1、前面几篇文章分析了tls1.3协议，其实原子的加密算法就那么几种，基础的加密套件也就那么几种，关键是根据业务需求和目的灵活组合使用；不知道大家有没有发现一个问题：这些加密套件组合都在TCP层之上，从TCP层开始就没动过了，为啥了? 原因很简单：TCP层及以下都需要硬件支持，换句话说我们从一个节点把数据发到另一个节点，中间可能会经过大量的中转设备，常见的就是交换机和路由器了；这些硬件设备都是按照网络标准设计和制造的。如果我们自己擅自更改TCP层及以下的数据包内容、甚至格式，可能会让这些网络设备识别不了，导致数据包被丢弃！ 所以现在所有的加密套件针对的都是TCP层以上的数据！
通信的三要素：（1）加密让明文变密文，就算被中间人拦截也不担心泄露关键信息 （2）身份认证，确保数据就是对方发的 （3）数据完整，没被篡改！ tls1.3协议已经实现，浏览器和服务器通信时就算数据被第三方拦截，如果没有密钥，第三方也无法解密；所以现在很多外挂hook的时候一般不会再拦截中间的密文，而是等客户端收到、解密后再hook，这比解密密文容易多了！为了应对这种应用层的hook，又衍生出了应用层的保护方式：签名！
在应用层，由于需要给真正的用户展示数据，所以肯定会解密数据，这时再给数据加密已经没有意义了，只会浪费算力！那么怎么才能防止数据被第三方非法获取了？签名（原理类似数字签名）！大概的原理如下：
客户端要给服务端发送请求，肯定会带上很多参数，来标明请求的目的，比如请求商品数据？请求一些音视频? 或者是给谁点个赞？ 或则是评论个啥？这些请求在应用层都是明文的，为了防止被第三方非法调用或篡改，往往会用一些关键的数据做签名，然后把签名和数据一起发给服务器；举个栗子：比如请求参数ts=xxxx&name=xxxx&login=xxxxx¬ice=xxxx等，如果直接这样传输，第三方很容易篡改参数，然后重新发包，达到重放攻击的目的！为了防止这种攻击，目前市面上客户端（比如app、浏览器）最常见的方式就是选几个关键的字段签名，然后请求参数带上签名字段。比如上面有4个参数，选择一种签名算法（可以是hash，也可以是自创的，这种算法主要用于验证或校验，要求不高）把这些参数“加密”（本质就是做个转换），单独形成一个字段，常见的就是sign=xxxxxxx，然后把sign字段和其他参数一起拼接后发给服务器。服务器收到参数后，用同样的方法计算sign字段，如果和客户端发过来的一样，说明没有被篡改（和数字签名的本质是一样的；当然这里是可以破解的，很多黑产就利用了这点），服务器随机返回客户端需要的数据；截至目前，据作者本人逆向的app客户端和很多web站点而言，都会对重要的参数加上签名，包括x音、某宝、并夕夕、某东等都是如此！为了防止这种签名算法被破解，app客户端做了大量的防护工作，android方面最典型的就是：（1）java层变量、类、方法名称混淆 （2）so层加密； windows的客户端也会采取加壳、反调试等方式增加逆向分析和复原签名算法的难度！为了便于理解这种算法的核心思路，这里先找个“软柿子”试试：xx音乐！
2、打开xx音乐的歌手列表，效果如下：标红的这个接口是返回所有歌手列表的接口。如果爬虫想要遍历爬取xx音乐的所有歌曲，第一步就需要遍历所有歌手列表，得到singer_mid的值，后续才能继续进入歌手自己的主页，找到该歌手的所有歌曲！
既然是http接口，就要遵从http协议！http请求头如下：
:authority: xxxxxxxx :method: GET :path: /cgi-bin/musics.fcg?-=getUCGI5650218101004765&g_tk=5381&sign=zzax2nhlf4kqqx2f3fef04bda3a286eeb40136f6b80f4a&loginUin=0&hostUin=0&format=json&inCharset=utf8&outCharset=utf-8¬ice=0&platform=yqq.json&needNewCode=0&data=%7B%22comm%22%3A%7B%22ct%22%3A24%2C%22cv%22%3A0%7D%2C%22singerList%22%3A%7B%22module%22%3A%22Music.SingerListServer%22%2C%22method%22%3A%22get_singer_list%22%2C%22param%22%3A%7B%22area%22%3A-100%2C%22sex%22%3A-100%2C%22genre%22%3A-100%2C%22index%22%3A-100%2C%22sin%22%3A0%2C%22cur_page%22%3A1%7D%7D%7D :scheme: https accept: application/json, text/javascript, */*; q=0.01 accept-encoding: gzip, deflate, br accept-language: zh-CN,zh;q=0.9,en;q=0.8 cookie: _ga=GA1.2.148670794.1595925440; ied_qq=o1595205151; o_cookie=1595205151; pac_uid=1_1595205151; pgv_pvi=7010615296; pgv_pvid=5315621604; ptcz=57a0d6f0ef5ebec6de37f6bf2b32743731a808df842a36fd3c18839f8f2b6dcb; RK=SkgxEIVsRA; tvfe_boss_uuid=e66e71c1405d1b04; XWINDEXGREY=0; ptui_loginuin=3382604797; iip=1; ts_uid=4018853478; userAction=1; yqq_stat=0; pgv_info=ssid=s3722110056; ts_last=y.qq.com/portal/singer_list.html origin: https://xxxxxxx referer: https://xxxxxx/ sec-ch-ua: "Google Chrome";v="89", "Chromium";v="89", ";Not A Brand";v="99" sec-ch-ua-mobile: ?0 sec-fetch-dest: empty sec-fetch-mode: cors sec-fetch-site: same-site user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
从这里看，没啥特别的，都是按照http协议要求构造的“废话”，对于逆向人员而言，没啥特殊的价值（由于需要符合http协议，这些字段都是固定的，否则服务端无法解析，所以这里也没有啥大的扩展空间）！继续看query string参数，如下：
-: getUCGI5650218101004765
g_tk: 5381
sign: zzax2nhlf4kqqx2f3fef04bda3a286eeb40136f6b80f4a
loginUin: 0
hostUin: 0
format: json
inCharset: utf8
outCharset: utf-8
notice: 0
platform: yqq.json
needNewCode: 0
data: {"comm":{"ct":24,"cv":0},"singerList":{"module":"Music.SingerListServer","method":"get_singer_list","param":{"area":-100,"sex":-100,"genre":-100,"index":-100,"sin":0,"cur_page":1}}}
这个接口请求最大的猫腻就在这里了：有个字段叫sign，取值看着很奇怪，一点都不像普通的字符串或数字，正常人都无法理解其含义，“事出反常必有妖”！这个字段是干什么的了？截至目前我也不知道，干脆去掉这个sign字段再请求一下服务器，看看服务器都返回了啥，如下：原先返回的歌手列表都没了，只有这么3个字段，这个code应该是个错误码，ts是时间！
重新带上这个sign字段，服务器又能返回歌手列表了！
所以这里的sign字段作用就很明显了：浏览器带上这个sign才能通过服务器的认证鉴权，否则直接返回错误！自己写爬虫爬关键数据，当然是需要动态生成这个sign字段了，现在最核心的问题来了：这个sign字段是怎么生成的了？sign字段是在URL中被作为参数的字段之一，那么肯定有生成sign字段、并且和其他字段拼接起来的地方！浏览这边干这种活的一般都是js代码，所以直接在chrome中用“sign=”作为关键词搜索，结果如下：
这里很明显实在生成sign字段，并且和其他字段拼接；为了确认我们的猜测，可以在这样代码这里下断点，然后刷新页面，可以看到这里的r.data.data就是请求参数里面的data字段的内容；也就是说：整个请求的字段中，js代码会调用getSecuritySign方法对data字段进行处理，生成一段人看不懂的密文sign；那么getSecuritySign方法又是怎么实现的了？
选择getSecuritySign方法，点击step into，来到getSecuritySign方法内部，我这里直接复制了，如下（这个函数里面有个时间20200305，貌似是去年3月份写的）：
!function(n, t) {
"object" == typeof exports && "undefined" != typeof module ? module.exports = t() : "function" == typeof define && define.amd ? define(t) : (n = n || self).getSecuritySign = t()
}(this, function() {
"use strict";
var n = function() {
if ("undefined" != typeof self)
return self;
if ("undefined" != typeof window)
return window;
if ("undefined" != typeof global)
return global;
throw new Error("unable to locate global object")
}();
n.__sign_hash_20200305 = function(n) {
function l(n, t) {
var o = (65535 & n) + (65535 & t);
return (n >> 16) + (t >> 16) + (o >> 16) << 16 | 65535 & o
}
function r(n, t, o, e, u, p) {
return l((i = l(l(t, n), l(e, p))) << (r = u) | i >>> 32 - r, o);
var i, r
}
function g(n, t, o, e, u, p, i) {
return r(t & o | ~t & e, n, t, u, p, i)
}
function a(n, t, o, e, u, p, i) {
return r(t & e | o & ~e, n, t, u, p, i)
}
function s(n, t, o, e, u, p, i) {
return r(t ^ o ^ e, n, t, u, p, i)
}
function v(n, t, o, e, u, p, i) {
return r(o ^ (t | ~e), n, t, u, p, i)
}
function t(n) {
return function(n) {
var t, o = "";
for (t = 0; t < 32 * n.length; t += 8)
o += String.fromCharCode(n[t >> 5] >>> t % 32 & 255);
return o
}(function(n, t) {
n[t >> 5] |= 128 << t % 32,
n[14 + (t + 64 >>> 9 << 4)] = t;
var o, e, u, p, i, r = 1732584193, f = -271733879, h = -1732584194, c = 271733878;
for (o = 0; o < n.length; o += 16)
r = g(e = r, u = f, p = h, i = c, n[o], 7, -680876936),
c = g(c, r, f, h, n[o + 1], 12, -389564586),
h = g(h, c, r, f, n[o + 2], 17, 606105819),
f = g(f, h, c, r, n[o + 3], 22, -1044525330),
r = g(r, f, h, c, n[o + 4], 7, -176418897),
c = g(c, r, f, h, n[o + 5], 12, 1200080426),
h = g(h, c, r, f, n[o + 6], 17, -1473231341),
f = g(f, h, c, r, n[o + 7], 22, -45705983),
r = g(r, f, h, c, n[o + 8], 7, 1770035416),
c = g(c, r, f, h, n[o + 9], 12, -1958414417),
h = g(h, c, r, f, n[o + 10], 17, -42063),
f = g(f, h, c, r, n[o + 11], 22, -1990404162),
r = g(r, f, h, c, n[o + 12], 7, 1804603682),
c = g(c, r, f, h, n[o + 13], 12, -40341101),
h = g(h, c, r, f, n[o + 14], 17, -1502002290),
r = a(r, f = g(f, h, c, r, n[o + 15], 22, 1236535329), h, c, n[o + 1], 5, -165796510),
c = a(c, r, f, h, n[o + 6], 9, -1069501632),
h = a(h, c, r, f, n[o + 11], 14, 643717713),
f = a(f, h, c, r, n[o], 20, -373897302),
r = a(r, f, h, c, n[o + 5], 5, -701558691),
c = a(c, r, f, h, n[o + 10], 9, 38016083),
h = a(h, c, r, f, n[o + 15], 14, -660478335),
f = a(f, h, c, r, n[o + 4], 20, -405537848),
r = a(r, f, h, c, n[o + 9], 5, 568446438),
c = a(c, r, f, h, n[o + 14], 9, -1019803690),
h = a(h, c, r, f, n[o + 3], 14, -187363961),
f = a(f, h, c, r, n[o + 8], 20, 1163531501),
r = a(r, f, h, c, n[o + 13], 5, -1444681467),
c = a(c, r, f, h, n[o + 2], 9, -51403784),
h = a(h, c, r, f, n[o + 7], 14, 1735328473),
r = s(r, f = a(f, h, c, r, n[o + 12], 20, -1926607734), h, c, n[o + 5], 4, -378558),
c = s(c, r, f, h, n[o + 8], 11, -2022574463),
h = s(h, c, r, f, n[o + 11], 16, 1839030562),
f = s(f, h, c, r, n[o + 14], 23, -35309556),
r = s(r, f, h, c, n[o + 1], 4, -1530992060),
c = s(c, r, f, h, n[o + 4], 11, 1272893353),
h = s(h, c, r, f, n[o + 7], 16, -155497632),
f = s(f, h, c, r, n[o + 10], 23, -1094730640),
r = s(r, f, h, c, n[o + 13], 4, 681279174),
c = s(c, r, f, h, n[o], 11, -358537222),
h = s(h, c, r, f, n[o + 3], 16, -722521979),
f = s(f, h, c, r, n[o + 6], 23, 76029189),
r = s(r, f, h, c, n[o + 9], 4, -640364487),
c = s(c, r, f, h, n[o + 12], 11, -421815835),
h = s(h, c, r, f, n[o + 15], 16, 530742520),
r = v(r, f = s(f, h, c, r, n[o + 2], 23, -995338651), h, c, n[o], 6, -198630844),
c = v(c, r, f, h, n[o + 7], 10, 1126891415),
h = v(h, c, r, f, n[o + 14], 15, -1416354905),
f = v(f, h, c, r, n[o + 5], 21, -57434055),
r = v(r, f, h, c, n[o + 12], 6, 1700485571),
c = v(c, r, f, h, n[o + 3], 10, -1894986606),
h = v(h, c, r, f, n[o + 10], 15, -1051523),
f = v(f, h, c, r, n[o + 1], 21, -2054922799),
r = v(r, f, h, c, n[o + 8], 6, 1873313359),
c = v(c, r, f, h, n[o + 15], 10, -30611744),
h = v(h, c, r, f, n[o + 6], 15, -1560198380),
f = v(f, h, c, r, n[o + 13], 21, 1309151649),
r = v(r, f, h, c, n[o + 4], 6, -145523070),
c = v(c, r, f, h, n[o + 11], 10, -1120210379),
h = v(h, c, r, f, n[o + 2], 15, 718787259),
f = v(f, h, c, r, n[o + 9], 21, -343485551),
r = l(r, e),
f = l(f, u),
h = l(h, p),
c = l(c, i);
return [r, f, h, c]
}(function(n) {
var t, o = [];
for (o[(n.length >> 2) - 1] = void 0,
t = 0; t < o.length; t += 1)
o[t] = 0;
for (t = 0; t < 8 * n.length; t += 8)
o[t >> 5] |= (255 & n.charCodeAt(t / 8)) << t % 32;
return o
}(n), 8 * n.length))
}
function o(n) {
return t(unescape(encodeURIComponent(n)))
}
return function(n) {
var t, o, e = "0123456789abcdef", u = "";
for (o = 0; o < n.length; o += 1)
t = n.charCodeAt(o),
u += e.charAt(t >>> 4 & 15) + e.charAt(15 & t);
return u
}(o(n))
}
,
function r(f, h, c, l, g) {
g = g || [[this], [{}]];
for (var t = [], o = null, n = [function() {
return !0
}
, function() {}
, function() {
g.length = c[h++]
}
, function() {
g.push(c[h++])
}
, function() {
g.pop()
}
, function() {
var n = c[h++]
, t = g[g.length - 2 - n];
g[g.length - 2 - n] = g.pop(),
g.push(t)
}
, function() {
g.push(g[g.length - 1])
}
, function() {
g.push([g.pop(), g.pop()].reverse())
}
, function() {
g.push([l, g.pop()])
}
, function() {
g.push([g.pop()])
}
, function() {
var n = g.pop();
g.push(n[0][n[1]])
}
, function() {
g.push(g[g.pop()[0]][0])
}
, function() {
var n = g[g.length - 2];
n[0][n[1]] = g[g.length - 1]
}
, function() {
g[g[g.length - 2][0]][0] = g[g.length - 1]
}
, function() {
var n = g.pop()
, t = g.pop();
g.push([t[0][t[1]], n])
}
, function() {
var n = g.pop();
g.push([g[g.pop()][0], n])
}
, function() {
var n = g.pop();
g.push(delete n[0][n[1]])
}
, function() {
var n = [];
for (var t in g.pop())
n.push(t);
g.push(n)
}
, function() {
g[g.length - 1].length ? g.push(g[g.length - 1].shift(), !0) : g.push(void 0, !1)
}
, function() {
var n = g[g.length - 2]
, t = Object.getOwnPropertyDescriptor(n[0], n[1]) || {
configurable: !0,
enumerable: !0
};
t.get = g[g.length - 1],
Object.defineProperty(n[0], n[1], t)
}
, function() {
var n = g[g.length - 2]
, t = Object.getOwnPropertyDescriptor(n[0], n[1]) || {
configurable: !0,
enumerable: !0
};
t.set = g[g.length - 1],
Object.defineProperty(n[0], n[1], t)
}
, function() {
h = c[h++]
}
, function() {
var n = c[h++];
g[g.length - 1] && (h = n)
}
, function() {
throw g[g.length - 1]
}
, function() {
var n = c[h++]
, t = n ? g.slice(-n) : [];
g.length -= n,
g.push(g.pop().apply(l, t))
}
, function() {
var n = c[h++]
, t = n ? g.slice(-n) : [];
g.length -= n;
var o = g.pop();
g.push(o[0][o[1]].apply(o[0], t))
}
, function() {
var n = c[h++]
, t = n ? g.slice(-n) : [];
g.length -= n,
t.unshift(null),
g.push(new (Function.prototype.bind.apply(g.pop(), t)))
}
, function() {
var n = c[h++]
, t = n ? g.slice(-n) : [];
g.length -= n,
t.unshift(null);
var o = g.pop();
g.push(new (Function.prototype.bind.apply(o[0][o[1]], t)))
}
, function() {
g.push(!g.pop())
}
, function() {
g.push(~g.pop())
}
, function() {
g.push(typeof g.pop())
}
, function() {
g[g.length - 2] = g[g.length - 2] == g.pop()
}
, function() {
g[g.length - 2] = g[g.length - 2] === g.pop()
}
, function() {
g[g.length - 2] = g[g.length - 2] > g.pop()
}
, function() {
g[g.length - 2] = g[g.length - 2] >= g.pop()
}
, function() {
g[g.length - 2] = g[g.length - 2] << g.pop()
}
, function() {
g[g.length - 2] = g[g.length - 2] >> g.pop()
}
, function() {
g[g.length - 2] = g[g.length - 2] >>> g.pop()
}
, function() {
g[g.length - 2] = g[g.length - 2] + g.pop()
}
, function() {
g[g.length - 2] = g[g.length - 2] - g.pop()
}
, function() {
g[g.length - 2] = g[g.length - 2] * g.pop()
}
, function() {
g[g.length - 2] = g[g.length - 2] / g.pop()
}
, function() {
g[g.length - 2] = g[g.length - 2] % g.pop()
}
, function() {
g[g.length - 2] = g[g.length - 2] | g.pop()
}
, function() {
g[g.length - 2] = g[g.length - 2] & g.pop()
}
, function() {
g[g.length - 2] = g[g.length - 2] ^ g.pop()
}
, function() {
g[g.length - 2] = g[g.length - 2]in g.pop()
}
, function() {
g[g.length - 2] = g[g.length - 2]instanceof g.pop()
}
, function() {
g[g[g.length - 1][0]] = void 0 === g[g[g.length - 1][0]] ? [] : g[g[g.length - 1][0]]
}
, function() {
for (var e = c[h++], u = [], n = c[h++], t = c[h++], p = [], o = 0; o < n; o++)
u[c[h++]] = g[c[h++]];
for (var i = 0; i < t; i++)
p[i] = c[h++];
g.push(function n() {
var t = u.slice(0);
t[0] = [this],
t[1] = [arguments],
t[2] = [n];
for (var o = 0; o < p.length && o < arguments.length; o++)
0 < p[o] && (t[p[o]] = [arguments[o]]);
return r(f, e, c, l, t)
})
}
, function() {
t.push([c[h++], g.length, c[h++]])
}
, function() {
t.pop()
}
, function() {
return !!o
}
, function() {
o = null
}
, function() {
g[g.length - 1] += String.fromCharCode(c[h++])
}
, function() {
g.push("")
}
, function() {
g.push(void 0)
}
, function() {
g.push(null)
}
, function() {
g.push(!0)
}
, function() {
g.push(!1)
}
, function() {
g.length -= c[h++]
}
, function() {
g[g.length - 1] = c[h++]
}
, function() {
var n = g.pop()
, t = g[g.length - 1];
t[0][t[1]] = g[n[0]][0]
}
, function() {
var n = g.pop()
, t = g[g.length - 1];
t[0][t[1]] = n[0][n[1]]
}
, function() {
var n = g.pop()
, t = g[g.length - 1];
g[t[0]][0] = g[n[0]][0]
}
, function() {
var n = g.pop()
, t = g[g.length - 1];
g[t[0]][0] = n[0][n[1]]
}
, function() {
g[g.length - 2] = g[g.length - 2] < g.pop()
}
, function() {
g[g.length - 2] = g[g.length - 2] <= g.pop()
}
]; ; )
try {
for (; !n[c[h++]](); )
;
if (o)
throw o;
return g.pop()
} catch (n) {
var e = t.pop();
if (void 0 === e)
throw n;
o = n,
h = e[0],
g.length = e[1],
e[2] && (g[e[2]][0] = o)
}
}(120731, 0, [21, 34, 50, 100, 57, 50, 102, 50, 98, 99, 101, 52, 54, 97, 52, 99, 55, 56, 52, 49, 57, 54, 57, 49, 56, 98, 102, 100, 100, 48, 48, 55, 55, 102, 2, 10, 3, 2, 9, 48, 61, 3, 9, 48, 61, 4, 9, 48, 61, 5, 9, 48, 61, 6, 9, 48, 61, 7, 9, 48, 61, 8, 9, 48, 61, 9, 9, 48, 4, 21, 427, 54, 2, 15, 3, 2, 9, 48, 61, 3, 9, 48, 61, 4, 9, 48, 61, 5, 9, 48, 61, 6, 9, 48, 61, 7, 9, 48, 61, 8, 9, 48, 61, 9, 9, 48, 61, 10, 9, 48, 61, 11, 9, 48, 61, 12, 9, 48, 61, 13, 9, 48, 61, 14, 9, 48, 61, 10, 9, 55, 54, 97, 54, 98, 54, 99, 54, 100, 54, 101, 54, 102, 54, 103, 54, 104, 54, 105, 54, 106, 54, 107, 54, 108, 54, 109, 54, 110, 54, 111, 54, 112, 54, 113, 54, 114, 54, 115, 54, 116, 54, 117, 54, 118, 54, 119, 54, 120, 54, 121, 54, 122, 54, 48, 54, 49, 54, 50, 54, 51, 54, 52, 54, 53, 54, 54, 54, 55, 54, 56, 54, 57, 13, 4, 61, 11, 9, 55, 54, 77, 54, 97, 54, 116, 54, 104, 8, 55, 54, 102, 54, 108, 54, 111, 54, 111, 54, 114, 14, 55, 54, 77, 54, 97, 54, 116, 54, 104, 8, 55, 54, 114, 54, 97, 54, 110, 54, 100, 54, 111, 54, 109, 14, 25, 0, 3, 4, 9, 11, 3, 3, 9, 11, 39, 3, 1, 38, 40, 3, 3, 9, 11, 38, 25, 1, 13, 4, 61, 12, 9, 55, 13, 4, 61, 13, 9, 3, 0, 13, 4, 4, 3, 13, 9, 11, 3, 11, 9, 11, 66, 22, 306, 4, 21, 422, 24, 4, 3, 14, 9, 55, 54, 77, 54, 97, 54, 116, 54, 104, 8, 55, 54, 102, 54, 108, 54, 111, 54, 111, 54, 114, 14, 55, 54, 77, 54, 97, 54, 116, 54, 104, 8, 55, 54, 114, 54, 97, 54, 110, 54, 100, 54, 111, 54, 109, 14, 25, 0, 3, 10, 9, 55, 54, 108, 54, 101, 54, 110, 54, 103, 54, 116, 54, 104, 15, 10, 40, 25, 1, 13, 4, 61, 12, 9, 6, 11, 3, 10, 9, 3, 14, 9, 11, 15, 10, 38, 13, 4, 61, 13, 9, 6, 11, 6, 5, 1, 5, 0, 3, 1, 38, 13, 4, 61, 0, 5, 0, 43, 4, 21, 291, 61, 3, 12, 9, 11, 0, 3, 9, 9, 49, 72, 0, 2, 3, 4, 13, 4, 61, 8, 9, 21, 721, 3, 2, 8, 3, 2, 9, 48, 61, 3, 9, 48, 61, 4, 9, 48, 61, 5, 9, 48, 61, 6, 9, 48, 61, 7, 9, 48, 4, 55, 54, 115, 54, 101, 54, 108, 54, 102, 8, 10, 30, 55, 54, 117, 54, 110, 54, 100, 54, 101, 54, 102, 54, 105, 54, 110, 54, 101, 54, 100, 32, 28, 22, 510, 4, 21, 523, 22, 4, 55, 54, 115, 54, 101, 54, 108, 54, 102, 8, 10, 0, 55, 54, 119, 54, 105, 54, 110, 54, 100, 54, 111, 54, 119, 8, 10, 30, 55, 54, 117, 54, 110, 54, 100, 54, 101, 54, 102, 54, 105, 54, 110, 54, 101, 54, 100, 32, 28, 22, 566, 4, 21, 583, 3, 4, 55, 54, 119, 54, 105, 54, 110, 54, 100, 54, 111, 54, 119, 8, 10, 0, 55, 54, 103, 54, 108, 54, 111, 54, 98, 54, 97, 54, 108, 8, 10, 30, 55, 54, 117, 54, 110, 54, 100, 54, 101, 54, 102, 54, 105, 54, 110, 54, 101, 54, 100, 32, 28, 22, 626, 4, 21, 643, 25, 4, 55, 54, 103, 54, 108, 54, 111, 54, 98, 54, 97, 54, 108, 8, 10, 0, 55, 54, 69, 54, 114, 54, 114, 54, 111, 54, 114, 8, 55, 54, 117, 54, 110, 54, 97, 54, 98, 54, 108, 54, 101, 54, 32, 54, 116, 54, 111, 54, 32, 54, 108, 54, 111, 54, 99, 54, 97, 54, 116, 54, 101, 54, 32, 54, 103, 54, 108, 54, 111, 54, 98, 54, 97, 54, 108, 54, 32, 54, 111, 54, 98, 54, 106, 54, 101, 54, 99, 54, 116, 27, 1, 23, 56, 0, 49, 444, 0, 0, 24, 0, 13, 4, 61, 8, 9, 55, 54, 95, 54, 95, 54, 103, 54, 101, 54, 116, 54, 83, 54, 101, 54, 99, 54, 117, 54, 114, 54, 105, 54, 116, 54, 121, 54, 83, 54, 105, 54, 103, 54, 110, 15, 21, 1126, 49, 2, 14, 3, 2, 9, 48, 61, 3, 9, 48, 61, 4, 9, 48, 61, 5, 9, 48, 61, 6, 9, 48, 61, 7, 9, 48, 61, 8, 9, 48, 61, 9, 9, 48, 61, 10, 9, 48, 61, 11, 9, 48, 61, 9, 9, 55, 54, 108, 54, 111, 54, 99, 54, 97, 54, 116, 54, 105, 54, 111, 54, 110, 8, 10, 30, 55, 54, 117, 54, 110, 54, 100, 54, 101, 54, 102, 54, 105, 54, 110, 54, 101, 54, 100, 32, 28, 22, 862, 21, 932, 21, 4, 55, 54, 108, 54, 111, 54, 99, 54, 97, 54, 116, 54, 105, 54, 111, 54, 110, 8, 55, 54, 104, 54, 111, 54, 115, 54, 116, 14, 55, 54, 105, 54, 110, 54, 100, 54, 101, 54, 120, 54, 79, 54, 102, 14, 55, 54, 121, 54, 46, 54, 113, 54, 113, 54, 46, 54, 99, 54, 111, 54, 109, 25, 1, 3, 0, 3, 1, 39, 32, 22, 963, 4, 55, 54, 67, 54, 74, 54, 66, 54, 80, 54, 65, 54, 67, 54, 114, 54, 82, 54, 117, 54, 78, 54, 121, 54, 55, 21, 974, 50, 4, 3, 12, 9, 11, 3, 8, 3, 10, 24, 2, 13, 4, 61, 10, 9, 3, 13, 9, 55, 54, 95, 54, 95, 54, 115, 54, 105, 54, 103, 54, 110, 54, 95, 54, 104, 54, 97, 54, 115, 54, 104, 54, 95, 54, 50, 54, 48, 54, 50, 54, 48, 54, 48, 54, 51, 54, 48, 54, 53, 15, 10, 22, 1030, 21, 1087, 22, 4, 3, 13, 9, 55, 54, 95, 54, 95, 54, 115, 54, 105, 54, 103, 54, 110, 54, 95, 54, 104, 54, 97, 54, 115, 54, 104, 54, 95, 54, 50, 54, 48, 54, 50, 54, 48, 54, 48, 54, 51, 54, 48, 54, 53, 15, 3, 9, 9, 11, 3, 3, 9, 11, 38, 25, 1, 13, 4, 61, 11, 9, 3, 12, 9, 11, 3, 10, 3, 53, 3, 37, 39, 24, 2, 13, 4, 4, 55, 54, 122, 54, 122, 54, 97, 3, 11, 9, 11, 38, 3, 10, 9, 11, 38, 0, 49, 771, 2, 1, 12, 9, 13, 8, 3, 12, 4, 4, 56, 0], n);
var t = n.__getSecuritySign;
return delete n.__getSecuritySign,
t
});
这种代码我估计一般人看着都头晕，更别说去逐行分析了！幸运的是，服务端只看结果，不看过程！换句话说，只要我们自己能生成正确的sign字段，服务器是不会管这个sign字段是怎么来的！所以一般情况下是没必要逐行分析代码、搞清楚每行代码意义的（当然出于学习的目的，有空的小伙伴可以自己试试）！这里直接调用这段js代码，生成sign字段即可（后续搞app逆向也可以如法炮制：so层的sign函数很多时候其实没必要真正的去破解，在java层直接调用生成sign字段即可）！为了方便地执行这段js，我这里选择python，有execjs.compile可以直接执行js代码，核心python代码如下：
def get_sign(data):
with open('./get_sign.js','r',encoding='utf-8') as f:
text = f.read()
js_data = execjs.compile(text)
sign = js_data.call('get_sign',data)
return sign
把上面sign的js代码保存到同目录下的get_sign.js文件即可！更详细可以看下面参考的链接！
最后，xx音乐web界面弹窗，建议用户使用客户端，我个人猜测：客户端的防护相比浏览器要容易很多，这大概也是原因之一吧！浏览器要生成自定义的加密签名，只能依靠js，很容易被找到并调用；android客户端可以把加密的关键逻辑放到so层，然后用OLLVM混淆so的代码，增加反编译和调试的难度，比浏览器安全多了！
参考：
1、https://space.bilibili.com/343154012?spm_id_from=333.788.b_765f7570696e666f.1 爬虫