微信公众号登录密码pwd参数加密详解

前言

此参数的加密没有任何难度，适合小白练手学习。
网址：https://mp.weixin.qq.com/

一、打开浏览器开始抓包

输入错误的账号密码，登录。然后找到login字眼的发送包，可以看到密码pwd参数被加密了，我们要找到加密这个字符串的js方法

二、通过搜索定位方法，快速找到关键位置

底部搜索栏输入关键参数，搜索到js文件，点击后定位到目标js文件，格式化代码，然后在代码也继续搜索关键参数，可以看到以下代码

 pwd: c(n.pwd.substr(0, 16)),

这里就是pwd的赋值地方了。很显然是调用了c方法，我们在这行打上断点，重新点击登录，断点就会断到这个位置，然后进入c方法，查看

三、找到关键加密位置，扣下代码，分析代码，自己构造然后运行

可以直接定位到这个方法，传入密码t参数，返回结果，那么在return这行打上断点，点击运行到下一个断点。此时就会运行到当前return断点的位置，就可以看到各参数和方法的内容了，分析return代码

return e ? n ? a(e, t) : o(a(e, t)) : n ? r(t) : o(r(t))

很明显就是嵌套的三元表达式，简单拆分下就能看明白了

e ? 
n ? a(e, t) : o(a(e, t))

 : 

n ? r(t) : o(r(t))

判断e的值，e为undefined，所以跳到第二个，然后判断n的值，n也是undefined，所以密码加密的关键代码就是o(r(t)) 调用了两个方法。

然后往上翻代码或者点击r方法就可以看到加密的位置了，
复制相关的加密代码到js调试工具，
然后自己构造个方法，返回结果就可以了
全部代码如下：

function f(t, e) {
    var n = (65535 & t) + (65535 & e);
    return (t >> 16) + (e >> 16) + (n >> 16) << 16 | 65535 & n
}

function s(t, e, n, o, i, r) {
    return f((a = f(f(e, t), f(o, r))) << (s = i) | a >>> 32 - s, n);
    var a, s
}

function d(t, e, n, o, i, r, a) {
    return s(e & n | ~e & o, t, e, i, r, a)
}

function p(t, e, n, o, i, r, a) {
    return s(e & o | n & ~o, t, e, i, r, a)
}

function m(t, e, n, o, i, r, a) {
    return s(e ^ n ^ o, t, e, i, r, a)
}

function h(t, e, n, o, i, r, a) {
    return s(n ^ (e | ~o), t, e, i, r, a)
}

function c(t, e) {
    t[e >> 5] |= 128 << e % 32,
    t[14 + (e + 64 >>> 9 << 4)] = e;
    var n, o, i, r, a, s = 1732584193,
        c = -271733879,
        u = -1732584194,
        l = 271733878;
    for (n = 0; n < t.length; n += 16)
    s = d(o = s, i = c, r = u, a = l, t[n], 7, -680876936),
    l = d(l, s, c, u, t[n + 1], 12, -389564586),
    u = d(u, l, s, c, t[n + 2], 17, 606105819),
    c = d(c, u, l, s, t[n + 3], 22, -1044525330),
    s = d(s, c, u, l, t[n + 4], 7, -176418897),
    l = d(l, s, c, u, t[n + 5], 12, 1200080426),
    u = d(u, l, s, c, t[n + 6], 17, -1473231341),
    c = d(c, u, l, s, t[n + 7], 22, -45705983),
    s = d(s, c, u, l, t[n + 8], 7, 1770035416),
    l = d(l, s, c, u, t[n + 9], 12, -1958414417),
    u = d(u, l, s, c, t[n + 10], 17, -42063),
    c = d(c, u, l, s, t[n + 11], 22, -1990404162),
    s = d(s, c, u, l, t[n + 12], 7, 1804603682),
    l = d(l, s, c, u, t[n + 13], 12, -40341101),
    u = d(u, l, s, c, t[n + 14], 17, -1502002290),
    s = p(s, c = d(c, u, l, s, t[n + 15], 22, 1236535329), u, l, t[n + 1], 5, -165796510),
    l = p(l, s, c, u, t[n + 6], 9, -1069501632),
    u = p(u, l, s, c, t[n + 11], 14, 643717713),
    c = p(c, u, l, s, t[n], 20, -373897302),
    s = p(s, c, u, l, t[n + 5], 5, -701558691),
    l = p(l, s, c, u, t[n + 10], 9, 38016083),
    u = p(u, l, s, c, t[n + 15], 14, -660478335),
    c = p(c, u, l, s, t[n + 4], 20, -405537848),
    s = p(s, c, u, l, t[n + 9], 5, 568446438),
    l = p(l, s, c, u, t[n + 14], 9, -1019803690),
    u = p(u, l, s, c, t[n + 3], 14, -187363961),
    c = p(c, u, l, s, t[n + 8], 20, 1163531501),
    s = p(s, c, u, l, t[n + 13], 5, -1444681467),
    l = p(l, s, c, u, t[n + 2], 9, -51403784),
    u = p(u, l, s, c, t[n + 7], 14, 1735328473),
    s = m(s, c = p(c, u, l, s, t[n + 12], 20, -1926607734), u, l, t[n + 5], 4, -378558),
    l = m(l, s, c, u, t[n + 8], 11, -2022574463),
    u = m(u, l, s, c, t[n + 11], 16, 1839030562),
    c = m(c, u, l, s, t[n + 14], 23, -35309556),
    s = m(s, c, u, l, t[n + 1], 4, -1530992060),
    l = m(l, s, c, u, t[n + 4], 11, 1272893353),
    u = m(u, l, s, c, t[n + 7], 16, -155497632),
    c = m(c, u, l, s, t[n + 10], 23, -1094730640),
    s = m(s, c, u, l, t[n + 13], 4, 681279174),
    l = m(l, s, c, u, t[n], 11, -358537222),
    u = m(u, l, s, c, t[n + 3], 16, -722521979),
    c = m(c, u, l, s, t[n + 6], 23, 76029189),
    s = m(s, c, u, l, t[n + 9], 4, -640364487),
    l = m(l, s, c, u, t[n + 12], 11, -421815835),
    u = m(u, l, s, c, t[n + 15], 16, 530742520),
    s = h(s, c = m(c, u, l, s, t[n + 2], 23, -995338651), u, l, t[n], 6, -198630844),
    l = h(l, s, c, u, t[n + 7], 10, 1126891415),
    u = h(u, l, s, c, t[n + 14], 15, -1416354905),
    c = h(c, u, l, s, t[n + 5], 21, -57434055),
    s = h(s, c, u, l, t[n + 12], 6, 1700485571),
    l = h(l, s, c, u, t[n + 3], 10, -1894986606),
    u = h(u, l, s, c, t[n + 10], 15, -1051523),
    c = h(c, u, l, s, t[n + 1], 21, -2054922799),
    s = h(s, c, u, l, t[n + 8], 6, 1873313359),
    l = h(l, s, c, u, t[n + 15], 10, -30611744),
    u = h(u, l, s, c, t[n + 6], 15, -1560198380),
    c = h(c, u, l, s, t[n + 13], 21, 1309151649),
    s = h(s, c, u, l, t[n + 4], 6, -145523070),
    l = h(l, s, c, u, t[n + 11], 10, -1120210379),
    u = h(u, l, s, c, t[n + 2], 15, 718787259),
    c = h(c, u, l, s, t[n + 9], 21, -343485551),
    s = f(s, o),
    c = f(c, i),
    u = f(u, r),
    l = f(l, a);
    return [s, c, u, l]
}

function o(t) {
    var e, n, o = "0123456789abcdef",
        i = "";
    for (n = 0; n < t.length; n += 1)
    e = t.charCodeAt(n),
    i += o.charAt(e >>> 4 & 15) + o.charAt(15 & e);
    return i
}

function i(t) {
    return unescape(encodeURIComponent(t))
}

function u(t) {
    var e, n = "";
    for (e = 0; e < 32 * t.length; e += 8)
    n += String.fromCharCode(t[e >> 5] >>> e % 32 & 255);
    return n
}

function l(t) {
    var e, n = [];
    for (n[(t.length >> 2) - 1] = void 0,
    e = 0; e < n.length; e += 1)
    n[e] = 0;
    for (e = 0; e < 8 * t.length; e += 8)
    n[e >> 5] |= (255 & t.charCodeAt(e / 8)) << e % 32;
    return n
}

function r(t) {
    return u(c(l(e = i(t)), 8 * e.length));
    var e
}

function getpwd(p) {
    return o(r(p))
}