BuringStraw

BuringStraw

Decrypting comic copies on the PC web端

(Why add 'pc' because the mobile version webpage seems to be unencrypted)

First, we open a comic directory page and press F12, we can see that the API request for the directory returns a bunch of hexadecimal.

Directory

Entering the JavaScript file that initiates this network request, we can see the eval blah blah.

eval

The function inside eval returns a string, save it into the JavaScript file, use Whistle to replace the requested file, find the callback function for the HTTP request in Firefox, set a breakpoint (mainly found 'url': _0x1edb91 + _0x2f1f('0x19') + _0x124534 + '/chapters','success': function(){blah blah} here).

js

debug

Running to line 155, we find the decrypted JSON stored in _0x336148. Lines 147, 148 are two function calls, a.b.c.d is written as a[b][c][d]. After evaluating the expressions in the brackets one by one, we find that the function is xxx.enc.hex.parse, search for the function name, find the relevant content of CryptoJS and conclude that AES decryption is used here. The password is 'dio' on line 144, and the IV offset value is '_0x513f33' on line 146. At this point, trying to decrypt directly with the 'result' from the JSON won't work, comparing reveals that '_0x2bee4f' is 16 characters shorter than 'result', and these 16 characters are the offset value. Remove them and then decrypt to get the directory.

decryption

Next is the comic reading page.

Didn't find an API call with F12, but the images are lazy-loaded. Checking the source code reveals...

Reading page

The decryption method here is the same as above.

Loading...
Ownership of this post data is guaranteed by blockchain and smart contracts to the creator alone.