漫画下载图片获取 token 接口表单新增字段 m1

[Nemo2011]

标题中接口即 https://manga.bilibili.com/twirp/comic.v1.Comic/ImageToken，网页端呈现的其请求信息如下：

请求负载表单中多出来了一个 m1，m1 在每次获取 token 的请求中都不同，但是长度相同，且貌似均以 B 开头。

顺着 m1 找到 https://s1.hdslb.com/bfs/manga-static/manga-pc/static/js/reader.995d7fb4e7.js。

反混淆后能找到这么一段代码：

["generateECDHKeyPair"]() {
  0x0;
  return _0x3d958b.A(_0x37f1ea().mark(function _0x49c640() {
    return _0x37f1ea().wrap(function (_0x1a77d0) {
      for (;;) {
        switch (_0x1a77d0.prev = _0x1a77d0.next) {
          case 0x0:
            var _0x5bd36e = {
              "name": "ECDH",
              "namedCurve": "P-256"
            };
            _0x1a77d0.next = 0x2;
            return window.crypto.subtle.generateKey(_0x5bd36e, true, ["deriveKey", "deriveBits"]);
          case 0x2:
            return _0x1a77d0.abrupt("return", _0x1a77d0.sent);
          case 0x3:
          case "end":
            return _0x1a77d0.stop();
        }
      }
    }, _0x49c640);
  }))();
}
["getM1AndKey"](_0x1ce836) {
  var _0x4fa285 = this;
  0x0;
  return _0x3d958b.A(_0x37f1ea().mark(function _0x431c98() {
    var _0x45f972;
    var _0x44bfa4;
    var _0x57af24;
    var _0x1bb41a;
    var _0x3ed59f;
    var _0x59822a;
    return _0x37f1ea().wrap(function (_0x28f935) {
      for (;;) {
        switch (_0x28f935.prev = _0x28f935.next) {
          case 0x0:
            _0x28f935.next = 0x2;
            return _0x4fa285.generateECDHKeyPair();
          case 0x2:
            _0x45f972 = _0x28f935.sent;
            _0x28f935.next = 0x5;
            return window.crypto.subtle.exportKey("raw", _0x45f972.publicKey);
          case 0x5:
            _0x44bfa4 = _0x28f935.sent; // public key
            _0x28f935.next = 0x8;
            return window.crypto.subtle.exportKey('jwk', _0x45f972.privateKey);
          case 0x8:
            _0x57af24 = _0x28f935.sent; // private key
            _0x1bb41a = JSON.stringify(_0x57af24);
            _0x3ed59f = btoa(_0x1bb41a);
            _0x59822a = btoa(String.fromCharCode.apply(null, new Uint8Array(_0x44bfa4)));
            _0x4fa285._m1Info.push({
              'm1': _0x3ed59f,
              'key': _0x59822a,
              'url': _0x1ce836
            });
            return _0x28f935.abrupt("return", _0x59822a);
          case 0xe:
          case "end":
            return _0x28f935.stop();
        }
      }
    }, _0x431c98);
  }))();
}

整理，能得到下面的代码：

const crypto = require("crypto");

async function generateECDHKeyPair() {
  return await crypto.subtle.generateKey(
    {
      name: "ECDH",
      namedCurve: "P-256",
    },
    true,
    ["deriveKey", "deriveBits"]
  );
}

async function getM1AndKey() {
  var key = await generateECDHKeyPair();
  var publicKey = await crypto.subtle.exportKey("raw", key.publicKey);
  var privateKey = await crypto.subtle.exportKey("jwk", key.privateKey);
  return {
    m1: btoa(JSON.stringify(privateKey)),
    key: btoa(String.fromCharCode.apply(null, new Uint8Array(publicKey))),
  };
}

getM1AndKey().then((data) => {
  console.log(data);
});

output:

{
  m1: 'eyJrZXlfb3BzIjpbImRlcml2ZUtleSIsImRlcml2ZUJpdHMiXSwiZXh0Ijp0cnVlLCJrdHkiOiJFQyIsIngiOiJNeFhwalBQUnR5LUg2SnA3RVNHbUhwdXYzbVpEd2t5Z1RJdzJYa0c4Uy1rIiwieSI6Il92X09DazR3VmVNV21ObEZZU0pZNmc4WndhODkxRjlJWVBFOEl1SUZGU2siLCJjcnYiOiJQLTI1NiIsImQiOiJKLThodU80RkxlWmt2YkdqWFVqYVQzYU1rWW1UMm0taEkxQXhJUHU2aHVjIn0=',
  key: 'BDMV6Yzz0bcvh+iaexEhph6br95mQ8JMoEyMNl5BvEvp/v/OCk4wVeMWmNlFYSJY6g8Zwa891F9IYPE8IuIFFSk='
}

观察到 key 字段即为所需的 m1 字段，总结来说 m1 为创建一个 ECC P-256 的密钥，然后将公钥 base64 加密的结果。

最后附上一份 python 的翻译：

from Cryptodome.PublicKey import ECC
import base64

def get_m1():
    key = ECC.generate(curve="P-256")
    pubKey = key.public_key().export_key(format="raw")
    return base64.b64encode(pubKey).decode("ascii")

if __name__ == '__main__':
    print(get_m1())