{中國移動}逆向算法分析

要分析的參數為：digest conversationId smsCode
smsCode 對應的是驗證碼

全部代碼：

window = global
const NodeRSA = require('node-rsa'); // 引入用于 RSA 加密的模块
const crypto = require('crypto'); // 引入 Node.js 自带的加密模块

// 当前时间
const curtime = Date.now();

function formatNumber(num, n) {
    let rv = num.toString();
    const length = rv.length;

    if (length <= n) {
        rv = '0'.repeat(n - length) + rv;
    } else {
        rv = rv.substring(length - n);
    }

    return rv;
}

function getConversationId(curtime) {
    let rv;
    const dateObj = new Date(curtime);

    const fullYear = formatNumber(dateObj.getFullYear(), 4);
    const month = formatNumber(dateObj.getMonth() + 1, 2);
    const date = formatNumber(dateObj.getDate(), 2);
    const hours = formatNumber(dateObj.getHours(), 2);
    const minutes = formatNumber(dateObj.getMinutes(), 2);
    const seconds = formatNumber(dateObj.getSeconds(), 2);
    const milliseconds = formatNumber(dateObj.getMilliseconds(), 3);

    // 根据当前时间毫秒数、url以及用户特定信息进行md5运算，产生随机数
    const strSeed = `${curtime},https://wap.10086.cn/barrierFree/login.html,Netscape,5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36,Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36`;
    const md5Hash = crypto.createHash('md5').update(strSeed).digest('hex');
    const rnd = formatNumber(parseInt(md5Hash.substring(25, 32), 16), 6);

    rv = `${fullYear}${month}${date}${hours}${minutes}${seconds}${milliseconds}${rnd}`;
    return rv;
}



function getDigest(curtime, secret) {
    const strmd5 = crypto.createHash('md5').update(`${curtime}${secret}`).digest('hex');
    const strbase64 = Buffer.from(strmd5).toString('base64');
    return strbase64;
}

function getSecret() {
    return "CM_201606";
}

const conversationId = getConversationId(curtime);
console.log(conversationId);

const secret = getSecret();
const digest = getDigest(curtime, secret);
console.log(digest);

function encrypt(s) {
    const key = `MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAi3ZtAm0iiSSm8/mY6FUc0iG1nC6MuN7pVwi9r5iw+oMwriAwBlbkmxNSDR1+EhNkz1gREsm9kzhOiKxKG5jk/QUe9lGN5ihH57sfG7HzbPeQkJt0AITEHbzl7Epqbmc379rydZ9Vl4aOGJvtmWqNPdmNKcqStJPsUE//IFLvJWEcJCHKvpO2pLRvUYwXkjXGZZ73FFZdeJ6AUtiF/MDCtLJLSgmkSlnrQXbdYiOzpNum+yDQc9FKfWU3O5EAzS5uzzSMUeECM5dTdCerT1NMVYu7Qelwz9QAB7s5NLs2FhcAB26P5tTuow8I7K/ccum3ulhYoyjkxC9b8z5qI6z2RwIDAQAB`;
    const rsa = new NodeRSA();
    rsa.importKey(key, 'pkcs8-public-pem');
    const encryptStr = rsa.encrypt(s, 'base64');
    return encryptStr;
}
const smsCode = encrypt("1346");
console.log(smsCode);