search

thesadru / genshinstats

PLEASE USE GENSHIN.PY A python library that can get the stats of Genshin Impact players using Mihoyo's API. PLEASE USE GENSHIN.PY
https://thesadru.github.io/pdoc/genshinstats/
MIT License
268 stars 38 forks source link

Genshin Javascript Reverse Engineering #15

Closed Velka-DEV closed 3 years ago

Velka-DEV commented 3 years ago

Hello, I apologize for opening an issue for this but I would like to know how you managed to reverse the "ds" header and intercept the value before its hash. There is some tips for debugging obfuscated JS ?

(I already have the necessary values, but I would like to understand how you did it.)

Thanks you in advance

thesadru commented 3 years ago

A few months back when I was trying to reverse engineer the API it was much simpler. The entire logic was contained in a single file and it wasn't really that much obfuscated aside from the automatic obfuscation which I believe is done by Vue (I'm not JavaScript expert so not sure). I then used some random tool I found on GitHub to at least try to deobfuscate parts of the code automatically and kinda managed to figure it out.

I had a look at the new API version back in may and the internals changed drastically so I doubt it's as easy as it was back then.

I've also seen a bunch of Chinese genshin projects use all the same function and I traced it back to this repo https://github.com/Womsxd/YuanShen_User_Info which I think was the very first open source project that used the api (or at least out of the ones on github).

Honestly the deobfuscation was a pain and I wish I could've found that project sooner.

Velka-DEV commented 3 years ago

Oh I see, thanks for the information. But in the end, there is therefore no real technique to easily trace variables and sources by debugging.

I was hoping that some tools would save time but obviously there is no magic formula

EDIT: And yes obfuscation is done on static files build