某狗音乐逆向(js逆向)

免责声明：
    本篇博文的初衷是分享自己学习逆向分析时的个人感悟，所涉及的内容仅供学习、交流，请勿将其用于非法用途！！！任何由此引发的法律纠纷均与作者本人无关，请自行负责！！！

1.请求分析

直接抓包分析这个参数改变的内容，我们可以直接找到这个加密参数的内容所在的位置，现在我们直接进行搜索这个加密参数进行分析

找到这个位置

找到变化的参数

有两个改变的参数，但是我们根据内容可以直接猜测出来这个time是指的是时间戳，所以我们直接进行下一步的内容读取即可

直接进行搜索这个内容，我们可以直接找到这个加密的位置，然后进行步入，找到最终生成加密参数的位置，然后进行补全代码。

直接打上断点，然后进行刷新界面，观察是否断到这个位置

成功打上断点，然后进行参数和函数效果的分析

我们可以发现参数是一个s.join("")加密函数是一个d()函数，然后现在我们直接进行内容的输出，通过控制台的形式

我们可以看出来这个内容就是参数拼接的内容

这个最终的加密参数是一个32位的密文，那么我们就需要去检查一下是否是md5加密的内容

控制台验证

加密工具验证

所以我们可以直接确定就是一个将参数拼接，然后随着时间戳的变化，整体参数是一个改变的值的一个过程，所以这个时候我们可以直接来调试然后确定到最终的内容

点击调试按钮，出现这个内容，相比于上面的多了三个额外的值

我们直接调试到最后观察内容是那一部分的。

这边继续抓包进行分析，我们可以直接找到这个内容的位置，

相应内容

所以我们可以发现这个加密的参数，应该是13个字符串组成的数组形式

所以直接拷贝然后引入md5，修改歌曲的id，然后返回python调用，这个内容就制作完成

const CryptoJS = require("crypto-js");
function main(name){
    n = Math.floor((new Date).getTime())+500
    si = [
        "NVPh5oo715z5DIWAeQlhMDsWXXQV4hwt",
        "appid=1014",
        `clienttime=${n}`,
        "clientver=20000",
        "dfid=4XSHcA2sKzHm1846L94fusi4",
        `encode_album_audio_id=${name}`,
        "mid=7761953a3ef1ef1d09d6e453a78f0424",
        "platid=4",
        "srcappid=2919",
        "token=",
        "userid=0",
        "uuid=7761953a3ef1ef1d09d6e453a78f0424",
        "NVPh5oo715z5DIWAeQlhMDsWXXQV4hwt"
    ]
    end_Signature = CryptoJS.MD5(si.join("")).toString()
    end_Result = {
        'time':n,
        's': end_Signature
    }
    return end_Result
}

这部分内容就是最终的需要。

python代码

import requests
import json
import execjs

headers = {
    "authority": "wwwapi.kugou.com",
    "accept": "*/*",
    "accept-language": "zh-CN,zh;q=0.9",
    "origin": "https://www.kugou.com",
    "referer": "https://www.kugou.com/",
    "sec-ch-ua": "\"Not_A Brand\";v=\"8\", \"Chromium\";v=\"120\", \"Google Chrome\";v=\"120\"",
    "sec-ch-ua-mobile": "?0",
    "sec-ch-ua-platform": "\"Windows\"",
    "sec-fetch-dest": "empty",
    "sec-fetch-mode": "cors",
    "sec-fetch-site": "same-site",
    "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
}
url = "https://wwwapi.kugou.com/play/songinfo"
name = "9qi99wa5"
end_Result = execjs.compile(open('D:\桌面\pythoncode\酷狗音乐逆向\demo.js', 'r', encoding='utf-8').read()).call('main',name)

print(end_Result)
params = {
    "srcappid": "2919",
    "clientver": "20000",
    "clienttime": end_Result['time'],
    "mid": "7761953a3ef1ef1d09d6e453a78f0424",
    "uuid": "7761953a3ef1ef1d09d6e453a78f0424",
    "dfid": "4XSHcA2sKzHm1846L94fusi4",
    "appid": "1014",
    "platid": "4",
    "encode_album_audio_id": str(name),
    "token": "",
    "userid": "0",
    "signature": end_Result['s']
}
print(params)
response = requests.get(url, headers=headers, params=params)
data = bytes(response.text, 'ascii').decode('unicode_escape')
print(data)

with open("D:\桌面\pythoncode\酷狗音乐逆向\demo.txt",'w',encoding='utf-8') as file:
    file.write(data)

搜索或者是其他数据的内容都是这种形式的加密，需要的话，就直接调式到位置进行复制就行。

完善代码，直接搜索
python代码

import requests
import json
import execjs
headers = {
    "authority": "wwwapi.kugou.com",
    "accept": "*/*",
    "accept-language": "zh-CN,zh;q=0.9",
    "origin": "https://www.kugou.com",
    "referer": "https://www.kugou.com/",
    "sec-ch-ua": "\"Not_A Brand\";v=\"8\", \"Chromium\";v=\"120\", \"Google Chrome\";v=\"120\"",
    "sec-ch-ua-mobile": "?0",
    "sec-ch-ua-platform": "\"Windows\"",
    "sec-fetch-dest": "empty",
    "sec-fetch-mode": "cors",
    "sec-fetch-site": "same-site",
    "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
}
url = "https://wwwapi.kugou.com/play/songinfo"

url_search = "https://complexsearch.kugou.com/v2/search/song"
music = input("搜索的歌曲内容:")
end_Result_end = execjs.compile(open('D:\桌面\pythoncode\酷狗音乐逆向\demo.js', 'r', encoding='utf-8').read()).call('main_search',music)

params = {
    "callback": "callback123",
    "srcappid": "2919",
    "clientver": "1000",
    "clienttime": end_Result_end['time'],
    "mid": "7761953a3ef1ef1d09d6e453a78f0424",
    "uuid": "7761953a3ef1ef1d09d6e453a78f0424",
    "dfid": "4XSHcA2sKzHm1846L94fusi4",
    "keyword": music,
    "page": "1",
    "pagesize": "30",
    "bitrate": "0",
    "isfuzzy": "0",
    "inputtype": "0",
    "platform": "WebFilter",
    "userid": "0",
    "iscorrection": "1",
    "privilege_filter": "0",
    "filter": "10",
    "token": "",
    "appid": "1014",
    "signature": end_Result_end['s']
}

print(params)
cookies = {

}
search_music  = requests.get(url_search, headers=headers, cookies=cookies, params=params).text
search_music = json.loads(str(search_music[12:-2]))
music_list = search_music['data']['lists']



print("-------搜索--------")
for music_message in music_list:
    SingerName = music_message['SingerName']
    SongName = music_message['SongName']

    id = music_message['EMixSongID']
    print(SingerName,SongName,id)
print("--------------------",end="\n\n")
print("-------歌曲---------")

name = input("输入歌曲id:")
end_Result = execjs.compile(open('D:\桌面\pythoncode\酷狗音乐逆向\demo.js', 'r', encoding='utf-8').read()).call('main',name)

print(end_Result)
params = {
    "srcappid": "2919",
    "clientver": "20000",
    "clienttime": end_Result['time'],
    "mid": "7761953a3ef1ef1d09d6e453a78f0424",
    "uuid": "7761953a3ef1ef1d09d6e453a78f0424",
    "dfid": "4XSHcA2sKzHm1846L94fusi4",
    "appid": "1014",
    "platid": "4",
    "encode_album_audio_id": str(name),
    "token": "",
    "userid": "0",
    "signature": end_Result['s']
}
print(params)
response = requests.get(url, headers=headers, params=params).json()
# data = bytes(response.text, 'ascii').decode('unicode_escape')

playerUrl = response['data']['play_url']
print(playerUrl)


print(response)

js代码

const CryptoJS = require("crypto-js");
function main(name){
    n = Math.floor((new Date).getTime())+500
    si = [
        "NVPh5oo715z5DIWAeQlhMDsWXXQV4hwt",
        "appid=1014",
        `clienttime=${n}`,
        "clientver=20000",
        "dfid=4XSHcA2sKzHm1846L94fusi4",
        `encode_album_audio_id=${name}`,
        "mid=7761953a3ef1ef1d09d6e453a78f0424",
        "platid=4",
        "srcappid=2919",
        "token=",
        "userid=0",
        "uuid=7761953a3ef1ef1d09d6e453a78f0424",
        "NVPh5oo715z5DIWAeQlhMDsWXXQV4hwt"
    ]
    end_Signature = CryptoJS.MD5(si.join("")).toString()
    end_Result = {
        'time':n,
        's': end_Signature
    }
    return end_Result
}

function main_search(name){
    var time = parseInt(new Date().getTime())

    demo = [
        "NVPh5oo715z5DIWAeQlhMDsWXXQV4hwt",
        "appid=1014",
        "bitrate=0",
        "callback=callback123",
        `clienttime=${time}`,
        "clientver=1000",
        "dfid=4XSHcA2sKzHm1846L94fusi4",
        "filter=10",
        "inputtype=0",
        "iscorrection=1",
        "isfuzzy=0",
        `keyword=${name}`,
        "mid=7761953a3ef1ef1d09d6e453a78f0424",
        "page=1",
        "pagesize=30",
        "platform=WebFilter",
        "privilege_filter=0",
        "srcappid=2919",
        "token=",
        "userid=0",
        "uuid=7761953a3ef1ef1d09d6e453a78f0424",
        "NVPh5oo715z5DIWAeQlhMDsWXXQV4hwt"
    ]
    end_Signature = CryptoJS.MD5(demo.join("")).toString()
    console.log(demo.join(""))
    end_Result = {
        'time':time,
        's': end_Signature,
    }
    return end_Result
}

console.log(main_search("如愿"))

效果展示

只是用于分享知识，不得用于商用或侵犯权益，如有此情况本人概不负责。