h5st 5.1.8纯算分析

分析过程

通过商详pc_detailpage_wareBusiness定位h5st生成的位置

这里我们能看到逻辑,

var l = JSON.stringify(r)
              , f = (new Date).getTime() || "1"
              , u = {
   
   
                appid: "pc-item-soa",
                functionId: "pc_detailpage_wareBusiness",
                client: "pc",
                clientVersion: "1.0.0",
                t: f,
                body: l
            }

先对body部分sha256再进行sign加密。

key: "sign",
            value: (r = Fl(My.mark((function t(r) {
   
   
                var e, n, o, i, a, c, u = this;
                return My.wrap((function(t) {
   
   
                    for (; ; )
                        switch (t.prev = t.next) {
   
   
                        case 0:
                            if (e = Gy(),
                            n = {
   
   
                                businessId: this.__appId,
                                bucketIndex: Em,
                                cAppId: r.appid,
                                cFunctionId: r.functionId,
                                t: Gy(),
                                temp: "1"
                            },
                            t.prev = 2,
                            !this.__retry2load) {
   
   
                                t.next = 8;
                                break
                            }
                            return o = ib(Gy() - 36e5 * 1.1, "yyyyMMdd"),
                            i = "https://storage.360buyimg.com/webcontainer/main/js_security_v3_main_0.1.8.js?v=" + o,
                            t.next = 8,
                            wm(i, 600, 1).catch((function(t) {
   
   
                                n.errorCode = 0,
                                n.errorMsg = "load script error.",
                                n.subErrorCode = 1,
                                n.subErrorMessage = "sub error:".concat(t)
                            }
                            ));
                        case 8:
                            return a = Gy() - e,
                            n.loadInterval = a,
                            gm(this.__debug, "retry load script elapsed time!=".concat(a, "ms")),
                            c = new window.ParamsSignMain({
   
   
                                appId: this.__appId,
                                debug: this.__debug,
                                onSign: function(t) {
   
   
                                    n.signInterval = Gy() - e,
                                    n.errorCode = t.code,
                                    n