QQ音乐API加密参数分析
- 1、背景
- 2、QQ音乐sign计算
- 3、Java代码实现
- 4、总结
1、背景
不知道什么时候开始，各家音乐APP都开始对API进行加密，最近一段时间对六大音乐平台的加密算法进行了研究，逆向了网页端、安卓端等等，已经掌握了各家的加密算法。
平台
加密算法
非加密接口
专属资源
海外IP支持
MD5
存在，可完全替代加密接口
需要绿钻Cookie
不支持，需要国内IP代理
KW
DES
存在，可完全替代加密接口
不需要额外信息
支持
KG
MD5
存在，不能完全替代加密接口
需要豪华会员Cookie
不支持，需要国内IP代理
WY
AES、RSA、MD5
存在，少数接口不能使用未加密接口，如登录
需要黑胶Cookie
不支持，但可通过设置X-Real-IP规避
MG
MD5
存在，可完全替代加密接口
不需要额外信息
支持
XM
私有加密
存在，可完全替代加密接口
不需要额外信息
不支持，需要国内IP代理
2、QQ音乐sign计算
首先说明，所有加密接口都有非加密的替代接口，但是以后肯定是向加密接口发展，两个最基础的API是
1https://u.y.qq.com/cgi-bin/musicu.fcg 支持加密和非加密 2 3https://u.y.qq.com/cgi-bin/musics.fcg 仅支持加密 4
以上说多了，这篇主要是讲如何计算最新版的QQ音乐加密参数。
首先打开QQ音乐官网，F12打开开发者工具，我们随便找一条加密的链接
如图所示，我们可以看到这样一条链接
https://u.y.qq.com/cgi-bin/musics.fcg?-=getUCGI6892186109455234&g_tk=680034686&sign=zzadg51jzc4krod4v97bc3696a5f2740962d1e6c467957c88&loginUin=0&hostUin=0&format=json&inCharset=utf8&outCharset=utf-8¬ice=0&platform=yqq.json&needNewCode=0&data=%7B%22detail%22%3A%7B%22module%22%3A%22musicToplist.ToplistInfoServer%22%2C%22method%22%3A%22GetDetail%22%2C%22param%22%3A%7B%22topId%22%3A4%2C%22offset%22%3A0%2C%22num%22%3A20%2C%22period%22%3A%222020-12-21%22%7D%7D%2C%22comm%22%3A%7B%22ct%22%3A24%2C%22cv%22%3A0%7D%7D
在链接中有个参数,我们的目标就是得到这个参数如何计算的方式
sign=zzadg51jzc4krod4v97bc3696a5f2740962d1e6c467957c88
点Initiator，找一下请求来源，点击来源的JS
在打开的JS里面查找sign找到如下图所示的区域，sign就是在这里得到的（格式化下js代码，否则看不清楚流程）在图中位置下断点，再刷新页面
https://y.gtimg.cn/music/portal/js/common/pkg/common_d9439fa.js?max_age=31536000:formatted
然后断在了这个地方，如果不是加密链接就放过，如果是，就步入
可以把鼠标放在变量上或者再控制台打印变量数据,如下图所示，我将请求的URL和请求参数打印了出来
1//u.y.qq.com/cgi-bin/musicu.fcg?-=getUCGI4444074835099534&g_tk=680034686 2 3 4{ 5 6 "detail":{ 7 8 "module":"musicToplist.ToplistInfoServer","method":"GetDetail","param":{ 9 10 "topId":4,"offset":0,"num":20,"period":"2020-12-21"}},"comm":{ 11 12 "ct":24,"cv":0}}
sign就是对请求参数加密之后得到的。
继续步入后，我们跳转到了下面这个JS里面，请求参数就是在这里加密的
https://y.qq.com/component/m/qmfe-security-sign/index.umd.js?max_age=2592000:formatted
具体的内容
1!function(n, t) { 2 3 4 "object" == typeof exports && "undefined" != typeof module ? module.exports = t() : "function" == typeof define && define.amd ? define(t) : (n = n || self).getSecuritySign = t() 5}(this, function() { 6 7 8 "use strict"; 9 var n = function() { 10 11 12 if ("undefined" != typeof self) 13 return self; 14 if ("undefined" != typeof window) 15 return window; 16 if ("undefined" != typeof global) 17 return global; 18 throw new Error("unable to locate global object") 19 }(); 20 n.__sign_hash_20200305 = function(n) { 21 22 23 function l(n, t) { 24 25 26 var o = (65535 & n) + (65535 & t); 27 return (n >> 16) + (t >> 16) + (o >> 16) << 16 | 65535 & o 28 } 29 function r(n, t, o, e, u, p) { 30 31 32 return l((i = l(l(t, n), l(e, p))) << (r = u) | i >>> 32 - r, o); 33 var i, r 34 } 35 function g(n, t, o, e, u, p, i) { 36 37 38 return r(t & o | ~t & e, n, t, u, p, i) 39 } 40 function a(n, t, o, e, u, p, i) { 41 42 43 return r(t & e | o & ~e, n, t, u, p, i) 44 } 45 function s(n, t, o, e, u, p, i) { 46 47 48 return r(t ^ o ^ e, n, t, u, p, i) 49 } 50 function v(n, t, o, e, u, p, i) { 51 52 53 return r(o ^ (t | ~e), n, t, u, p, i) 54 } 55 function t(n) { 56 57 58 return function(n) { 59 60 61 var t, o = ""; 62 for (t = 0; t < 32 * n.length; t += 8) 63 o += String.fromCharCode(n[t >> 5] >>> t % 32 & 255); 64 return o 65 }(function(n, t) { 66 67 68 n[t >> 5] |= 128 << t % 32, 69 n[14 + (t + 64 >>> 9 << 4)] = t; 70 var o, e, u, p, i, r = 1732584193, f = -271733879, h = -1732584194, c = 271733878; 71 for (o = 0; o < n.length; o += 16) 72 r = g(e = r, u = f, p = h, i = c, n[o], 7, -680876936), 73 c = g(c, r, f, h, n[o + 1], 12, -389564586), 74 h = g(h, c, r, f, n[o + 2], 17, 606105819), 75 f = g(f, h, c, r, n[o + 3], 22, -1044525330), 76 r = g(r, f, h, c, n[o + 4], 7, -176418897), 77 c = g(c, r, f, h, n[o + 5], 12, 1200080426), 78 h = g(h, c, r, f, n[o + 6], 17, -1473231341), 79 f = g(f, h, c, r, n[o + 7], 22, -45705983), 80 r = g(r, f, h, c, n[o + 8], 7, 1770035416), 81 c = g(c, r, f, h, n[o + 9], 12, -1958414417), 82 h = g(h, c, r, f, n[o + 10], 17, -42063), 83 f = g(f, h, c, r, n[o + 11], 22, -1990404162), 84 r = g(r, f, h, c, n[o + 12], 7, 1804603682), 85 c = g(c, r, f, h, n[o + 13], 12, -40341101), 86 h = g(h, c, r, f, n[o + 14], 17, -1502002290), 87 r = a(r, f = g(f, h, c, r, n[o + 15], 22, 1236535329), h, c, n[o + 1], 5, -165796510), 88 c = a(c, r, f, h, n[o + 6], 9, -1069501632), 89 h = a(h, c, r, f, n[o + 11], 14, 643717713), 90 f = a(f, h, c, r, n[o], 20, -373897302), 91 r = a(r, f, h, c, n[o + 5], 5, -701558691), 92 c = a(c, r, f, h, n[o + 10], 9, 38016083), 93 h = a(h, c, r, f, n[o + 15], 14, -660478335), 94 f = a(f, h, c, r, n[o + 4], 20, -405537848), 95 r = a(r, f, h, c, n[o + 9], 5, 568446438), 96 c = a(c, r, f, h, n[o + 14], 9, -1019803690), 97 h = a(h, c, r, f, n[o + 3], 14, -187363961), 98 f = a(f, h, c, r, n[o + 8], 20, 1163531501), 99 r = a(r, f, h, c, n[o + 13], 5, -1444681467), 100 c = a(c, r, f, h, n[o + 2], 9, -51403784), 101 h = a(h, c, r, f, n[o + 7], 14, 1735328473), 102 r = s(r, f = a(f, h, c, r, n[o + 12], 20, -1926607734), h, c, n[o + 5], 4, -378558), 103 c = s(c, r, f, h, n[o + 8], 11, -2022574463), 104 h = s(h, c, r, f, n[o + 11], 16, 1839030562), 105 f = s(f, h, c, r, n[o + 14], 23, -35309556), 106 r = s(r, f, h, c, n[o + 1], 4, -1530992060), 107 c = s(c, r, f, h, n[o + 4], 11, 1272893353), 108 h = s(h, c, r, f, n[o + 7], 16, -155497632), 109 f = s(f, h, c, r, n[o + 10], 23, -1094730640), 110 r = s(r, f, h, c, n[o + 13], 4, 681279174), 111 c = s(c, r, f, h, n[o], 11, -358537222), 112 h = s(h, c, r, f, n[o + 3], 16, -722521979), 113 f = s(f, h, c, r, n[o + 6], 23, 76029189), 114 r = s(r, f, h, c, n[o + 9], 4, -640364487), 115 c = s(c, r, f, h, n[o + 12], 11, -421815835), 116 h = s(h, c, r, f, n[o + 15], 16, 530742520), 117 r = v(r, f = s(f, h, c, r, n[o + 2], 23, -995338651), h, c, n[o], 6, -198630844), 118 c = v(c, r, f, h, n[o + 7], 10, 1126891415), 119 h = v(h, c, r, f, n[o + 14], 15, -1416354905), 120 f = v(f, h, c, r, n[o + 5], 21, -57434055), 121 r = v(r, f, h, c, n[o + 12], 6, 1700485571), 122 c = v(c, r, f, h, n[o + 3], 10, -1894986606), 123 h = v(h, c, r, f, n[o + 10], 15, -1051523), 124 f = v(f, h, c, r, n[o + 1], 21, -2054922799), 125 r = v(r, f, h, c, n[o + 8], 6, 1873313359), 126 c = v(c, r, f, h, n[o + 15], 10, -30611744), 127 h = v(h, c, r, f, n[o + 6], 15, -1560198380), 128 f = v(f, h, c, r, n[o + 13], 21, 1309151649), 129 r = v(r, f, h, c, n[o + 4], 6, -145523070), 130 c = v(c, r, f, h, n[o + 11], 10, -1120210379), 131 h = v(h, c, r, f, n[o + 2], 15, 718787259), 132 f = v(f, h, c, r, n[o + 9], 21, -343485551), 133 r = l(r, e), 134 f = l(f, u), 135 h = l(h, p), 136 c = l(c, i); 137 return [r, f, h, c] 138 }(function(n) { 139 140 141 var t, o = []; 142 for (o[(n.length >> 2) - 1] = void 0, 143 t = 0; t < o.length; t += 1) 144 o[t] = 0; 145 for (t = 0; t < 8 * n.length; t += 8) 146 o[t >> 5] |= (255 & n.charCodeAt(t / 8)) << t % 32; 147 return o 148 }(n), 8 * n.length)) 149 } 150 function o(n) { 151 152 153 return t(unescape(encodeURIComponent(n))) 154 } 155 return function(n) { 156 157 158 var t, o, e = "0123456789abcdef", u = ""; 159 for (o = 0; o < n.length; o += 1) 160 t = n.charCodeAt(o), 161 u += e.charAt(t >>> 4 & 15) + e.charAt(15 & t); 162 return u 163 }(o(n)) 164 } 165 , 166 function r(f, h, c, l, g) { 167 168 169 g = g || [[this], [{ 170 171 }]]; 172 for (var t = [], o = null, n = [function() { 173 174 175 return !0 176 } 177 , function() { 178 179 } 180 , function() { 181 182 183 g.length = c[h++] 184 } 185 , function() { 186 187 188 g.push(c[h++]) 189 } 190 , function() { 191 192 193 g.pop() 194 } 195 , function() { 196 197 198 var n = c[h++] 199 , t = g[g.length - 2 - n]; 200 g[g.length - 2 - n] = g.pop(), 201 g.push(t) 202 } 203 , function() { 204 205 206 g.push(g[g.length - 1]) 207 } 208 , function() { 209 210 211 g.push([g.pop(), g.pop()].reverse()) 212 } 213 , function() { 214 215 216 g.push([l, g.pop()]) 217 } 218 , function() { 219 220 221 g.push([g.pop()]) 222 } 223 , function() { 224 225 226 var n = g.pop(); 227 g.push(n[0][n[1]]) 228 } 229 , function() { 230 231 232 g.push(g[g.pop()[0]][0]) 233 } 234 , function() { 235 236 237 var n = g[g.length - 2]; 238 n[0][n[1]] = g[g.length - 1] 239 } 240 , function() { 241 242 243 g[g[g.length - 2][0]][0] = g[g.length - 1] 244 } 245 , function() { 246 247 248 var n = g.pop() 249 , t = g.pop(); 250 g.push([t[0][t[1]], n]) 251 } 252 , function() { 253 254 255 var n = g.pop(); 256 g.push([g[g.pop()][0], n]) 257 } 258 , function() { 259 260 261 var n = g.pop(); 262 g.push(delete n[0][n[1]]) 263 } 264 , function() { 265 266 267 var n = []; 268 for (var t in g.pop()) 269 n.push(t); 270 g.push(n) 271 } 272 , function() { 273 274 275 g[g.length - 1].length ? g.push(g[g.length - 1].shift(), !0) : g.push(void 0, !1) 276 } 277 , function() { 278 279 280 var n = g[g.length - 2] 281 , t = Object.getOwnPropertyDescriptor(n[0], n[1]) || { 282 283 284 configurable: !0, 285 enumerable: !0 286 }; 287 t.get = g[g.length - 1], 288 Object.defineProperty(n[0], n[1], t) 289 } 290 , function() { 291 292 293 var n = g[g.length - 2] 294 , t = Object.getOwnPropertyDescriptor(n[0], n[1]) || { 295 296 297 configurable: !0, 298 enumerable: !0 299 }; 300 t.set = g[g.length - 1], 301 Object.defineProperty(n[0], n[1], t) 302 } 303 , function() { 304 305 306 h = c[h++] 307 } 308 , function() { 309 310 311 var n = c[h++]; 312 g[g.length - 1] && (h = n) 313 } 314 , function() { 315 316 317 throw g[g.length - 1] 318 } 319 , function() { 320 321 322 var n = c[h++] 323 , t = n ? g.slice(-n) : []; 324 g.length -= n, 325 g.push(g.pop().apply(l, t)) 326 } 327 , function() { 328 329 330 var n = c[h++] 331 , t = n ? g.slice(-n) : []; 332 g.length -= n; 333 var o = g.pop(); 334 g.push(o[0][o[1]].apply(o[0], t)) 335 } 336 , function() { 337 338 339 var n = c[h++] 340 , t = n ? g.slice(-n) : []; 341 g.length -= n, 342 t.unshift(null), 343 g.push(new (Function.prototype.bind.apply(g.pop(), t))) 344 } 345 , function() { 346 347 348 var n = c[h++] 349 , t = n ? g.slice(-n) : []; 350 g.length -= n, 351 t.unshift(null); 352 var o = g.pop(); 353 g.push(new (Function.prototype.bind.apply(o[0][o[1]], t))) 354 } 355 , function() { 356 357 358 g.push(!g.pop()) 359 } 360 , function() { 361 362 363 g.push(~g.pop()) 364 } 365 , function() { 366 367 368 g.push(typeof g.pop()) 369 } 370 , function() { 371 372 373 g[g.length - 2] = g[g.length - 2] == g.pop() 374 } 375 , function() { 376 377 378 g[g.length - 2] = g[g.length - 2] === g.pop() 379 } 380 , function() { 381 382 383 g[g.length - 2] = g[g.length - 2] > g.pop() 384 } 385 , function() { 386 387 388 g[g.length - 2] = g[g.length - 2] >= g.pop() 389 } 390 , function() { 391 392 393 g[g.length - 2] = g[g.length - 2] << g.pop() 394 } 395 , function() { 396 397 398 g[g.length - 2] = g[g.length - 2] >> g.pop() 399 } 400 , function() { 401 402 403 g[g.length - 2] = g[g.length - 2] >>> g.pop() 404 } 405 , function() { 406 407 408 g[g.length - 2] = g[g.length - 2] + g.pop() 409 } 410 , function() { 411 412 413 g[g.length - 2] = g[g.length - 2] - g.pop() 414 } 415 , function() { 416 417 418 g[g.length - 2] = g[g.length - 2] * g.pop() 419 } 420 , function() { 421 422 423 g[g.length - 2] = g[g.length - 2] / g.pop() 424 } 425 , function() { 426 427 428 g[g.length - 2] = g[g.length - 2] % g.pop() 429 } 430 , function() { 431 432 433 g[g.length - 2] = g[g.length - 2] | g.pop() 434 } 435 , function() { 436 437 438 g[g.length - 2] = g[g.length - 2] & g.pop() 439 } 440 , function() { 441 442 443 g[g.length - 2] = g[g.length - 2] ^ g.pop() 444 } 445 , function() { 446 447 448 g[g.length - 2] = g[g.length - 2]in g.pop() 449 } 450 , function() { 451 452 453 g[g.length - 2] = g[g.length - 2]instanceof g.pop() 454 } 455 , function() { 456 457 458 g[g[g.length - 1][0]] = void 0 === g[g[g.length - 1][0]] ? [] : g[g[g.length - 1][0]] 459 } 460 , function() { 461 462 463 for (var e = c[h++], u = [], n = c[h++], t = c[h++], p = [], o = 0; o < n; o++) 464 u[c[h++]] = g[c[h++]]; 465 for (var i = 0; i < t; i++) 466 p[i] = c[h++]; 467 g.push(function n() { 468 469 470 var t = u.slice(0); 471 t[0] = [this], 472 t[1] = [arguments], 473 t[2] = [n]; 474 for (var o = 0; o < p.length && o < arguments.length; o++) 475 0 < p[o] && (t[p[o]] = [arguments[o]]); 476 return r(f, e, c, l, t) 477 }) 478 } 479 , function() { 480 481 482 t.push([c[h++], g.length, c[h++]]) 483 } 484 , function() { 485 486 487 t.pop() 488 } 489 , function() { 490 491 492 return !!o 493 } 494 , function() { 495 496 497 o = null 498 } 499 , function() { 500 501 502 g[g.length - 1] += String.fromCharCode(c[h++]) 503 } 504 , function() { 505 506 507 g.push("") 508 } 509 , function() { 510 511 512 g.push(void 0) 513 } 514 , function() { 515 516 517 g.push(null) 518 } 519 , function() { 520 521 522 g.push(!0) 523 } 524 , function() { 525 526 527 g.push(!1) 528 } 529 , function() { 530 531 532 g.length -= c[h++] 533 } 534 , function() { 535 536 537 g[g.length - 1] = c[h++] 538 } 539 , function() { 540 541 542 var n = g.pop() 543 , t = g[g.length - 1]; 544 t[0][t[1]] = g[n[0]][0] 545 } 546 , function() { 547 548 549 var n = g.pop() 550 , t = g[g.length - 1]; 551 t[0][t[1]] = n[0][n[1]] 552 } 553 , function() { 554 555 556 var n = g.pop() 557 , t = g[g.length - 1]; 558 g[t[0]][0] = g[n[0]][0] 559 } 560 , function() { 561 562 563 var n = g.pop() 564 , t = g[g.length - 1]; 565 g[t[0]][0] = n[0][n[1]] 566 } 567 , function() { 568 569 570 g[g.length - 2] = g[g.length - 2] < g.pop() 571 } 572 , function() { 573 574 575 g[g.length - 2] = g[g.length - 2] <= g.pop() 576 } 577 ]; ; ) 578 try { 579 580 581 for (; !n[c[h++]](); ) 582 ; 583 if (o) 584 throw o; 585 return g.pop() 586 } catch (n) { 587 588 589 var e = t.pop(); 590 if (void 0 === e) 591 throw n; 592 o = n, 593 h = e[0], 594 g.length = e[1], 595 e[2] && (g[e[2]][0] = o) 596 } 597 }(120731, 0, [21, 34, 50, 100, 57, 50, 102, 50, 98, 99, 101, 52, 54, 97, 52, 99, 55, 56, 52, 49, 57, 54, 57, 49, 56, 98, 102, 100, 100, 48, 48, 55, 55, 102, 2, 10, 3, 2, 9, 48, 61, 3, 9, 48, 61, 4, 9, 48, 61, 5, 9, 48, 61, 6, 9, 48, 61, 7, 9, 48, 61, 8, 9, 48, 61, 9, 9, 48, 4, 21, 427, 54, 2, 15, 3, 2, 9, 48, 61, 3, 9, 48, 61, 4, 9, 48, 61, 5, 9, 48, 61, 6, 9, 48, 61, 7, 9, 48, 61, 8, 9, 48, 61, 9, 9, 48, 61, 10, 9, 48, 61, 11, 9, 48, 61, 12, 9, 48, 61, 13, 9, 48, 61, 14, 9, 48, 61, 10, 9, 55, 54, 97, 54, 98, 54, 99, 54, 100, 54, 101, 54, 102, 54, 103, 54, 104, 54, 105, 54, 106, 54, 107, 54, 108, 54, 109, 54, 110, 54, 111, 54, 112, 54, 113, 54, 114, 54, 115, 54, 116, 54, 117, 54, 118, 54, 119, 54, 120, 54, 121, 54, 122, 54, 48, 54, 49, 54, 50, 54, 51, 54, 52, 54, 53, 54, 54, 54, 55, 54, 56, 54, 57, 13, 4, 61, 11, 9, 55, 54, 77, 54, 97, 54, 116, 54, 104, 8, 55, 54, 102, 54, 108, 54, 111, 54, 111, 54, 114, 14, 55, 54, 77, 54, 97, 54, 116, 54, 104, 8, 55, 54, 114, 54, 97, 54, 110, 54, 100, 54, 111, 54, 109, 14, 25, 0, 3, 4, 9, 11, 3, 3, 9, 11, 39, 3, 1, 38, 40, 3, 3, 9, 11, 38, 25, 1, 13, 4, 61, 12, 9, 55, 13, 4, 61, 13, 9, 3, 0, 13, 4, 4, 3, 13, 9, 11, 3, 11, 9, 11, 66, 22, 306, 4, 21, 422, 24, 4, 3, 14, 9, 55, 54, 77, 54, 97, 54, 116, 54, 104, 8, 55, 54, 102, 54, 108, 54, 111, 54, 111, 54, 114, 14, 55, 54, 77, 54, 97, 54, 116, 54, 104, 8, 55, 54, 114, 54, 97, 54, 110, 54, 100, 54, 111, 54, 109, 14, 25, 0, 3, 10, 9, 55, 54, 108, 54, 101, 54, 110, 54, 103, 54, 116, 54, 104, 15, 10, 40, 25, 1, 13, 4, 61, 12, 9, 6, 11, 3, 10, 9, 3, 14, 9, 11, 15, 10, 38, 13, 4, 61, 13, 9, 6, 11, 6, 5, 1, 5, 0, 3, 1, 38, 13, 4, 61, 0, 5, 0, 43, 4, 21, 291, 61, 3, 12, 9, 11, 0, 3, 9, 9, 49, 72, 0, 2, 3, 4, 13, 4, 61, 8, 9, 21, 721, 3, 2, 8, 3, 2, 9, 48, 61, 3, 9, 48, 61, 4, 9, 48, 61, 5, 9, 48, 61, 6, 9, 48, 61, 7, 9, 48, 4, 55, 54, 115, 54, 101, 54, 108, 54, 102, 8, 10, 30, 55, 54, 117, 54, 110, 54, 100, 54, 101, 54, 102, 54, 105, 54, 110, 54, 101, 54, 100, 32, 28, 22, 510, 4, 21, 523, 22, 4, 55, 54, 115, 54, 101, 54, 108, 54, 102, 8, 10, 0, 55, 54, 119, 54, 105, 54, 110, 54, 100, 54, 111, 54, 119, 8, 10, 30, 55, 54, 117, 54, 110, 54, 100, 54, 101, 54, 102, 54, 105, 54, 110, 54, 101, 54, 100, 32, 28, 22, 566, 4, 21, 583, 3, 4, 55, 54, 119, 54, 105, 54, 110, 54, 100, 54, 111, 54, 119, 8, 10, 0, 55, 54, 103, 54, 108, 54, 111, 54, 98, 54, 97, 54, 108, 8, 10, 30, 55, 54, 117, 54, 110, 54, 100, 54, 101, 54, 102, 54, 105, 54, 110, 54, 101, 54, 100, 32, 28, 22, 626, 4, 21, 643, 25, 4, 55, 54, 103, 54, 108, 54, 111, 54, 98, 54, 97, 54, 108, 8, 10, 0, 55, 54, 69, 54, 114, 54, 114, 54, 111, 54, 114, 8, 55, 54, 117, 54, 110, 54, 97, 54, 98, 54, 108, 54, 101, 54, 32, 54, 116, 54, 111, 54, 32, 54, 108, 54, 111, 54, 99, 54, 97, 54, 116, 54, 101, 54, 32, 54, 103, 54, 108, 54, 111, 54, 98, 54, 97, 54, 108, 54, 32, 54, 111, 54, 98, 54, 106, 54, 101, 54, 99, 54, 116, 27, 1, 23, 56, 0, 49, 444, 0, 0, 24, 0, 13, 4, 61, 8, 9, 55, 54, 95, 54, 95, 54, 103, 54, 101, 54, 116, 54, 83, 54, 101, 54, 99, 54, 117, 54, 114, 54, 105, 54, 116, 54, 121, 54, 83, 54, 105, 54, 103, 54, 110, 15, 21, 1126, 49, 2, 14, 3, 2, 9, 48, 61, 3, 9, 48, 61, 4, 9, 48, 61, 5, 9, 48, 61, 6, 9, 48, 61, 7, 9, 48, 61, 8, 9, 48, 61, 9, 9, 48, 61, 10, 9, 48, 61, 11, 9, 48, 61, 9, 9, 55, 54, 108, 54, 111, 54, 99, 54, 97, 54, 116, 54, 105, 54, 111, 54, 110, 8, 10, 30, 55, 54, 117, 54, 110, 54, 100, 54, 101, 54, 102, 54, 105, 54, 110, 54, 101, 54, 100, 32, 28, 22, 862, 21, 932, 21, 4, 55, 54, 108, 54, 111, 54, 99, 54, 97, 54, 116, 54, 105, 54, 111, 54, 110, 8, 55, 54, 104, 54, 111, 54, 115, 54, 116, 14, 55, 54, 105, 54, 110, 54, 100, 54, 101, 54, 120, 54, 79, 54, 102, 14, 55, 54, 121, 54, 46, 54, 113, 54, 113, 54, 46, 54, 99, 54, 111, 54, 109, 25, 1, 3, 0, 3, 1, 39, 32, 22, 963, 4, 55, 54, 67, 54, 74, 54, 66, 54, 80, 54, 65, 54, 67, 54, 114, 54, 82, 54, 117, 54, 78, 54, 121, 54, 55, 21, 974, 50, 4, 3, 12, 9, 11, 3, 8, 3, 10, 24, 2, 13, 4, 61, 10, 9, 3, 13, 9, 55, 54, 95, 54, 95, 54, 115, 54, 105, 54, 103, 54, 110, 54, 95, 54, 104, 54, 97, 54, 115, 54, 104, 54, 95, 54, 50, 54, 48, 54, 50, 54, 48, 54, 48, 54, 51, 54, 48, 54, 53, 15, 10, 22, 1030, 21, 1087, 22, 4, 3, 13, 9, 55, 54, 95, 54, 95, 54, 115, 54, 105, 54, 103, 54, 110, 54, 95, 54, 104, 54, 97, 54, 115, 54, 104, 54, 95, 54, 50, 54, 48, 54, 50, 54, 48, 54, 48, 54, 51, 54, 48, 54, 53, 15, 3, 9, 9, 11, 3, 3, 9, 11, 38, 25, 1, 13, 4, 61, 11, 9, 3, 12, 9, 11, 3, 10, 3, 53, 3, 37, 39, 24, 2, 13, 4, 4, 55, 54, 122, 54, 122, 54, 97, 3, 11, 9, 11, 38, 3, 10, 9, 11, 38, 0, 49, 771, 2, 1, 12, 9, 13, 8, 3, 12, 4, 4, 56, 0], n); 598 var t = n.__getSecuritySign; 599 return delete n.__getSecuritySign, 600 t 601}); 602
然后在进入函数的返回出下断点，断在如下位置后，在控制台执行
r(f, e, c, l, t)
然后打印参数t,我们可以看到参数t里面出现了几个很特别的参数
1CJBPACrRuNy7 2 397bc3696a5f2740962d1e6c467957c88 4 5{ 6 7 "detail":{ 8 9 "module":"musicToplist.ToplistInfoServer","method":"GetDetail","param":{ 10 11 "topId":4,"offset":0,"num":20,"period":"2020-12-21"}},"comm":{ 12 13 "ct":24,"cv":0}}
看到97bc3696a5f2740962d1e6c467957c88 这样的数字，又是32位，可以大胆地猜测是md5，事实上，97bc3696a5f2740962d1e6c467957c88就是 把固定的字符串CJBPACrRuNy7与请求参数拼接起来之后的md5值
1CJBPACrRuNy7{ 2 3 "detail":{ 4 5 "module":"musicToplist.ToplistInfoServer","method":"GetDetail","param":{ 6 7 "topId":4,"offset":0,"num":20,"period":"2020-12-21"}},"comm":{ 8 9 "ct":24,"cv":0}}
这个JS文件的作用就是用JS实现了一段MD5加密算法。
多次探索之后，我发现sign由以下规则生成
固定头zza+一段随机的小写字符串，由小写字母和数字组成，长度为10-16位+对固定字符串和请求参数取md5。这三部分拼接而成。
下面回到我们调试的地方，取消所有断电，放开运行，之后我们就得到了一个网址
https://u.y.qq.com/cgi-bin/musics.fcg?-=getUCGI5601160880585316&g_tk=680034686&sign=zza4bb58zhof1tkhk8t97bc3696a5f2740962d1e6c467957c88&loginUin=0&hostUin=0&format=json&inCharset=utf8&outCharset=utf-8¬ice=0&platform=yqq.json&needNewCode=0&data=%7B%22detail%22%3A%7B%22module%22%3A%22musicToplist.ToplistInfoServer%22%2C%22method%22%3A%22GetDetail%22%2C%22param%22%3A%7B%22topId%22%3A4%2C%22offset%22%3A0%2C%22num%22%3A20%2C%22period%22%3A%222020-12-21%22%7D%7D%2C%22comm%22%3A%7B%22ct%22%3A24%2C%22cv%22%3A0%7D%7D
计算出了sign后面就可以正常请求了。
3、Java代码实现
附上一段无名音乐中计算sign的代码，用Java实现
1public class QqEncrypt { 2 3 4 private static final String encNonce="CJBPACrRuNy7"; 5 private static final String signPrxfix="zza"; 6 private static final char[] dir="0234567890abcdefghijklmnopqrstuvwxyz".toCharArray(); 7 /** 8 * 9 *@param encParams 需要加密的参数，这是一段请求体数据，为json字符串格式，例如下面的格式，可以抓包获取 10 * {"comm":{"ct":24,"cv":0},"vip":{"module":"userInfo…baseinfo_v2","param":{"vec_uin":["3011429848"]}}} 11 * 12 * @return 加密的方式为固定字串 zza加上一个10-16位的随机字符串再加上 固定字串 CJBPACrRuNy7加上请求数据拼接的 MD5值 13 */ 14 public static String getSign(String encParams){ 15 16 17 return signPrxfix+uuidGenerate()+ Md5Encrypt.convertToMd5(encNonce+encParams); 18 } 19 20 private static String uuidGenerate(){ 21 22 23 int minLen=10; 24 int maxLen=16; 25 Random ran=new Random(System.currentTimeMillis()); 26 int ranLen=ran.nextInt(maxLen-minLen)+minLen; 27 StringBuilder sb=new StringBuilder(ranLen); 28 for (int i=0;i<ranLen;i++){ 29 30 31 sb.append(dir[ran.nextInt(dir.length)]); 32 } 33 return sb.toString(); 34 } 35} 36 37public class Md5Encrypt { 38 39 40 //必须要重视编码问题了！折腾了好多天才发现MD5要用UTF-8形式加密 41 public static String convertToMd5(String plainText) { 42 43 44 byte[] secretBytes = null; 45 try { 46 47 48 secretBytes = MessageDigest.getInstance("md5").digest(plainText.getBytes("utf-8")); 49 } catch (Exception e) { 50 51 52 throw new RuntimeException("没有这个md5算法！"); 53 } 54 String md5code = new BigInteger(1, secretBytes).toString(16); 55 for (int i = 0; i < 32 - md5code.length(); i++) { 56 57 58 md5code = "0" + md5code; 59 } 60 return md5code; 61 } 62} 63 64
下面是封装了一段请求代码
1public class RequestModule { 2 3 4 /** 5 * musicu支持加密请求和不加密请求，没有对请求进行限制 6 * musics仅支持加密请求 7 */ 8 private static final String[] apiServer={ 9 10 "https://u.y.qq.com/cgi-bin/musicu.fcg?","https://u.y.qq.com/cgi-bin/musics.fcg?"}; 11 private static final Map<String,String> headerMap=new HashMap<>(); 12 13 static { 14 15 16 headerMap.put("user-agent","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.66"); 17 headerMap.put("accept-encoding","application/json"); 18 headerMap.put("cache-control","max-age=0"); 19 } 20 21 /** 22 * 请求示例：{"area":-100,"sex":-100,"genre":-100,"index":15,"sin":0,"cur_page":1} 23 * @param area 地区 -100 不限 24 * @param genre 流派 全部：-100，流行：1 ，摇滚：2，民谣：3，电子：4，爵士：5，嘻哈：6 ..... 25 * @param index 索引 热门:-100 范围 0-26 对应歌手名称拼音A-Z开头 26 * @param sex 性别 不限：-100 男：0 女：1 组合：2 27 * @param sin 偏移(第sin位) 28 * @param currPage 当前页，第n页，默认每页最多80人 29 * @return 30 */ 31 public static String getSingerList(int area,int genre,int index,int sex,int sin,int currPage){ 32 33 34 RequestTemplate template=new RequestTemplate("Music.SingerListServer","get_singer_list","{\"area\":"+area+",\"sex\":"+sex+",\"genre\":"+genre+",\"index\":"+index+",\"sin\":"+sin+",\"cur_page\":"+currPage+"}"); 35 RequestTemplateBuilder templateBuilder=new RequestTemplateBuilder(); 36 templateBuilder.add("singerList",template); 37 String sign= QqEncrypt.getSign(templateBuilder.toString()); 38 Random ran=new Random(System.currentTimeMillis()); 39 return HttpRequestHelper.downloadWebSiteUsePost(apiServer[ran.nextInt(apiServer.length)]+"sign="+sign,templateBuilder.toString(),headerMap); 40 } 41 42 public static String getHotSingerList(){ 43 44 45 return getSingerList(-100,-100,-100,-100,0,1); 46 } 47 48 /** 49 * 50 * @param songId 统一规范，指的是songmid 51 * @return 52 */ 53 public static String getSongDetail(String songId){ 54 55 56 //{"songinfo":{"module":"music.pf_song_detail_svr","method":"get_song_detail","param":{"song_mid":"112344"}}} 57 RequestTemplate template=new RequestTemplate("music.pf_song_detail_svr","get_song_detail","{\"song_mid\":\""+songId+"\"}"); 58 RequestTemplateBuilder templateBuilder=new RequestTemplateBuilder(); 59 templateBuilder.add("songdetail",template); 60 String sign= QqEncrypt.getSign(templateBuilder.toString()); 61 Random ran=new Random(System.currentTimeMillis()); 62 return HttpRequestHelper.downloadWebSiteUsePost(apiServer[ran.nextInt(apiServer.length)] +"sign="+sign,templateBuilder.toString(),headerMap); 63 } 64 65} 66 67
实体类
1public class RequestTemplate{ 2 3 4 public String module=""; 5 public String method=""; 6 public Object param=new Object(); 7 8 public RequestTemplate() { 9 10 11 } 12 13 public RequestTemplate(String module, String method, Object param) { 14 15 16 this.module = module; 17 this.method = method; 18 this.param = param; 19 } 20 21 public String getModule() { 22 23 24 return module; 25 } 26 27 public void setModule(String module) { 28 29 30 this.module = module; 31 } 32 33 public String getMethod() { 34 35 36 return method; 37 } 38 39 public void setMethod(String method) { 40 41 42 this.method = method; 43 } 44 45 public Object getParam() { 46 47 48 return param; 49 } 50 51 public void setParam(Object param) { 52 53 54 this.param = param; 55 } 56 57 @Override 58 public String toString() { 59 60 61 return "{" + 62 "\"module\":\"" + module + "\"" + 63 ",\"method\":\"" + method + "\"" + 64 ",\"param\":" + param.toString() + 65 "}"; 66 } 67} 68 69/** 70 * 构造请求结构，所有请求都可以是这样的 71 * 72 * { 73 * "comm": { 74 * "ct": 24, 75 * "cv": 0 76 * }, 77 * "singerList": { 78 * "module": "Music.SingerListServer", 79 * "method": "get_singer_list", 80 * "param": { 81 * "area": -100, 82 * "sex": -100, 83 * "genre": -100, 84 * "index": -100, 85 * "sin": 0, 86 * "cur_page": 1 87 * } 88 * } 89 * } 90 */ 91public class RequestTemplateBuilder { 92 93 94 private Map<String,Object> requestTemplateMap=new HashMap<>(); 95 public RequestTemplateBuilder add(String name, Object req){ 96 97 98 requestTemplateMap.put(name,req); 99 return this; 100 } 101 @Override 102 public String toString() { 103 104 105 StringBuilder sb=new StringBuilder(); 106 for (String key: requestTemplateMap.keySet()){ 107 108 109 sb.append("\"").append(key).append("\":").append(requestTemplateMap.get(key).toString()).append(","); 110 } 111 sb.substring(0,sb.length()-1); 112 return "{"+sb.substring(0,sb.length()-1)+"}"; 113 } 114} 115
4、总结
核心的加密函数在以下JS文件中实现，这段JS主要就是实现了MD5算法，由于以前没接触过如何实现MD5算法，在分析这段代码上还是遇到了很大困难的，不过我们在实现过程中完全不必自己实现MD5加密算法，我们可以直接使用各个语言上的加密库实现MD5加密。
https://y.qq.com/component/m/qmfe-security-sign/index.umd.js?max_age=2592000:formatted