同程旅行 user-dun参数js逆向流程

原创已于 2025-10-15 18:02:10 修改 · 976 阅读

3 ·

CC 4.0 BY-SA版权

文章标签：

#javascript #前端 #爬虫 #js逆向

于 2025-10-15 16:31:27 首次发布

同程旅行中有多个接口用到了user-dun参数，这里我以hoteldetailroomlist接口为例，找到参数加密入口如下（A6方法）：

根据分析可知入参为AJ, AH, AP, AG值分别是：

AJ: 'https://www.ly.com/tapi/v4/hoteldetailroomlist?hotelid=66011327&indate=2025-10-15&outdate=2025-10-16&adultsNumber=1&childrenAges=&filterList=&rechargeTicket=1&searchEntranceId=h5_home&traceToken=&if=&of=&ch=&refid='

AH: undefined

AP: 2

AG: {}

那么我们就需要自己定义个函数来实现获取user-dun加密的返回值：

url = 'https://www.ly.com/tapi/v4/hoteldetailroomlist?hotelid=66011327&indate=2025-10-15&outdate=2025-10-16&adultsNumber=1&childrenAges=&filterList=&rechargeTicket=1&searchEntranceId=h5_home&traceToken=&if=&of=&ch=&refid='

function main123(url) {
    let arg2 = undefined;
    let arg3 = 2
    let arg4 = {}
    let userDun1 = A7(url, arg2, arg3, arg4);
    process = _process;
    return userDun1;

}

而整个加密算法就是一步一步扣就行，哪个变量和函数未定义就扣哪个：

function U(Q, h) {
    var X = v();
    return U = function (J, H) {
        J = J - 0xb6;
        var s = X[J];
        if (U['bOEoyS'] === undefined) {
            var P = function (K) {
                var Z = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';
                var i = ''
                    , L = '';
                for (var x = 0x0, l, g, T = 0x0; g = K['charAt'](T++); ~g && (l = x % 0x4 ? l * 0x40 + g : g,
                x++ % 0x4) ? i += String['fromCharCode'](0xff & l >> (-0x2 * x & 0x6)) : 0x0) {
                    g = Z['indexOf'](g);
                }
                for (var f = 0x0, F = i['length']; f < F; f++) {
                    L += '%' + ('00' + i['charCodeAt'](f)['toString'](0x10))['slice'](-0x2);
                }
                return decodeURIComponent(L);
            };
            var R = function (K, Z) {
                var L = [], k = 0x0, l, g = '';
                K = P(K);
                var T;
                for (T = 0x0; T < 0x100; T++) {
                    L[T] = T;
                }
                for (T = 0x0; T < 0x100; T++) {
                    k = (k + L[T] + Z['charCodeAt'](T % Z['length'])) % 0x100,
                        l = L[T],
                        L[T] = L[k],
                        L[k] = l;
                }
                T = 0x0,
                    k = 0x0;
                for (var f = 0x0; f < K['length']; f++) {
                    T = (T + 0x1) % 0x100,
                        k = (k + L[T]) % 0x100,
                        l = L[T],
                        L[T] = L[k],
                        L[k] = l,
                        g += String['fromCharCode'](K['charCodeAt'](f) ^ L[(L[T] + L[k]) % 0x100]);
                }
                return g;
            };
            U['QboEeO'] = R,
                Q = arguments,
                U['bOEoyS'] = !![];
        }
        var G = X[0x0]
            , j = J + G
            , a = Q[j];
        return !a ? (U['XErZTD'] === undefined && (U['XErZTD'] = !![]),
            s = U['QboEeO'](s, H),
            Q[j] = s) : s = a,
            s;
    }
        ,
        U(Q, h);
}





url = 'https://www.ly.com/tapi/v4/hoteldetailroomlist?hotelid=66011327&indate=2025-10-15&outdate=2025-10-16&adultsNumber=1&childrenAges=&filterList=&rechargeTicket=1&searchEntranceId=h5_home&traceToken=&if=&of=&ch=&refid='

function main123(url) {
    let arg2 = undefined;
    let arg3 = 2
    let arg4 = {}
    let userDun1 = A7(url, arg2, arg3, arg4);
    process = _process;
    return userDun1;

}

console.log(main123(url));

除了加密算法，还需要模拟浏览器的环境，也就是经常说的补环境，由于字数限制补环境和整体代码并不完整，有需要可以联系博主获取。