文章总结： 本文讲解JS逆向反混淆练习平台第二题的解题过程，通过抓包分析发现动态cookie字段m，定位混淆代码并还原逻辑。关键发现是m值通过魔改MD5算法计算时间戳生成，文章提供完整Python实现代码，包括自定义MD5算法和请求流程，最终成功获取数据。建议使用魔改浏览器跳过debugger，结合AI工具辅助代码转换提升效率。
综合评分： 78
文章分类： 逆向分析,实战经验,爬虫,WEB安全

JS逆向|逆向反混淆练习平台第二题加密参数并获取数据

原创

悦来客栈的老板
悦来客栈的老板

菜鸟学Python编程

2026年3月29日 21:00
湖北

关注它，不迷路。

本文章中所有内容仅供学习交流，不可用于任何商业用途和非法用途，否则后果自负，如有侵权，请联系作者立即删除！

为啥不用AI来逆向？因为古法逆向，用的时间更少。

一.题目地址

https://match.yuanrenxue.cn/match/2

二.抓包分析

打开控制台后，抓包分析，停在debugger位置:

当你只是想分析加密参数的接口时，可以使用魔改的浏览器来跳过这个debugger。

题目说的是动态cookie,使用魔改的浏览器抓包后发现有个 m 字段:

定位到混淆代码，直接彻底还原即可清晰的看到 m 的赋值过程:

这里注意到 _0xd38b9f 函数，它每次返回的时间戳都是不一样的。

过程:

第一次请求:

https://match.yuanrenxue.cn/api/question/2?page=1&pageSize=10&kw=

这个接口，会返回上面的混淆js，并根据时间戳计算出 m 的值。然后带着 m 的cookie 值再次访问这个接口，就可以拿到正确的data了。

三.请求源码

使用AI将还原的js代码处理Python纯算代码，方便程序调用:

import&nbsp;reimport&nbsp;jsonimport&nbsp;randomimport&nbsp;timeimport&nbsp;requests
session = requests.Session()

session.headers = {&nbsp; &nbsp;&nbsp;"User-Agent":&nbsp;"yuanrenxue",
}
session.cookies.set('sessionid','你的sessionid')
def&nbsp;to_int32(value:&nbsp;int) ->&nbsp;int:&nbsp; &nbsp; value &=&nbsp;0xFFFFFFFF&nbsp; &nbsp;&nbsp;return&nbsp;value&nbsp;if&nbsp;value <&nbsp;0x80000000&nbsp;else&nbsp;value -&nbsp;0x100000000

def&nbsp;unsigned_rshift(value:&nbsp;int, bits:&nbsp;int) ->&nbsp;int:&nbsp; &nbsp;&nbsp;return&nbsp;(value &&nbsp;0xFFFFFFFF) >> bits

def&nbsp;safe_add(x:&nbsp;int, y:&nbsp;int) ->&nbsp;int:&nbsp; &nbsp; x = to_int32(x)&nbsp; &nbsp; y = to_int32(y)&nbsp; &nbsp; low = (x &&nbsp;0xFFFF) + (y &&nbsp;0xFFFF)&nbsp; &nbsp; high = (x >>&nbsp;16) + (y >>&nbsp;16) + (low >>&nbsp;16)&nbsp; &nbsp;&nbsp;return&nbsp;to_int32((high <<&nbsp;16) | (low &&nbsp;0xFFFF))

def&nbsp;bit_rol(value:&nbsp;int, shift:&nbsp;int) ->&nbsp;int:&nbsp; &nbsp; value = to_int32(value)&nbsp; &nbsp;&nbsp;return&nbsp;to_int32(((value << shift) &&nbsp;0xFFFFFFFF) | unsigned_rshift(value,&nbsp;32&nbsp;- shift))

def&nbsp;md5_cmn(q:&nbsp;int, a:&nbsp;int, b:&nbsp;int, x:&nbsp;int, s:&nbsp;int, t:&nbsp;int) ->&nbsp;int:&nbsp; &nbsp;&nbsp;return&nbsp;safe_add(bit_rol(safe_add(safe_add(a, q), safe_add(x, t)), s), b)

def&nbsp;md5_ff(a:&nbsp;int, b:&nbsp;int, c:&nbsp;int, d:&nbsp;int, x:&nbsp;int, s:&nbsp;int, t:&nbsp;int) ->&nbsp;int:&nbsp; &nbsp;&nbsp;return&nbsp;md5_cmn((b & c) | (~b & d), a, b, x, s, t)

def&nbsp;md5_gg(a:&nbsp;int, b:&nbsp;int, c:&nbsp;int, d:&nbsp;int, x:&nbsp;int, s:&nbsp;int, t:&nbsp;int) ->&nbsp;int:&nbsp; &nbsp;&nbsp;return&nbsp;md5_cmn((b & d) | (c & ~d), a, b, x, s, t)

def&nbsp;md5_hh(a:&nbsp;int, b:&nbsp;int, c:&nbsp;int, d:&nbsp;int, x:&nbsp;int, s:&nbsp;int, t:&nbsp;int) ->&nbsp;int:&nbsp; &nbsp;&nbsp;return&nbsp;md5_cmn(b ^ c ^ d, a, b, x, s, t)

def&nbsp;md5_ii(a:&nbsp;int, b:&nbsp;int, c:&nbsp;int, d:&nbsp;int, x:&nbsp;int, s:&nbsp;int, t:&nbsp;int) ->&nbsp;int:&nbsp; &nbsp;&nbsp;return&nbsp;md5_cmn(c ^ (b | ~d), a, b, x, s, t)

def&nbsp;str_to_binl(raw:&nbsp;str) ->&nbsp;list[int]:&nbsp; &nbsp; words:&nbsp;list[int] = []&nbsp; &nbsp; bit_len =&nbsp;8&nbsp;*&nbsp;len(raw)&nbsp; &nbsp;&nbsp;for&nbsp;bit_index&nbsp;in&nbsp;range(0, bit_len,&nbsp;8):&nbsp; &nbsp; &nbsp; &nbsp; word_index = bit_index >>&nbsp;5&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;while&nbsp;len(words) <= word_index:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; words.append(0)&nbsp; &nbsp; &nbsp; &nbsp; words[word_index] = to_int32(&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; words[word_index] | ((ord(raw[bit_index //&nbsp;8]) &&nbsp;0xFF) << (bit_index %&nbsp;32))&nbsp; &nbsp; &nbsp; &nbsp; )&nbsp; &nbsp;&nbsp;return&nbsp;words

def&nbsp;binl_to_str(words:&nbsp;list[int]) ->&nbsp;str:&nbsp; &nbsp; chars:&nbsp;list[str] = []&nbsp; &nbsp; total_bits =&nbsp;32&nbsp;*&nbsp;len(words)&nbsp; &nbsp;&nbsp;for&nbsp;bit_index&nbsp;in&nbsp;range(0, total_bits,&nbsp;8):&nbsp; &nbsp; &nbsp; &nbsp; chars.append(chr(unsigned_rshift(words[bit_index >>&nbsp;5], bit_index %&nbsp;32) &&nbsp;0xFF))&nbsp; &nbsp;&nbsp;return&nbsp;"".join(chars)

def&nbsp;core_modified_md5(words:&nbsp;list[int], bit_len:&nbsp;int) ->&nbsp;list[int]:&nbsp; &nbsp; words = words[:]
&nbsp; &nbsp; pad_index = bit_len >>&nbsp;5&nbsp; &nbsp;&nbsp;while&nbsp;len(words) <= pad_index:&nbsp; &nbsp; &nbsp; &nbsp; words.append(0)&nbsp; &nbsp; words[pad_index] = to_int32(words[pad_index] | (0x80&nbsp;<< (bit_len %&nbsp;32)))
&nbsp; &nbsp; length_index =&nbsp;14&nbsp;+ (((bit_len +&nbsp;64) >>&nbsp;9) <<&nbsp;4)&nbsp; &nbsp;&nbsp;while&nbsp;len(words) <= length_index:&nbsp; &nbsp; &nbsp; &nbsp; words.append(0)&nbsp; &nbsp; words[length_index] = bit_len&nbsp; &nbsp;&nbsp;while&nbsp;len(words) %&nbsp;16&nbsp;!=&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp; words.append(0)
&nbsp; &nbsp; a =&nbsp;1732584193&nbsp; &nbsp; b = -271733879&nbsp; &nbsp; c = -1732584194&nbsp; &nbsp; d =&nbsp;271733878
&nbsp; &nbsp;&nbsp;for&nbsp;i&nbsp;in&nbsp;range(0,&nbsp;len(words),&nbsp;16):&nbsp; &nbsp; &nbsp; &nbsp; old_a = a&nbsp; &nbsp; &nbsp; &nbsp; old_b = b&nbsp; &nbsp; &nbsp; &nbsp; old_c = c&nbsp; &nbsp; &nbsp; &nbsp; old_d = d
&nbsp; &nbsp; &nbsp; &nbsp; a = md5_ff(a, b, c, d, words[i],&nbsp;7, -680876936)&nbsp; &nbsp; &nbsp; &nbsp; d = md5_ff(d, a, b, c, words[i +&nbsp;1],&nbsp;12, -389564586)&nbsp; &nbsp; &nbsp; &nbsp; c = md5_ff(c, d, a, b, words[i +&nbsp;2],&nbsp;17,&nbsp;606105819)&nbsp; &nbsp; &nbsp; &nbsp; b = md5_ff(b, c, d, a, words[i +&nbsp;3],&nbsp;22, -1044525330)&nbsp; &nbsp; &nbsp; &nbsp; a = md5_ff(a, b, c, d, words[i +&nbsp;4],&nbsp;7, -176418897)&nbsp; &nbsp; &nbsp; &nbsp; d = md5_ff(d, a, b, c, words[i +&nbsp;5],&nbsp;12,&nbsp;1200080426)&nbsp; &nbsp; &nbsp; &nbsp; c = md5_ff(c, d, a, b, words[i +&nbsp;6],&nbsp;17, -1473231341)&nbsp; &nbsp; &nbsp; &nbsp; b = md5_ff(b, c, d, a, words[i +&nbsp;7],&nbsp;22, -45705983)&nbsp; &nbsp; &nbsp; &nbsp; a = md5_ff(a, b, c, d, words[i +&nbsp;8],&nbsp;7,&nbsp;1770010416)&nbsp; &nbsp; &nbsp; &nbsp; d = md5_ff(d, a, b, c, words[i +&nbsp;9],&nbsp;12, -1958414417)&nbsp; &nbsp; &nbsp; &nbsp; c = md5_ff(c, d, a, b, words[i +&nbsp;10],&nbsp;17, -42063)&nbsp; &nbsp; &nbsp; &nbsp; b = md5_ff(b, c, d, a, words[i +&nbsp;11],&nbsp;22, -1990404162)&nbsp; &nbsp; &nbsp; &nbsp; a = md5_ff(a, b, c, d, words[i +&nbsp;12],&nbsp;7,&nbsp;1804603682)&nbsp; &nbsp; &nbsp; &nbsp; d = md5_ff(d, a, b, c, words[i +&nbsp;13],&nbsp;12, -40341101)&nbsp; &nbsp; &nbsp; &nbsp; c = md5_ff(c, d, a, b, words[i +&nbsp;14],&nbsp;17, -1502882290)&nbsp; &nbsp; &nbsp; &nbsp; b = md5_ff(b, c, d, a, words[i +&nbsp;15],&nbsp;22,&nbsp;1236535329)&nbsp; &nbsp; &nbsp; &nbsp; a = md5_gg(a, b, c, d, words[i +&nbsp;1],&nbsp;5, -165796510)&nbsp; &nbsp; &nbsp; &nbsp; d = md5_gg(d, a, b, c, words[i +&nbsp;6],&nbsp;9, -1069501632)&nbsp; &nbsp; &nbsp; &nbsp; c = md5_gg(c, d, a, b, words[i +&nbsp;11],&nbsp;14,&nbsp;643717713)&nbsp; &nbsp; &nbsp; &nbsp; b = md5_gg(b, c, d, a, words[i],&nbsp;20, -373897302)&nbsp; &nbsp; &nbsp; &nbsp; a = md5_gg(a, b, c, d, words[i +&nbsp;5],&nbsp;5, -701558691)&nbsp; &nbsp; &nbsp; &nbsp; d = md5_gg(d, a, b, c, words[i +&nbsp;10],&nbsp;9,&nbsp;38016083)&nbsp; &nbsp; &nbsp; &nbsp; c = md5_gg(c, d, a, b, words[i +&nbsp;15],&nbsp;14, -660478335)&nbsp; &nbsp; &nbsp; &nbsp; b = md5_gg(b, c, d, a, words[i +&nbsp;4],&nbsp;20, -405537848)&nbsp; &nbsp; &nbsp; &nbsp; a = md5_gg(a, b, c, d, words[i +&nbsp;9],&nbsp;5,&nbsp;568446438)&nbsp; &nbsp; &nbsp; &nbsp; d = md5_gg(d, a, b, c, words[i +&nbsp;14],&nbsp;9, -1019803690)&nbsp; &nbsp; &nbsp; &nbsp; c = md5_gg(c, d, a, b, words[i +&nbsp;3],&nbsp;14, -187363961)&nbsp; &nbsp; &nbsp; &nbsp; b = md5_gg(b, c, d, a, words[i +&nbsp;8],&nbsp;20,&nbsp;1163531501)&nbsp; &nbsp; &nbsp; &nbsp; a = md5_gg(a, b, c, d, words[i +&nbsp;13],&nbsp;5, -1444681467)&nbsp; &nbsp; &nbsp; &nbsp; d = md5_gg(d, a, b, c, words[i +&nbsp;2],&nbsp;9, -51403784)&nbsp; &nbsp; &nbsp; &nbsp; c = md5_gg(c, d, a, b, words[i +&nbsp;7],&nbsp;14,&nbsp;1735328473)&nbsp; &nbsp; &nbsp; &nbsp; b = md5_gg(b, c, d, a, words[i +&nbsp;12],&nbsp;20, -1926607734)&nbsp; &nbsp; &nbsp; &nbsp; a = md5_hh(a, b, c, d, words[i +&nbsp;5],&nbsp;4, -378558)&nbsp; &nbsp; &nbsp; &nbsp; d = md5_hh(d, a, b, c, words[i +&nbsp;8],&nbsp;11, -2022574463)&nbsp; &nbsp; &nbsp; &nbsp; c = md5_hh(c, d, a, b, words[i +&nbsp;11],&nbsp;16,&nbsp;1839030562)&nbsp; &nbsp; &nbsp; &nbsp; b = md5_hh(b, c, d, a, words[i +&nbsp;14],&nbsp;23, -35309556)&nbsp; &nbsp; &nbsp; &nbsp; a = md5_hh(a, b, c, d, words[i +&nbsp;1],&nbsp;4, -1530992060)&nbsp; &nbsp; &nbsp; &nbsp; d = md5_hh(d, a, b, c, words[i +&nbsp;4],&nbsp;11,&nbsp;1272893353)&nbsp; &nbsp; &nbsp; &nbsp; c = md5_hh(c, d, a, b, words[i +&nbsp;7],&nbsp;16, -155497632)&nbsp; &nbsp; &nbsp; &nbsp; b = md5_hh(b, c, d, a, words[i +&nbsp;10],&nbsp;23, -1094730640)&nbsp; &nbsp; &nbsp; &nbsp; a = md5_hh(a, b, c, d, words[i +&nbsp;13],&nbsp;4,&nbsp;681279174)&nbsp; &nbsp; &nbsp; &nbsp; d = md5_hh(d, a, b, c, words[i],&nbsp;11, -358537222)&nbsp; &nbsp; &nbsp; &nbsp; c = md5_hh(c, d, a, b, words[i +&nbsp;3],&nbsp;16, -722521979)&nbsp; &nbsp; &nbsp; &nbsp; b = md5_hh(b, c, d, a, words[i +&nbsp;6],&nbsp;23,&nbsp;76029189)&nbsp; &nbsp; &nbsp; &nbsp; a = md5_hh(a, b, c, d, words[i +&nbsp;9],&nbsp;4, -640364487)&nbsp; &nbsp; &nbsp; &nbsp; d = md5_hh(d, a, b, c, words[i +&nbsp;12],&nbsp;11, -421815835)&nbsp; &nbsp; &nbsp; &nbsp; c = md5_hh(c, d, a, b, words[i +&nbsp;15],&nbsp;16,&nbsp;530742520)&nbsp; &nbsp; &nbsp; &nbsp; b = md5_hh(b, c, d, a, words[i +&nbsp;2],&nbsp;23, -995338651)&nbsp; &nbsp; &nbsp; &nbsp; a = md5_ii(a, b, c, d, words[i],&nbsp;6, -198630844)&nbsp; &nbsp; &nbsp; &nbsp; d = md5_ii(d, a, b, c, words[i +&nbsp;7],&nbsp;10,&nbsp;1126891415)&nbsp; &nbsp; &nbsp; &nbsp; c = md5_ii(c, d, a, b, words[i +&nbsp;14],&nbsp;15, -1416354905)&nbsp; &nbsp; &nbsp; &nbsp; b = md5_ii(b, c, d, a, words[i +&nbsp;5],&nbsp;21, -57434055)&nbsp; &nbsp; &nbsp; &nbsp; a = md5_ii(a, b, c, d, words[i +&nbsp;12],&nbsp;6,&nbsp;1700485571)&nbsp; &nbsp; &nbsp; &nbsp; d = md5_ii(d, a, b, c, words[i +&nbsp;3],&nbsp;10, -1894986606)&nbsp; &nbsp; &nbsp; &nbsp; c = md5_ii(c, d, a, b, words[i +&nbsp;10],&nbsp;15, -1051523)&nbsp; &nbsp; &nbsp; &nbsp; b = md5_ii(b, c, d, a, words[i +&nbsp;1],&nbsp;21, -2054922799)&nbsp; &nbsp; &nbsp; &nbsp; a = md5_ii(a, b, c, d, words[i +&nbsp;8],&nbsp;6,&nbsp;1873313359)&nbsp; &nbsp; &nbsp; &nbsp; d = md5_ii(d, a, b, c, words[i +&nbsp;15],&nbsp;10, -30611744)&nbsp; &nbsp; &nbsp; &nbsp; c = md5_ii(c, d, a, b, words[i +&nbsp;6],&nbsp;15, -1560198380)&nbsp; &nbsp; &nbsp; &nbsp; b = md5_ii(b, c, d, a, words[i +&nbsp;13],&nbsp;21,&nbsp;1309151649)&nbsp; &nbsp; &nbsp; &nbsp; a = md5_ii(a, b, c, d, words[i +&nbsp;4],&nbsp;6, -145523070)&nbsp; &nbsp; &nbsp; &nbsp; d = md5_ii(d, a, b, c, words[i +&nbsp;11],&nbsp;10, -1120210379)&nbsp; &nbsp; &nbsp; &nbsp; c = md5_ii(c, d, a, b, words[i +&nbsp;2],&nbsp;15,&nbsp;718787259)&nbsp; &nbsp; &nbsp; &nbsp; b = md5_ii(b, c, d, a, words[i +&nbsp;9],&nbsp;21, -343485441)
&nbsp; &nbsp; &nbsp; &nbsp; a = safe_add(a, old_a)&nbsp; &nbsp; &nbsp; &nbsp; b = safe_add(b, old_b)&nbsp; &nbsp; &nbsp; &nbsp; c = safe_add(c, old_c)&nbsp; &nbsp; &nbsp; &nbsp; d = safe_add(d, old_d)
&nbsp; &nbsp;&nbsp;return&nbsp;[a, b, c, d]

def&nbsp;utf8_to_js_raw(value:&nbsp;str) ->&nbsp;str:&nbsp; &nbsp;&nbsp;return&nbsp;str(value).encode("utf-8").decode("latin1")

def&nbsp;modified_md5_hex(value:&nbsp;str) ->&nbsp;str:&nbsp; &nbsp; raw = utf8_to_js_raw(value)&nbsp; &nbsp; digest = binl_to_str(core_modified_md5(str_to_binl(raw),&nbsp;8&nbsp;*&nbsp;len(raw)))&nbsp; &nbsp; hex_chars =&nbsp;"0123456789abcdef"&nbsp; &nbsp; parts:&nbsp;list[str] = []&nbsp; &nbsp;&nbsp;for&nbsp;ch&nbsp;in&nbsp;digest:&nbsp; &nbsp; &nbsp; &nbsp; code =&nbsp;ord(ch)&nbsp; &nbsp; &nbsp; &nbsp; parts.append(hex_chars[(code >>&nbsp;4) &&nbsp;0x0F] + hex_chars[code &&nbsp;0x0F])&nbsp; &nbsp;&nbsp;return&nbsp;"".join(parts)
def&nbsp;main() ->&nbsp;None:
&nbsp; &nbsp; pattern =&nbsp;r'return 0x[0-9A-Fa-f]{11}'&nbsp; &nbsp; cookie_url =&nbsp;"https://match.yuanrenxue.cn/api/question/2?page=1&pageSize=10&kw="&nbsp; &nbsp; res = session.get(cookie_url)&nbsp; &nbsp;&nbsp;match&nbsp;= re.search(pattern, res.text)
&nbsp; &nbsp;&nbsp;if&nbsp;(match):&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; group1 =&nbsp;match.group()
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; timestamp =&nbsp;int(group1[7:],16)
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; value = modified_md5_hex(str(timestamp)) +&nbsp;f"|{timestamp}; path=/"
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; session.cookies.set('m',value)
&nbsp; &nbsp; total =&nbsp;0&nbsp; &nbsp;&nbsp;for&nbsp;i&nbsp;in&nbsp;range(1,6):&nbsp; &nbsp; &nbsp; &nbsp; cookie_url =&nbsp;f"https://match.yuanrenxue.cn/api/question/2?page={i}&pageSize=10&kw="&nbsp; &nbsp; &nbsp; &nbsp; res = session.get(cookie_url)&nbsp; &nbsp; &nbsp; &nbsp; data = &nbsp;res.json()["data"]&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;print&nbsp;(i,res.json()['data'])&nbsp; &nbsp; &nbsp; &nbsp; total +=sum(data)&nbsp; &nbsp;&nbsp;print&nbsp;(total)

if&nbsp;__name__ ==&nbsp;"__main__":&nbsp; &nbsp; main()

可以拿到结果:

做这道题，依然用到了AI，已经离不开它了。

今天的分享就到这里，感谢阅读。

欢迎加入知识星球，学习更多AST和爬虫技巧。

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：菜鸟学Python编程悦来客栈的老板
悦来客栈的老板《JS逆向|逆向反混淆练习平台第二题加密参数并获取数据》

Tags: WEB安全实战经验爬虫逆向分析

你可能错过

Podman曝CVSS 10.0严重容器逃逸漏洞(CVE-2026-94603)，恶意镜像可绕过沙箱限制

macOS SMB 内核漏洞 CVE-2026-84543：详情与概念验证（PoC）漏洞利用代码发布

三种鲜为人知的持久化技术剖析

关于新型僵尸网络FlyLegit大范围传播的风险提示