AI Cracks an Obfuscated Wallpaper API in Minutes, No Manual JS Tracing Required

Follow my public account: 【编程朝花夕拾】 to get first-hand content.

01 Introduction

We often analyze interfaces through reverse engineering to scrape interface data. This leads to attack and defense drills: attackers want to scrape data, while defenders need to prevent scrapers from obtaining data while ensuring normal page data display. The pressure is on the defenders, who worry that overly strict defenses might accidentally harm normal users.

As a result, various encryption and obfuscation schemes emerge endlessly. The difficulty of manual reverse engineering has increased significantly, but in the AI era, the barrier to entry has been lowered again.

Let's look at a case study together.

02 Case Study

2.1 A Normal Website

A website without any encryption or obfuscation looks like this. We take the backend list of Juejin's hot topics as an example:

Both the request and response messages are in plain text, and all data can be obtained directly by scraping the interface.

This is also the method used by most of our websites, displaying everything normally to everyone. If they want to scrape, let them scrape!

2.2 An Encrypted Website

A wallpaper website I've always liked, Zhefeng Wallpaper, official address: https://www.haowallpaper.com/

Its request and response messages both use Base64 encoding, but not simple encoding; it also incorporates an obfuscation mechanism.

Request Message

Response Message

2.3 Reverse Engineering Analysis

Base64 encoding can be decoded using the browser functions btoa() and atob(), but after decoding, we still can't make sense of it.

Because the page is accessed normally, the data must eventually be decrypted. For frontend decryption, the key will naturally be placed in the js code. Let's take a look together:

Its JS files are too numerous, irregular, and have very poor readability. There's simply no place to start.

Although we can initially locate it by monitoring the request path: pc/wallpaper/wallpaperList.

Let's take a look first:

Monitoring the Path

Monitoring Result

We continue to follow up with breakpoints, but still find no clues. Grabbing the corresponding image information is just too difficult.

03 AI-Powered Reverse Engineering

In the AI era, do we no longer need to locate things step by step?

Here, I use opencode to handle it:

Parse the request and response parameters of the wallpaper site: https://www.haowallpaper.com/

After a long wait, we see that the parsing was successful:

The website uses the AES-128-CBC + PKCS7 algorithm.

How to locate it?

We also hand it over to AI:

How to set breakpoints to get the decrypted data and the specific decryption location

AI provides multiple breakpoint methods. We just try them out as instructed.

We try setting breakpoints according to the method:

Following the steps, we can quickly locate the decryption position.

04 Summary

AI-powered reverse engineering lowers the barrier for users. There are also similar risk controls like slider CAPTCHAs, where AI intervention can resolve the battle in minutes. AI is not only good at coding but even better at data analysis. Handing over those repetitive job searches or data analysis tasks to AI often yields twice the result with half the effort!

Folks, what reverse engineering analyses have you done using AI?