惠美四川-请求数据加解密

惠美四川-请求数据加解密

请求与响应的数据被加密：

image-20240220233822389

其中data加密流程:

  1. 生成16为长度的随机字符串作为密钥(key)
  2. 使用SM4 ECB模式加密数据

signData并不算是请求签名，只是使用SM3对SM4的密钥进行加密。若固定SM4的密钥，signData的值可以重复使用。

调试过程：

image-20240220234333468

image-20240220233747116

image-20240220234454658

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
def random_str(n):
    l = []
    for i in range(n):
        l.append(random.choice(string.ascii_letters))
    return ''.join(l)

def get_sign(prvtCtrctId, timestamp, nonce):
    # prvtCtrctId + ts + nonce + "b85E3G6f2hC9tD59"
    salt = 'b85E3G6f2hC9tD59'
    s = prvtCtrctId + str(timestamp) + nonce + salt
    data = s.encode()
    return base64.b64encode(hashlib.sha256(data).digest()).decode()

def encrypt(d):
    s = json.dumps(d)
    sm4_key = b'1234567890123456'
    crypt_sm4 = CryptSM4()
    crypt_sm4.set_key(sm4_key, SM4_ENCRYPT)
    encrypt_value = crypt_sm4.crypt_ecb(s.encode())
    return base64.b64encode(encrypt_value).decode()

def decrypt(s):
    sm4_key = b'1234567890123456'
    crypt_sm4 = CryptSM4()
    crypt_sm4.set_key(sm4_key, SM4_DECRYPT)
    data = base64.b64decode(s)
    decrypt_value = crypt_sm4.crypt_ecb(data)
    return decrypt_value.decode()

def test():
    url = "https://scqy.ccb.com/prod-api/public/buss/all"
    cookie = 'ccbcustomid=bf70c8bf0e52bd0bmnZiRpQfucLPqgM6Xcrk1679470962527L3CTimvBdh16rYTtJhhT463b28ceff47fde09ff1bba710e51c87; zc_mcpcxkuz9d3f6bey=%7B%22sid%22%3A%20%221680599914149_563095963627632%22%2C%22updated%22%3A%201680599914149%2C%22info%22%3A%201680599913116%2C%22superProperty%22%3A%20%22%7B%5C%22app_id%5C%22%3A%20%5C%22mcpcxkuz9d3f6bey%5C%22%7D%22%2C%22platform%22%3A%20%22%7B%7D%22%2C%22utm%22%3A%20%22%7B%7D%22%2C%22referrerDomain%22%3A%20%22just998.com%22%7D; dsloginTypeTips=7; zc_did=%7B%22did%22%3A%20%221874b8f929912cf-02e2f57b14ecb7-26031851-384000-1874b8f929a15e7%22%7D; zc_nmccadi6bv8x90wg=%7B%22sid%22%3A%20%221700114251999_519372677547505%22%2C%22updated%22%3A%201700114252008%2C%22info%22%3A%201700114252000%2C%22superProperty%22%3A%20%22%7B%5C%22app_name%5C%22%3A%20%5C%22%E5%BB%BA%E8%A1%8C%E7%94%9F%E6%B4%BB%5C%22%2C%5C%22app_id%5C%22%3A%20%5C%22nmccadi6bv8x90wg%5C%22%2C%5C%22user_id%5C%22%3A%20%5C%22%5C%22%2C%5C%22mobile_no%5C%22%3A%20%5C%22%5C%22%2C%5C%22cst_id%5C%22%3A%20%5C%22%5C%22%2C%5C%22nick_name%5C%22%3A%20%5C%22%5C%22%2C%5C%22country_name%5C%22%3A%20%5C%22%E4%B8%AD%E5%9B%BD%5C%22%2C%5C%22province%5C%22%3A%20%5C%22%5C%22%2C%5C%22city%5C%22%3A%20%5C%22%5C%22%2C%5C%22latitude%5C%22%3A%20%5C%22%5C%22%2C%5C%22longitude%5C%22%3A%20%5C%22%5C%22%7D%22%2C%22platform%22%3A%20%22%7B%7D%22%2C%22utm%22%3A%20%22%7B%7D%22%2C%22referrerDomain%22%3A%20%22%22%7D; zg_did=%7B%22did%22%3A%20%22187084528f31183-04f4ac030c8cca-26031851-384000-187084528f414f7%22%7D; zg_002714230c264ddda7d94375a4d23e40=%7B%22sid%22%3A%201701927946204%2C%22updated%22%3A%201701927946204%2C%22info%22%3A%201701927946205%2C%22superProperty%22%3A%20%22%7B%5C%22app_id%5C%22%3A%20%5C%22ccvcag5mqy1f7ie2%5C%22%2C%5C%22app_name%5C%22%3A%20%5C%22%E7%8F%AD%E5%85%8B%5C%22%2C%5C%22user_id%5C%22%3A%20%5C%223e603926-4e5c-4128-bf18-485db1317b59%5C%22%2C%5C%22screen_height%5C%22%3A%201440%2C%5C%22screen_width%5C%22%3A%202560%7D%22%2C%22platform%22%3A%20%22%7B%7D%22%2C%22utm%22%3A%20%22%7B%7D%22%2C%22referrerDomain%22%3A%20%22www.ccb.com%22%2C%22zs%22%3A%200%2C%22sc%22%3A%200%2C%22firstScreen%22%3A%201701927946204%7D; cityName=%E5%8C%97%E4%BA%AC%E5%B8%82; cityCode=110000; bankName=%E5%8C%97%E4%BA%AC%E5%B8%82%E5%88%86%E8%A1%8C; bankCode=110000000'
    headers = {"Content-Type": "application/json", 
               "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 NetType/WIFI MicroMessenger/7.0.20.1781(0x6700143B) WindowsWechat(0x63090217) XWEB/8555 Flue", 
               "Referer": "https://scqy.ccb.com/hmscmob/pfin/gmyl",
               "Cookie": cookie
               }
    prvtCtrctId = '9381b0914281ba3f2cb5e26c4fea558b8c3603f50cb47d554f7bada45410d69d'
    timestamp = int(time.time()*1000)
    nonce = random_str(11)
    sign_str = get_sign(prvtCtrctId, timestamp, nonce)
    req_data = {"bussStcd":"00","prvtCtrctId":prvtCtrctId,"timestamp":timestamp,"nonce":nonce ,"sign":sign_str}
    
    req_json={"data": encrypt(req_data),
              "signData": "aBtE+ZPh78z78O3ttB690Q0wCXeHX0FcNMCygmqFAFmyf/jIbmj9R08obh1/8KAQvHSvmsX7tM9cH+1CEVjyJAx6axu2qmHERC2pVdWgk9nrxmWehZLRhP1FrlkyuxU3hJ7yweTqEhe59HDDZT8No4oF0M2DruUc71FaN7zh9W0="}
    http = requests.post(url, headers=headers, json=req_json)  
    
    resp = http.text
    print(decrypt(resp))