某【网盘直链下载助手】验证码获取思路
本帖最后由 xavier001 于 2023-9-1 09:52 编辑## 前言
之前在论坛看了不少的逆向的帖子，一直想找个机会练练手
刚好昨天，想从某云盘下载文件，发现要求限制100MB大小，而目标文件大小是200MB，需要下载客户端才能下载，由于电脑软件安装受到限制，无法自由安装软件，于是想起来了之前在论坛看到过类似的通过油猴脚本获取直链的方式，于是去找了对应的脚本
经过一番检索，找到了[网盘直链下载助手](https://greasyfork.org/zh-CN/scripts/436446-%E7%BD%91%E7%9B%98%E7%9B%B4%E9%93%BE%E4%B8%8B%E8%BD%BD%E5%8A%A9%E6%89%8B) 这一款脚本，想着体验一下效果，结果发现点击下载的时候出现了关注公众号的二维码
本着学习的态度，进行了分析，如下是分析的思路
## 分析思路
按照惯例，先随便输入点内容，点击提交，发现没有任何网络请求，这说明解析是在本地完成的，且大概率不是动态解析
于是开始分析代码，点开油猴脚本的源代码，搜索”重新输入“，找到了如下代码
```javascript
async initDialog() {
let result = await Swal.fire({
title: pan.init,
html: `<div><img style="width: 250px;margin-bottom: 10px;" src="${pan.img}" alt="${pan.img}"><input class="swal2-input" id="init" type="text" placeholder="${pan.init}"></div>`,
allowOutsideClick: false,
showCloseButton: true,
confirmButtonText: '确定'
});
console.log('value: ', $('#init').val(), pan.num)
if (result.isDismissed && result.dismiss === 'close') return;
if (pan.num === $('#init').val()) {
base.setValue('setting_init_code', pan.num);
message.success(pan.init);
setTimeout(() => {
history.go(0);
}, 1500);
} else {
await Swal.fire({
title: pan.init,
text: pan.init,
confirmButtonText: '重新输入',
imageUrl: pan.img,
});
await this.initDialog();
}
}
```
从上面的代码中找到了一点端倪，其中的`pan.num === $('#init').val()`判断条件就是用于决定是否允许往下走的处理逻辑，这就很简单了，直接将if条件修改为true，` if (pan.num === $('#init').val()) {` ==> `if (true) {`，再次输入，点击确定，ok了
## 总结
一开始思路是对的，先看网络请求，然后分析代码进行逆向，但是在分析代码的时候发现自己傻了，不知道怎么入手，后来才想起来在论坛看过关键词检索的方式，才终于找到了入口
这算是新人的第一篇简单的逆向分析文章，内容很简单，但是一开始分析的时候还是没有思路，果然还是要多在论坛观看帖子，学习大佬们的分析思路才行 本帖最后由 云在天 于 2023-11-21 17:00 编辑
Post访问 “https://api.youxiaohou.com/config/tianyi?ver=6.1.1&a=GreasyFork”
base64解码后在URL解码，之后找num这个里面的数据就行。
当然这样很麻烦，但不用修改脚本
添加一段脚本代码, 可以直接在浏览器的Console里面运行
fetch('https://api.youxiaohou.com/config/v2/xunlei?ver=6.1.2&a=GreasyFork', {
method: 'POST',
headers: {
"accept": "*/*",
"accept-language": "zh-CN,zh;q=0.9,en-CA;q=0.8,en;q=0.7,zh-TW;q=0.6",
"cache-control": "no-cache",
"content-type": "application/json",
"pragma": "no-cache",
"sec-ch-ua": "\"Google Chrome\";v=\"119\", \"Chromium\";v=\"119\", \"Not?A_Brand\";v=\"24\"",
"sec-ch-ua-mobile": "?0",
"sec-ch-ua-platform": "\"Windows\"",
"sec-fetch-dest": "empty",
"sec-fetch-mode": "cors",
"sec-fetch-site": "cross-site"
},
"referrer": "https://greasyfork.org/",
"referrerPolicy": "strict-origin-when-cross-origin",
"body": null,
"mode": "cors",
"credentials": "omit"
})
.then(response => response.text())
.then(data => {
const decodedData = atob(data);
const decodedText = new TextDecoder('utf-8').decode(new Uint8Array(decodedData.split('').map(c => c.charCodeAt(0))));
console.log(decodedText);
})
输出如下:
{"code":200,"pcs":{"0":"https://api-pan.xunlei.com/drive/v1/files/"},"img":"https://pic.rmb.bdstatic.com/bjh/042ab94281280afa385a1c050e21f9ec2462.png","btn":{"home":".FileMenu__menu--XBFEH","share":".file-features-btns-wrap"},"d":"http://d.youxiaohou.com","name":"网盘直链下载助手","init":{"0":"请输入本助手开源协议","1":"请输入本助手开源协议，扫二维码免费查看","2":"开源协议正确！【下载助手】点亮成功！","3":"开源协议不正确！","4":"试试用微信扫码回复👉开源👈来点亮按钮吧！","5":"请安装更强大的 Tampermonkey BETA (红色图标) 替换 Tampermonkey (黑色图标)，然后重新安装本助手！"},"api":{"0":"API下载<span style=\"font-size:14px;font-weight: 400;opacity: .8;\">（适用于 <a href=\"https://www.youxiaohou.com/zh-cn/idm.html\" target=\"_blank\" class=\"pl-a\" data-no-instant=\"1\">IDM</a>，<a href=\"https://www.youxiaohou.com/zh-cn/ndm.html\" target=\"_blank\" class=\"pl-a\" data-no-instant=\"1\">NDM</a> 以及浏览器自带下载）</span>","1":"点击链接直接下载，例如：<a href=\"https://www.youxiaohou.com/zh-cn/idm.html\" target=\"_blank\" class=\"pl-a\" data-no-instant=\"1\">IDM</a>，若未唤起IDM，请 <a href=\"https://www.youxiaohou.com/zh-cn/idm.html\" target=\"_blank\" class=\"pl-a\" data-no-instant=\"1\">点击这里</a> 配置文件类型，IDM 不显示文件名时，请手动复制填写"},"aria":{"0":"Aria下载<span style=\"font-size:14px;font-weight: 400;opacity: .8;\">（适用于 <a href=\"https://www.youxiaohou.com/zh-cn/xdown.html\" target=\"_blank\" class=\"pl-a\" data-no-instant=\"1\">XDown</a> 及 <a href=\"https://www.youxiaohou.com/zh-cn/linux.html#linux-shell\" target=\"_blank\" class=\"pl-a\" data-no-instant=\"1\">Linux Shell命令行</a>）</span>","1":"点击链接复制地址到剪切板，粘贴到支持 aria2c 协议的下载器中，例如：<a href=\"https://www.youxiaohou.com/zh-cn/xdown.html\" target=\"_blank\" class=\"pl-a\" data-no-instant=\"1\">XDown</a>，<a href=\"https://www.youxiaohou.com/zh-cn/linux.html#linux-shell\" target=\"_blank\" class=\"pl-a\" data-no-instant=\"1\">Linux Shell</a>"},"rpc":{"0":"RPC下载<span style=\"font-size:14px;font-weight: 400;opacity: .8;\">（适用于 <a href=\"https://www.youxiaohou.com/zh-cn/motrix.html\" target=\"_blank\" class=\"pl-a\" data-no-instant=\"1\">Motrix</a>，<a href=\"https://www.youxiaohou.com/download.html\" target=\"_blank\" class=\"pl-a\" data-no-instant=\"1\">Aria2 Tools</a>，<a href=\"https://www.youxiaohou.com/download.html\" target=\"_blank\" class=\"pl-a\" data-no-instant=\"1\">AriaNgGUI</a>）</span>","1":"点击按钮发送链接至本地或远程 RPC 服务，例如：<a href=\"https://www.youxiaohou.com/zh-cn/motrix.html\" target=\"_blank\" class=\"pl-a\" data-no-instant=\"1\">Motrix</a>，RPC 参数含义见<a href=\"https://www.youxiaohou.com/zh-cn/motrix.html\" target=\"_blank\" class=\"pl-a\" data-no-instant=\"1\">此处</a>"},"curl":{"0":"cURL下载<span style=\"font-size:14px;font-weight: 400;opacity: .8;\">（适用于 <a href=\"https://www.youxiaohou.com/zh-cn/curl.html\" target=\"_blank\" class=\"pl-a\" data-no-instant=\"1\">Windows，Linux，MacOS 终端</a>）</span>","1":"点击链接复制地址到剪切板，粘贴到 <a href=\"https://www.youxiaohou.com/zh-cn/curl.html\" target=\"_blank\" class=\"pl-a\" data-no-instant=\"1\">Windows，Linux，MacOS 终端</a>，支持断点续传"},"bc":{"0":"BC下载<span style=\"font-size:14px;font-weight: 400;opacity: .8;\">（适用于 <a href=\"https://www.youxiaohou.com/zh-cn/bitcomet.html\" target=\"_blank\" class=\"pl-a\" data-no-instant=\"1\">比特彗星</a>）</span>","1":"点击链接复制地址到剪切板，粘贴到 <a href=\"https://www.youxiaohou.com/zh-cn/bitcomet.html\" target=\"_blank\" class=\"pl-a\" data-no-instant=\"1\">比特彗星</a> 下载器中，镜像地址可用于加速下载，使用方法<a href=\"https://www.youxiaohou.com/zh-cn/bitcomet.html\" target=\"_blank\" class=\"pl-a\" data-no-instant=\"1\">见此处</a>"},"mirror":["vod0067-aliyun08-vip-lixian.xunlei.com","vod0254-aliyun08-vip-lixian.xunlei.com","vod0255-aliyun08-vip-lixian.xunlei.com","vod0256-aliyun08-vip-lixian.xunlei.com","vod0257-aliyun08-vip-lixian.xunlei.com","vod0258-aliyun08-vip-lixian.xunlei.com","vod0259-aliyun08-vip-lixian.xunlei.com","vod0260-aliyun08-vip-lixian.xunlei.com","vod0261-aliyun08-vip-lixian.xunlei.com","vod0262-aliyun08-vip-lixian.xunlei.com","vod0263-aliyun08-vip-lixian.xunlei.com","vod0264-aliyun08-vip-lixian.xunlei.com","vod0265-aliyun08-vip-lixian.xunlei.com","vod0266-aliyun08-vip-lixian.xunlei.com","vod0267-aliyun08-vip-lixian.xunlei.com","vod0554-aliyun06-vip-lixian.xunlei.com","vod0555-aliyun06-vip-lixian.xunlei.com","vod0556-aliyun06-vip-lixian.xunlei.com","vod0680-aliyun08-vip-lixian.xunlei.com","vod0681-aliyun08-vip-lixian.xunlei.com","vod0682-aliyun08-vip-lixian.xunlei.com","vod0683-aliyun08-vip-lixian.xunlei.com","vod0684-aliyun08-vip-lixian.xunlei.com","vod0685-aliyun08-vip-lixian.xunlei.com","vod0686-aliyun08-vip-lixian.xunlei.com","vod0687-aliyun08-vip-lixian.xunlei.com","vod0688-aliyun08-vip-lixian.xunlei.com","vod0689-aliyun08-vip-lixian.xunlei.com","vod0690-aliyun08-vip-lixian.xunlei.com","vod0724-aliyun08-vip-lixian.xunlei.com","vod0725-aliyun08-vip-lixian.xunlei.com","vod0726-aliyun08-vip-lixian.xunlei.com","vod0727-aliyun08-vip-lixian.xunlei.com","vod0728-aliyun08-vip-lixian.xunlei.com","vod0075.aliyun06.vip.lixian.xunlei.com","vod0076.aliyun06.vip.lixian.xunlei.com","vod0077.aliyun06.vip.lixian.xunlei.com","vod0779-aliyun04-vip-lixian.xunlei.com","vod0078.aliyun06.vip.lixian.xunlei.com","vod0780-aliyun04-vip-lixian.xunlei.com","vod0781-aliyun04-vip-lixian.xunlei.com","vod0079.aliyun06.vip.lixian.xunlei.com","vod0080.aliyun06.vip.lixian.xunlei.com","vod0117.aliyun04.vip.lixian.xunlei.com","vod0118.aliyun04.vip.lixian.xunlei.com","vod0119.aliyun04.vip.lixian.xunlei.com","vod1284-aliyun06-vip-lixian.xunlei.com","vod1285-aliyun06-vip-lixian.xunlei.com","vod1363-aliyun06-vip-lixian.xunlei.com","vod1371-aliyun06-vip-lixian.xunlei.com","vod1372-aliyun06-vip-lixian.xunlei.com","vod1426-aliyun06-vip-lixian.xunlei.com","vod1427-aliyun06-vip-lixian.xunlei.com","vod1428-aliyun06-vip-lixian.xunlei.com","vod1429-aliyun06-vip-lixian.xunlei.com","vod1442-aliyun06-vip-lixian.xunlei.com","vod1443-aliyun06-vip-lixian.xunlei.com","vod1444-aliyun06-vip-lixian.xunlei.com","vod1445-aliyun06-vip-lixian.xunlei.com","vod1446-aliyun06-vip-lixian.xunlei.com","vod1447-aliyun06-vip-lixian.xunlei.com","vod1469-aliyun06-vip-lixian.xunlei.com","vod1470-aliyun06-vip-lixian.xunlei.com","vod1471-aliyun06-vip-lixian.xunlei.com","vod1489-aliyun06-vip-lixian.xunlei.com","vod1490-aliyun06-vip-lixian.xunlei.com","vod1491-aliyun06-vip-lixian.xunlei.com","vod1492-aliyun06-vip-lixian.xunlei.com","vod1493-aliyun06-vip-lixian.xunlei.com","vod0215.aliyun06.vip.lixian.xunlei.com","vod0216.aliyun06.vip.lixian.xunlei.com","vod0217.aliyun06.vip.lixian.xunlei.com","vod0218.aliyun06.vip.lixian.xunlei.com","vod0219.aliyun06.vip.lixian.xunlei.com","vod0220.aliyun06.vip.lixian.xunlei.com","vod0241.aliyun08.vip.lixian.xunlei.com","vod0244.aliyun08.vip.lixian.xunlei.com","vod0251.aliyun08.vip.lixian.xunlei.com","vod0252.aliyun08.vip.lixian.xunlei.com","vod0253.aliyun08.vip.lixian.xunlei.com","vod0254.aliyun08.vip.lixian.xunlei.com","vod0255.aliyun08.vip.lixian.xunlei.com","vod0256.aliyun08.vip.lixian.xunlei.com","vod0257.aliyun08.vip.lixian.xunlei.com","vod0260.aliyun08.vip.lixian.xunlei.com","vod0261.aliyun08.vip.lixian.xunlei.com","vod0262.aliyun08.vip.lixian.xunlei.com","vod0263.aliyun08.vip.lixian.xunlei.com","vod0264.aliyun08.vip.lixian.xunlei.com","vod0265.aliyun08.vip.lixian.xunlei.com","vod0266.aliyun08.vip.lixian.xunlei.com","vod0267.aliyun08.vip.lixian.xunlei.com","vod3379-aliyun04-vip-lixian.xunlei.com","vod3380-aliyun04-vip-lixian.xunlei.com","vod3429-aliyun04-vip-lixian.xunlei.com","vod3458-aliyun04-vip-lixian.xunlei.com","vod3459-aliyun04-vip-lixian.xunlei.com","vod3496-aliyun04-vip-lixian.xunlei.com","vod3497-aliyun04-vip-lixian.xunlei.com","vod3498-aliyun04-vip-lixian.xunlei.com","vod3499-aliyun04-vip-lixian.xunlei.com","vod3500-aliyun04-vip-lixian.xunlei.com","vod3501-aliyun04-vip-lixian.xunlei.com","vod3522-aliyun04-vip-lixian.xunlei.com","vod3523-aliyun04-vip-lixian.xunlei.com","vod3533-aliyun04-vip-lixian.xunlei.com","vod3534-aliyun04-vip-lixian.xunlei.com","vod3535-aliyun04-vip-lixian.xunlei.com","vod3536-aliyun04-vip-lixian.xunlei.com","vod3549-aliyun04-vip-lixian.xunlei.com","vod3550-aliyun04-vip-lixian.xunlei.com","vod3551-aliyun04-vip-lixian.xunlei.com","vod3552-aliyun04-vip-lixian.xunlei.com","vod3553-aliyun04-vip-lixian.xunlei.com","vod3554-aliyun04-vip-lixian.xunlei.com","vod3555-aliyun04-vip-lixian.xunlei.com","vod0551.aliyun06.vip.lixian.xunlei.com","vod0552.aliyun06.vip.lixian.xunlei.com","vod0553.aliyun06.vip.lixian.xunlei.com","vod0554.aliyun06.vip.lixian.xunlei.com","vod0555.aliyun06.vip.lixian.xunlei.com","vod0556.aliyun06.vip.lixian.xunlei.com","vod0686.aliyun08.vip.lixian.xunlei.com","vod0687.aliyun08.vip.lixian.xunlei.com","vod0688.aliyun08.vip.lixian.xunlei.com","vod0689.aliyun08.vip.lixian.xunlei.com","vod0724.aliyun08.vip.lixian.xunlei.com","vod0725.aliyun08.vip.lixian.xunlei.com","vod0726.aliyun08.vip.lixian.xunlei.com","vod0727.aliyun08.vip.lixian.xunlei.com","vod0728.aliyun08.vip.lixian.xunlei.com","vod0759.aliyun04.vip.lixian.xunlei.com","vod0760.aliyun04.vip.lixian.xunlei.com","vod0769.aliyun04.vip.lixian.xunlei.com","vod0770.aliyun04.vip.lixian.xunlei.com","vod0771.aliyun04.vip.lixian.xunlei.com","vod0772.aliyun04.vip.lixian.xunlei.com","vod0773.aliyun04.vip.lixian.xunlei.com","vod0774.aliyun04.vip.lixian.xunlei.com","vod0775.aliyun04.vip.lixian.xunlei.com","vod0776.aliyun04.vip.lixian.xunlei.com","vod0777.aliyun04.vip.lixian.xunlei.com","vod0778.aliyun04.vip.lixian.xunlei.com","vod0779.aliyun04.vip.lixian.xunlei.com","vod0780.aliyun04.vip.lixian.xunlei.com","vod0781.aliyun04.vip.lixian.xunlei.com","vod3522.aliyun04.vip.lixian.xunlei.com","vod3523.aliyun04.vip.lixian.xunlei.com","vod3533.aliyun04.vip.lixian.xunlei.com","vod3535.aliyun04.vip.lixian.xunlei.com","vod3550.aliyun04.vip.lixian.xunlei.com","vod3551.aliyun04.vip.lixian.xunlei.com","vod3552.aliyun04.vip.lixian.xunlei.com","vod3553.aliyun04.vip.lixian.xunlei.com","vod3554.aliyun04.vip.lixian.xunlei.com","vod3555.aliyun04.vip.lixian.xunlei.com"],"num":"865746","license":"AGPL3","version":"6.1.2","new":"<li class=\"pl-dropdown-menu-item\"><a class=\"pl-a\" data-no-instant=\"1\" style=\"color:#F24C43\" href=\"https://www.youxiaohou.com/install.html?from=update\" target=\"_blank\"><span style=\"margin-right: 5px;\">发现新版</span><svg style=\"animation: load 2.5s cubic-bezier(0.22, 0.61, 0.36, 1) infinite;\" viewBox=\"0 0 1024 1024\" xmlns=\"http://www.w3.org/2000/svg\" width=\"12\" height=\"12\"><path d=\"M171.31 549.028c-24.558-153.572 59.801-308.76 210.442-367.477 111.637-43.53 232.005-22.71 317.236 39.47l-72.527 117.48 325.245-1.254L835.459 0l-59.547 96.426C650.34 15.104 479.156-11.493 329.258 46.95 121.578 127.91 2.038 337.29 25.64 549.03h145.67z\" fill=\"#F24C43\"/><path d=\"M852.688 464.966c24.536 153.572-59.78 308.78-210.422 367.477-102.693 40.024-215.86 24.94-302.874-29.019 16.57-26.895 65.537-106.198 65.537-106.198L55.17 676.704 203.176 1024l62.053-100.484c125.552 81.322 279.592 101.992 429.489 43.55 207.638-80.982 327.22-290.34 303.618-502.058H852.688z\" fill=\"#F24C43\"/></svg></a></li>","footer":"<div style=\"text-align: center;\">点击查看 <a href=\"https://www.youxiaohou.com/zh-cn/motrix.html\" target=\"_blank\" class=\"pl-a\" data-no-instant=\"1\">RPC配置说明</a>，配置修改后自动生效</div>"}
云在天 发表于 2023-9-1 12:32
Post访问 “https://api.youxiaohou.com/config/tianyi?ver=6.1.1&a=GreasyFork”
base64解码后在URL解码 ...
好方法，马上按照你这个方法开发了个工具。https://www.123pan.com/s/dRh9-1XPa.html 本帖最后由 wkdxz 于 2023-9-1 16:39 编辑
云在天 发表于 2023-9-1 12:32
Post访问 “https://api.youxiaohou.com/config/tianyi?ver=6.1.1&a=GreasyFork”
base64解码后在URL解码 ...
有了思路确实简单，谢了
import json
import requests
import base64
url = "https://api.youxiaohou.com/config/tianyi?ver=6.1.1&a=GreasyFork"
response = requests.post(url)
decoded_data = base64.b64decode(response.text).decode('utf-8')
js = json.loads(decoded_data)
print(js['num'])
再简单一点:lol
import json, requests, base64;print(json.loads(base64.b64decode(requests.post("https://api.youxiaohou.com/config/tianyi?ver=6.1.1&a=GreasyFork").text).decode('utf-8'))['num']) 高啊，，我还一直在乖乖关注公众号发消息。。。 其实大家仔细找都能处理的，没跳过是因为作者提供免费的脚本，只是关注公众号。关注了是对作者的尊重 https://github.com/hmjz100/Online-disk-direct-link-download-assistant
可以参考这个的 你去逆向百度网盘啊，你想这个有啥用 厉害了，学到了;www 可以，可以，谢谢分享 但过了这步，没啥用啊，下载速度还是很慢。。 学习了，感谢分享。
学习了，感谢大大分享。 这个方法对我也是全新认知
感谢分享。有机会实践一下 可以的，刚试了下，牛 很好的思路 这思路不错，可以借鉴一下