aardio爬虫) 实战篇:逆向有道翻译web接口

前言

之前的文章把js引擎(aardio封装库) 微软开源的js引擎(ChakraCore))写好了,这篇文章整点js代码来测一下bug。测试网站:https://fanyi.youdao.com/index.html#/

逆向思路

逆向思路可以看有道翻译js逆向(MD5加密,AES加密)附完整源码,逆向我就不赘述了。这篇文章说一下怎么将文章中给的Python代码翻译成aardio调用和扣js代码用ChakraCore调用。

扣js代码

有道翻译的js是webpack,扣webpack主要有两个内容,一个是加载器函数,还有就是实际调用的函数。这个可以去看b站志远一期的内容,讲的很详细。

这个我看了下,把整个js放到nodejs里执行就行,不需要扣函数,函数和函数之间关联太多了,扣反而不方便。上面补个window,然后导出成全局函数。

91565这个函数在另一个js文件里,把整个大对象拿下来和e合并一下。

然后就可以直接调用

var r = n(91565)
console.log(r.createHash("md5").update("11111111").digest("hex"))

再封装两个函数给外部调用:

function md5(content){
    let r = n(91565);
    return r.createHash("md5").update(content).digest("hex");
};

function aes_cbc_decrypt(key, iv, content){
    let r = n(91565);
    let o = r.createHash("md5").update(key).digest();
    let a = r.createHash("md5").update(iv).digest() ; 
    let i = r.createDecipheriv("aes-128-cbc", o, a);
    let c = i.update(content, "base64", "utf-8");
    return c += i.final("utf-8");
};

测试了封装的ChakraCore库,有个莫名其妙的bug:如果不在js里调用这两个函数,那你再aardio使用run或者callFunction调用可能会报错,测试了半天也没找到具体原因,主要是ChakraCore的文档有点少。

没办法,目前只能在javaScript里先调用一次,这个bug后面看看能不能解决

var decodeiv = "ydsecret://query/iv/C@lZe2YzHtZ2CYgaXKSVfsb7Y4QWHjITPPZ0nQp87fBeJ!Iv6v^6fvi2WN@bYpJ4";
var decodekey = "ydsecret://query/key/B*RGygVywfNBwpmBaZg*WT7SIOUP2T0C9WHMZN39j^DAdaZhAnxvGcCY6VYFwnHl";
var text = "";
// 需要先在js里调用一次,不然aardio调用报错
md5("1111")
aes_cbc_decrypt(decodekey, decodeiv, text)

用ChakraCore调用的完整代码(js文件我放到了aardio-extlibs那个github仓库里作为ChakraCore的用例):

import console; 
import kirequests;
import ChakraCore;
io.open()
var core = ChakraCore()
core.start()

core.run(string.load("./有道翻译.js"))

var client = "fanyideskweb";
var product = "webfanyi";
var key = "fsdsogkndfokasodnaso";
var signStr = `client=%s&mysticTime=%s&product=%s&key=%s`;

// 先请求主页获取cookie
var session = kirequests.session();
var url = "https://fanyi.youdao.com/index.html"
var resp = session.get(url);

// 要翻译的内容
var word = "中国";
// 内容是什么语言
var from = "auto";
// 想翻译成什么语言
var to = "";
var webtranslateApi = "https://dict.youdao.com/webtranslate";
var timestamp = tostring(tonumber(time())) + string.random(3,"1234567890");
var postData = {
	"i": word,
	"from": from,
	"to": to,
	"domain": "0",
	"dictResult": "true",
	"keyid": product,
	"client": client,
	"product": product,
	"appVersion": "1.0.0",
	"vendor": "web",
	"pointParam": "client,mysticTime,product",
	"mysticTime": timestamp,
	"keyfrom": "fanyi.web",
	"mid": "1",
	"screen": "1",
	"model": "1",
	"network": "wifi",
	"abtest": "0",
	"yduuid": "abcdefg"
}
var s = string.format(signStr, client,timestamp,product,key)
postData["sign"] =  core.callFunction("window.md5",s);
var resp = session.post(url=webtranslateApi,data=postData);
// 开始解密
var decodeiv = "ydsecret://query/iv/C@lZe2YzHtZ2CYgaXKSVfsb7Y4QWHjITPPZ0nQp87fBeJ!Iv6v^6fvi2WN@bYpJ4";
var decodekey = "ydsecret://query/key/B*RGygVywfNBwpmBaZg*WT7SIOUP2T0C9WHMZN39j^DAdaZhAnxvGcCY6VYFwnHl";
var result = core.callFunction("window.aes_cbc_decrypt", decodekey, decodeiv,resp.text)
console.log(result)
console.pause(true);

aardio实现

这里在给个不用ChakraCore用上篇文章写的aes库调用的代码。

import console; 
import kirequests;
import kicrypt.aes;
import crypt;
import crypt.bin;


var client = "fanyideskweb";
var product = "webfanyi";
var key = "fsdsogkndfokasodnaso";
var signStr = `client=%s&mysticTime=%s&product=%s&key=%s`;

// 先请求主页获取cookie
var session = kirequests.session();
var url = "https://fanyi.youdao.com/index.html"
var resp = session.get(url);

// 要翻译的内容
var word = "hello";
// 内容是什么语言
var from = "auto";
// 想翻译成什么语言
var to = "";
var webtranslateApi = "https://dict.youdao.com/webtranslate";
var timestamp = tostring(tonumber(time())) + string.random(3,"1234567890");
var postData = {
	"i": word,
	"from": from,
	"to": to,
	"domain": "0",
	"dictResult": "true",
	"keyid": product,
	"client": client,
	"product": product,
	"appVersion": "1.0.0",
	"vendor": "web",
	"pointParam": "client,mysticTime,product",
	"mysticTime": timestamp,
	"keyfrom": "fanyi.web",
	"mid": "1",
	"screen": "1",
	"model": "1",
	"network": "wifi",
	"abtest": "0",
	"yduuid": "abcdefg"
}

postData["sign"] = crypt.md5(string.format(signStr, client,timestamp,product,key),false);
var resp = session.post(url=webtranslateApi,data=postData);
// 开始解密
var decodeiv = "ydsecret://query/iv/C@lZe2YzHtZ2CYgaXKSVfsb7Y4QWHjITPPZ0nQp87fBeJ!Iv6v^6fvi2WN@bYpJ4";
var decodekey = "ydsecret://query/key/B*RGygVywfNBwpmBaZg*WT7SIOUP2T0C9WHMZN39j^DAdaZhAnxvGcCY6VYFwnHl";
var key = string.unhex(crypt.md5(decodekey,false),"")
var iv = string.unhex(crypt.md5(decodeiv,false),"")
var aesObj = kicrypt.aes(key, iv);
var data = crypt.bin.decodeUrlBase64(resp.text)
var result = aesObj.decrypt(data, kicrypt.aes.CBC)
console.log(result)
console.pause(true);

本文由博客一文多发平台 OpenWrite 发布!

热门相关:美食萌后:皇上,休了你   神医娘亲之腹黑小萌宝   田园晚色:肥妇三嫁良夫   首席的强娶豪夺:离婚365次   大唐杨国舅