Python爬虫进阶 | 漫画柜加密分析

此次文章是补以前文章提到的eval加密 -- 漫画柜

以前写文章简单介绍了常见的JS混淆：

juejin.im/post/5d841e…

查看请求

打开控制台,随意点击一本漫画,进入到正文页面,查看请求:

能够很容易看到这里有个md5的参数值是加密的。

定位加密位置

这里有两种定位方法: 第一种面向老手,先翻一遍请求,网页源码能够迅速定位。

第二种就是按照以前的文章提到的分析流程,咱们分析一遍,虽然麻烦点会走弯路可是适合新手:

没有看过的朋友能够点击下面的文章连接回顾一下:

先搜索一下关键字,这里加密的参数是md5,因此试试下面这几种搜索关键词:

md5:
md5 :
md5=
md5 =
md5
复制代码

搜索结果以下:

经过关键字搜索没有获得想要的结果,按照以前文章提到的流程到这里就卡住了。

不过咱们看到上面请求里还有另外一参数cid,既然都是请求参数,那么md5这个参数多是和他一块儿提交的,咱们能够试试搜索cid关键词试试。

搜索cid这个参数结果以下:

果真有点东西,咱们点进第一个文件,搜索下有多少和cid这个参数相关搜索项,检索以后有18项相关,经过分析代码,很快咱们定位到下图的代码,打上断点从新加载看看是否能进入咱们的断点位置:

果真成功进入断点了,可是好像并无咱们想要得md5参数,这个时候好像又卡住了。

不过很快咱们经过查看左侧堆栈信息找到了md5参数的位置:

这里vm的代码又是经过下面这段代码生成的:

这开头,不就是熟悉的eval加密吗。

到这里就定位到解密的地方了,可是这段eval代码又是在哪呢？

发现左侧有.html的标识,搜索是搜不到了,咱们就看看这个页面的源代码吧,发现右键是进入下一页漫画,因此经过控制台的Doc选项卡看看,经过格式化代码咱们找到了上面的eval代码。

window["\x65\x76\x61\x6c"](function(p, a, c, k, e, d) {
                e = function(c) {
                    return (c < a ? "" : e(parseInt(c / a))) + ((c = c % a) > 35 ? String.fromCharCode(c + 29) : c.toString(36))
                }
                ;
                if (!''.replace(/^/, String)) {
                    while (c--)
                        d[e(c)] = k[c] || e(c);
                    k = [function(e) {
                        return d[e]
                    }
                    ];
                    e = function() {
                        return '\\w+'
                    }
                    ;
                    c = 1;
                }
                ;while (c--)
                    if (k[c])
                        p = p.replace(new RegExp('\\b' + e(c) + '\\b','g'), k[c]);
                return p;
            }('I.H({"G":4,"J":"M","L":"4.2","K":B,"A":"z","C":["F.2.3","E.2.3","D.2.3","N.2.3","X.2.3","W.2.3","V.2.3","Y.2.3","11.2.3","10.2.3","Z.2.3","Q.2.3","P.2.3","O.2.3","R.2.3","U.2.3","T.2.3","S.2.3","d.2.3","c.2.3","b.2.3","e.2.3","h.2.3","g.2.3","f.2.3","a.2.3","5.2.3","6.2.3","8.2.3","7.2.3","9.2.3","i.2.3","u.2.3","t.2.3","s.2.3","v.2.3","y.2.3","x.2.3","w.2.3","r.2.3","m.2.3","k.2.3","j.2.3","n.2.3","q.2.3","p.2.3","o.2.3","12.2.3","1E.2.3","1D.2.3","1C.2.3","1F.2.3","1I.2.3","1H.2.3","1G.2.3","1x.2.3","1w.2.3","1v.2.3","1y.2.3","1B.2.3","1A.2.3","1z.2.3","1V.2.3","1S.2.3","1T.2.3","1R.2.3","1W.2.3","1U.2.3","1L.2.3","1M.2.3","1J.2.3","1K.2.3","1P.2.3","1Q.2.3","1N.2.3","1O.2.3","1c.2.3","1b.2.3","1a.2.3","1d.2.3","1g.2.3","1f.2.3","1e.2.3","15.2.3","14.2.3","13.2.3","16.2.3"],"19":18,"17":1q,"1p":"/1o/l/1r/1u/","1t":1,"1s":"","1j":1i,"1h":0,"1k":{"1n":"1m"}}).1l();', 62, 121, 'D7BWAcHNgdwUwEbmARgJwHYAcwAMAmANgIz3wwJwLVwGZcytq966UyBWAws3A93OgINBTdGRQF8ZACwEOZevhll8BWi0m1puGWpkbdkvSF18ZAg7pW7iM0rq4ye1xyxpyWc2grr1aNtp+LFy0LrRMtGgsFBEsxLSkgDTegoDuysAAxgB2AIYAtnCohBgyCgBmAJYANnAAznjCdA2SBA18gsAIFQAmwBV5kAAiOQAuOcAAygCyABKduQWZPZ3gFRnAgOr+gJGqgATyDaw2KPQoh2pHeCiSKDongr4oFChUKMQPF1wvDcS4DrhcuC4zH8GhRcM8+JcGjRJA0mLhoroKDIqFguFgXFg5Ki8Fh6JiccQsKQallgCMAE4AV0KlSyFVqAAs4L0fkwMAiMBRsHgMMROTyaEwcWpcTjJFgdHCsOxwOS4AA3ACSvReJR4WTgAA8RsrgLUqsBZXBFXSRsAspSAII5S0AYRm3QAYgANDJYABagwmAHkYOSKuTupbgHlugpwLUZaMGcAicAqgyAF6dKoAewyAGsAPoZda1MYjSn1Dp/CgcKgcYgcBwcLiVvDlv4IwiSQg6b4ths0YgNvgcSw0Lh4ZG6BH9v46DhyWsN+hThtqDiGUEYASrn7tpiEZs0Cg8uQYXyHn4uDBqDDL+glPCELiEFyEeiEGzPgG+YoAqhtgGGe8AjBAA=='['\x73\x70\x6c\x69\x63']('\x7c'), 0, {}))
复制代码

解密过程

咱们来捋一捋整个过程,首先网站加载页面,执行了这段eval,解密了参数里的一堆密文,以后根据参数请求具体内容,那咱们逆向只要拿到页面的代码,用execjs执行这段代码不就能拿到md5值直接请求了吗。

可是把这段代码直接复制到eval解密里好像并无用,我感受应该和末尾的加密参数有关,通过测试这段参数虽然长得和Base64很像但并非base64加密,我又卡住了,因此我求助了大佬。

通过 @ 悦来客栈的老板 的提点我尝试了下果真是这段是这段代码有问题:

通过解密运行的结果就是咱们在vm中看到的结果了:

到这里就简单了,请求网页的代码,使用正则替换代码里的密文,使用execjs执行这段代码就能够获得md5值,再使用这个md5值就能够请求了。

结束总结

此次的解密文章写的比较啰嗦,虽然整个加密比较简单,可是本身在这整个过程也踩了很多坑,走了很多弯路。

JS逆向是细致活,须要大胆假设,当心求证,耐心调试,同时在逆向过程当中卡住了须要求助的时候也不要很差意思。把本身思考的结果、遇到的问题描述清楚附上小小的红包和大佬聊聊,会有意想不到的惊喜。

共勉~