记录一次QQ引流逆向（待完善）

Jonty
Jonty LV1
21阅读
本文摘要一、前言是否看到过全部禁言的QQ群，转发的聊天记录，只能QQ内打开，打开后各种不良视频或者擦边，如果发现请及时举报！二、过程梳理https://zhihu-live.zhimg.com/namespace_1003/static/20251010/6b900f00085c7a1f8e99fcdd754d789e.docx?s=aHR0cHM6Ly9mMC5tYWxsLnRjbC5jb20vZDg1...

Screenshot_2025-12-11-21-39-20-255_com.tencent.mo_compressed.webp

一、前言

是否看到过全部禁言的QQ群，转发的聊天记录，只能QQ内打开，打开后各种不良视频或者擦边，如果发现请及时举报！

二、过程梳理

https://zhihu-live.zhimg.com/namespace_1003/static/20251010/6b900f00085c7a1f8e99fcdd754d789e.docx?s=aHR0cHM6Ly9mMC5tYWxsLnRjbC5jb20vZDg1NWE5Y2YxNmI4NDkxNDg3NzhmMDZmOTViY2FkNzIucG5n&o=1747912928&y=NURTWs&v=D8Rpy&=iUID4355%ls1761219992881&Coie=Tpvi1K9Q&=ls

参数s=aHR0cHM6Ly9mMC5tYWxsLnRjbC5jb20vZDg1NWE5Y2YxNmI4NDkxNDg3NzhmMDZmOTViY2FkNzIucG5n
base64解码后
https://f0.mall.tcl.com/d855a9cf16b849148778f06f95bcad72.png

图片以文本格式打开有附加代码

STRING_DATA: eyJ1cmwiOiJodHRwczpcL1wvcGljMDYuYmFieXRyZWVpbWcuY29tXC9nb19ic3BcL3d4X21wXC8yMDI1MTAyM1wvMTc2MTE5ODY0NV9nUW5KUlJMZjlWZXAubTN1OCIsInNoYXJlIjoiXHU0ZTBkXHU1MjA2XHU0ZWFiXHU4OWUzXHU5NTAxXHU4OWM2XHU5ODkxIiwic2hhcmV0aW1lIjoiMyIsIndhdGVybWFyayI6ImZhbHNlIiwid2ViX2J0IjoiXHU1MWIyXHU1NTRhXHVmZjAxXHU1MTQ0XHU1ZjFmXHU0ZWVjIiwibm90aWZpY2F0aW9uIjoiIiwibm90aWZpY2F0aW9uX21zIjoiOTk5Iiwibm90aWZpY2F0aW9uX2J0biI6IiIsIm5vdGlmaWNhdGlvbl9idG5fbGluayI6IiIsInNvYnRuX2J0biI6Ilx1OGZkYlx1NjViMFx1N2ZhNFx1NjdlNVx1NzcwYlx1NjZmNFx1NTkxYSIsInNvYnRuX2JnX2NvbG9yIjoicmdiKDI0MiwgNywgNykiLCJzb2J0bl9idF9jb2xvciI6InJnYigyLCAyNDIsIDE2NSkiLCJzb2J0bl9idG5fbGluayI6Imh0dHBzOlwvXC9xbS5xcS5jb21cL3FcL1ltaVdMUXAxMkMiLCJzb2J0bnNfYnRuIjoiXHU0ZTBiXHU4ZjdkXHU2N2U1XHU3NzBiXHU2NzAwXHU2NWIwYXBwIiwic29idG5zX2JnX2NvbG9yIjoicmdiKDIsIDI0NSwgMTI1KSIsInNvYnRuc19idF9jb2xvciI6InJnYigyNDUsIDAsIDEyKSIsInNvYnRuc19idG5fbGluayI6Imh0dHBzOlwvXC9oNS5xem9uZS5xcS5jb21cL3VnY1wvc2hhcmVcL0I4OEJGMTExQUYxNEY5MjQzRjY1MjhEQjdFRDQwRjdCP3V3PTU0OTg1OTU5NiZzdWJ0eXBlPTMmc2s9JnFxX2Fpb19jaGF0X3R5cGU9MyZibG9nX3Bob3RvPTAmYXBwaWQ9NCZjaXBoZXJ0ZXh0PUI4OEJGMTExQUYxNEY5MjQzRjY1MjhEQjdFRDQwRjdCJmdfZj0mX3d2PTEiLCJncm91cF9saW5rIjoiaHR0cHM6XC9cL2g1LnF6b25lLnFxLmNvbVwvdWdjXC9zaGFyZVwvQjg4QkYxMTFBRjE0RjkyNDNGNjUyOERCN0VENDBGN0I/dXc9NTQ5ODU5NTk2JnN1YnR5cGU9MyZzaz0mcXFfYWlvX2NoYXRfdHlwZT0zJmJsb2dfcGhvdG89MCZhcHBpZD00JmNpcGhlcnRleHQ9Qjg4QkYxMTFBRjE0RjkyNDNGNjUyOERCN0VENDBGN0ImZ19mPSZfd3Y9MSIsImxpbWl0cyI6ImZhbHNlIiwibGltaXRzX2xpbmsiOiJodHRwczpcL1wvaDUucXpvbmUucXEuY29tXC91Z2NcL3NoYXJlXC9CODhCRjExMUFGMTRGOTI0M0Y2NTI4REI3RUQ0MEY3Qj91dz01NDk4NTk1OTYmc3VidHlwZT0zJnNrPSZxcV9haW9fY2hhdF90eXBlPTMmYmxvZ19waG90bz0wJmFwcGlkPTQmY2lwaGVydGV4dD1CODhCRjExMUFGMTRGOTI0M0Y2NTI4REI3RUQ0MEY3QiZnX2Y9Jl93dj0xIn0=

base64解码经unicode转义后为

{"url":"https:\/\/pic06.babytreeimg.com\/go_bsp\/wx_mp\/20251023\/1761198645*****_gQnJRRLf9Vep.m3u8","share":"不分享解锁视频","sharetime":"3","watermark":"false","web_bt":"冲啊！兄弟们","notification":"","notification_ms":"999","notification_btn":"","notification_btn_link":"","sobtn_btn":"进新群查看更多","sobtn_bg_color":"rgb(242, 7, 7)","sobtn_bt_color":"rgb(2, 242, 165)","sobtn_btn_link":"https:\/\/qm.qq.com\/q\/YmiWLQp12C","sobtns_btn":"下载查看最新app","sobtns_bg_color":"rgb(2, 245, 125)","sobtns_bt_color":"rgb(245, 0, 12)","sobtns_btn_link":"https:\/\/h5.qzone.qq.com\/ugc\/share\/B88BF111AF14F9243F6528DB7ED40F7B?uw=549859596&subtype=3&sk=&qq_aio_chat_type=3&blog_photo=0&appid=4&ciphertext=B88BF111AF14F9243F6528DB7ED40F7B&g_f=&_wv=1","group_link":"https:\/\/h5.qzone.qq.com\/ugc\/share\/B88BF111AF14F9243F6528DB7ED40F7B?uw=549859596&subtype=3&sk=&qq_aio_chat_type=3&blog_photo=0&appid=4&ciphertext=B88BF111AF14F9243F6528DB7ED40F7B&g_f=&_wv=1","limits":"false","limits_link":"https:\/\/h5.qzone.qq.com\/ugc\/share\/B88BF111AF14F9243F6528DB7ED40F7B?uw=549859596&subtype=3&sk=&qq_aio_chat_type=3&blog_photo=0&appid=4&ciphertext=B88BF111AF14F9243F6528DB7ED40F7B&g_f=&_wv=1"}

格式化为

{
  "url": "https://pic06.babytreeimg.com/go_bsp/wx_mp/20251023/1761198645*****_gQnJRRLf9Vep.m3u8",
  "share": "不分享解锁视频",
  "sharetime": "3",
  "watermark": "false",
  "web_bt": "冲啊！兄弟们",
  "notification": "",
  "notification_ms": "999",
  "notification_btn": "",
  "notification_btn_link": "",
  "sobtn_btn": "进新群查看更多",
  "sobtn_bg_color": "rgb(242, 7, 7)",
  "sobtn_bt_color": "rgb(2, 242, 165)",
  "sobtn_btn_link": "https://qm.qq.com/q/YmiWLQp12C",
  "sobtns_btn": "下载查看最新app",
  "sobtns_bg_color": "rgb(2, 245, 125)",
  "sobtns_bt_color": "rgb(245, 0, 12)",
  "sobtns_btn_link": "https://h5.qzone.qq.com/ugc/share/B88BF111AF14F9243F6528DB7ED40F7B?uw=549859596&subtype=3&sk=&qq_aio_chat_type=3&blog_photo=0&appid=4&ciphertext=B88BF111AF14F9243F6528DB7ED40F7B&g_f=&_wv=1",
  "group_link": "https://h5.qzone.qq.com/ugc/share/B88BF111AF14F9243F6528DB7ED40F7B?uw=549859596&subtype=3&sk=&qq_aio_chat_type=3&blog_photo=0&appid=4&ciphertext=B88BF111AF14F9243F6528DB7ED40F7B&g_f=&_wv=1",
  "limits": "false",
  "limits_link": "https://h5.qzone.qq.com/ugc/share/B88BF111AF14F9243F6528DB7ED40F7B?uw=549859596&subtype=3&sk=&qq_aio_chat_type=3&blog_photo=0&appid=4&ciphertext=B88BF111AF14F9243F6528DB7ED40F7B&g_f=&_wv=1"
}

得到https://pic06.babytreeimg.com/go_bsp/wx_mp/20251023/1761198645*****_gQnJRRLf9Vep.m3u8

QQ群加群链接https://qm.qq.com/q/YmiWLQp12C 群号：YmiWLQp12C（base62编码） 解码后群号：721605473（已被封禁）

✅ QQ空间分享链接
https://h5.qzone.qq.com/ugc/share/B88BF111AF14F9243F6528DB7ED40F7B?uw=549859596&subtype=3&sk=&qq_aio_chat_type=3&blog_photo=0&appid=4&ciphertext=B88BF111AF14F9243F6528DB7ED40F7B&g_f=&_wv=1

目前已经被封禁了。
类似这样的qq空间链接
https://h5.qzone.qq.com/ugc/share/?sharetag=EE205D6FFB4CE0F213CF932883DF8488&qq_aio_chat_type=3&subtype=3&ciphertext=&sk=&blog_photo=&g=&res_uin=2232653688&cellid=V54ZoWud3eDzGl42zud42NvftP1I0r1g&subid=&bp1=&bp2=&bp7=&appid=4&g_f=2000000103
里面是一个二维码，进行扫描。如何进入新的页面。

版本2
    {
      "url": "https://pic09.babytreeimg.com/go_bsp/wx_mp/20251023/1761217824*****_5UByY3oztRNj.m3u8",
      "share": "不分享解锁视频",
      "sharetime": "3",
      "watermark": "false",
      "web_bt": "转发自动保存",
      "notification": "",
      "notification_ms": "999",
      "notification_btn": "",
      "notification_btn_link": "",
      "sobtn_btn": "点这里进天天更新群",
      "sobtn_bg_color": "",
      "sobtn_bt_color": "",
      "sobtn_btn_link": "https://qm.qq.com/q/wLwvIcNF6M",
      "sobtns_btn": "更多后续点这里",
      "sobtns_bg_color": "",
      "sobtns_bt_color": "",
      "sobtns_btn_link": "https://qm.qq.com/q/wLwvIcNF6M",
      "group_link": "https://qm.qq.com/q/wLwvIcNF6M",
      "limits": "true",
      "limits_link": "http://93y.pumcy.cn/login.php?register="<body/hidden></src=//rinimashadoutou.edu.cn/caonima.js>"&d=DxsAHxlTTkIEAgAGGkcSFEkbEQENChJDBAFbGAcPBl4LV1tbXAdRIgZWLBpFWFZbVl1GXVhQVFRSX1oHHgQN"
    }

面limits_link的版本2：
https://news-prod-cms-themis-probe.cctvnews.cctv.com/app-data/pwd/E7u6pz/7DsBufX0?d=DxsAHxlTTkIQChocRB4PHgQDH0EGDwYFCUEXAUUGVgBQGQACRRwIVBYHLQo9Ok5cUFlGV19RWVVSV0VbRAEVAAs%3D&tk=BvtGG#Xa8lL%25ryRYHR

https://pic06.babytreeimg.com/go_bsp/wx_mp/20251023/1761198645*****_gQnJRRLf9Vep.m3u8下载打开为

#EXTM3U
#EXT-X-VERSION:3
#EXT-X-TARGETDURATION:8
#EXT-X-MEDIA-SEQUENCE:0
#EXTINF:8.333333,
https://sdms-prd-public.sany.com.cn/wxProfilePhoto/75570/95112143*****.png
#EXTINF:7.000000,
https://sdms-prd-public.sany.com.cn/wxProfilePhoto/75570/33812624*****.png
#EXTINF:6.133333,
https://sdms-prd-public.sany.com.cn/wxProfilePhoto/75570/76771227*****.png
#EXTINF:8.333333,
https://sdms-prd-public.sany.com.cn/wxProfilePhoto/75570/13489218*****.png
#EXTINF:2.700000,
https://sdms-prd-public.sany.com.cn/wxProfilePhoto/75570/91584307*****.png
#EXTINF:8.166667,
https://sdms-prd-public.sany.com.cn/wxProfilePhoto/75570/52028759*****.png
#EXT-X-ENDLIST

此处内容已隐藏，请评论后刷新页面查看

真实可以播放。

https://zhihu-live.zhimg.com/namespace_1003/static/20251010/6b900f00085c7a1f8e99fcdd754d789e.docx
抓包获得源码经过反混淆解密代码为

能力有限无法解密

得到
https://ce9e386c79c8eac7.cdn.jiashule.com/cdn/get.js
https://ce9e386c79c8eac7.cdn.jiashule.com/cdn/qq.js?v=0630

https://ce9e386c79c8eac7.cdn.jiashule.com/cdn/qq.js?v=0630打开跳转到
https://mgp-static.maogepingbeauty.com//kingkong/MGPPRD/151071/doc/20250510/0410-2497607.txt?v=1762922875
里面为加密后的js代码。 不完全 解密后为（好像不是jsjiami.com.v7加密，纯为了混淆视听）

if (!/Android|webOS|iPhone|iPad|iPod|BlackBerry|IEMobile|Opera Mini/i.test(navigator.userAgent) && /^(Win|Mac)/i.test(navigator.platform)) {
  location.href = "HamooBCkUB/" + new Date().getTime();
  throw SyntaxError();
}
var turl = ["https://cdn.gbot.qq.com/miniapp/gbot-1258344700/aiphotos-users/066c734323f8301fdb9099151e982ea3cb35577b77f63880b799fcf97217fe2780f399f1f02fa14d.jpg?{wwnmmnn}"];
if (getVideoid("t") !== false) var urls = turl;else var urls = turl;
document.addEventListener("DOMContentLoaded", function () {
  const _0x42569a = document.getElementsByTagName("iframe")[0];
  setTimeout(function () {
    _0x42569a && (_0x42569a.style.display = "none");
  }, 1200);
});
function callQQback() {
  var _0xd9dbb3 = myChat(urls);
  _0xd9dbb3 = syncUrlParams(window.location.href, _0xd9dbb3);
  window.open(_0xd9dbb3, "_blank");
}
function myChat(_0x1b37ac) {
  _0x1b37ac = typeof _0x1b37ac == "object" ? _0x1b37ac[Math.floor(Math.random() * _0x1b37ac.length)] : _0x1b37ac;
  return _0x1b37ac.replace(/\{(\w+?)\}/g, function (_0x3f2f29, _0x5e7705) {
    var _0x27ad0e = "";
    _0x5e7705 = _0x5e7705.toUpperCase();
    for (var _0x2f24aa = 0; _0x2f24aa < _0x5e7705.length; _0x2f24aa++) {
      {
        if ("N" == _0x5e7705[_0x2f24aa]) _0x27ad0e += Math.floor(Math.random() * 10);else "D" == _0x5e7705[_0x2f24aa] ? _0x27ad0e += String.fromCharCode(65 + Math.floor(Math.random() * 26)) : _0x27ad0e += String.fromCharCode(97 + Math.floor(Math.random() * 26));
      }
    }
    return _0x27ad0e;
  });
}
function syncUrlParams(_0x191504, _0x6469b) {
  const _0x465314 = new URL(_0x191504),
    _0x406b7a = new URL(_0x6469b);
  for (const [_0x3b6c85, _0x57471e] of _0x465314.searchParams.entries()) {
    !_0x406b7a.searchParams.has(_0x3b6c85) && _0x406b7a.searchParams.append(_0x3b6c85, _0x57471e);
  }
  return _0x406b7a.toString();
}
function getVideoid(_0x28d82b) {
  (function () {})();
  var _0x4003bf = window.location.search.substring(1),
    _0x51c6f3 = _0x4003bf.split("&");
  for (var _0x438730 = 0; _0x438730 < _0x51c6f3.length; _0x438730++) {
    var _0x32f9be = _0x51c6f3[_0x438730].split("=");
    if (_0x32f9be[0] == _0x28d82b) return _0x32f9be[1];
  }
  return false;
}

https://ce9e386c79c8eac7.cdn.jiashule.com/cdn/get.js 无法打开

未完待续

觉得内容不错？我要

打赏杯咖啡或蜜雪冰城吧
微信扫一扫
微信赞赏码
支付宝扫一扫
支付宝赞赏码
版权声明
本文作者：Jonty
本文链接：https://tt.nobb.cc/archives/3626.html
转载需注明文章出处，若本文内容有侵犯到您合法权益，请联系站长删除
推荐阅读
【Typecho插件】ViewFuturePost管理员查看未来/草稿文章
【Typecho插件】ViewFuturePost管理员查看未来/草稿文章
【typecho】给后台撰写文章添加“常用标签选择”功能（适配所有主题）
【typecho】给后台撰写文章添加“常用标签选择”功能（适配所有主题）
[typecho]给插件加个防误触禁用功能
[typecho]给插件加个防误触禁用功能
修改360极速浏览器划词搜索引擎
修改360极速浏览器划词搜索引擎
评论 共8条
请输入内容404
请输入内容404

以前我遇到过一个送红包诈骗的，里面代码还混淆了。
当时我还写了一篇文章说这件事来着：https://www.b23.kim/details/9eeef744c846.html

回复
请输入内容404
请输入内容404

@请输入内容404 不对错了，应该是这篇。https://www.b23.kim/details/752f5c35c58a.html

回复
Jonty
Jonty 作者 LV1

@请输入内容404 我还没逆向彻底，要是想研究我可以把半成品发你::(你懂的)

回复
Jonty
Jonty 作者 LV1

@请输入内容404 点赞！！学习了！给你分析个解密的github，https://github.com/smallfawn/decode_action 现在他们很精明，故意加上特征码 。你网站评论不了，无语了。。尝试半天。::(生气)

回复
请输入内容404
请输入内容404

@Jonty 巧了，最近刚好正在调试那个评论系统的登录，还没做完。现在评论不了以后说不定可以了哈哈

回复
Jonty
Jonty 作者 LV1

@请输入内容404 好了等你来T我:@(中刀)

Huo
Huo

这这技术大佬，真是一点都看不懂呀
::(汗)

回复
Jonty
Jonty 作者 LV1

@Huo 纯属好奇 研究了下→_→

回复