目标站点：

aHR0cHM6Ly9hcHAuZGlhbmRpYW4uY29tL3JhbmsvZ29vZ2xlcGxheS8xMS00LTAtMjQtMQ==

请求接口及加密参数：

• 请求接口种类：

  • https://api.diandian.com/pc/app/v1/rank 榜单数据

  • https://api.diandian.com/pc/app/v1/app/more 详情页接口

参数：

• https://api.diandian.com/pc/app/v1/rank

  • S, k, l 值均有主页面请求获得：https://app.diandian.com/rank/googleplay/

  params = {
      "market_id": 11,
      "genre_id": app_categories[category],
      "country_id": country_id,
      "device_id": 0,
      "page": page,
      "time": int(time.time()),
      "rank_type": rank_type,
      "brand_id": brand_id
  }
  
  n = {
      "sort": "dd",
      "num": 10,
      "s": s,
      "k": k,
      "l": l,
      "d": 0
  }
  ```-
  https://api.diandian.com/pc/app/v1/app/more
  
  ```JSON
  params = {
      "id": app_id,
      "country_id": country_id,
      "language_id": 12
  }
  
  n = {
      "sort": "dd",
      "num": 10,
      "s": s,
      "k": k,
      "l": l,
      "d": 0
  }
  ```-
  打xhr断点，找入口
  
  

进入上方断点后，向下单步调试，会发现进入该方法内： 可以在webpack分发器后手动插入函数，实现掉包自吐（或者直接打日志断点）：示例代码如下：

let t_= t;
var func_dict = {};
t = function(cc){
    console.log("开始调用函数",cc)
    if (Object.keys(func_dict).indexOf(cc) == -1){
        func_dict[cc] = o[cc].toString()
    }
return t_(cc)

然后跳到加密函数加载的位置，就能自吐出调用函数

JS 加密源码（不予展示，只做学习使用）

代码调用示例：

url = 'https://app.diandian.com/rank/googleplay/'
status_code, response = self.get_response(url)
res = response.text
infos = re.findall("u:(.*?),activeNav", res)[0]
s = re.findall('s:"(.*?)",', infos)[0]
k = re.findall('k:"(.*?)",', infos)[0]
l = re.findall('l:"(.*?)",', infos)[0]
print(s, k, l)
n = {
    "sort": "dd",
    "num": 10,
    "s": s,
    "k": k,
    "l": l,
    "d": 0
}
with open("diandian.js", 'r', encoding="utf8") as f:
    jstext = f.read()
ctx = execjs.compile(jstext)
params = {
    "market_id": 11,
    "genre_id": app_categories[category],
    "country_id": country_id,
    "device_id": 0,
    "page": page,
    "time": int(time.time()),
    "rank_type": rank_type,
    "brand_id": brand_id
}
result = ctx.call('get_result', params, '/v1/rank', n)
print(result)
params.update({"k": result})
status_code, response = self.get_response("https://api.diandian.com/pc/app/v1/rank", params=params)
res = response.json()
print(res)