python爬虫：小程序逆向实战教程

根据我之前发表的文章，我们进行延伸实战 https://blog.csdn.net/weixin_64809364/article/details/146981598?spm=1001.2014.3001.5501

1. 想要爬取什么小程序，我们进行搜索

2. 找到我们vx小程序的文件地址，我们就可以进行破解

• 破解步骤强看一下上一篇文章：开头的网址
• 下面图片就是我们破解成功的图片

3. 使用微信开发者工具打开我们的破解之后的小程序（根据下面的图片勾选配置，不然会影响你的账号）

4. 如果控制台没有报错或者左侧直接可以加载出来，我们小程序的界面，这时候我们的前期工作就已经完毕，接下来就是js请求加密、解密，获取批量数据*（注意：不要干扰小程序的正常运行，违法行为）*

5. 我们先进行响应解密

• 通过输出，我们可以看出来需要响应解密（我们先进行入口定位）：这里我们采用关键字搜索decrypt(

• 通过关键字搜索，我们找到了，响应解密入口，看到iv，我们就可以猜到它使用了AES加密算法，我们就可以使用AES进行解密
• 将图片中的代码复制粘贴，放到pycahrm中进行调试，并且再python中获得加密值，我们进行测试，最终效果如下：

const CryptoJS = require("crypto-js")

function i(e, n) {
    var r = "WAG0JIUGYALACVJF"
        , i = CryptoJS.enc.Utf8.parse(r) // key
        , t = CryptoJS.enc.Utf8.parse(n); // iv
    return CryptoJS.AES.decrypt(e, i, {
        iv: t,
        mode: CryptoJS.mode.CBC,
        padding: CryptoJS.pad.Pkcs7
    }).toString(CryptoJS.enc.Utf8)
}

// 响应解密测试
e = "TwTu0RHcacQCBBjk7NHDtzo7sCA5v/gnk6Acz+7xaWdSLEUSAAsPx4dCrw/jbVLIANinR0oHq9jjnjjAWxX89xH6fivgNQfCAudgqV1JGUWKfe1u1co2qIEm639luWnGfQPqYyhyz7qbDpbP9XwUWrjnlo2+Knunwky5NsejyfO5ZG9963VDgFaxeD9GVf1RxTmkm5cFQMUvnQt64TsVfPJB4Rz0gXnvDKqL/+iyHbeVkUUnyRpJ8Y6osdw5LxSZoHjpH1qck7ulQWhRC3cI8GLQ6alWt3TdJOfDJpjqLDZqw++WZGNp5gmPjTRRbyOMZjg+ZYFAq1dMCA5OJR1gT2rZSp6hgwp7OHlpih/V1kuVkHM/CRWzETGkAoZM7dnUpr99poNjkTeBPudGnJ2viapj5qlPsxUIwF3UJgJJUk0c22QOQzU8bwrXz6/LXQRtOJveNBNcl6K1Z6SDYxv9+BFlXvKuCsagpL+8jWaYtl5LuPSmXv4PbwqBBlrt+fVhgmmKB959hbp5NJmCN4vGIl/I4lDQKtmI9yL0L3AjRLkhLVPb0VzgPxtrxvg7YlG5R3n0nwkgmxQzp/tGFI+S83+ZewLFf2UxSQChumeHcQm+Vepsz9RwT6winTG07LcHTsPga554Fz/enZgvJ2BB0AISV+4mo12yVOAbF49oIKM5sOlmlavpEB5jGRqeGWGEiFXtwpFE8DQ+fgIAH4QQDQkYdLxEgqSdaQvh/azd7/fAIi5DMxryrTTRHnLXq4dxdEOGVpdA9PA8wDMD0ULPYM3y5hNS2ehj/vl/lIjC/mObC6tXF+i5LjUcSMrvsFEXfdF87hqWjoVW7LYHZlgShM+duTIqmxlztkWXQxNbFZw/mydHZZlmIu0jbP00xZEiBDiqPvtV3Z/GTK5KfUMLfzG5ClZHM0W6G2aVz9HT8BXFEX/h0L6GcJjrrHBieKyueUGg7YzYSfG2CEiu1tRMN15fNhNt1VSp9gUgiv4tkUg5avd6G28o99JxfLjZZ8hnOw7YduhWU3x3SLzUj4IFs+PIQxZzcZI5/UpJ5vqfgU8BBk6jqBhGCxInBDLA8sKu4vhAcQvYzsMBv+b26gHzqWP7Jr6vSDwJ/J02KNeieSS7RvsEt8mOHmyjqE6jnlbGgdB3CB6Sq3CL3Qb/v10DAnhFSPmqAWSlc91LCfU6uRGsWELzNQdo7Q8DiOyn1R1JaTyGyXU2zFGyKZ2uzHsng2xVBRyP+Qpd+VMq2wHBKM/ZGmhQ0e5anIxXi/yO7imsruX1ayUGvQJB+MQFCWj4BVKLNpsu2Ftn/mm6YbZfvmTePgwg3+TIal+yKQwNCLH753DVpn4/vJ+FMQkgvW5vmw/qI25oi5ZvgwTSrd3qh1ZceOreg301+VkV8EiJ3D3bV0qUFz20tf9LCwtx4I+wDvA18XMJFWq3Z6XQ7YARPALh2x494r4WML2xY2d2lDzVwsX13pdBmIw35MXndZ5THBvAhz6GCSM3V0aLnr1ldC62VuGwcTXYNzFhGBy12c9NBHX4BjCXcP6TD67xxtN+pGo5eOuvKPbgoC9+TJN5Yae5jWmRx8SUnUcwDYC3ARb/gqnUryyjPzoeh2QxB+71vuXr2aUXVmEy2TAhI34vZZRQpxbKhBpxTxwCxO6U0P5en4oSWnxqNT8hsoxCVjzOFnDGzVKuVQyhav9M4y/VWx84bonQy+iGdZ3KCxqg45KdRtKD0bT2rrlEuq1vRBacv//sLK2Nc8tKHpsxDeAGvRbryG0vPVu8ijY7bpJ+uvWoiSZraIX+E2401e9m5ikqxX9RTiEFUbYbowqnK6Uvtjc94CmBQHNxrgkJiNSBbQbU1iAptE5r1Eu4IwYLAyuxHCxnhJsrw1vDBu3IAKIDsDTt1QMsTGoCT84fiXXJa0Q7N7sYtrCv8JQoMwpdcB1fsrKdfb12Qi7uksOy7mMY7IRv0RXcCgBt9pnkG2MttidRPoI5jxNdZRpuyN8fiy1Qunun2ByTA2/aajt9gsDFMl/6cGByvvKuJR1hnOKvw1v5TBDla+N9aObEBTiapEiqoMlp/vHeQg9CVgJf/LSuClU8U6E7wc/skyLQNMIK9LbcrFaq74EvRaHzp99fqyhdEoYFpPhYPCltZRrh71wZuuQKtYxQIoIAbwbZQ8dkHiqGiZNjJ/vG6W2JMUU7qihFZdDLRNCj9pObYSGoS5s7G+06bKpaPi7Mf1NQfOzRGCFnGiLeEaxbTWMF0uZvFp6EjeUwElK5Ed6H8HBiC+jCRx4="
n = "HVK6TCJKWBLYFT2T"

• 然后我们使用python的第三方模块，使用python调用js代码
• 安装第三方模块：pip install execjs
• 我们在使用前要导入以下代码（在windows电脑下，mac不需要）：

import subprocess
from functools import partial

subprocess.Popen = partial(subprocess.Popen, encoding="utf-8")

import execjs

# -*- coding: utf-8 -*-
# coding=utf-8
import base64

import requests
import time
import subprocess
from functools import partial

subprocess.Popen = partial(subprocess.Popen, encoding="utf-8")

import execjs

headers = {
    'authority': 'min-api.xliii.cn',
    'user-agent': 'Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.0 Mobile/15E148 Safari/604.1 wechatdevtools/1.06.2407110 MicroMessenger/8.0.5 Language/zh_CN webview/',
    'content-type': 'application/json',
    'accept': '*/*',
    'sec-fetch-site': 'cross-site',
    'sec-fetch-mode': 'cors',
    'sec-fetch-dest': 'empty',
    'referer': '',
}

params = {
    'requestData': '3x5T5fobv/lgYOMehTSyKGQD547tWeTGXItoZhgPp0fdGFU9fLYHyxyriTtogilHi2THpYQGaGYne7kTTUQ/vAcuyg03cf2ijUKRdbV9DNcxl17qsxy3PXtIHU2jYIBNv7g7bywLOSKdhrOlSIpDEM2PVCfOGbirswA0LP1wlTM=',
    'iv': 'zbdozs4sjdtIxKmY',
}

response = requests.get('', params=params, headers=headers)
ret = response.json().get('data')
b64 = ret.get('data')
# print(b64)

# 响应解密
with open("APP_decrypt.js", encoding="utf8") as f:
    jsCode = f.read()
js_compile = execjs.compile(jsCode)
n = "HVK6TCJKWBLYFT2T"
ret = js_compile.call("i", str(b64), n)
print(ret)

• 展示效果如下，我们可以获取到数据了：

6. 我们在进行请求加密

• 我们在network中发现，要使用请求加密，所以我们直接使用关键字搜索

• 我们把所需要的代码复制到pycharm中进行分析调试
• 最终效果如下：

// 请求加密
const CryptoJS = require("crypto-js")

let c = '{"res_id": 88038, "appid": "wx41cd4f32cf8164b3", "ver": "7.0.0", "min_push": 0, "scene": 1001}'


function t(e, n) {
    var r = "WAG0JIUGYALACVJF"
        , i = CryptoJS.enc.Utf8.parse(r)
        , t = CryptoJS.enc.Utf8.parse(n);
    return CryptoJS.AES.encrypt(e, i, {
        iv: t,
        mode: CryptoJS.mode.CBC,
        padding: CryptoJS.pad.Pkcs7
    }).toString()
}

function d() {
    for (var e = "", a = ["1", "2", "4", "5", "3", "8", "0", "7", "9", "6", "A", "Q", "W", "E", "R", "T", "Y", "U", "I", "O", "P", "S", "D", "F", "G", "H", "J", "K", "L", "q", "w", "S", "e", "a", "s", "d", "z", "x", "c", "v", "f", "r", "t", "g", "b", "y", "h", "n", "m", "j", "u", "i", "o", "k", "l", "p"], n = 0; n < 16; n++)
        e += a[(Math.random() * (a.length - 1)).toFixed(0)];
    return e
}

let u = d()
// console.log(ret)
function s(){
    return {
        'requestData':t(c,u,undefined),
        'iv':u
    }
}

console.log(s())

• 然后我们也搬到python中，使用python进行调试：

7.完整代码如下：

# -*- coding: utf-8 -*-
# coding=utf-8
import base64

import requests
import time
import subprocess
from functools import partial

subprocess.Popen = partial(subprocess.Popen, encoding="utf-8")

import execjs

headers = {
    'authority': 'min-api.xliii.cn',
    'user-agent': 'Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.0 Mobile/15E148 Safari/604.1 wechatdevtools/1.06.2407110 MicroMessenger/8.0.5 Language/zh_CN webview/',
    'content-type': 'application/json',
    'accept': '*/*',
    'sec-fetch-site': 'cross-site',
    'sec-fetch-mode': 'cors',
    'sec-fetch-dest': 'empty',
    'referer': '',
}

params = {
    'requestData': '3x5T5fobv/lgYOMehTSyKGQD547tWeTGXItoZhgPp0fdGFU9fLYHyxyriTtogilHi2THpYQGaGYne7kTTUQ/vAcuyg03cf2ijUKRdbV9DNcxl17qsxy3PXtIHU2jYIBNv7g7bywLOSKdhrOlSIpDEM2PVCfOGbirswA0LP1wlTM=',
    'iv': 'zbdozs4sjdtIxKmY',
}

response = requests.get('', params=params, headers=headers)
ret = response.json().get('data')
b64 = ret.get('data')
# print(b64)

# 响应解密
with open("APP_decrypt.js", encoding="utf8") as f:
    jsCode = f.read()
js_compile = execjs.compile(jsCode)
n = "HVK6TCJKWBLYFT2T"
ret = js_compile.call("i", str(b64), n)
print(ret)