Mac上连接了越狱的手机，pp助手才会进行一键安装，不太方便。这里介绍一种，直接从pp助手官网下载越狱版本ipa的方法。

以小米运动为例，搜索框输入“小米运动”：

搜索小米运动

1、查看网网源码，找到搜索相关的代码：

<a href="https://www.25pp.com/ios/search_app_0/小米运动/" id="search-app" data-href="https://www.25pp.com/ios/search_app_0/" 
class="search-link act-link" data-stat-pos="appSearch" data-stat-exp="page=default;search_type=0;search_keyword=小米运动">
包含“<span class="key-word">小米运动</span>”的应用</a>

2、过滤出搜索请求： https://www.25pp.com/ios/search_app_0/小米运动/

3、点击请求，跳转到搜索结果页面：

搜索结果页面

继续查看网页源码，找到小米运动详情相关的代码：

<a class="app-icon" href="https://www.25pp.com/ios/detail_1571646/" target="_blank" onclick="showAppDetail(this)" 
data-id="1571646" data-iid="938688461" title="苹果版小米运动下载" data-stat-act="det" data-stat-pos="list">
<img src="https://img.25pp.com/uploadfile/app/icon/20180328/1522248388516301.jpg@120w_120h" width="70" height="70" alt="苹果版小米运动下载" title="苹果版小米运动下载"></a>

过滤出详情网页地址 https://www.25pp.com/ios/detail_1571646/

4、进入详情界面，通过关键字“下载越狱版”找到红框所在的网页源码

下载越狱版

<a href="javascript:void(0);" class="btn-install-x" apptype="app" data-id="1571646" data-iid="938688461" appname="小米运动" appversion="3.3.1"
appdownurl="aHR0cDovL3IxMS4yNXBwLmNvbS9zb2Z0LzIwMTgvMDMvMjgvMjAxODAzMjhfMTI5NjhfMjE4OTgwMDUwOTgzLmlwYQ==" closetimer="-1" 
onclick="return ppOneKeySetup(this)" data-stat-act="jb" data-stat-pos="install">下载越狱版</a>

5、通过appdownurl及 点击事件处理ppOneKeySetup，找到pp_onekey-d17d98b4.js中的关键代码:

(C = h.href, E = h.getAttribute("appdownurl"), E && E.length > 0 && (C = o.base64decode(o.utf8to16(E)))

可见js只是对传入的appdownurl作了简单的base64解码，转化后得到真实的下载地址：

http://r11.25pp.com/soft/2018/03/28/20180328_12968_218980050983.ipa

为方便获取下载地址，将上面的步骤用Python3实现：

import urllib.request
import urllib.parse
import re
import ssl
import base64

#关闭SSL验证
user_agent = 'Mozilla/4.0 (compatible; MSIE 5.5; Windows NT)'
headers = { 'User-Agent' : user_agent }
ssl._create_default_https_context = ssl._create_unverified_context
print("Close certificate verify...")

def getSearchResult():
    keyword = input("Input the search key word: ")

    #将中文转换成url编码
    keyword = urllib.parse.quote(keyword)

    searchUrl = "https://www.25pp.com/ios/search_app_0/" + keyword + "/"
    content = getHtmlStringByUrl(searchUrl)
    detailUrl = getSearchDetailUrl(content)
    content = getHtmlStringByUrl(detailUrl)
    downUrl = getAppdownUrlByHtmlContent(content)
    return downUrl


# 根据url 获取网页内容
def getHtmlStringByUrl(url):
    try:
        request = urllib.request.Request(url, headers=headers)
        response = urllib.request.urlopen(request)
        content = response.read().decode('utf-8')  # gbk
        return content

    except urllib.request.URLError as e:
        if hasattr(e, "code"):
            print(e.code)
        if hasattr(e, "reason"):
            print(e.reason)

    return ""

# 根据网页内容获取详情链接
def getSearchDetailUrl(content):
    pattern = re.compile('href="(https://www.25pp.com/ios/detail_.*?)"', re.S) #href = "https://www.25pp.com/ios/detail_3491226/"
    items = re.findall(pattern, content)

    if len(items):
        print("Detail url: " + items[0])
        return items[0]

    return ""

# 根据网页内容获取ipa的下载链接
def getAppdownUrlByHtmlContent(content):
    pattern = re.compile('appdownurl="(.*?)"', re.S)  # appdownurl="aHR0cDovL3IxMS4yNXBwLmNvbS9zb2Z0LzIwMTgvMDEvMDkvMjAxODAxMDlfNjI0NThfMjE1MDYwOTY4Nzc4LmlwYQ=="
    items = re.findall(pattern, content)

    if len(items):
        print("Orgin download url: " + items[0])

        # Base64Decode
        output = base64.standard_b64decode(items[0])
        output = output.__str__()
        return output

    return ""


downUrl = getSearchResult()
print("Down url: " + downUrl)