再提一下之前看到得到g_tk的JavaScript函数:
getACSRFToken:function(url) {
url = QZFL.util.URI(url);
var skey;
if (url) {
if (url.host && url.host.indexOf("qzone.qq.com") > 0) {
try {
skey = QZONE.FP._t.QZFL.cookie.get("p_skey");
} catch (err) {
skey = QZFL.cookie.get("p_skey");
}
} else {
if (url.host && url.host.indexOf("qq.com") > 0) {
skey = QZFL.cookie.get("skey");
}
}
}
if (!skey) {
skey = QZFL.cookie.get("p_skey") || (QZFL.cookie.get("skey") || (QZFL.cookie.get("rv2") || ""));
}
var hash = 5381;
for (var i = 0, len = skey.length;i < len;++i) {
hash += (hash << 5) + skey.charCodeAt(i);
}
return hash & 2147483647;
可以看出
skey = p_skey or skey or rv2
然后对hash每一位左移5位,加上skey的i位字符码,叠加hash
最后对hash & 2147483647 控制hash在int范围内
这里代码借鉴了其他博客的改了改
get_gtk.py
import sys
import re
def LongToInt(value): # 由于int+int超出范围后自动转为long型,通过这个转回来
if isinstance(value, int):
return int(value)
else:
return int(value & sys.maxint)
def LeftShiftInt(number, step): # 由于左移可能自动转为long型,通过这个转回来
if number>0x200000000:
return int((number << step) - 0x200000000)
else:
return int(number << step)
def getOldGTK(skey):
a = 5381
for i in range(0, len(skey)):
a = a + LeftShiftInt(a, 5) + ord(skey[i])
a = LongToInt(a)
return a & 0x7fffffff
def getNewGTK(p_skey, skey, rv2):
b = p_skey or skey or rv2
a = 5381
for i in range(0, len(b)):
a = a + LeftShiftInt(a, 5) + ord(b[i])
a = LongToInt(a)
return a & 0x7fffffff
def getGTK(cookieStr):
if re.search(r'p_skey=(?P<p_skey>[^;]*)', cookieStr):
p_skey = re.search(r'p_skey=(?P<p_skey>[^;]*)', cookieStr).group('p_skey')
else:
p_skey = None
if re.search(r'skey=(?P<skey>[^;]*)', cookieStr):
skey = re.search(r'skey=(?P<skey>[^;]*)', cookieStr).group('skey')
else:
skey = None
if re.search(r'rv2=(?P<rv2>[^;]*)', cookieStr):
rv2 = re.search(r'rv2=(?P<rv2>[^;]*)', cookieStr).group('rv2')
else:
rv2 = None
return getNewGTK(p_skey, skey, rv2)