首先看下网址特点。

https://www.kugou.com/mixsong/6gsqxea8.html#hash=410EFBBE1F8F256BB5944AA996A58236&album_id=55955060&album_audio_id=391012178

话不多说,先抓下包。分析发现有一个js解析中有mp3播放地址
而这个地址 会携带很多东西,但测试过后发现只要有mid, album_id, hash就行。 而album_id, hash根据网址已知。mid和cookie中的kg_mid一样。可以发现,在之前就写入了cookie。
~642~G7M7CF36YKZGP78T.png

那么就要找到这个写入cookie的地方。搜索一下。代码并未完全混淆。
image.png
可以看到他用的是一个v的对象写入v.Md5(e) 、参数e是v.Guid()

function S() {
        var e = v.Guid();
        try {
            v.Cookie.write("kg_mid", v.Md5(e), 864e6, "/", "kugou.com")
        } catch (e) {}
        return v.Md5(e)
    }

先根进入Cookie.write 看看是什么

{
            write: function(e, t, n, i, r, a) {
                /^\w*$/.test(e) || alert("cookie格式不正确"),
                /; /.test(t) && alert("cookie格式不正确");
                var o = e + "=" + t; //e是kg_mid t就是值了
                if (n) {
                    var s = new Date;
                    s.setTime(s.getTime() + 1e3 * n),
                    o += "; expires=" + s.toGMTString()
                }
                i && (o += "; path=" + i),
                r && (o += "; domain=" + r),
                a && (o += "; secure"),
                document.cookie = o //这里写入cookie
            },
            rewriteKey: function(e, t, n, i, r, a, o) {
                var s = t;
                if (n) {
                    var c = this.read(e)
                      , l = new RegExp("\\b" + t + "=([^&]*)\\b","g");
                    s = c.replace(l, function(e, t) {
                        return e.replace(t, n)
                    })
                }
                /^\d+(s|m|h|d)$/i.test(i) ? (/^\d+s$/i.test(i) && this.setSec(e, s, i.replace(/s$/i, ""), r, a, o),
                /^\d+m$/i.test(i) && this.setMin(e, s, i.replace(/m$/i, ""), r, a, o),
                /^\d+h$/i.test(i) && this.setHour(e, s, i.replace(/h$/i, ""), r, a, o),
                /^\d+d$/i.test(i) && this.setDay(e, s, i.replace(/d$/i, ""), r, a, o)) : this.write(e, s, i, r, a, o)
            },
            setDay: function(e, t, n, i, r, a) {
                this.write(e, t, 24 * n * 60 * 60, i, r, a)
            },
            setHour: function(e, t, n, i, r, a) {
                this.write(e, t, 60 * n * 60, i, r, a)
            },
            setMin: function(e, t, n, i, r, a) {
                this.write(e, t, 60 * n, i, r, a)
            },
            setSec: function(e, t, n, i, r, a) {
                this.write(e, t, n, i, r, a)
            },
            read: function(e, t, n) {
                for (var i = "", r = document.cookie.split("; "), a = 0; a < r.length; a++) {
                    var o = r[a].match(/^(\w+)=(.+)$/);
                    if (o && 1 < o.length && o[1] == e) {
                        i = o[2];
                        break
                    }
                }
                return "" == i ? null : t ? n ? JSON.parse(i)[t] : (new v.Param).parse(i)[t] : i
            },
            remove: function(e, t, n) {
                var i = e + "=";
                t && (i += "; path=" + t),
                n && (i += ";domain=" + n),
                i += "; expires=Fri, 02-Jan-1970 00:00:00 GMT",
                document.cookie = i
            }
        }

可以看到他是写入cookie的东西。
那么我们找到这个值是怎么生成的。v.Md5(v.Guid())

找到两个函数

function Guid() {
            function e() {
                return (65536 * (1 + Math.random()) | 0).toString(16).substring(1)
            }
            return e() + e() + "-" + e() + "-" + e() + "-" + e() + "-" + e() + e() + e()
}


function md5(e) {
            var t, r = 0, a = 8;
            function s(e, t, n, i, r, a) {
                return p(function(e, t) {
                    return e << t | e >>> 32 - t
                }(p(p(t, e), p(i, a)), r), n)
            }
            function d(e, t, n, i, r, a, o) {
                return s(t & n | ~t & i, e, t, r, a, o)
            }
            function f(e, t, n, i, r, a, o) {
                return s(t & i | n & ~i, e, t, r, a, o)
            }
            function h(e, t, n, i, r, a, o) {
                return s(t ^ n ^ i, e, t, r, a, o)
            }
            function g(e, t, n, i, r, a, o) {
                return s(n ^ (t | ~i), e, t, r, a, o)
            }
            function p(e, t) {
                var n = (65535 & e) + (65535 & t);
                return (e >> 16) + (t >> 16) + (n >> 16) << 16 | 65535 & n
            }
            return e = e ? function(e) {
                for (var t = r ? "0123456789ABCDEF" : "0123456789abcdef", n = "", i = 0; i < 4 * e.length; i++)
                    n += t.charAt(e[i >> 2] >> i % 4 * 8 + 4 & 15) + t.charAt(e[i >> 2] >> i % 4 * 8 & 15);
                return n
            }(function(e, t) {
                e[t >> 5] |= 128 << t % 32,
                e[14 + (t + 64 >>> 9 << 4)] = t;
                for (var n = 1732584193, i = -271733879, r = -1732584194, a = 271733878, o = 0; o < e.length; o += 16) {
                    var s = n
                      , c = i
                      , l = r
                      , u = a;
                    n = d(n, i, r, a, e[o + 0], 7, -680876936),
                    a = d(a, n, i, r, e[o + 1], 12, -389564586),
                    r = d(r, a, n, i, e[o + 2], 17, 606105819),
                    i = d(i, r, a, n, e[o + 3], 22, -1044525330),
                    n = d(n, i, r, a, e[o + 4], 7, -176418897),
                    a = d(a, n, i, r, e[o + 5], 12, 1200080426),
                    r = d(r, a, n, i, e[o + 6], 17, -1473231341),
                    i = d(i, r, a, n, e[o + 7], 22, -45705983),
                    n = d(n, i, r, a, e[o + 8], 7, 1770035416),
                    a = d(a, n, i, r, e[o + 9], 12, -1958414417),
                    r = d(r, a, n, i, e[o + 10], 17, -42063),
                    i = d(i, r, a, n, e[o + 11], 22, -1990404162),
                    n = d(n, i, r, a, e[o + 12], 7, 1804603682),
                    a = d(a, n, i, r, e[o + 13], 12, -40341101),
                    r = d(r, a, n, i, e[o + 14], 17, -1502002290),
                    i = d(i, r, a, n, e[o + 15], 22, 1236535329),
                    n = f(n, i, r, a, e[o + 1], 5, -165796510),
                    a = f(a, n, i, r, e[o + 6], 9, -1069501632),
                    r = f(r, a, n, i, e[o + 11], 14, 643717713),
                    i = f(i, r, a, n, e[o + 0], 20, -373897302),
                    n = f(n, i, r, a, e[o + 5], 5, -701558691),
                    a = f(a, n, i, r, e[o + 10], 9, 38016083),
                    r = f(r, a, n, i, e[o + 15], 14, -660478335),
                    i = f(i, r, a, n, e[o + 4], 20, -405537848),
                    n = f(n, i, r, a, e[o + 9], 5, 568446438),
                    a = f(a, n, i, r, e[o + 14], 9, -1019803690),
                    r = f(r, a, n, i, e[o + 3], 14, -187363961),
                    i = f(i, r, a, n, e[o + 8], 20, 1163531501),
                    n = f(n, i, r, a, e[o + 13], 5, -1444681467),
                    a = f(a, n, i, r, e[o + 2], 9, -51403784),
                    r = f(r, a, n, i, e[o + 7], 14, 1735328473),
                    i = f(i, r, a, n, e[o + 12], 20, -1926607734),
                    n = h(n, i, r, a, e[o + 5], 4, -378558),
                    a = h(a, n, i, r, e[o + 8], 11, -2022574463),
                    r = h(r, a, n, i, e[o + 11], 16, 1839030562),
                    i = h(i, r, a, n, e[o + 14], 23, -35309556),
                    n = h(n, i, r, a, e[o + 1], 4, -1530992060),
                    a = h(a, n, i, r, e[o + 4], 11, 1272893353),
                    r = h(r, a, n, i, e[o + 7], 16, -155497632),
                    i = h(i, r, a, n, e[o + 10], 23, -1094730640),
                    n = h(n, i, r, a, e[o + 13], 4, 681279174),
                    a = h(a, n, i, r, e[o + 0], 11, -358537222),
                    r = h(r, a, n, i, e[o + 3], 16, -722521979),
                    i = h(i, r, a, n, e[o + 6], 23, 76029189),
                    n = h(n, i, r, a, e[o + 9], 4, -640364487),
                    a = h(a, n, i, r, e[o + 12], 11, -421815835),
                    r = h(r, a, n, i, e[o + 15], 16, 530742520),
                    i = h(i, r, a, n, e[o + 2], 23, -995338651),
                    n = g(n, i, r, a, e[o + 0], 6, -198630844),
                    a = g(a, n, i, r, e[o + 7], 10, 1126891415),
                    r = g(r, a, n, i, e[o + 14], 15, -1416354905),
                    i = g(i, r, a, n, e[o + 5], 21, -57434055),
                    n = g(n, i, r, a, e[o + 12], 6, 1700485571),
                    a = g(a, n, i, r, e[o + 3], 10, -1894986606),
                    r = g(r, a, n, i, e[o + 10], 15, -1051523),
                    i = g(i, r, a, n, e[o + 1], 21, -2054922799),
                    n = g(n, i, r, a, e[o + 8], 6, 1873313359),
                    a = g(a, n, i, r, e[o + 15], 10, -30611744),
                    r = g(r, a, n, i, e[o + 6], 15, -1560198380),
                    i = g(i, r, a, n, e[o + 13], 21, 1309151649),
                    n = g(n, i, r, a, e[o + 4], 6, -145523070),
                    a = g(a, n, i, r, e[o + 11], 10, -1120210379),
                    r = g(r, a, n, i, e[o + 2], 15, 718787259),
                    i = g(i, r, a, n, e[o + 9], 21, -343485551),
                    n = p(n, s),
                    i = p(i, c),
                    r = p(r, l),
                    a = p(a, u)
                }
                return Array(n, i, r, a)
            }(function(e) {
                for (var t = Array(), n = (1 << a) - 1, i = 0; i < e.length * a; i += a)
                    t[i >> 5] |= (e.charCodeAt(i / a) & n) << i % 32;
                return t
            }(t = e), t.length * a)) : ""
        }

测了一下这个是真的md5 32位。
直接调试js

image.png

得到值 88ad2ce345bab491501fed75d06eb241

去测试一下:
image.png

格式化一下

{
	"status": 1,
	"err_code": 0,
	"data": {
		"hash": "410EFBBE1F8F256BB5944AA996A58236",
		"timelength": 269792,
		"filesize": 4317302,
		"audio_name": "许华升 - 短暂爱一场",
		"have_album": 1,
		"album_name": "短暂爱一场",
		"album_id": "55955060",
		"img": "http:\/\/imge.kugou.com\/stdmusic\/20220323\/20220323174358192907.jpg",
		"have_mv": 0,
		"video_id": 0,
		"author_name": "许华升",
		"song_name": "短暂爱一场",
		"lyrics": "[id:$00000000]\r\n[ar:许华升]\r\n[ti:短暂爱一场]\r\n[by:]\r\n[hash:410efbbe1f8f256bb5944aa996a58236]\r\n[al:]\r\n[sign:]\r\n[qq:]\r\n[total:269792]\r\n[offset:0]\r\n[00:00.00]许华升 - 短暂爱一场\r\n[00:00.28]作词:许华升\r\n[00:00.49]作曲:乐者\r\n[00:00.71]编曲:杜文阳\r\n[00:00.92]录混:李东凯\r\n[00:01.13]和声:李东凯\r\n[00:19.37]我想离开这城市\r\n[00:22.74]到另一个地方\r\n[00:26.27]到一个陌生的地方疗伤\r\n[00:33.50]今生只能和你短暂爱一场\r\n[00:40.11]却不能和你走到白发苍苍\r\n[00:47.68]如果离开我你有\r\n[00:50.90]更幸福的生活\r\n[00:54.56]也许我的心会比较好过\r\n[01:01.76]我也知道我给不了你太多\r\n[01:08.37]宁愿选择放手也不想你难过\r\n[01:15.00]只是过去多年以后\r\n[01:18.70]你是否还会记得我\r\n[01:22.00]记得你的世界我曾经来过\r\n[01:29.17]后来我又回到这座城市\r\n[01:33.25]又经过那条街\r\n[01:36.16]心跳还是会如此的强烈\r\n[01:43.20]关于你的回忆\r\n[01:45.97]我想是永远打不开的结\r\n[01:50.31]让它化作秘密在心底冻结\r\n[02:01.79]如果离开我你有\r\n[02:04.99]更幸福的生活\r\n[02:08.67]也许我的心会比较好过\r\n[02:15.92]我也知道我给不了你太多\r\n[02:22.41]宁愿选择放手也不想你难过\r\n[02:29.10]只是过去多年以后\r\n[02:32.66]你是否还会记得我\r\n[02:36.21]记得你的世界我曾经来过\r\n[02:43.25]后来我又回到这座城市\r\n[02:47.42]又经过那条街\r\n[02:50.26]心跳还是会如此的强烈\r\n[02:57.41]关于你的回忆\r\n[02:59.97]我想是永远打不开的结\r\n[03:04.46]让它化作秘密在心底冻结\r\n[03:25.63]只是过去多年以后\r\n[03:29.04]你是否还会记得我\r\n[03:32.60]记得你的世界我曾经来过\r\n[03:39.71]后来我又回到这座城市\r\n[03:43.91]又经过那条街\r\n[03:46.76]心跳还是会如此的强烈\r\n[03:53.79]关于你的回忆\r\n[03:56.43]我想是永远打不开的结\r\n[04:00.84]让它化作秘密在心底冻结\r\n[04:08.40]让它化作秘密在心底冻结\r\n",
		"author_id": "182107",
		"privilege": 8,
		"privilege2": "1000",
		"play_url": "https:\/\/webfs.ali.kugou.com\/202203262208\/e8185fd5fc68dc8bbac1c61b49be333e\/KGTX\/CLTX001\/410efbbe1f8f256bb5944aa996a58236.mp3",
		"authors": [{
			"author_id": "182107",
			"author_name": "许华升",
			"is_publish": "1",
			"sizable_avatar": "http:\/\/singerimg.kugou.com\/uploadpic\/softhead\/{size}\/20210715\/20210715205437764488.jpg",
			"avatar": "http:\/\/singerimg.kugou.com\/uploadpic\/softhead\/400\/20210715\/20210715205437764488.jpg"
		}],
		"is_free_part": 0,
		"bitrate": 128,
		"recommend_album_id": "55955060",
		"audio_id": "154670106",
		"has_privilege": true,
		"play_backup_url": "https:\/\/webfs.cloud.kugou.com\/202203262208\/d952c3cfb2a9770f231338ca8f4e53b7\/KGTX\/CLTX001\/410efbbe1f8f256bb5944aa996a58236.mp3"
	}
}

再找一个地址:
https://www.kugou.com/song/#hash=3E14CEBEDCF8196D38C6F109D949B148

发现没有album_id参数。经测试他会提示填0

所有没有album_id参数填0就行

总体上这个加密还是比较简单的。没有过多的干扰项

测试API地址: http://api.yeyusmile.top

Q.E.D.