1.目標

網址：https://y.qq.com/n/ryqq/toplist/26

切換榜單出現請求，可以看到sign和data是加密的

2.逆向分析

搜索sign:


可以看到sign = P(n.data)，而n.data就是請求的加密data參數

data = '{"comm":{"cv":4747474,"ct":24,"format":"json","inCharset":"utf-8","outCharset":"utf-8","notice":0,"platform":"yqq.json","needNewCode":1,"uin":0,"g_tk_new_20200303":5381,"g_tk":5381},"req_1":{"module":"musicToplist.ToplistInfoServer","method":"GetDetail","param":{"topid":27,"offset":0,"num":20,"period":"2025-05-27"}}}'

3.webpack分析

這是Webpack 打包后的模塊加載代碼

在這里打上斷點找加載器n，然后刷新頁面

可以看到加載器的name是"f"，數組m里面390個模塊
點擊進入就是加載器

可以看到是以列表的方式存儲模塊的，
然后將獲取sign的模塊，就是含有下面內容的模塊，放進去

var P = G._getSecuritySign;
var L = j.__cgiEncrypt, N = j.__cgiDecrypt;

• G._getSecuritySign
  • 獲取sign
• j.__cgiEncrypt
  • 加密請求參數data
• j.__cgiDecrypt
  • 解密響應二進制數據

window = global;!function(e) {function r() {for (var e, t = 0; t < d.length; t++) {for (var r = d[t], a = !0, n = 1; n < r.length; n++) {var c = r[n];0 !== o[c] && (a = !1)}a && (d.splice(t--, 1),e = f(f.s = r[0]))}return e}var a = {}, n = {21: 0}, o = {21: 0}, d = [];function f(t) {if (a[t])return a[t].exports;var r = a[t] = {i: t,l: !1,exports: {}};console.log(t)return e[t].call(r.exports, r, r.exports, f),r.l = !0,r.exports}f.m = e,f.c = a,f.d = function(e, t, r) {f.o(e, t) || Object.defineProperty(e, t, {enumerable: !0,get: r})},f.r = function(e) {"undefined" !== typeof Symbol && Symbol.toStringTag && Object.defineProperty(e, Symbol.toStringTag, {value: "Module"}),Object.defineProperty(e, "__esModule", {value: !0})},f.t = function(e, t) {if (1 & t && (e = f(e)),8 & t)return e;if (4 & t && "object" === typeof e && e && e.__esModule)return e;var r = Object.create(null);if (f.r(r),Object.defineProperty(r, "default", {enumerable: !0,value: e}),2 & t && "string" != typeof e)for (var a in e)f.d(r, a, function(t) {return e[t]}.bind(null, a));return r},f.o = function(e, t) {return Object.prototype.hasOwnProperty.call(e, t)}r()window.shark = f;
}([]);console.log(window.shark);

先刪除一些無用的代碼，然后將模塊放進去

如果這么運行的話，毫無疑問是會報錯的

        return e[t].call(r.exports, r, r.exports, f),^TypeError: Cannot read properties of undefined (reading 'call')

很明顯缺少的是下標為81的模塊，然后我們去瀏覽器取該模塊


然后這里也不是導入81模塊，在這里我們是導入自己的下標為1的模塊

然后接下來就是導出全局函數了

打印方法沒有問題

4.sign驗證

get_sign = (data) => window.shark(0).getSign(data);data = '{"comm":{"cv":4747474,"ct":24,"format":"json","inCharset":"utf-8","outCharset":"utf-8","notice":0,"platform":"yqq.json","needNewCode":1,"uin":0,"g_tk_new_20200303":5381,"g_tk":5381},"req_1":{"module":"musicToplist.ToplistInfoServer","method":"GetDetail","param":{"topid":27,"offset":0,"num":20,"period":"2025-05-28"}}}'console.log(get_sign(data))

寫個箭頭函數驗證能否生成sign

運行代碼可以生成sign

但是和瀏覽器的sign不一樣，而且data是一樣的，這就是缺少必要的環境

window = global;document = {cookie: 'pgv_pvid=592785550; fqm_pvqid=75e53579-6875-45e3-9bfa-8c3634fd8b23; fqm_sessionid=4742d993-b7c2-4148-b070-67c2ac322bc7; pgv_info=ssid=s6945372512; ts_last=y.qq.com/n/ryqq/toplist/26; ts_refer=cn.bing.com/; ts_uid=4872983500',createElement: function(res){if(res == 'a') return {}},
}
navigator = {userAgent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36",}
location = {"href": "https://y.qq.com/","host": "y.qq.com",
}

補充環境之后發現和瀏覽器的一致

sign算法逆向參見：https://blog.csdn.net/2406_83321119/article/details/146435985