《大麦网》抢票工具开发记录

xyjwfn

最近一直在想办法做一个《大麦网》抢票的小工具，遇到一些难题，开个帖子抛砖引玉，让大家来一起讨论分析分析。


先说一下目前的进展，现在可以正常使用《大麦网》移动端的的Api去登陆、创建订单、下单：

[Asm] 纯文本查看 复制代码

九月 29, 2019 2:30:21 下午 okhttp3.internal.platform.Platform log
[color=Magenta]信息: --> POST https://acs.m.taobao.com/gw/com.taobao.mtop.mloginservice.login/1.0[/color]
.....

信息: --> END POST (592-byte body)

...

信息: {"api":"com.taobao.mtop.mloginservice.login","data":{"actionType":"SUCCESS","code":"3000","codeGroup":"other","message":"成功","returnValue":{"data":"{\"expires\":1569824422,\"openId\":\"AAHZul69AETRT9WB9dc_ljTp\",\"cookies\":[\"munb=2206524624699;Domain=damai.cn;Path=/;Expires=Sun, 06-Oct-2019 06:30:22 GMT;\",\"cookie2=1a9c8ff4dee7e17be80867bb620fb567;Domain=damai.cn;Path=/;Expires=Sun, 06-Oct-2019 06:30:22 GMT;HttpOnly\",\"csg=136e5fa1;Domain=damai.cn;Path=/;Expires=Sun, 06-Oct-2019 06:30:22 GMT;\",\"t=8fc2d2797a44f5db46725611950cafae;Domain=damai.cn;Path=/;Expires=Thu, 28-Jun-2029 07:10:22 GMT;\",\"_tb_token_=ee59f8015a154;Domain=damai.cn;Path=/;Expires=Sun, 06-Oct-2019 06:30:22 GMT;\"],\"sid\":\"1a9c8ff4dee7e17be80867bb620fb567\",\"nick\":\"18817096723\",\"openSid\":\"aee9a287dd9da63f51fbd913dbb9c142b45d50f9e0512ed9f9edab087fb9cf17640d102741c723a6f154f80c61a65d63\",\"loginTime\":1569738622,\"headPicLink\":\"https://wwc.alicdn.com/avatar/getAvatar.do?userIdStrV2=7PDLjaXCJpaVB9A9PLR3LNTT&type=taobao\",\"havanaSsoTokenExpiredTime\":0,\"uidDigest\":\"0d8fc5f473f85678676bb7096655b746\",\"userId\":2206524624699,\"loginServiceExt\":{\"damaiExt\":\"{\\\"damaiUserId\\\":146125758,\\\"headImageUrl\\\":\\\"https://perico.damai.cn/userheadphotos/730628/146125758.jpg\\\",\\\"nickname\\\":\\\"麦子17dlL\\\"}\",\"loginType\":\"password\",\"hasPwd\":\"true\"},\"returnSessionKeys\":\"null\",\"phone\":\"18817096723\",\"subSid\":\"7a532832dd5a4a71aa7a61f599233c99_3_2\",\"loginPhone\":\"18817096723\"}","displayNick":"t-156766296416799240-18","extMap":{"damaiExt":"{\"damaiUserId\":146125758,\"headImageUrl\":\"https://perico.damai.cn/userheadphotos/730628/146125758.jpg\",\"nickname\":\"麦子17dlL\"}","headPicLink":"https://wwc.alicdn.com/avatar/getAvatar.do?userIdStrV2=7PDLjaXCJpaVB9A9PLR3LNTT&type=taobao","loginType":"password","bind_token":"CN-SPLIT-AQi7nvf4m0AQhAciEWJpbmRfdG9rZW5fZG9tYWluKhZiaW5kX3Rva2VuX2FjdGlvbl90eXBlMgEBOPSI2t3XLUABShBDMfTrdfDJOLU68OOwmRKmgoxp6TcngjzVxUs25DqRsw5Cds0","hasPwd":"true"},"hid":"2206524624699","mobile":"18817096723","showLoginId":"18817096723","sid":"1a9c8ff4dee7e17be80867bb620fb567","site":"18","taobaoNick":"t-156766296416799240-18"}},"ret":["SUCCESS::成功"],"v":"1.0"}
九月 29, 2019 2:30:22 下午 okhttp3.internal.platform.Platform log
信息: <-- END HTTP (2231-byte body)
{"appkey":"23781390","sid":"1a9c8ff4dee7e17be80867bb620fb567","subSid":"7a532832dd5a4a71aa7a61f599233c99_3_2","ttid":"1569738622@damai_android_7.5.4","uid":"2206524624699","utdid":"V21qMUDc/jVYwtZadzXL79fL","versionCode":"100","versionName":"7.5.4"}
九月 29, 2019 2:30:22 下午 okhttp3.internal.platform.Platform log
[color=Magenta]信息: --> POST https://mtop.damai.cn/gw/mtop.trade.order.build/4.0[/color]
...

信息: --> END POST (540-byte body)

....

 {"api":"mtop.trade.order.build","data":{"container":{"data":[{"containerType":"dinamicx","name":"buy_dialog_single_button","type":["dinamicx$500$buydialogsinglebutton"],"version":"18","url":"https://ossgw.alicdn.com/rapid-oss-bucket/template_online/buy_dialog_single_button/71680936/buy_dialog_single_button_android.xml","md5":"9ba5974a460fe29a9d9a43e76400d330"},{"containerType":"dinamicx","name":"buy_dialog_title","type":["dinamicx$499$buydialogtitle"],"version":"6","url":"https://ossgw.alicdn.com/rapid-oss-bucket/template_online/buy_dialog_title/73856438/buy_dialog_title_android.xml","md5":"1d53523ab035a9d679daccfe0926443b"},{"containerType":"dinamicx","name":"buy_popup_check_box","type":["dinamicx$547$buypopupcheckbox"],"version":"14","url":"https://ossgw.alicdn.com/rapid-oss-bucket/template_online/buy_popup_check_box/71601319/buy_popup_check_box_android.xml","md5":"42e8339b2e3c5088ba5b6bdf5980a3d3"},{"containerType":"dinamicx","name":"dm_buy_item_201904","type":["dinamicx$2956$dmbuyitem201904"],"version":"35","url":"https://ossgw.alicdn.com/rapid-oss-bucket/1567689061328/dm_buy_item_201904.zip","md5":"ea7a711e9462a6cb2c91ee1063ee43d6"},{"containerType":"dinamicx","name":"dm_buy_submit","type":["dinamicx$3129$dmbuysubmit"],"version":"19","url":"https://ossgw.alicdn.com/rapid-oss-bucket/publish/1564568105152/dm_buy_submit.zip","md5":"9bff7c44375276b79169474804b58623"},{"containerType":"dinamicx","name":"dm_buy_ticketsinfo_201904","type":["dinamicx$2974$dmbuyticketsinfo201904"],"version":"17","url":"https://ossgw.alicdn.com/rapid-oss-bucket/publish/1563957261531/dm_buy_ticketsinfo_201904.zip","md5":"4a735bc06d23b471f64670f5feaca44c"},{"containerType":"dinamicx","name":"dm_contacts_phone_201904","type":["dinamicx$3116$dmcontactsphone201904"],"version":"15","url":"https://ossgw.alicdn.com/rapid-oss-bucket/1563524089202/dm_contacts_phone_201904.zip","md5":"90398ddbb8ea31326dde8e2aad1ad8c2"},{"containerType":"dinamicx","name":"dm_delivery_address_201904","type":["dinamicx$3110$dmdeliveryaddress201904"],"version":"12","url":"https://ossgw.alicdn.com/rapid-oss-bucket/publish/1563962172163/dm_delivery_address_201904.zip","md5":"d97b08b866cc737bd0d6f4b62a8d7955"},{"containerType":"dinamicx","name":"dm_delivery_fee","type":["dinamicx$3172$dmdeliveryfee"],"version":"10","url":"https://ossgw.alicdn.com/rapid-oss-bucket/1563962372567/dm_delivery_fee.zip","md5":"3a22229e1f5b79538a7fbc4d59536a7b"},{"containerType":"dinamicx","name":"dm_delivery_ticket_addressinfo","type":["dinamicx$3108$dmdeliveryticketaddressinfo"],"version":"11","url":"https://ossgw.alicdn.com/rapid-oss-bucket/publish/1563951143668/dm_delivery_ticket_addressinfo.zip","md5":"9a1235f13266efcd74552a877b0d8ed9"},{"containerType":"dinamicx","name":"dm_delivery_tip_201904","type":["dinamicx$3107$dmdeliverytip201904"],"version":"12","url":"https://ossgw.alicdn.com/rapid-oss-bucket/publish/1563962757264/dm_delivery_tip_201904.zip","md5":"64d9854d2f3b5e39757e1fb93f9a574a"},{"containerType":"dinamicx","name":"dm_input","type":["dinamicx$3128$dminput"],"version":"14","url":"https://ossgw.alicdn.com/rapid-oss-bucket/1563525356729/dm_input.zip","md5":"8b9d58df7808411343fcc0513c715a03"},{"containerType":"dinamicx","name":"dm_protocol_check_box","type":["dinamicx$3125$dmprotocolcheckbox"],"version":"12","url":"https://ossgw.alicdn.com/rapid-oss-bucket/1563958032940/dm_protocol_check_box.zip","md5":"adb97cc747a802f1e8bd5d5e1b29b82e"},{"containerType":"dinamicx","name":"dm_rigth_arrow","type":["dinamicx$3507$dmrigtharrow"],"version":"6","url":"https://

 ...
 
信息: <-- END HTTP (27236-byte body)
九月 29, 2019 2:30:24 下午 okhttp3.internal.platform.Platform log

不得不说阿里系的App实在是太硬了，一开始弄之前没想到是阿里系的App，一把老泪。。。。
现在的得想办法绕过MTOP网关的人机检测机制，因为Api调用的太快全出现419响应：

[Asm] 纯文本查看 复制代码

信息: <-- 419 https://mtop.damai.cn/gw/mtop.trade.order.build/4.0 (50ms)
九月 29, 2019 2:44:04 下午 okhttp3.internal.platform.Platform log
[color=Magenta]信息: Location: https://mtop.damai.cn:443//gw/mtop.trade.order.build/4.0/_____tmd_____/punish?x5secdata=5e0c8e1365474455070961b803bd560607b52cabf5960afff39b64ce58073f781bfb15e0f149ea97f57ae941e5007f71e00224e112fff7e0d9d151f880c6122aeb2bc16b1dbc91ea592f0222d32ec23f1976b91a091e5174a4153ee53f360b269783bbae415916f4e376d892cf8ccf5d879040640c387e9162234062279cf14fc2856c55caf335ec0edf1569d913f0d3a9236307471551300a1bf262fd5f11a0550f9b99556ac6acf209c33fe49bb30375f8a261ee6ce5aeea402038a0729216e62a00b19c8a1028d0d1f99e928a20ea5dd0b0a835532f4907806fdb9ec7f094f6312a5f4e165cf1682c97ebd41edc7d1a8819a4b4138bdc11d2fccd91b1b0a98cebd57bee48abc90125312a46f20ff2009dcc6dfda88831ec41bf92cd9b9d6be32f0a88dc34bacf93ca4147f02df983552a5b68295442279fb714652a0ba3a8980b36a529e62eae55721c5422e06f49b0c0fc3e09ccf336e80eabaca9a5eb435a1b13a675a39ea5f1d8a23f063cd92b20bc2079d80bb9f79e6f69c7c441da1c5c04eb2e4ba9fea278d022a2f3ae7137f833a9280b2a5507917f6c1475f4d45c639951b576c8bd7991690e8c06dae1cd09a34093cee709ee142a6f4111a94f0ea31f729f4ded266cd4cb3f3137e44645982a591aff3eea7558da34351930bc6b36c3499eca79a51bf5aee606b5a5f13d&x5step=2&http_referer=https://sec.taobao.com/[/color]
九月 29, 2019 2:44:04 下午 okhttp3.internal.platform.Platform log
信息: Server: Tengine/Aserver
九月 29, 2019 2:44:04 下午 okhttp3.internal.platform.Platform log
信息: EagleEye-TraceId: 0baf4f1415697394448621232e35de
九月 29, 2019 2:44:04 下午 okhttp3.internal.platform.Platform log
信息: 
九月 29, 2019 2:44:04 下午 okhttp3.internal.platform.Platform log
信息: {
  "ret": [
    "FAIL_SYS_USER_VALIDATE::哎哟喂,被挤爆啦,请稍后重试!"
  ],
  "data": {}
}
九月 29, 2019 2:44:04 下午 okhttp3.internal.platform.Platform log
信息: <-- END HTTP (102-byte body)

打开这个Location头的URL是个滑动检测的页面：





使用puppeteer模拟滑动可以提示验证成功，坑爹的是再次调用下单还是会再次出现这个419的http状态码。再次分析发现App内部的浏览器打开这个页面的时候带了一些参数：

[Asm] 纯文本查看 复制代码

uri: https://mtop.damai.cn//gw/mtop.trade.order.build/4.0/_____tmd_____/punish?x5secdata=5e0c8e1365474455070961b803bd560607b52cabf5960afff39b64ce58073f781bfb15e0f149ea97f57ae941e5007f71e00224e112fff7e0d9d151f880c6122aeb2bc16b1dbc91ea592f0222d32ec23f1976b91a091e5174a4153ee53f360b269783bbae415916f4e376d892cf8ccf5d824df8ad1c6b8ae7d99be1dc3ce3463f0c84937cb126a165560c9cf8acdadba8ad53b2556ebe6884b3124ce81e650f2b550f9b99556ac6acf209c33fe49bb30375f8a261ee6ce5aeea402038a0729216e62a00b19c8a1028d0d1f99e928a20ea5dd0b0a835532f4907806fdb9ec7f094f6312a5f4e165cf1682c97ebd41edc7d1a8819a4b4138bdc11d2fccd91b1b0a98cebd57bee48abc90125312a46f20ff2009dcc6dfda88831ec41bf92cd9b9d6be32f0a88dc34bacf93ca4147f02df983552a5b68295442279fb714652a0ba3a8980b36a529e62eae55721c5422e06f49b0c0fc3e09ccf336e80eabaca9a5eb435a1b13a675a39ea5f1d8a23f063cd92b20bc2079d80bb9f79e6f69c7c441da1c5c04eb2e4ba9fea278d022a2f3ae7137f833a9280b2a5507917f6c1475f4d45c639951b576c8bd7991690e8c06dae1cd7e8eaf259b0c5d24c00d526f6287f20e1d8e651d3be00ccd56d3454596d9e69f2e13d19ab182a47cbed3cd01db38aa91eb74dfe4d082c0c2108d3f06992f33c8&x5step=2&tmd_nc=1&http_referer=https://sec.taobao.com/
header --> name: f-refer: wv_h5
header --> name: X-Requested-With: cn.damai
header --> name: Cookie: munb=2206524624699; cookie2=125bade803d85957d328b478f43c3a94; csg=8d1fa60a; t=f76758f174d5bff7fa4ee8f40e696b52; _tb_token_=ab61bfe31e99
header --> name: Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
header --> name: User-Agent: Mozilla/5.0 (Linux; U; Android 6.0.1; zh-CN; MI 4C Build/MMB29M) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/69.0.3497.100 UWS/3.19.0.24 Mobile Safari/537.36 AliApp(DM/7.5.4) UCBS/2.11.1.1 TTID/700159@damai_android_7.5.4 WindVane/8.5.0

使用puppeteer带上这些参数， 还是不行。现在基本上已经卡在这里了，我太难了~~~~


分析《大麦网》App同时也积累了一些经验，与大家分享：

淘宝系MtopSDK逆向分析（一）
淘宝系MtopSDK逆向分析（二）

[2019-10-17]


最近有点忙没来得急更新，说一下最近的情况，试着抢了杰伦和JJ的票可惜没有抢到~~
移动端的API大麦限流非常严重.....， 好难受~~


大家可关注我的个人公众号，获取最新进展：

wu8511128

不会支持下

transistor

阿里系确实……楼主加油

Richor

前排支持

jidan

能抢周杰伦的票嘛~

广东漂泊的浪子

前排支持楼主

清炒藕片丶

从没去看过演唱会，真羡慕你们。

全球小破孩

大麦的支持！！！

zheng2429

硬核加油

Y-one

如果能抢到票，就好了，继续跟进楼主