Shulou(Shulou.com)06/02 Report--

The previous section mainly talked about the parallel capture of data through multiple simulators. In the absence of docker environment, this time it is mainly aimed at the video data of chattering. No matter you are personal preference or project demand, everyone is very interested in the video data of chattering. For example, if you like that beautiful XX sister, you want to save his video for future viewing. Slowly on your lap. The appium mentioned last time to complete the capture of chatter fan data can also complete the capture of chatter video data, the idea of capture is also to figure out, through mitmdump data analysis, appium simulation sliding. If one device is slow to grab, multiple simulators can be used to grab. This time, the main way to grab is in another way.

(i) Analysis and sharing page

Google Chrome Open: www.douyin.com/share/user/89923219116

1.1 refresh the page

Follow the legend steps to view the returned data

url: www.douyin.com/aweme/v1/aweme/post/? user_id=89923219116&count=21&max_cursor=0&aid=1128&_signature=HTvXTBAUQVTTUFGelHo.NB0711&dytk=2be712bf2e309b4b7947b459667ea3a1

1.2 View the returned data format in json.cn

1.2.1 10 returned.

1.2.2 Discovered, analyzed, discovered.

1.2.3 Open aweme.snssdk.com/aweme/v1/playwm/? video_id=v0200f0e0000bhlo7ff2gdds3j6apkfg&line=0

1.2.4 i.e. via https://www.douyin.com/aweme/v1/aweme/post/? user_id=89923219116&count=21&max_cursor=0&aid=1128&_signature=HTvXTBAUQVTTUFGelHo.NB0711&dytk=2be712bf2e309b4b7947b459667ea3a1 Address where video can be obtained

1.2.5 Parsing the parameters inside

https://www.douyin.com/aweme/v1/aweme/post/? user_id=89923219116&count=21&max_cursor=0&aid=1128&_signature=4vFoMhAYvqksmu7gHnkAsuLxaC&dytk=2be712bf2e309b4b7947b459667ea3a1

1.2.6 There are 6 parameters in it.

user_idcountmax_cursoraid_signaturedytk

1.2.7 The next step is to find out where these six parameters came from.

There must be some old iron asking, since the address is known, directly using the address to obtain can not finish, then why bother? I'm going to take a screenshot and decrypt it, because URL addresses are time-sensitive.

1.2.7.1 user_id is the last field in the url, which can be obtained directly

1.2.7.2 count directly write dead 21

1.2.7.3 max_cursor Write 0 directly, get the write timestamp

1.2.7.4 aid directly write dead 1128

1.2.7.5 dytk can be obtained directly through the page, through regular expressions

1.2.7.6_signature is troublesome, here we analyze it together

1.2.7.6.1 Query_signature information, search for: _signature

1.2.7.6.2 Click on the first of the 2 files that come out of the search, and then follow the steps I said and click

1.2.7.6.3 Enter ctrl+f and enter_signature query, and find_signature = signature assigned by signature.

1.2.7.6.4 signature Find 3 places

initialization

assignment signature

1.signature = _bytedAcrawler.sign(nonce),

2. nonce is actually user_id, user_id has been obtained on the page

3. Need to know_bytedAccrawler.sign

1.2.7.6.5 _bytedAcrawler How to come in via ctrl+f

_bytedAcrawler = require("douyin_falcon:node_modules/byted-acrawler/dist/runtime")

1.2.7.6.5 douyin_falcon:node_modules/byted-acrawler/dist/runtime How does it come again

1.2.7.6.6 Click to find douyin_falcon:node_modules/byted-acrawler/dist/runtime corresponding file, found through this method. And confused.

1.2.7.6.7 Double-click the arrow in the figure below to confuse the source code and parse it into code by browser.

1.2.7.6.8 The following are highly obfuscated and cannot be decrypted.

1.2.6.9 understand the source code of M, after analysis (specific analysis, according to the name experience and code), find base.js is originally the definition of M

PS: Next, let's talk about parsing this piece and how to crack it to get_signature.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.