关于WEB端优酷YouKu弹幕分析笔记

题记

近期对官方源弹幕进行优化更新及新增，目前支持优酷，奇艺，腾讯，芒果，bilibili，乐视，搜狐。
优化了颜色显示、出现位置、文字大小，更具真实性，特色！
常有弹幕在，观影不孤独！

数据分析

通过抓包：
参考官方JS：https://g.alicdn.com/pc-playpage-components/youku-barrage/0.1.24/index.js

1、https://acs.youku.com/h5/mopen.youku.danmu.list/1.0/?jsv=2.5.1&appKey=24679788&t=1632124149241&sign=9df66618e35f8ff79242106ea10f48f9&api=mopen.youku.danmu.list&v=1.0&type=originaljson&dataType=jsonp&timeout=20000&jsonpIncPrefix=utility

这是接口，仍需要POST提交数据
2、post数据data=%7B%22pid%22%3A0%2C%22ctype%22%3A10004%2C%22sver%22%3A%223.1.0%22%2C%22cver%22%3A%22v1.0%22%2C%22ctime%22%3A1632124149214%2C%22guid%22%3A%22JCCoF7kmLS4CATFSBgl5BofS%22%2C%22vid%22%3A%22XNTE4NjI4MTI1Ng%3D%3D%22%2C%22mat%22%3A6%2C%22mcount%22%3A1%2C%22type%22%3A1%2C%22msg%22%3A%22eyJjdGltZSI6MTYzMjEyNDE0OTIxNCwiY3R5cGUiOjEwMDA0LCJjdmVyIjoidjEuMCIsImd1aWQiOiJKQ0NvRjdrbUxTNENBVEZTQmdsNUJvZlMiLCJtYXQiOjYsIm1jb3VudCI6MSwicGlkIjowLCJzdmVyIjoiMy4xLjAiLCJ0eXBlIjoxLCJ2aWQiOiJYTlRFNE5qSTRNVEkxTmc9PSJ9%22%2C%22sign%22%3A%22ef83bc07a5aedffaf104ce5cfff8f63a%22%7D
通过urlencode解码可得json明文。

{"pid":0,"ctype":10004,"sver":"3.1.0","cver":"v1.0","ctime":1632124149214,"guid":"JCCoF7kmLS4CATFSBgl5BofS","vid":"XNTE4NjI4MTI1Ng==","mat":6,"mcount":1,"type":1,"msg":"eyJjdGltZSI6MTYzMjEyNDE0OTIxNCwiY3R5cGUiOjEwMDA0LCJjdmVyIjoidjEuMCIsImd1aWQiOiJKQ0NvRjdrbUxTNENBVEZTQmdsNUJvZlMiLCJtYXQiOjYsIm1jb3VudCI6MSwicGlkIjowLCJzdmVyIjoiMy4xLjAiLCJ0eXBlIjoxLCJ2aWQiOiJYTlRFNE5qSTRNVEkxTmc9PSJ9","sign":"ef83bc07a5aedffaf104ce5cfff8f63a"}

先分析接口地址，其他都可以通过明文获取除了sign参数，大约可得知是md5，继续翻官方JS。https://g.alicdn.com/youku-node/pc-playpage/1.3.38/scripts/lib.js

if (i.H5Request === !0) {
            var n = "//" + (i.prefix ? i.prefix + "." : "") + (i.subDomain ? i.subDomain + "." : "") + i.mainDomain +
                "/h5/" + t.api.toLowerCase() + "/" + t.v.toLowerCase() + "/",
                r = t.appKey || ("waptest" === i.subDomain ? "4272" : "12574478"),
                a = (new Date).getTime(),
                o = s(i.token + "&" + a + "&" + r + "&" + t.data),
                l = {
                    appKey: r,
                    t: a,
                    sign: o
                },
                u = {
                    data: t.data,
                    ua: t.ua
                };
            Object.keys(t).forEach(function (e) {
                "undefined" == typeof l[e] && "undefined" == typeof u[e] && (l[e] = t[e])
            }), i.getJSONP ? l.type = "jsonp" : i.getOriginalJSONP ? l.type = "originaljsonp" : (i.getJSON || i
                .postJSON) && (l.type = "originaljson"), i.querystring = l, i.postdata = u, i.path = n
        }

i.token就是cookie m_h5_tk 中的【】前面一部分，
a是时间戳，
r当前appKey,
t.data就是上面post的data值

md5(2f8596ebe61d0619ebc0581e41a682b2 + "&" + 1632126761503 + "&" + 24679788 + "&" + {"pid":0,"ctype":10004,"sver":"3.1.0","cver":"v1.0","ctime":1632124149214,"guid":"JCCoF7kmLS4CATFSBgl5BofS","vid":"XNTE4NjI4MTI1Ng==","mat":6,"mcount":1,"type":1,"msg":"eyJjdGltZSI6MTYzMjEyNDE0OTIxNCwiY3R5cGUiOjEwMDA0LCJjdmVyIjoidjEuMCIsImd1aWQiOiJKQ0NvRjdrbUxTNENBVEZTQmdsNUJvZlMiLCJtYXQiOjYsIm1jb3VudCI6MSwicGlkIjowLCJzdmVyIjoiMy4xLjAiLCJ0eXBlIjoxLCJ2aWQiOiJYTlRFNE5qSTRNVEkxTmc9PSJ9","sign":"ef83bc07a5aedffaf104ce5cfff8f63a"})

接口地址解析的差不多了，现在看POST的数据

ctime，mat，msg，sign，vid是动态的，需要获取
ctime时间戳
mat可能是弹幕文件的序列号，从0开始（暂定）
msg，先base64解码一下，发现其实就是套用母层数据重新生成一个JSON，没什么难度

{"ctime":1632124149214,"ctype":10004,"cver":"v1.0","guid":"JCCoF7kmLS4CATFSBgl5BofS","mat":6,"mcount":1,"pid":0,"sver":"3.1.0","type":1,"vid":"XNTE4NjI4MTI1Ng=="}

sign的算法：md5(编码后的msg值+MD5盐值)
md5的盐值为MkmC9SoIw6xCkSKHhJ7b5D2r51kBiREr
访问时要附带cookie