Mac上連接了越獄的手機，pp助手才會進行一鍵安裝，不太方便。這里介紹一種，直接從pp助手官網下載越獄版本ipa的方法。

以小米運動為例，搜索框輸入“小米運動”：

搜索小米運動

1、查看網網源碼，找到搜索相關的代碼：

<a  id="search-app" data- 
class="search-link act-link" data-stat-pos="appSearch" data-stat-exp="page=default;search_type=0;search_keyword=小米運動">
包含“<span class="key-word">小米運動</span>”的應用</a>

2、過濾出搜索請求： https://www.25pp.com/ios/search_app_0/小米運動/

3、點擊請求，跳轉到搜索結果頁面：

搜索結果頁面

繼續查看網頁源碼，找到小米運動詳情相關的代碼：

<a class="app-icon"  target="_blank" onclick="showAppDetail(this)" 
data-id="1571646" data-iid="938688461" title="蘋果版小米運動下載" data-stat-act="det" data-stat-pos="list">
<img src="https://img.25pp.com/uploadfile/app/icon/20180328/1522248388516301.jpg@120w_120h" width="70" height="70" alt="蘋果版小米運動下載" title="蘋果版小米運動下載"></a>

過濾出詳情網頁地址 https://www.25pp.com/ios/detail_1571646/

4、進入詳情界面，通過關鍵字“下載越獄版”找到紅框所在的網頁源碼

下載越獄版

<a href="javascript:void(0);" class="btn-install-x" apptype="app" data-id="1571646" data-iid="938688461" appname="小米運動" appversion="3.3.1"
appdownurl="aHR0cDovL3IxMS4yNXBwLmNvbS9zb2Z0LzIwMTgvMDMvMjgvMjAxODAzMjhfMTI5NjhfMjE4OTgwMDUwOTgzLmlwYQ==" closetimer="-1" 
onclick="return ppOneKeySetup(this)" data-stat-act="jb" data-stat-pos="install">下載越獄版</a>

5、通過appdownurl及 點擊事件處理ppOneKeySetup，找到pp_onekey-d17d98b4.js中的關鍵代碼:

(C = h.href, E = h.getAttribute("appdownurl"), E && E.length > 0 && (C = o.base64decode(o.utf8to16(E)))

可見js只是對傳入的appdownurl作了簡單的base64解碼，轉化后得到真實的下載地址：

http://r11.25pp.com/soft/2018/03/28/20180328_12968_218980050983.ipa

為方便獲取下載地址，將上面的步驟用Python3實現：

import urllib.request
import urllib.parse
import re
import ssl
import base64

#關閉SSL驗證
user_agent = 'Mozilla/4.0 (compatible; MSIE 5.5; Windows NT)'
headers = { 'User-Agent' : user_agent }
ssl._create_default_https_context = ssl._create_unverified_context
print("Close certificate verify...")

def getSearchResult():
    keyword = input("Input the search key word: ")

    #將中文轉換成url編碼
    keyword = urllib.parse.quote(keyword)

    searchUrl = "https://www.25pp.com/ios/search_app_0/" + keyword + "/"
    content = getHtmlStringByUrl(searchUrl)
    detailUrl = getSearchDetailUrl(content)
    content = getHtmlStringByUrl(detailUrl)
    downUrl = getAppdownUrlByHtmlContent(content)
    return downUrl


# 根據url 獲取網頁內容
def getHtmlStringByUrl(url):
    try:
        request = urllib.request.Request(url, headers=headers)
        response = urllib.request.urlopen(request)
        content = response.read().decode('utf-8')  # gbk
        return content

    except urllib.request.URLError as e:
        if hasattr(e, "code"):
            print(e.code)
        if hasattr(e, "reason"):
            print(e.reason)

    return ""

# 根據網頁內容獲取詳情鏈接
def getSearchDetailUrl(content):
    pattern = re.compile('href="(https://www.25pp.com/ios/detail_.*?)"', re.S) #
    items = re.findall(pattern, content)

    if len(items):
        print("Detail url: " + items[0])
        return items[0]

    return ""

# 根據網頁內容獲取ipa的下載鏈接
def getAppdownUrlByHtmlContent(content):
    pattern = re.compile('appdownurl="(.*?)"', re.S)  # appdownurl="aHR0cDovL3IxMS4yNXBwLmNvbS9zb2Z0LzIwMTgvMDEvMDkvMjAxODAxMDlfNjI0NThfMjE1MDYwOTY4Nzc4LmlwYQ=="
    items = re.findall(pattern, content)

    if len(items):
        print("Orgin download url: " + items[0])

        # Base64Decode
        output = base64.standard_b64decode(items[0])
        output = output.__str__()
        return output

    return ""


downUrl = getSearchResult()
print("Down url: " + downUrl)