当前位置：首页 > article >正文

京东 rpc调用h5st

article 2025/2/9 5:03:50

一，jsrpc程序下载，双击启动

https://github.com/jxhczhl/JsRpc

二，注入JS，构建通信环境（/resouces/JsEnv_De.js）

var rpc_client_id, Hlclient = function (wsURL) {
    this.wsURL = wsURL;
    this.handlers = {
        _execjs: function (resolve, param) {
            var res = eval(param)
            if (!res) {
                resolve("没有返回值")
            } else {
                resolve(res)
            }
        }
    };
    this.socket = undefined;
    if (!wsURL) {
        throw new Error('wsURL can not be empty!!')
    }
    this.connect()
}
Hlclient.prototype.connect = function () {
    if (this.wsURL.indexOf("clientId=") === -1 && rpc_client_id) {
        this.wsURL += "&clientId=" + rpc_client_id
    }
    console.log('begin of connect to wsURL: ' + this.wsURL);
    var _this = this;
    try {
        this.socket = new WebSocket(this.wsURL);
        this.socket.onmessage = function (e) {
            _this.handlerRequest(e.data)
        }
    } catch (e) {
        console.log("connection failed,reconnect after 10s");
        setTimeout(function () {
            _this.connect()
        }, 10000)
    }
    this.socket.onclose = function () {
        console.log('rpc已关闭');
        setTimeout(function () {
            _this.connect()
        }, 10000)
    }
    this.socket.addEventListener('open', (event) => {
        console.log("rpc连接成功");
    });
    this.socket.addEventListener('error', (event) => {
        console.error('rpc连接出错,请检查是否打开服务端:', event.error);
    })
};
Hlclient.prototype.send = function (msg) {
    this.socket.send(msg)
}
Hlclient.prototype.regAction = function (func_name, func) {
    if (typeof func_name !== 'string') {
        throw new Error("an func_name must be string");
    }
    if (typeof func !== 'function') {
        throw new Error("must be function");
    }
    console.log("register func_name: " + func_name);
    this.handlers[func_name] = func;
    return true
}
Hlclient.prototype.handlerRequest = function (requestJson) {
    var _this = this;
    try {
        var result = JSON.parse(requestJson)
    } catch (error) {
        console.log("请求信息解析错误", requestJson);
        return
    }
    if (result["registerId"]) {
        rpc_client_id = result['registerId']
        return
    }
    if (!result['action'] || !result["message_id"]) {
        console.warn('没有方法或者消息id,不处理');
        return
    }
    var action = result["action"], message_id = result["message_id"]
    var theHandler = this.handlers[action];
    if (!theHandler) {
        this.sendResult(action, message_id, 'action没找到');
        return
    }
    try {
        if (!result["param"]) {
            theHandler(function (response) {
                _this.sendResult(action, message_id, response);
            })
            return
        }
        var param = result["param"]
        try {
            param = JSON.parse(param)
        } catch (e) {
        }
        theHandler(function (response) {
            _this.sendResult(action, message_id, response);
        }, param)
    } catch (e) {
        console.log("error: " + e);
        _this.sendResult(action, message_id, e);
    }
}
Hlclient.prototype.sendResult = function (action, message_id, e) {
    if (typeof e === 'object' && e !== null) {
        try {
            e = JSON.stringify(e)
        } catch (v) {
            console.log(v)//不是json无需操作
        }
    }
    this.send(JSON.stringify({"action": action, "message_id": message_id, "response_data": e}));
}
window.demo = new Hlclient("ws://127.0.0.1:12080/ws?group=zzz");

三，打开控制台注入js 方法

四，python调用，传入参数，获取返回的加密参数

import json
from time import time
import requests
import hashlib

def sha256_hash(message):
    # 创建SHA-256对象
    sha256 = hashlib.sha256()

    # 更新哈希对象的内容
    sha256.update(message.encode('utf-8'))

    # 计算哈希值
    hash_value = sha256.hexdigest()

    return hash_value


headers = {
    'authority': 'api.m.jd.com',
    'accept': 'application/json, text/javascript, */*; q=0.01',
    'accept-language': 'zh-CN,zh;q=0.9',
    'cache-control': 'no-cache',
    'content-type': 'application/json;charset=gbk',
    'cookie': '__jdu=788028862; shshshfpa=6179fbc4-1638-5cd0-fd09-ffe006066559-1724397295; shshshfpx=6179fbc4-1638-5cd0-fd09-ffe006066559-1724397295; pinId=ez8XBoKkqCnZYXhRE4sgnLV9-x-f3wj7; pin=jd_744e8a9340d35; unick=jd_131722ska; TrackID=1qd-jutBKg_3EWJichX_x64pYH3j6TmbpptPmh-LTkzKn_fEBVzCz0arpFJRhU8NunnVV441YrsYYI4fibgXpuNDn7Qfv6E4YtILOdOhNXVs; thor=DDA96665A6C47DCC27FAEE74E2B8C4CEDCE74C3B856CADF307EB008CC3F6B16E5ED70D136CF58A196F8D631D7E0C2F3AA6D29BE0FF00D30439DA35815330D2D60A468BBF10E754A37ABB028B6691B1C01BC88462A71ED72182E656074D61CEE28B2AB5CC69E9C334981F0C89AE8B6969F8F424775C52862DA29CA332150FF8F4C09BA50EF3CC29ACC6F7D12AA9FA898CFDFB74A1AF543E4E2AFAD80005DB516C; light_key=AASBKE7rOxgWQziEhC_QY6yayKRkZEzgCc0EQgeOCyMjOPCHOc7pl2yKfelium3Ym4KNqdvX; __jdv=181111935|direct|-|none|-|1729069595839; areaId=19; ipLoc-djd=19-1601-50258-129167; 3AB9D23F7A4B3C9B=TYBTJASDTYK2MZ2STCMJFNLZBYPZXCNYIKXYOALCK3SUWHNYDKGHJ4K7NVXC2PLEVR74GULZL6TAEOOLKUBY4A7X6I; __jdc=181111935; 3AB9D23F7A4B3CSS=jdd03TYBTJASDTYK2MZ2STCMJFNLZBYPZXCNYIKXYOALCK3SUWHNYDKGHJ4K7NVXC2PLEVR74GULZL6TAEOOLKUBY4A7X6IAAAAMSYGOA4VYAAAAADKUS3D3DPACN5IX; jsavif=1; jsavif=1; __jda=181111935.788028862.1724397289.1729759923.1729825084.26; shshshfpb=BApXS17qUwvdAj1XU5H-yZE_Alpe9wNSDBmZ4dbpj9xJ1MqwD1YC2; flash=3_U3NMQ3e3TCEFy0oTfcvQ1uUJWBlsGSgbOr-bPVLhX7Yxnp3jdLtgiiM3HdB4dSFLep08JcRFl4HuWyqUV7ro5qqV-yekCC4CFdAnU7VIHl45D1nwNw3-AezIorjxHzNt-VhznJfPitg7zIzmBkH3kxYBCuYjZyCwQ_9mnS-9kA6ynBiCRbWG_V**; token=debc5c7912df5f57390dd68145146093,3,961015',
    'origin': 'https://item.jd.com',
    'pragma': 'no-cache',
    'referer': 'https://item.jd.com/',
    'sec-ch-ua': '"Not.A/Brand";v="8", "Chromium";v="114", "Google Chrome";v="114"',
    'sec-ch-ua-mobile': '?0',
    'sec-ch-ua-platform': '"Windows"',
    'sec-fetch-dest': 'empty',
    'sec-fetch-mode': 'cors',
    'sec-fetch-site': 'same-site',
    'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36',
    'x-referer-page': 'https://item.jd.com/100044835937.html',
    'x-rp-client': 'h5_1.0.0',
}


params = {
    'appid': 'item-v3',
    'functionId': 'pc_club_productPageComments',
    'client': 'pc',
    'clientVersion': '1.0.0',
    'body': '{"productId":100044835937,"score":0,"sortType":5,"page":1,"pageSize":10,"isShadowSku":0,"rid":0,"fold":1,"bbtf":"","shield":""}',
    'x-api-eid-token': 'jdd03TYBTJASDTYK2MZ2STCMJFNLZBYPZXCNYIKXYOALCK3SUWHNYDKGHJ4K7NVXC2PLEVR74GULZL6TAEOOLKUBY4A7X6IAAAAMSIJC7YMQAAAAADJRHCPRE244USIX',
    'loginType': '3',
    'uuid': '181111935.788028862.1724397289.1725852250.1727168030.23',
}
t = int(time()*1000)
sha256 = sha256_hash(params['body'])
u = {
    "appid": "item-v3",
    "functionId": "pc_club_productPageComments",
    "client": "pc",
    "clientVersion": "1.0.0",
    "t": t,
    "body": sha256
}
print(u)
url = "http://127.0.0.1:12080/go"
data = {
    "group": "zzz",
    "action": "hello3",
    "param": json.dumps({"parameter": u})
}
res = requests.post(url, data=data)
print(res.text)
resjson = json.loads(res.json().get('data'))

params['t'] = resjson.get('t')
params['h5st'] = resjson.get('h5st')
response = requests.get('https://api.m.jd.com/', params=params, headers=headers)
print(response)
print(response.json())

请求成功