1002 字

3 分钟

某东h5st逆向全流程

2026-05-16

逆向

/

h5st

/

爬虫

某东h5st全流程#

免责声明#

本文仅供学习交流使用，严禁用于商业用途及非法用途！

本文所涉及的技术、代码、思路均来源于公开的网络资源及个人学习研究，仅用于技术交流与知识分享。
本文中的爬虫示例代码、逆向分析方法，仅作为学习爬虫技术与反爬虫技术的参考，读者应在遵守相关法律法规及网站服务条款的前提下使用。
严禁使用本文中的技术手段进行任何形式的非法数据获取、商业竞争、侵犯隐私等行为。 任何因不当使用本文内容而产生的法律纠纷及后果，均由使用者自行承担，与本文作者无关。
如果相关网站或平台认为本文内容侵犯了您的权益，请联系作者，作者将在第一时间删除相关内容。
学技术是为了保护自己，而不是去伤害别人。 请尊重网站的数据所有权，合理合法地使用网络资源。
如有问题，请第一时间练习本人进行删除。

h5st采用控制流混淆，以及大量指纹与环境检测，颇为麻烦，这篇文章我们用补环境的方式来拿到h5st。

本篇针对最新版h5st，也就是5.3版本😭

由于我的账号被风控了，为了演示清楚，我在网上找了一些类似的浏览器截图✊

流程#

通过抓包我们可以发现，表单里有个h5st参数，这个参数就是我们的目标。

我们直接利用搜索，在所有和h5st相关的地方打上断点。

最后会断在这里

现在就清晰明了了，我们要拿到h5st，就要搞到d这个参数。d就在上面，没截进来。

我们在node里模拟出d，这里我取名为u，参数照着浏览器拿就行。

1
u = {
2
    appid: "search-pc-java",
3
    functionId: 'pc_search_searchWare',
4
    client: "pc",
5
    clientVersion: "1.0.0",
6
    t: new Date().getTime(),
7
    body: crypto.SHA256(JSON.stringify(params)).toString()
8
};

u的body又是一个sha256加密的params，我们接着去拿这个params

1
params = {
2
    "enc": "utf-8",
3
    "area": "52993_52994_146660_0",
4
    "page": 1,
5
    "mode": "",
6
    "concise": false,
7
    "hoverPictures": false,
8
    "newAdvRepeat": false,
9
    "mixerParam": false,
10
    "new_interval": true,
11
    "s": 1
12
}

这里只有page和s是动态变化的，这个s生成逻辑如下，pf是个动态数组，需要请求才能拿到。

1
nction get_s(e) {
2
    Pf = new Map([
3

4
])
5
    try {
6
        let t = 0
7
          , n = 0;
8
        return Pf.forEach(r => {
9
            r.page < e && (t += +r.adNum,
10
            n += +r.repeatNum)
11
        }
12
        ),
13
        1 + (e - 1) * 30 - t + n
14
    } catch (t) {
15
        return 1
16
    }
17
}

但是我们通过重放，可以发现，对s校验不是很严格！（ps：这个有可能是个风控点）所以我们先不管他。

这样，我们就可以在node构造获取h5st的函数了。

1
function get_h5st() {
2
    params = {
3
    "enc": "utf-8",
4
    "area": "52993_52994_146660_0",
5
    "page": 1,
6
    "mode": "",
7
    "concise": false,
8
    "hoverPictures": false,
9
    "newAdvRepeat": false,
10
    "mixerParam": false,
11
    "new_interval": true,
12
    "s": 1
13
}
14
    u = {
15
        appid: "search-pc-java",
16
        functionId: 'pc_search_searchWare',
17
        client: "pc",
18
        clientVersion: "1.0.0",
19
        t: new Date().getTime(),
20
        body: crypto.SHA256(JSON.stringify(params)).toString()
21
    };
22
    window.PSign = new window.ParamsSign({
23
            appId: 'f06cc',
24
            preRequest: false,
25
            onSign: (res) => {
26
              // 签名可用率监控，业务方自行上报
27
              if (res.code != 0) {
28
                try {
29
                  window.dra &&
30
                    window.dra.sendCustomEvent &&
31
                    window.dra.sendCustomEvent({
32
                      name: 'main_search',
33
                      metrics: {
34
                        error_code: '751',
35
                        error_type_txt: '接口加密失败onSign非0',
36
                      },
37
                      context: {
38
                        error_code: res.code,
39
                      },
40
                    })
41
                } catch (error) {
42
                  console.log(error)
43
                }
44
              }
45
            },
46
            onRequestTokenRemotely: (res) => {
47
              // 算法接口可用率监控，业务方自行上报
48
              if (res.code != 200) {
49
                try {
50
                  window.dra &&
51
                    window.dra.sendCustomEvent &&
52
                    window.dra.sendCustomEvent({
53
                      name: 'main_search',
54
                      metrics: {
55
                        error_code: '751',
56
                        error_type_txt: '接口加密失败onRequestTokenRemotely',
57
                      },
58
                      context: {
59
                        error_msg: res && res.message ? res.message : '接口加密失败',
60
                      },
61
                    })
62
                } catch (error) {
63
                  console.log(error)
64
                }
65
              }
66
            },
67
          })
68
    h5st = window.PSign._$sdnmd(u)
69
    return h5st
70
}

window.PSign通过搜索也能拿到，他是在文件开头被初始化，我们直接扣下来放在上面。

通过跟栈，我们可以发现，h5st生成就是在js_security这个文件里，我们把这个文件全部拿到node里并命名为js_code。

1
const crypto = require('crypto-js')
2
//生成逻辑
3
require('./js_code')
4

5
function get_h5st() {
6
    params = {
7
    "enc": "utf-8",
8
    "area": "52993_52994_146660_0",
9
    "page": 1,
10
    "mode": "",
11
    "concise": false,
12
    "hoverPictures": false,
13
    "newAdvRepeat": false,
14
    "mixerParam": false,
15
    "new_interval": true,
16
    "s": 1
17
}
18
    u = {
19
        appid: "search-pc-java",
20
        functionId: 'pc_search_searchWare',
21
        client: "pc",
22
        clientVersion: "1.0.0",
23
        t: new Date().getTime(),
24
        body: crypto.SHA256(JSON.stringify(params)).toString()
25
    };
26
    window.PSign = new window.ParamsSign({
27
            appId: 'f06cc',
28
            preRequest: false,
29
            onSign: (res) => {
30
              // 签名可用率监控，业务方自行上报
31
              if (res.code != 0) {
32
                try {
33
                  window.dra &&
34
                    window.dra.sendCustomEvent &&
35
                    window.dra.sendCustomEvent({
36
                      name: 'main_search',
37
                      metrics: {
38
                        error_code: '751',
39
                        error_type_txt: '接口加密失败onSign非0',
40
                      },
41
                      context: {
42
                        error_code: res.code,
43
                      },
44
                    })
45
                } catch (error) {
46
                  console.log(error)
47
                }
48
              }
49
            },
50
            onRequestTokenRemotely: (res) => {
51
              // 算法接口可用率监控，业务方自行上报
52
              if (res.code != 200) {
53
                try {
54
                  window.dra &&
55
                    window.dra.sendCustomEvent &&
56
                    window.dra.sendCustomEvent({
57
                      name: 'main_search',
58
                      metrics: {
59
                        error_code: '751',
60
                        error_type_txt: '接口加密失败onRequestTokenRemotely',
61
                      },
62
                      context: {
63
                        error_msg: res && res.message ? res.message : '接口加密失败',
64
                      },
65
                    })
66
                } catch (error) {
67
                  console.log(error)
68
                }
69
              }
70
            },
71
          })
72
    h5st = window.PSign._$sdnmd(u)
73
    return h5st
74

75
}
76

77
console.log(get_h5st())

现在，我们直接挂上代理，补环境即可！这里耐心补就行，不过它检测了原型链！需要补原型链！

基本大量是document的环境。

接着是canvas指纹和webgl指纹。

这两个取巧可以直接去拿。

1
function _$RD(_$RO) {
2
_$RI(_$RO, 'pf', function(_$RY) {
3
            return window.navigator.platform;
4
        }, _$RW),
5
        _$RI(_$RO, 'pr', function(_$RY) {
6
            return window.devicePixelRatio;
7
        }, _$RW),
8
        _$RI(_$RO, 're', function(_$RY) {
9
            return document.referrer;
10
        }, _$RW),
11
        _$I.AWTVk(_$RI, _$RO, Zn(0x26b), function(_$RY) {
12
            return _$q8(0x2184 * -0x1 + 0x6dd + -0x86 * -0x33);
13
        }, _$RW),
14
        _$RI(_$RO, Zn(0x27e), function(_$RY) {
15
            var Ze = Zn
16
              , _$RQ = new RegExp(Ze(0x1f5))
17
              , _$Rb = document.referrer.match(_$RQ);
18
            return _$Rb && _$Rb[0xae0 + -0x21b8 + 0x2db * 0x8] ? _$Rb[-0x305 * 0x4 + 0x62 * -0x53 + 0x74f * 0x6] : '';
19
        }, _$RW),
20
        _$RI(_$RO, 'v', function(_$RY) {
21
            return _$ql;
22
        }, _$RW),
23
        _$RI(_$RO, Zn(0x290), function(_$RY) {
24
            var Za = Zn
25
              , _$RQ = new Error(Za(0x2d8)).stack.toString()
26
              , _$Rb = _$RQ.split('\x0a')
27
              , _$Rw = _$Rb.length;
28
            return _$RA.ZaihA(_$Rw, -0x1c4f + -0x228f + -0x22b * -0x1d) ? _$Rb[_$Rw - (-0x1 * -0x265 + 0x120c + -0x1470)] : _$RQ;
29
        }, _$RW),
30
        _$RI(_$RO, Zn(0x302), function(_$RY) {
31
            return Window.toString() + '$' + Window.toString.toString.toString();
32
        }, _$RW),
33
        _$I.GxyBI(_$RI, _$RO, Zn(0x1d2), function(_$RY) {
34
            return '0';
35
        }, _$RW),
36
        _$I.GxyBI(_$RI, _$RO, _$I.ELueU, function(_$RY) {
37
            var _$RQ = _$qT.get(_$qk.CANVAS_FP)
38
              , _$Rb = _$RA.CGaEl(_$q7, _$RQ) ? _$RQ.v : '';
39
            return _$Rb || (navigator.userAgent && !/Mobi|Android|webOS|iPhone|iPad|iPod|BlackBerry|IEMobile|Opera Mini/i.test(navigator.userAgent) && (_$Rb = _$RA.ilAqh(_$qA)),
40
            _$Rb && _$qT.set(_$qk.CANVAS_FP, {
41
                'v': _$Rb,
42
                't': Date.now(),
43
                'e': 0x1e13380
44
            })),
45
            _$Rb;
46
        }, _$RW),
47
        _$RI(_$RO, _$I.xhXJd, function(_$RY) {
48
            var _$RQ = _$qA();
49
            return _$RQ && _$qT.set(_$qk.CANVAS_FP, {
50
                'v': _$RQ,
51
                't': Date.now(),
52
                'e': 0x1e13380
53
            }),
54
            _$RQ;
55
        }, _$RW),
56
        _$I.AWTVk(_$RI, _$RO, Zn(0x227), function(_$RY) {
57
            var _$RQ = _$qT.get(_$qk.WEBGL_FP);
58
            return _$q7(_$RQ) && _$RQ.v ? _$RQ.v : '';
59
        }, _$RW),
60
        _$RI(_$RO, Zn(0x2ef), function(_$RY) {
61
            return navigator.hardwareConcurrency;
62
        }, _$RW),
63
        _$RW;
64
    }
65
}

我们可以看到，它检测了大量navigator，直接搜到这里，我们能发现_$RW对象包含了大量指纹信息。

直接把他拿到我们的node环境里赋值，注意里面有两个random随机数，这个我们可以通过追栈或者直接hook，最后能找到这个随机数的生成函数_ $q8，就能拿到random属性`"random": _$ q8(10)`。

python模拟请求#

由于检测了tls指纹，我们需要利用curl_cffi来模拟指纹，另外execjs这个狗屎编码问题也需要解决。方案如下

1
import time
2
from curl_cffi import requests
3
import subprocess
4
from functools import partial
5
# 解决 Windows 编码问题
6
subprocess.Popen = partial(subprocess.Popen, encoding='utf-8')
7
import execjs
8
print(execjs.get().name)  # 确保能正常运行
9
with open("狗东h5st.js", "r", encoding="utf-8") as f:
10
    js_code = f.read()
11
ctx = execjs.compile(js_code)
12
headers = {
13
    "accept": "application/json, text/plain, */*",
14
    "accept-language": "zh-CN,zh;q=0.9",
15
    "cache-control": "no-cache",
16
    "origin": "https://search.jd.com",
17
    "pragma": "no-cache",
18
    "priority": "u=1, i",
19
    "referer": "https://search.jd.com/Search?keyword=jk&enc=utf-8&pvid=cd0e7cded0fd46e19f75c9ea87e29986&themeColor=&from=home&spmTag=YTAyMTkuYjAwMjM1Ni5jMDAwMDcxNjEuMSU0MDE3Nzg4OTI5MTA2MTQlMjMxNzc4NzY0NzE5NTE1MTY5OTk0OTU0MSUyMzE5Mjg0MTIyNzc",
20
    "sec-ch-ua": "\"Chromium\";v=\"148\", \"Google Chrome\";v=\"148\", \"Not/A)Brand\";v=\"99\"",
21
    "sec-ch-ua-mobile": "?0",
22
    "sec-ch-ua-platform": "\"Windows\"",
23
    "sec-fetch-dest": "empty",
24
    "sec-fetch-mode": "cors",
25
    "sec-fetch-site": "same-site",
26
    "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36",
27
    "x-referer-page": "https://search.jd.com/Search",
28
    "x-rp-client": "h5_2.1.0"
29
}
30
cookies = {
31
    "__jdv": "229668127|cn.bing.com|t_2037222536_0_0|adrealizable|f49c1979fb28d62d-p_0|1778760960019",
32
    "jcap_dvzw_fp": "67G6EpotjV1J0eDMn-JsRuIHuU_J5iLXjyGeSV8Tmajx66RJzEiZ4WlUT1sDg04R6Es07eAs84QRfEuCdzxPlW3p1uA=",
33
    "PCSYCityID": "CN_320000_320500_0",
34
    "user-key": "1063871e-fef9-46fb-90f3-2f11fcc86806",
35
    "shshshfpa": "7016242f-a138-659d-7491-5709d4550ab4-1778761184",
36
    "shshshfpx": "7016242f-a138-659d-7491-5709d4550ab4-1778761184",
37
    "__jdu": "17787647195151699949541",
38
    "areaId": "52993",
39
    "ipLoc-djd": "52993-52994-146660-0",
40
    "TrackID": "1RZcfqjkwy76IJKCAe59oT1JBBKuBGlMrbE4NgcObczVnYG-e0UwFdLh7NeVnDUTohS1B4BCz2FDIzNSd36rexqAPv1GW9ae6HvVCJM56_S4",
41
    "light_key": "AASBKE7rOxgWQziEhC_QY6ya2qL1uZOKJ26TLn-7vCoZWxnGUe6STkaVDa2a003PEPXUYde7",
42
    "pinId": "OI66V8DdRcDvRP4X3ePfTg",
43
    "pin": "jd_KlBTjtKcZjSM",
44
    "unick": "2l652aq5b18189",
45
    "_tp": "nRRl2Me9wmEDL1EY%2FCqfTg%3D%3D",
46
    "_pst": "jd_KlBTjtKcZjSM",
47
    "autoOpenApp_downCloseDate_autoOpenApp_handler": "1778839798571_1",
48
    "thor": "43756E9B198DF241723079EF4BD85A79B835F3CDCF648F0BEB2B713C4B12EB320A368AA2F11FBD14F679272B9C59349767EBFA088D41BD415A033394A27983D0",
49
    "3AB9D23F7A4B3CSS": "jdd034BPKMDD2RHGRUQV5KRSOZKORJMNUXX4XMCMHWQPUJ6S6H4YZVJ2TU4GFI7OULL45RNG7SPUP5HVZB7KFZA45ZHCP7EAAAAM6FZDYL2YAAAAADB6MGM3YYN2XO4X",
50
    "mail_times": "4%2C1%2C1778892901084",
51
    "umc_count": "1",
52
    "__jda": "143920055.17787647195151699949541.1778764720.1778852393.1778892900.6",
53
    "__jdc": "143920055",
54
    "cid": "9",
55
    "3AB9D23F7A4B3C9B": "4BPKMDD2RHGRUQV5KRSOZKORJMNUXX4XMCMHWQPUJ6S6H4YZVJ2TU4GFI7OULL45RNG7SPUP5HVZB7KFZA45ZHCP7E",
56
    "flash": "3_3IVwA_AoKgPBjcEwGfJ2h_Q1FrVfx3ICqMi7CSFiFkp04BNsQQrKw538-hT1tH_HQnXHEg5uZN9r520I51HFpxb472wCxV29wpLR_ZtH9qMd2KmfhH4s0NzTv_6Yv2cc9tG7Zp5U1miT5yRbxY6snslW2-25fMjohNusHGdETDoW4TzxBZxp",
57
    "sdtoken": "AAbEsBpEIOVjqTAKCQtvQu17ufJOKOnkyrGFeRRK4gqM-z1ZogKzU6BynGrK2MBnxOr6xKr65bBRTa9bDZ-dUEbF9g3zPVLJUutUZEdm3lGX1ZDNafLoH_YeoTDumsyCeqk7Q_NwHm_u1e45Ccsb",
58
    "shshshfpb": "BApXWaiWLLftA4Io_U3-LKcZYPn5vk7tuBjo3Fqto9xJ1PdZfQq3asC7hmAD5CYxAXjWF06vnsaxgIblgv64M5Ip_Og3qp_RZiYI",
59
    "__jdb": "143920055.40.17787647195151699949541|6.1778892900"
60
}
61
url = "https://api.m.jd.com/api"
62
res = ctx.call("get_h5st")
63
params = {
64
    "appid": "search-pc-java",
65
    "t": [
66
        str(res['t']),
67
        str(int(time.time()*1000)),
68
    ],
69
    "client": "pc",
70
    "clientVersion": "1.0.0",
71
    "cthr": "1",
72
    "uuid": "17787647195151699949541",
73
    "loginType": "3",
74
    "keyword": "jk",
75
    "functionId": "pc_search_searchWare",
76
    "body": "{\"enc\":\"utf-8\",\"pvid\":\"cd0e7cded0fd46e19f75c9ea87e29986\",\"from\":\"home\",\"area\":\"52993_52994_146660_0\",\"page\":1,\"mode\":\"\",\"concise\":false,\"hoverPictures\":false,\"newAdvRepeat\":false,\"mixerParam\":false,\"new_interval\":true,\"s\":1}",
77
    "x-api-eid-token": "aldjaodaiodj",
78
    "h5st":res["h5st"]
79
}
80
response = requests.get(url, headers=headers, cookies=cookies, params=params,impersonate="chrome110")
81

82
print(response.text)
83
print(response)

最后能拿到数据，但是注意风控！

1
裙+白色衬衫+蓝条纹领带","commentFuzzy":"32","d30ItemUvDesc":"100+","deliveryable":1,"disableCart":0,"finalPrice":{"count":1,"estimatedPrice":"461.64","isFinal":1,"subPriceType":null,"title":"到手价","type":1},"finalPriceJson":"{\"count\":1,\"estimatedPrice\":\"461.64\",\"isFinal\":1,\"title\":\"到手价\",\"type\":1}","followed":0,"govSubsidyBenefit":null,"hidePrice":0,"iconList1":null,"iconList2":null,"iconList3":null,"iconList4":null,"imageurl":"jfs/t1/327793/5/9733/112790/68a934a9F52c765ec/441fe048eb1734c9.jpg","isContrast":1,"jdPrice":"481.50","jdPriceDesc":"","jdPriceFuzzy":"","limitCompanyBuy":0,"longImageUrl":"","mockFinalPrice":null,"oriPrice":"","pingou":0,"plusGoodShop":0,"plusLimit":0,"presale":0,"productUrl":null,"promotionDiscount":"","realPrice":"481.50","sdx":"","seckill":0,"selfSupport":0,"showAddCart":1,"showPurchaseList":0,"skuId":null,"stock":1,"subsidyPrice":"","timeOrderType":0,"totalSales":"","wareId":"10175899914465","wholeSales":"","yushouInfo":null,"yuyueInfo":null,"yuyueYushouJson":""},{"addCartUrl":null,"advanceBooking":0,"cashFirst":"","clickUrl":"","color":"粉色百褶裙+白色衬衫+少女心事领","commentFuzzy":"32","d30ItemUvDesc":"1","deliveryable":1,"disableCart":0,"finalPrice":{"count":1,"estimatedPrice":"461.64","isFinal":1,"subPriceType":null,"title":"到手价","type":1},"finalPriceJson":"{\"count\":1,\"estimatedPrice\":\"461.64\",\"isFinal\":1,\"title\":\"到手价\",\"type\":1}","followed":0,"govSubsidyBenefit":null,"hidePrice":0,"iconList1":null,"iconList2":null,"iconList3":null,"iconList4":null,

某东h5st逆向全流程

https://fatdog.20060113.xyz/posts/h5st/

作者

神秘大胖狗

发布于

2026-05-16

许可协议

CC BY-NC-SA 4.0

部分信息可能已经过时

事先声明！

利用Ast解ob混淆