydWUpIHt9",
        "aktGdkU=",
        "dXpiVXg=",
        "YUlLVnk=",
        "5q2k572R6aG15Y+X44CQ54ix6ZSt5LqR55u+IFYxLjAg5Yqo5oCB54mI44CR5L+d5oqk",
        "amxnWlU=",
        "SFF6RmY=",
        "U0FYVGc=",
        "RGR2Wnk=",
        "dmFsdWVPZg==",
        "VmNoR2U=",
        "ckdSaEc="
    ]

    var _$ob = function (a, b) {
        a = a - 0x0;
        var c = _$oa[a];
        if (_$ob['fVeoOz'] === undefined) {
            (function () {
                var f;
                try {
                    var h = Function('return\x20(function()\x20' + '{}.constructor(\x22return\x20this\x22)(\x20)' + ');');
                    f = h();
                } catch (i) {
                    f = window;
                }
                var g = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
                f['atob'] || (f['atob'] = function (j) {
                        var k = String(j)['replace'](/=+$/, '');
                        var l = '';
                        for (var m = 0x0, n, o, p = 0x0; o = k['charAt'](p++); ~o && (n = m % 0x4 ? n * 0x40 + o : o,
                        m++ % 0x4) ? l += String['fromCharCode'](0xff & n >> (-0x2 * m & 0x6)) : 0x0) {
                            o = g['indexOf'](o);
                        }
                        return l;
                    }
                );
            }());
            _$ob['rYGugk'] = function (e) {
                var f = atob(e);
                var g = [];
                for (var h = 0x0, j = f['length']; h < j; h++) {
                    g += '%' + ('00' + f['charCodeAt'](h)['toString'](0x10))['slice'](-0x2);
                }
                return decodeURIComponent(g);
            }
            ;
            _$ob['okJzdh'] = {};
            _$ob['fVeoOz'] = !![];
        }
        var d = _$ob['okJzdh'][a];
        if (d === undefined) {
            c = _$ob['rYGugk'](c);
            _$ob['okJzdh'][a] = c;
        } else {
            c = d;
        }
        return c;
    };
    var a = {
        'uzbUx': function (d, e) {
            return d + e;
        },
        'yTrWo': _$ob('0x14'),
        'RZoQG': _$ob('0x6'),
        'HQzFf': _$ob('0x37'),
        'IJeEt': function (d, e) {
            return d !== e;
        },
        'mRYIg': _$ob('0x4e'),
        'dhoMH': _$ob('0x34'),
        'oZcUr': _$ob('0x32'),
        'pfdzH': function (d, e) {
            return d(e);
        },
        'PuKNR': _$ob('0x8'),
        'hfxlo': _$ob('0xc'),
        'DdvZy': function (d, e) {
            return d + e;
        },
        'baKIo': _$ob('0x3d'),
        'mUowE': function (d, e) {
            return d !== e;
        },
        'YNxtD': 'RcOux',
        'FFiEx': function (d) {
            return d();
        },
        'NwgBW': 'while\x20(true)\x20{}',
        'kZzut': 'counter',
        'QHHVn': function (d, e, f) {
            return d(e, f);
        },
        'xvdvK': _$ob('0x4d'),
        'jKFvE': 'aiding_win',
        'JifCJ': function (d, e) {
            return d(e);
        },
        'MhYwh': function (d, e) {
            return d(e);
        },
        'aIKVy': function (d, e) {
            return d + e;
        },
        'azDnq': function (d, e) {
            return d(e);
        },
        'WzYwp': function (d, e) {
            return d / e;
        },
        'ngmoy': function (d, e) {
            return d + e;
        },
        'ASPPX': function (d, e) {
            return d + e;
        },
        'DDzWj': _$ob('0x17'),
        'knFPT': function (d, e) {
            return d / e;
        },
        'ZIATq': _$ob('0x3')
    };

    var c = new Date()[_$ob('0x52')]();
    // var c = '1587102734000';
    // console.log(c)

    window.btoa = require('btoa')
    var token = window['btoa'](a[_$ob('0x51')](a[_$ob('0x4a')], a[_$ob('0x42')](String, c)));


    var md = a[_$ob('0x2c')](hex_md5, window['btoa'](a['aIKVy'](a[_$ob('0x4a')], a[_$ob('0x2')](String, Math[_$ob('0xe')](a[_$ob('0x18')](c, 0x3e8))))));

    var cookie = a[_$ob('0x4c')](a[_$ob('0x4c')](a[_$ob('0x4c')](a[_$ob('0x2b')](a[_$ob('0x2b')](a['ASPPX'](a[_$ob('0x4')], Math[_$ob('0xe')](a['knFPT'](c, 0x3e8))), '~'), token), '|'), md), a['ZIATq']);
    // console.log(cookie)
    return cookie
}

console.log(SDK_1())
python代码

import requests
import execjs

with open('sdk.js','r',encoding='utf-8') as f:
        js_text=f.read()
        # print(js_text)
        compile= execjs.compile(js_text)
        cookie=compile.call("SDK_1").split(';')[0].replace('sign=','')
        print(cookie)
        cookies = {
            # 'Hm_lvt_337e99a01a907a08d00bed4a1a52e35d': '1615456972',
            # 'no-alert': 'true',
            'sessionid': '47wd3fm32bz79kezyq1t7dqqzdoahq0v',
            # 'Hm_lpvt_337e99a01a907a08d00bed4a1a52e35d': '1615513367',
            'sign': cookie
        }

        headers = {
            'Connection': 'keep-alive',
            'Pragma': 'no-cache',
            'Cache-Control': 'no-cache',
            'Upgrade-Insecure-Requests': '1',
            'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.82 Safari/537.36',
            'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',
            'Referer': 'http://www.python-spider.com/challenge/2',
            'Accept-Language': 'zh-CN,zh;q=0.9',
        }

        response = requests.get('http://www.python-spider.com/challenge/2', headers=headers, cookies=cookies, verify=False)
        print(response.text)