js逆向-某度翻译

网址：fanyi.baidu.com
接口：https://fanyi.baidu.com/ait/text/translateIncognitoAi
参数：Acs-Token

请求分析

打开devtool，随便输入单词，发包找请求堆栈：

进去，下断点，再次发包，发现参数已经生成：

跟栈分析

顺着堆栈找，注意这是异步堆栈，代码有很多重复执行的地方，真正的逻辑是for-case，例如：

下断点：

再次发包，然后单步跟栈：

进去：

这样可以直接跳到调用函数：

跟过来：

进到run内：

发现有点类似虚拟机的分发机制：

插桩

直接进去看看
然后开始插桩，不过不会插太多，只插特殊的：

只插这样的，将运行结果赋值给了e.V

进去：

不插，再回来：

进去

插上，日志断点，就这样，有个3，4个就行了，一些重要特殊断点：

日志分析

然后放开断点让他执行，看日志，发现已经生成：

然后搜索（去掉两个时间戳前缀）

经过在线验证是aes-cbc加密：

但是发现明文中好像还有加密内容，例如d0,d78

对于d0

依然全局搜索：

答案已经很清晰了

对于d78

经验证，是sha1加密：

___false_0__0 好像是环境检测，固定就行了

源码

from curl_cffi import requests
import time, re, base64
from hashlib import sha1
from Crypto.Cipher import AES
from Crypto.Util.Padding import pad


def aes_cbc_encrypt_str(plaintext: str, key_n: str | bytes, iv_n: str | bytes) -> str:
    if isinstance(key_n, str):
        key_n = key_n.encode('utf-8')
    if isinstance(iv_n, str):
        iv_n = iv_n.encode('utf-8')
    cipher = AES.new(key_n, AES.MODE_CBC, iv_n)  # noqa
    padded_plaintext = pad(plaintext.encode('utf-8'), AES.block_size)
    ciphertext = cipher.encrypt(padded_plaintext)
    return base64.b64encode(ciphertext).decode('utf-8')


def update_response_cookies(response1, need_upgrade_cookies: bool | dict = None):
    if need_upgrade_cookies is None:
        need_upgrade_cookies = {}
    cookies_str = str(response1.cookies)
    raw_cookies = re.compile(r'<Cookies\[(.*?)]>').findall(cookies_str)
    if raw_cookies:
        for raw in raw_cookies[0].split(','):
            temp = raw.strip().split(' ')[1].split('=')
            need_upgrade_cookies.update({temp[0]: temp[1]})
        return need_upgrade_cookies
    else:
        return need_upgrade_cookies


class BaiDuTranslate:
    def __init__(self):
        self.key_str = 'kwoigaeecyumqcya'
        self.iv_str = '1234567887654321'
        self.headers = {
            'Accept-Language': 'zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6',
            'Cache-Control': 'no-cache',
            'Connection': 'keep-alive',
            'Content-Type': 'application/json',
            'Origin': 'https://fanyi.baidu.com',
            'Pragma': 'no-cache',
            'Referer': 'https://fanyi.baidu.com/',
            'Sec-Fetch-Dest': 'empty',
            'Sec-Fetch-Mode': 'cors',
            'Sec-Fetch-Site': 'same-origin',
            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 Edg/147.0.0.0',
            'accept': 'text/event-stream',
            'sec-ch-ua': '"Microsoft Edge";v="147", "Not.A/Brand";v="8", "Chromium";v="147"',
            'sec-ch-ua-mobile': '?0',
            'sec-ch-ua-platform': '"Windows"',
        }
        self.get_cookies()

    def get_cookies(self):
        response = requests.get('https://www.baidu.com/', cookies={}, headers=self.headers)
        self.cookies = update_response_cookies(response)
        print(self.cookies)

    def to_base(self, num, base=32):
        self.none = None
        if num == 0:
            return '0'
        digits = '0123456789abcdefghijklmnopqrstuvwxyz'  # 0-9, a-z
        result = ''
        while num > 0:
            result = digits[num % base] + result
            num //= base
        return result

    def get_acs_token(self, client_time: int):
        base_str = self.to_base(client_time)
        salt_str_head = f'if2glnrf99c{base_str}'
        salt_str = f'{salt_str_head}___false_0__0'
        d78 = int(sha1(salt_str.encode()).hexdigest()[:4], 16)
        param_str = f'{{"d0":"{salt_str_head}","ua":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 Edg/147.0.0.0","baiduid":"{self.cookies['BAIDUID']}","platform":"Win32","d23":1,"hfe":"","d1":"","d2":0,"d420":0,"clientTs":{client_time},"version":"1.4.0.3","extra":"","odkp":0,"hf":"","d78":{d78},"h0":false,"h1":0}}'
        acs_token = f'1777312805494_{client_time}_{aes_cbc_encrypt_str(param_str, self.key_str, self.iv_str)}'  # 这里的前缀时间戳还有待考究
        return acs_token

    def translate(self, word: str, from_: str = 'en', to_: str = 'zh'):  # 自行添加语言方向处理逻辑
        start_time = int(time.time() * 1000)
        end_time = start_time + 1
        cal_end_time = start_time + 3001
        acs_token = self.get_acs_token(cal_end_time)
        self.headers['Acs-Token'] = acs_token
        json_data = {
            'needNewlineCombine': False,
            'disableCache': False,
            'isAi': False,
            'sseStartTime': start_time,
            'query': word,
            'from': from_,
            'to': to_,
            'reference': '',
            'corpusIds': [],
            'needPhonetic': True,
            'domain': 'common',
            'detectLang': '',
            'isIncognitoAI': False,
            'milliTimestamp': end_time,
        }

        response = requests.post('https://fanyi.baidu.com/ait/text/translate', cookies=self.cookies, headers=self.headers, json=json_data)
        print(response.text)  # 自行添加结果处理逻辑