百度post参数分析（二）完结，dv、traceid的js来源

上一篇已经找到了post参数中的dv来源，今天继续往下看，回顾一上一篇中dv的相关js

v
4000
ar a = document.getElementById("dv_Input")
, c = {
gid: n.guideRandom || "",
username: n._SBCtoDBC(i.value),
countrycode: s,
bdstoken: n.bdPsWtoken,
tpl: n.config.product ? n.config.product : "",
vcodestr: n.getElement("smsHiddenFields_smsVcodestr").value,
vcodesign: n.getElement("smsHiddenFields_smsVcodesign").value,
verifycode: n._SBCtoDBC(n.getElement("confirmVerifyCode").value),
flag_code: n.config.voice_sms_flag,
dv: a ? a.value : window.LG_DV_ARG && window.LG_DV_ARG.dvjsInput || ""
}

dv来源window.LG_DV_ARG.dvjsInput，然后继续往下找LG_DV_ARG

function d(e) {
M && (x = e.token + "@" + S(e, e.token),
(1 & F.SendMethod) > 0 && c(x))
}
function c(n) {
var r = t.getElementById("dv_Input");
r && (r.value = n),
e.LG_DV_ARG.dvjsInput = n
}

其中重要只有x = e.token + “@” + S(e, e.token)

继续找到e.token的生成函数和S函数的源码

b.Token = "tk" + Math.random() + (new Date).getTime(),

function S(e, t) {
var r = new n(t)
, o = {
flashInfo: 0,
mouseDown: 1,
keyDown: 2,
mouseMove: 3,
version: 4,
loadTime: 5,
browserInfo: 6,
token: 7,
location: 8,
screenInfo: 9
}
, a = [r.iary([2])];
for (var i in e) {
var d = e[i];
if (void 0 !== d && void 0 !== o[i]) {
var c;
"number" == typeof d ? (c = d >= 0 ? 1 : 2,
d = r.int(d)) : "boolean" == typeof d ? (c = 3,
d = r.int(d ? 1 : 0)) : "object" == typeof d && d instanceof Array ? (c = 4,
d = r.bary(d)) : (c = 0,
d = r.str(d + "")),
d && a.push(r.iary([o[i], c, d.length]) + d)
}
}
return a.join("")
}

e.token生成很简单，就是随机数加上时间戳；s函数的作用就是拼接e对象里面的几个属性值，我们可以用一个固定值代替s函数的执行结果。

traceid

继续全局查找traceid只有下面js函数可疑，先看看

e.traceID = {
headID: e.traceID && e.traceID.headID || "",
flowID: e.traceID && e.traceID.flowID || "",
cases: e.traceID && e.traceID.cases || "",
initTraceID: function(e) {
var t = this;
e && e.length > 0 ? (t.headID = e.slice(0, 6),
t.flowID = e.slice(6, 8)) : t.destory()
},
createTraceID: function() {
var e = this;
return e.headID + e.flowID + e.cases
},
startFlow: function(e) {
var t = this
, n = t.getFlowID(e);
0 === t.flowID.length || t.flowID === n ? (t.createHeadID(),
t.flowID = n) : t.finishFlow(n)
},
finishFlow: function() {
var e = this;
e.destory()
},
getRandom: function() {
return parseInt(90 * Math.random() + 10, 10)
},
createHeadID: function() {
var e = this
, t = (new Date).getTime() + e.getRandom().toString()
, n = Number(t).toString(16)
, i = n.length
, s = n.slice(i - 6, i).toUpperCase();
e.headID = s
},
getTraceID: function(e) {
var t = this
, n = e && e.traceid || "";
t.initTraceID(n)
},
getFlowID: function(e) {
var t = {
login: "01",
reg: "02"
};
return t[e]
},
setData: function(e) {
var t = this;
return e.data ? e.data.traceid = t.createTraceID() : e.url = e.url + (e.url.indexOf("?") > -1 ? "&" : "?") + "traceid=" + t.createTraceID(),
e
},
destory: function() {
var e = this;
e.headID = "",
e.flowID = ""
}
};

createTraceID:return e.headID + e.flowID + e.cases其中e.case是固定的01，e.headID+e.flowID需要按下面js执行

e.traceID.initTraceID()
undefined
e.traceID.createHeadID()
undefined
e.traceID.createTraceID()
"C23F67"

但是注意e对象定义的时候应该给他赋值，不然返回是空，完整如下

var e = {a: 1, b: 1, c: 1}
e.traceID = {
headID: e.traceID && e.traceID.headID || "",
flowID: e.traceID && e.traceID.flowID || "",
cases: e.traceID && e.traceID.cases || "",
initTraceID: function(e) {
var t = this;
e && e.length > 0 ? (t.headID = e.slice(0, 6),
t.flowID = e.slice(6, 8)) : t.destory()
},

省略········

getFlowID: function(e) {
var t = {
login: "01",
reg: "02"
};
return t[e]
},
setData: function(e) {
var t = this;
return e.data ? e.data.traceid = t.createTraceID() : e.url = e.url + (e.url.indexOf("?") > -1 ? "&" : "?") + "traceid=" + t.createTraceID(),
e
},
destory: function() {
var e = this;
e.headID = "",
e.flowID = ""
}
};
{headID: "", flowID: "", cases: "", initTraceID: ƒ, createTraceID: ƒ, …}
e
{a: 1, b: 1, c: 1, traceID: {…}}
e.traceID.initTraceID
ƒ (e) {
var t = this;
e && e.length > 0 ? (t.headID = e.slice(0, 6),
t.flowID = e.slice(6, 8)) : t.destory()
}

e.traceID.initTraceID()
undefined
e.traceID.createHeadID()
undefined
e.traceID.createTraceID()+"01"
"C23F6701"

至于密码的RSA算法的js分析就不理了，到此百度post的参数分析就完结了。文章是边分析边写，可能有些地方有点混乱，在后面如果有时间的话会在完整是重塑一遍，并用Python完整实现登陆。

ID：Python之战

|作|者|公(zhong)号:python之战

专注Python，专注于网络爬虫、RPA的学习-践行-总结

喜欢研究技术瓶颈并分享，欢迎围观，共同学习。

独学而无友,则孤陋而寡闻！