文章日期：2024.12.17

使用工具：Python，Node.js

本章知识：逆向分析海外Temu返回的 javascript 代码，并执行获取【Tc2e3d54f910d96001dff4abf7658c106c】值

文章难度：低等（没难度）

解密方法：AES-GCM

文章全程已做去敏处理！！！  【需要做的可联系我】 

AES解密处理（直接解密即可）（crypto-js.js 标准算法）：​​​​​​在线AES加解密工具

仅供学习！仅供学习！仅供学习！ 

首先今天讲的内容只是用作于学习交流，并非其他目的！！

今天来逆向分析【Tc2e3d54f910d96001dff4abf7658c106c】参数，这个参数一般情况下遇不到，只有风控的时候才会出现，给大家看一下图片

1、打开某某网站（使用文章开头的AES在线工具解密)：

dvNWQ4C3dbUE8ikDLyzTobNWMWI/iO0K9bnAJp5+P0Y=

2、随便打开一个商品，然后用python请求一下,(浏览器里复制不了，代码会被网站自动清除），然后我们把返回的js代码粘贴到新的js文件内，记得看清楚，复制js代码，其他的就不要复制了

3、记得格式化一下，不然看不懂，太拥挤了。Pycharm编译器的格式化命令是【Ctrl+alt+L】,其他的编译器请自行查找吧，我不常用不太清楚

4、格式化完成后，直接运行看报错的内容是什么，然后跟战修改报错内容，发现缺少【navigator】环境，好，直接在文件开头补上此环境

5、再次运行，发现又报错了，再次补上缺少的环境，然后再次运行，这都是需要边运行边修复错误

6、运行发现又报错了，这次他缺少的是【XMLHttpRequest】函数，这个函数是用来发送请求，和服务器通信的，我们可以暂时先把他用空函数替换，不让他发送请求数据，我们要保证运行没问题后，再进行处理这个东西。

7、在此运行，发现他是想要读取服务器返回的数据，但由于请求没用发送出去，自然也是读取不到了，而且我们都已经把他的函数制空了，open函数自然也是不存在的。我们在他当前函数的开始位置加一个打印，看一下他想要发送什么数据给服务器

8、这次显示缺少window环境，我们直接补上，再次运行

9、这次就对了，他想要把这些数据返回给服务器，然后让服务器验证请求，但这都不重要，重要的是我们可以看到他已经有【tc2e3d54f910d96001dff4abf7658c106c】值了。我再次运行发现值是一样的，说明服务器返回一次js代码，那么就是一个固定的【tc2e3d54f910d96001dff4abf7658c106c】值，由此可以得出，他是用js进行处理了某系数据或解密了某些数据才得出的这个值

10、我们把刚刚的这个函数里面的所有代码都删除，然后只保留一个打印功能，可以发现他只下一个数据包了，刚好这个就是我们所需要的，而且不报错了。（注意，我图片里headers里的那个值卡没了，和代码无关，是编译器控制台出现问题了，再次运行就没事了）

11、随后我又用python多请求了几份js代码，进行对比分析，发现图中的【_0x231244[_0x4132('0x2b')]】值会有变化，不同的js代码，这个值都是不同的，我猜测是key密钥。另一个是【_0x43f1】，里面的内容也会有变化，而且我还发现他里面有密文

12、我们往后看看，就能发现有很长的密文，这就能知道他的值是怎么来的，就是通过解密得出的

13、我把js代码再次进行了整理，该删除的删掉了，下次请求再返回js代码，我们只需要更换这两个参数即可直接得出结果值

14、给大家用图演示了一下，可以看一下

本文分析就到这里了

【py代码】

import requests
import base64

# base64 解密
def base64_decode(str):
    return base64.b64decode(str).decode('utf-8')
# 这个是链接被base64加密了，此步骤只用于去敏，无其他作用
url = base64_decode('aHR0cHM6Ly93d3cudGVtdS5jb20vZ29vZHMuaHRtbD9fYmdfZnM9MSZnb29kc19pZD02MDEwOTk3NjYwMTY3MTAmX29ha19tcF9pbmY9RU1iVm5KQ24xb2dCR2habWJHRnphRjl6WVd4bFgyeHBjM1JmTUd0MWVtVnJJTm1DenB5OU1nJTNEJTNEJnRvcF9nYWxsZXJ5X3VybD1odHRwcyUzQSUyRiUyRmltZy5rd2Nkbi5jb20lMkZwcm9kdWN0JTJGZmFuY3klMkZjZGE3NGEyYi00YjUwLTQwZmItOWVlNC1jYjc2ZWVmYTQ3ODEuanBnJnNwZWNfZ2FsbGVyeV9pZD0yNzkxNDYzMTQzJnJlZmVyX3BhZ2Vfc249MTAxMzImcmVmZXJfc291cmNlPTAmZnJlZXNpYV9zY2VuZT0xMTYmX29ha19mcmVlc2lhX3NjZW5lPTExNiZfb2FrX3JlY19leHRfMT1NakEwT0EmX29ha19nYWxsZXJ5X29yZGVyPTE0OTYwMTEzMzIlMkMxNDM2MTIzMzAlMkM1NjI4NTkwNTQlMkMxNDk4MzAyOTU4JTJDMTA1OTYxNjc=')
response = requests.get(url)
print(response.text)

【过js代码.js】  直接使用即可，他是AES-GCM解密

window = global;
// 这个也要更换
var _0x43f1 = ['fwUcS','keys','reload','wHLJB','WoDem','setRequestHeader','gFDVx','message','rep','onreadystatechange','error_msg','ZFfOY','swSmy','WCvPA','SzlGe','userAgent','xIfpS','fromCharCode','tc2e3d54f910d96001dff4abf7658c106c','vfXMb','method','/goods.html?_bg_fs=1&goods_id=601099766016710&_oak_mp_inf=EMbVnJCn1ogBGhZmbGFzaF9zYWxlX2xpc3RfMGt1emVrINmCzpy9Mg%3D%3D&top_gallery_url=https%3A%2F%2%2Fproduct%2Ffancy%2Fcda74a2b-4b50-40fb-9ee4-cb76eefa4781.jpg&spec_gallery_id=2791463143&refer_page_sn=10132&refer_source=0&freesia_scene=116&_oak_freesia_scene=116&_oak_rec_ext_1=MjA0OA&_oak_gallery_order=1496011332%2C143612330%2C562859054%2C1498302958%2C10596167','MLWUt','slice','OIXif','HsxCT','application/json','mPRLv','GRWYj','NdwJC','uSCgy','JPgvy','ImGrd','SNcrg','gEOGy','zEAbc','apply','c-jc','gCKRy','QwXya','lkzlV','DOWuQ','stringify','ZAlRj','onSuccess','open','bfXle','ZOGTb','send','yYqeu','zBMaP','rhGoG','atob','jKrAI','url','aAyDE','eGdPO','subtle','catch','key','i/s','then','status','LlCXk','QalwX','charCodeAt','splHr','OJnjzAjZuHj87sKoSde9RF+F//5Kh/o7cR/mXUrB2MomSvKB3aT0ttnuc5d3JhpdoPDhZp/YYK5GRdt9eK/aftvoUaU1r7VRKuei6Hra1lt6os0Rita2tigeienAh/ubUDBxQQPqlKXeG013BvsFZ+LJIDhLGdTXDpyB9jyDBCNAteWaRHxU0INqx+ZR3kiwsyOm0OsvT67C8km/UzFlsg7SofnMw0lu7idjOXZjjAs/d9TnVBqTKLLthvGKjBx6','IfwYq','KnWDt','xCKPq','WVlmi','importKey','headers','sVytz','fUBCJ','iYOqI','iCzJz','GET','POST','data','href','split','xnlLx','forEach','QiCRA','readyState','zWKMr','eQYat','WCFvR','map','cOMdA','decrypt']
// 返回的数据里全局搜索这个【_0x4132('0x2b')】，然后复制第一个里面的key密钥
var AES_KEY = 'moytj4zg87xe2f5s';  // key密钥

(function (_0x208cd6, _0x43f1d5) {
    var _0x41323a = function (_0x14ded8) {
        while (--_0x14ded8) {
            _0x208cd6['push'](_0x208cd6['shift']());
        }
    };
    _0x41323a(++_0x43f1d5);
}(_0x43f1, 0xec));
var _0x4132 = function (_0x208cd6, _0x43f1d5) {
    _0x208cd6 = _0x208cd6 - 0x0;
    var _0x41323a = _0x43f1[_0x208cd6];
    return _0x41323a;
};
!function () {
    var _0x231244 = {};
    _0x231244['xIfpS'] = function (_0x191b5d, _0x1ab40f) {
        return _0x191b5d(_0x1ab40f);
    };
    _0x231244[_0x4132('0x47')] = function (_0x1c079, _0x2647f7) {
        return _0x1c079 !== _0x2647f7;
    };
    _0x231244[_0x4132('0xd')] = _0x4132('0x15');
    _0x231244[_0x4132('0x59')] = 'raw';
    _0x231244[_0x4132('0x39')] = _0x4132('0x2a');
    _0x231244['xnlLx'] = function (_0x6aa7e0, _0x315760) {
        return _0x6aa7e0 !== _0x315760;
    };
    _0x231244[_0x4132('0x49')] = _0x4132('0x38');
    _0x231244[_0x4132('0x10')] = _0x4132('0x51');
    _0x231244[_0x4132('0x13')] = function (_0x151ed9, _0x177533) {
        return _0x151ed9 === _0x177533;
    };
    _0x231244[_0x4132('0x2f')] = function (_0x57ffae) {
        return _0x57ffae();
    };
    _0x231244[_0x4132('0x25')] = function (_0x403447) {
        return _0x403447();
    };
    _0x231244[_0x4132('0x2e')] = 'mCUrr';
    _0x231244[_0x4132('0x44')] = _0x4132('0x4d');
    _0x231244['jKrAI'] = function (_0xeb1b48, _0x311cd6) {
        return _0xeb1b48 || _0x311cd6;
    };
    _0x231244[_0x4132('0x31')] = _0x4132('0x1c');
    _0x231244['WCFvR'] = _0x4132('0x3e');
    _0x231244['NdwJC'] = _0x4132('0x1d');
    _0x231244['ZFfOY'] = function (_0x253985, _0xd2992c) {
        return _0x253985 + _0xd2992c;
    };
    _0x231244[_0x4132('0x29')] = function (_0xa61f0b, _0x541d20) {
        return _0xa61f0b + _0x541d20;
    };
    _0x231244[_0x4132('0x6')] = function (_0x241c2d, _0x598606) {
        return _0x241c2d + _0x598606;
    };
    _0x231244[_0x4132('0x37')] = _0x4132('0xa');
    _0x231244[_0x4132('0x56')] = _0x4132('0x50');
    _0x231244[_0x4132('0x14')] = _0x4132('0x33');
    _0x231244[_0x4132('0x12')] = _0x4132('0x45');
    _0x231244['DOWuQ'] = function (_0x153c80) {
        return _0x153c80();
    };
    _0x231244[_0x4132('0x1b')] = function (_0x2e26fd, _0x632bf2) {
        return _0x2e26fd(_0x632bf2);
    };
    _0x231244[_0x4132('0x19')] = function (_0x4bd670, _0x3d9535) {
        return _0x4bd670 !== _0x3d9535;
    };
    _0x231244[_0x4132('0x52')] = function (_0x53af3b, _0x1018b2) {
        return _0x53af3b(_0x1018b2);
    };
    _0x231244[_0x4132('0x46')] = _0x4132('0x3d');
    _0x231244['aAyDE'] = _0x4132('0x11');
    _0x231244[_0x4132('0x2b')] = AES_KEY;
    _0x231244['OIXif'] = function (_0x171ccf, _0x2541c6) {
        return _0x171ccf === _0x2541c6;
    };
    _0x231244[_0x4132('0x4b')] = 'mPwaI';
    _0x231244[_0x4132('0x41')] = function (_0x4a7656, _0x77ad3b, _0x4c5dcf) {
        return _0x4a7656(_0x77ad3b, _0x4c5dcf);
    };
    _0x231244[_0x4132('0x26')] = _0x4132('0x1');
    _0x231244[_0x4132('0x5c')] = function (_0x444fab, _0x25e5a4) {
        return _0x444fab(_0x25e5a4);
    };
    var _0x2de96e = _0x231244;
    var _0xf1aa4c = _0x2de96e['mPRLv'], _0x56a3b8 = _0x2de96e[_0x4132('0x5')], _0x392d9a = _0x2de96e[_0x4132('0x2b')];

    function _0x3f6e60(_0x4b9898) {
        return new Uint8Array(_0x4b9898[_0x4132('0x20')]('')[_0x4132('0x28')](function (_0x407560) {
            return _0x407560[_0x4132('0xf')](0x0);
        }));
    }

    function _0xbdc4a7(_0x2ec911, _0x4b96a1) {
        console.log('【密文内容】：',_0x2ec911)
        console.log('【key密钥】：',_0x4b96a1)
        if (_0x2de96e[_0x4132('0x47')](_0x2de96e[_0x4132('0xd')], _0x2de96e[_0x4132('0xd')])) {
            return _0x2ec911[_0x4132('0xf')](0x0);
        } else {
            var _0x3316f9 = window[_0x4132('0x2')](_0x2ec911),
                _0x15e86e = _0x2de96e[_0x4132('0x3b')](_0x3f6e60, _0x3316f9['slice'](0x0, 0xc)),
                _0x1f1e39 = _0x3f6e60(_0x4b96a1),
                _0x40132e = {'name': String['fromCharCode'](0x41, 0x45, 0x53, 0x2d, 0x47, 0x43, 0x4d), 'iv': _0x15e86e};
            return crypto['subtle'][_0x4132('0x16')](_0x2de96e['bfXle'], _0x1f1e39, _0x40132e, !0x1, [_0x2de96e['SzlGe']])[_0x4132('0xb')](function (_0x5b4f56) {
                var _0x3bcc08 = _0x2de96e[_0x4132('0x3b')](_0x3f6e60, _0x3316f9[_0x4132('0x42')](0xc));
                return crypto[_0x4132('0x7')]['decrypt'](_0x40132e, _0x5b4f56, _0x3bcc08)[_0x4132('0xb')](function (_0x294ba7) {
                    return _0x1d2ce7 = _0x294ba7, String[_0x4132('0x3c')][_0x4132('0x4f')](null, new Uint8Array(_0x1d2ce7));
                    var _0x1d2ce7;
                });
            });
        }
    }

    function _0x423b31(_0x1bcae2) {
        console.log('【成功返回数据】 - ',_0x1bcae2)

    }
    _0x2de96e[_0x4132('0x41')](_0xbdc4a7, _0x56a3b8, _0x392d9a)[_0x4132('0xb')](function (_0x15b95d) {
        var _0x21f58d = {};
        _0x21f58d[_0xf1aa4c] = _0x15b95d, _0x2de96e[_0x4132('0x52')](_0x423b31, {
            'url': _0x4132('0x40'), 'headers': _0x21f58d, 'onSuccess': function () {
                var _0x1f8375 = {};
                _0x1f8375['ZOGTb'] = function (_0x13c2ad, _0x10f9e1) {
                    return _0x2de96e[_0x4132('0x1b')](_0x13c2ad, _0x10f9e1);
                };
                _0x1f8375[_0x4132('0x1a')] = _0x2de96e[_0x4132('0x48')];
                _0x1f8375[_0x4132('0x4a')] = function (_0x2385ec, _0x438996) {
                    return _0x2de96e['eGdPO'](_0x2385ec, _0x438996);
                };
                _0x1f8375[_0x4132('0x23')] = _0x2de96e[_0x4132('0x56')];
                _0x1f8375[_0x4132('0xe')] = _0x2de96e[_0x4132('0x14')];
                _0x1f8375[_0x4132('0x0')] = _0x2de96e[_0x4132('0x12')];
                var _0x4c322b = _0x1f8375;

            }
        });
    });
}();