用python模拟代码加密逻辑
'''
获取arg1
'''
def get_arg1(arg):_0x4b082b = [0xf, 0x23, 0x1d, 0x18, 0x21, 0x10, 0x1, 0x26, 0xa, 0x9, 0x13, 0x1f, 0x28, 0x1b, 0x16, 0x17, 0x19, 0xd,0x6, 0xb, 0x27, 0x12, 0x14, 0x8, 0xe, 0x15, 0x20, 0x1a, 0x2, 0x1e, 0x7, 0x4, 0x11, 0x5, 0x3, 0x1c,0x22, 0x25, 0xc, 0x24]_0x4da0dc = ['']*40_0x12605e = ''for _0x20a7bf in range(0,len(arg)):_0x385ee3 = arg[_0x20a7bf]for _0x217721 in range(0,len(_0x4b082b)):if _0x4b082b[_0x217721] == _0x20a7bf + 0x1:_0x4da0dc[_0x217721] = _0x385ee3_0x12605e = ''.join(_0x4da0dc)return _0x12605e'''
获取arg2
'''
def get_arg2(_0x4e08d8,_0x23a392):_0x5a5d3b = ''_0xe89588 = 0x0while _0xe89588 < len(_0x23a392) and _0xe89588 < len(_0x4e08d8):_0x401af1 = int(_0x23a392[_0xe89588:_0xe89588 + 0x2],16)_0x105f59 = int(_0x4e08d8[_0xe89588:_0xe89588 + 0x2],16)_0x189e2c = hex(_0x401af1 ^ _0x105f59)if len(_0x189e2c) == 0x1:_0x189e2c = '\x30' + _0x189e2c_0x5a5d3b += _0x189e2c[2:]_0xe89588 += 0x2return _0x5a5d3bdef get_arg(arg):key = '3000176000856006061501533003690027800375'_0x23a392 = get_arg1(arg)arg2 = "acw_sc__v2=" + get_arg2(key, _0x23a392)return arg2if __name__ == '__main__':text = requests.get(url='https://bj.xiaoqu.zhuge.com/chaoyang/',timeout=10).texttime.sleep(1)arg = re.search("arg1=.*", text).group().split('\'')[1]get_arg(arg)
ok，此时我们可以获取到加密生成的cookie了，遵循网页的执行原理，将获取到的cookie加入到herders中再去请求
import requests
headers = {"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9","Accept-Encoding": "gzip, deflate, br","Accept-Language": "zh-CN,zh;q=0.9","Cache - Control": "max-age=0","Connection": "keep-alive","Sec-Fetch-Dest": "document","Sec-Fetch-Mode": "navigate","Sec-Fetch-Site": "same-origin","Sec-Fetch-User": "?1","Upgrade-Insecure-Requests": "1","User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.75 Safari/537.36","Cookie":get_arg(arg)}
datas = requests.get(url='https://bj.xiaoqu.zhuge.com/chaoyang/',headers=hersers,timeout=10).text
print(datas)
此时获取的datas就是存在数据的页面，可以自行将所需要的数据提取出来，提取方法不再叙述
总结：
第一点就是有些网站会进行前端反调试，手段之一就是会检测开发者工具是不是打开，而且如果我们把代码拿到本地，竟然还会检测本地代码是否是展开的？第二点就是代码混淆的方式，有些网站会用_0xxxx等操蛋的符号以及使用16进制来迷惑我们，想要还原的话直接打印一下就可以，js也能读取16进制
注意：尽量不要在herders中加入Host和Referer两个参数，平台的也不能使用，因为平台会根据这个来判断你是不是spider
？第二点就是代码混淆的方式，有些网站会用_0xxxx等操蛋的符号以及使用16进制来迷惑我们，想要还原的话直接打印一下就可以，js也能读取16进制**
注意：尽量不要在herders中加入Host和Referer两个参数，平台的也不能使用，因为平台会根据这个来判断你是不是spider
