嘿 大漂亮大帅逼，老Amy又来了~大家好像对JS反爬都非常感兴趣，而这方面的资料也是少之又少，毕竟难度系数也是有的…emmm，所以今天再次来学习这顶好的JS反爬之有道翻译

需求

1.打开有道翻译 http://fanyi.youdao.com/

输入hello后抓包的请求为post，所以在发送请求时是有一系列的参数的。而这些参数我们需要知道哪些是变化的，哪些是不变的，所以多加载几个。观察如下：

• 输入hello的参数

i: hello
from: AUTO
to: AUTO
smartresult: dict
client: fanyideskweb
salt: 16044875956897
sign: f2e025a59410a41c04bec2f3194737be
lts: 1604487595689
bv: 4abf2733c66fbf953861095a23a839a8
doctype: json
version: 2.1
keyfrom: fanyi.web
action: FY_BY_CLICKBUTTION

• 输入china的参数

i: china
from: AUTO
to: AUTO
smartresult: dict
client: fanyideskweb
salt: 16044880196198
sign: 5a575b04ba07b4eae33de58448356d48
lts: 1604488019619
bv: 4abf2733c66fbf953861095a23a839a8
doctype: json
version: 2.1
keyfrom: fanyi.web
action: FY_BY_CLICKBUTTION

总结如下：

• 变动参数
  • i
  • salt
  • sign
  • lts

现在我们就着重来关注变动的参数。因为这些参数好像都是随机生成的，我们人为很难去揣测参数的生成，那应该就是代码控制生成的，揣测是JS加密出来的结果。

于是我们回到抓包处，看到Initiator，此处是该链接所涉及到的JS文件。

在此处Ctrl+F搜索sign

往下来走，看到些许关于ts,bv,salt,sign等，于是我们可以在此处来执行这些代码。

• 1.对需要执行的行进行点击打断点，变为蓝色的
• 2.点击翻译
• 3.执行往下走

那在这块我们看到md5，鼠标停留在md5，并且点击进入md5函数。将我们看到的js代码放置youdao.js中

function md5(e) {var t, n, i, a, o, s, m, g, v, y = Array();for (e = h(e),y = f(e),s = 1732584193,m = 4023233417,g = 2562383102,v = 271733878,t = 0; t < y.length; t += 16)n = s,i = m,a = g,o = v,s = l(s, m, g, v, y[t + 0], 7, 3614090360),v = l(v, s, m, g, y[t + 1], 12, 3905402710),g = l(g, v, s, m, y[t + 2], 17, 606105819),m = l(m, g, v, s, y[t + 3], 22, 3250441966),s = l(s, m, g, v, y[t + 4], 7, 4118548399),v = l(v, s, m, g, y[t + 5], 12, 1200080426),g = l(g, v, s, m, y[t + 6], 17, 2821735955),m = l(m, g, v, s, y[t + 7], 22, 4249261313),s = l(s, m, g, v, y[t + 8], 7, 1770035416),v = l(v, s, m, g, y[t + 9], 12, 2336552879),g = l(g, v, s, m, y[t + 10], 17, 4294925233),m = l(m, g, v, s, y[t + 11], 22, 2304563134),s = l(s, m, g, v, y[t + 12], 7, 1804603682),v = l(v, s, m, g, y[t + 13], 12, 4254626195),g = l(g, v, s, m, y[t + 14], 17, 2792965006),m = l(m, g, v, s, y[t + 15], 22, 1236535329),s = c(s, m, g, v, y[t + 1], 5, 4129170786),v = c(v, s, m, g, y[t + 6], 9, 3225465664),g = c(g, v, s, m, y[t + 11], 14, 643717713),m = c(m, g, v, s, y[t + 0], 20, 3921069994),s = c(s, m, g, v, y[t + 5], 5, 3593408605),v = c(v, s, m, g, y[t + 10], 9, 38016083),g = c(g, v, s, m, y[t + 15], 14, 3634488961),m = c(m, g, v, s, y[t + 4], 20, 3889429448),s = c(s, m, g, v, y[t + 9], 5, 568446438),v = c(v, s, m, g, y[t + 14], 9, 3275163606),g = c(g, v, s, m, y[t + 3], 14, 4107603335),m = c(m, g, v, s, y[t + 8], 20, 1163531501),s = c(s, m, g, v, y[t + 13], 5, 2850285829),v = c(v, s, m, g, y[t + 2], 9, 4243563512),g = c(g, v, s, m, y[t + 7], 14, 1735328473),m = c(m, g, v, s, y[t + 12], 20, 2368359562),s = u(s, m, g, v, y[t + 5], 4, 4294588738),v = u(v, s, m, g, y[t + 8], 11, 2272392833),g = u(g, v, s, m, y[t + 11], 16, 1839030562),m = u(m, g, v, s, y[t + 14], 23, 4259657740),s = u(s, m, g, v, y[t + 1], 4, 2763975236),v = u(v, s, m, g, y[t + 4], 11, 1272893353),g = u(g, v, s, m, y[t + 7], 16, 4139469664),m = u(m, g, v, s, y[t + 10], 23, 3200236656),s = u(s, m, g, v, y[t + 13], 4, 681279174),v = u(v, s, m, g, y[t + 0], 11, 3936430074),g = u(g, v, s, m, y[t + 3], 16, 3572445317),m = u(m, g, v, s, y[t + 6], 23, 76029189),s = u(s, m, g, v, y[t + 9], 4, 3654602809),v = u(v, s, m, g, y[t + 12], 11, 3873151461),g = u(g, v, s, m, y[t + 15], 16, 530742520),m = u(m, g, v, s, y[t + 2], 23, 3299628645),s = d(s, m, g, v, y[t + 0], 6, 4096336452),v = d(v, s, m, g, y[t + 7], 10, 1126891415),g = d(g, v, s, m, y[t + 14], 15, 2878612391),m = d(m, g, v, s, y[t + 5], 21, 4237533241),s = d(s, m, g, v, y[t + 12], 6, 1700485571),v = d(v, s, m, g, y[t + 3], 10, 2399980690),g = d(g, v, s, m, y[t + 10], 15, 4293915773),m = d(m, g, v, s, y[t + 1], 21, 2240044497),s = d(s, m, g, v, y[t + 8], 6, 1873313359),v = d(v, s, m, g, y[t + 15], 10, 4264355552),g = d(g, v, s, m, y[t + 6], 15, 2734768916),m = d(m, g, v, s, y[t + 13], 21, 1309151649),s = d(s, m, g, v, y[t + 4], 6, 4149444226),v = d(v, s, m, g, y[t + 11], 10, 3174756917),g = d(g, v, s, m, y[t + 2], 15, 718787259),m = d(m, g, v, s, y[t + 9], 21, 3951481745),s = r(s, n),m = r(m, i),g = r(g, a),v = r(v, o);return (p(s) + p(m) + p(g) + p(v)).toLowerCase()
}

那现在，我们需要使用python去模拟这个JS代码，但是会发现…哇好长呀。那现在我们需要介绍神器——pyexecjs。该库是python用来执行JS代码的，在tool.py中具体代码如下：

import execjsdef get_js_function(js_path, func_name, func_args):with open(js_path, encoding="utf-8") as f:js = f.read()ctx = execjs.compile(js)return ctx.call(func_name, func_args)res = get_js_function("youdao.js","md5","hello")
print(res)

执行代码报错：

execjs._exceptions.ProgramError: ReferenceError: h is not defined

也就是说，h函数没有找到，我们则需要去找h函数的定义。

• 1.进入md5
• 2.给8198行打断点
• 3.给h(e)打断点
• 4.进入下一步

跳转如下：

将其复制到youdao.js里面。则可以输出

5d41402abc4b2a76b9719d911017c592

现在，我们想输出所有的可变参数，所以将以下复制到JS里面。

但是发现navigator.appVersion又是一个未知的东西，所以我们来找传进去md5的参数e是啥。如下图，发现e好像是我们的UA…于是代码如下：

function youdao(e) {var t = md5("5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36"), r = "" + (new Date).getTime(), i = r + parseInt(10 * Math.random(), 10);return {lts: r,bv: t,salt: i,sign: md5("fanyideskweb" + e + i + "]BjuETDhU)zqSxf-=B#7m")}
};

OK，我们再来执行youdao.py

from tool import get_js_functiondic = get_js_function("youdao.js","youdao","hello")
print(dic)

输出如下：

{'lts': '1604557839594', 'bv': '4abf2733c66fbf953861095a23a839a8', 'salt': '16045578395947', 'sign': 'e4eef867494f2768a324d0f8e1502abe'}

奥啦啦，那么这些动态参数就被我们全部破解完毕啦~代码什么都非常简单，不过JS代码就很长，我就不重复写啦！如果有需要的话可以扫码关注以下公众号，留言：有道翻译 获取完整代码奥