Charge Generation (Liberation) 、Decay Rate-CFANZ编程社区

主页链接:
https://www.qimai.cn/rank
在这里插入图片描述
analysis逆向

完整参数生成代码如下：
const {JSDOM} = require('jsdom')
const dom = new JSDOM('<!DOCTYPE html><p>hello</p>')
window = dom.window


function customDecrypt(n, t) {
    t = t || generateKey();  // 如果没有提供 t，则使用默认密钥
    // 将字符串 n 分割成字符数组
    n = n.split("");
    for (var i = 0; i < n.length; i++) {
        // 对字符 n[i] 进行异或运算
        n[i] = String.fromCharCode(n[i].charCodeAt(0) ^ t.charCodeAt((i + 10) % t.length));
    }
    // 将字符数组拼接成字符串
    return n.join("");
};

// 拼接a字符串
function a_for_bs64(t){
    var z = window;
    var Z = "Object";
    var i7 = "keys";
    var Zt = "params";
    var M = "forEach";
    var n;
    var N2 = "hasOwnProperty";
    var a = [];
    var b = "push";
    var Ot ="sort" ;
    var I1 = "join";
    var _ = "";


    z[Z][i7](t[Zt])[M](function (n) {
        t[Zt][N2](n) && a[b](t[Zt][n])
    });
    a = a[Ot]()[I1](_);

    console.log(a);
    return a
}


function  analysis_gen(t){
    var d = "xyz517cda96efgh";
    var currentDate = new Date();
    // 获取毫秒级时间戳
    var timestampInMilliseconds = currentDate.getTime();
    a_start = a_for_bs64(t);
    console.log('a_start==>',a_start)
    a_mid_1 = btoa(a_start);
    // MzIwMjMtMTEtMDYzNmFsbGNuaXBob25l
    console.log('a_mid_1==>',a_mid_1);
    time_period = timestampInMilliseconds - 1661224081041;
    // time_period = 38050153244;
    a_end = a_mid_1+"@#"+t.url+"@#"+time_period+"@#"+"3";
    console.log("a_end==>",a_end);
    // 我生成的  MjAyMy0xMS0wNjMzNmFsbGNuaXBob25l@#/rank/indexPlus/brand_id/1@#38050153244@#3
    // 页面生成 "MjAyMy0xMS0wNjMzNmFsbGNuaXBob25l@#/rank/indexPlus/brand_id/1@#38050153244@#3"
    data = customDecrypt(a_end, d);
    e  = btoa(data);
    console.log(e);
    return e
};


// 接受一个t的对象
const t = {
    "url": "/rank/indexPlus/brand_id/0",
    "params": {
        "brand": "all",
        "country": "cn",
        "device": "iphone",
        "genre": "36",
        "date": "2023-11-06",
        "page": 3
    },
    "baseURL": "https://api.qimai.cn",
};
// 将 params 对象拼接为查询字符串
const params = new URLSearchParams(t.params).toString();

// 构建完整的 URL
const fullURL = `${t.baseURL}${t.url}?analysis=${analysis_gen(t)}&${params}`;

console.log(fullURL);

// 完整生成流程
// 1. 获取加密请求数据对象
// 2. 生成需要加密的字符串a_start
// 3. base64编码生成密文 a_mid_1
// 4. 获取毫秒时间戳与定义差值
// 5. 拼接密文，时间戳差值，请求uri，参数等，生成代编码字符串a_end
// 6. 结合密钥d生成待编码字符串 data
// 7. base64编码字符串生成最终的analysis参数