(Why add 'pc' because the mobile version webpage seems to be unencrypted)
First, we open a comic directory page and press F12, we can see that the API request for the directory returns a bunch of hexadecimal.
Entering the JavaScript file that initiates this network request, we can see the eval blah blah.
The function inside eval returns a string, save it into the JavaScript file, use Whistle to replace the requested file, find the callback function for the HTTP request in Firefox, set a breakpoint (mainly found 'url': _0x1edb91 + _0x2f1f('0x19') + _0x124534 + '/chapters','success': function(){blah blah}
here).
Running to line 155, we find the decrypted JSON stored in _0x336148
. Lines 147, 148 are two function calls, a.b.c.d
is written as a[b][c][d]
. After evaluating the expressions in the brackets one by one, we find that the function is xxx.enc.hex.parse
, search for the function name, find the relevant content of CryptoJS
and conclude that AES decryption is used here. The password is 'dio' on line 144, and the IV offset value is '_0x513f33' on line 146. At this point, trying to decrypt directly with the 'result' from the JSON won't work, comparing reveals that '_0x2bee4f' is 16 characters shorter than 'result', and these 16 characters are the offset value. Remove them and then decrypt to get the directory.
Next is the comic reading page.
Didn't find an API call with F12, but the images are lazy-loaded. Checking the source code reveals...
The decryption method here is the same as above.