X猫免费小说安卓逆向分析

最新推荐文章于 2024-05-15 14:56:57 发布

原创

最新推荐文章于 2024-05-15 14:56:57 发布 · 4.2k 阅读

4 ·

CC 4.0 BY-SA版权

本文对x猫免费小说进行安卓逆向分析。先使用ApkTool查壳，显示未加壳；接着进行抓包分析，从提交数据入手；通过jadx反编译定位到相关class，用objection hook后因显示问题需写frida代码，拿到提交参数和返回结果，还衍生出Frida -rpc方案并配合flask编写api接口。

x猫免费小说安卓逆向分析难度(♥)

文章目录

x猫免费小说安卓逆向分析难度(♥)
1. 查壳
2. 抓包分析
3. sign
- 1. Frida-rpc

1. 查壳

我这边使用的是ApkTool, 拖进去显示未加壳。

2. 抓包分析

POST https://xiaoshuo.xxxx.com/api/v1/login/index HTTP/1.1
net-env: 1
channel: qm-cbcpa056_wm
is-white: 0
platform: android
app-version: 50500
reg: 
application-id: com.xxxx.reader
AUTHORIZATION: 
qm-params: cLGZ4CG-uloLp3U1paHWHzpzpzpzpzpztqRTgeKQNlN2N5UzpzpztqpzpzpT4hG2Nhk-A3HjHSRUmqF5A5HwgI9wgI9wgaMMNeoTth0lgIHQpzpzp5Uzpzpz4TKMpqFnAIg5taG-pCp14lfQmqF5A5HLgIHwgh0LNh9nge4wgI0rNe9eNz4lpI0E4zFENyfepzpzNhsxgIfrNzFwgIkTgIox4egegIx5Nq4Lghgwg5HjHzUx4LHWH-oIATgEATFeA-fwA-FrAT0MH5w5OE2etCp2O5HWHTK7g3rwH5w5u_GUOEk2paU1paHWH-kUhRkokTfEBzn_k-N4OIpeczfYpExjNToWuS27uEuYhzpA3hGHm-rEgMNym_-rR-unhTxnRhHL3LQ53C2QpqnQ3ynHNhurtMJSN-QipTsiAyjLBEoAc205taG1BqR1HTZ5gefLNhgngIKrNh0rghOrH5w5BqJ-pqw5A5GFmCx2BaHjHSuj45U1BqR1HTZ5gefLNhgngIKrNh0rghOrH5w5uln5tCR1paHWHTgUgTfegh9rAIfnAI0EAaHjHzNjmqR7uaU1paHWHzN24lp54qk-gqHEglfM4qg5taG5Ozo7paHWHzuDBlujp3HjHzJxmqF5A5H56F==
sign: b27fb3051c9ee919bb7143a8f856a31f
QM-it: 1606239365
QM-ii: 1901732340
no-permiss: 0
User-Agent: webviewversion/50500
Content-Type: application/x-www-form-urlencoded
Content-Length: 124
Host: xiaoshuo.wtzw.com
Connection: Keep-Alive
Accept-Encoding: gzip

cancell_check=1&encrypt_phone=ghgUNIFENeKrNhf=&gender=2&open_push=1&type=1&verify=1111&sign=3a7c6107895fe47d8cfb7647d21a8c86

发现如果我们想要登录, 至少需要解决 qm-params，encrypt_phone,sign

由于没有加固, 那么我们从提交数据开始.

3. sign

jadx反编译, 一些魅族华为的包都不用看，就看可以的。可以定位到

f.f.e.b.c.a.c这个class.

if (this.f32692a.a(url.host())) {
   
   
                HashMap<String, String> b2 = this.f32692a.b();
                TreeMap treeMap = new TreeMap();
                if (b2 != null) {
   
   
                    for (String str : b2.keySet()) {
   
   
                        String str2 = b2.get(str);
                        if (str2 != null) {
   
   
                            newBuilder.addHeader(str, str2);
                            treeMap.put(str, str2);
                        }
                    }
                }
                String y = f.f.e.b.d.a.m().y();
                if (!TextUtils.isEmpty(y)) {
   
   
                    newBuilder.addHeader("qm-params", y);
                    treeMap.put("qm-params", y);
                }
                if (!treeMap.isEmpty()) {
   
   
                    StringBuilder sb = new StringBuilder();
                    for (String str3 : treeMap.keySet()) {
   
   
                        sb.append(str3);
                        sb.append("=");
                        sb.append((String) treeMap.get(str3));
                    }
                    newBuilder.addHeader("sign", Encryption.sign(sb.toString()));
                }
                try {
   
   
                    if (!(this.f32693b == null || (m = this.f32693b.m()) == null || m.length <= 0)) {
   
   
                        for (String str4 : m) {
   
   
                            String string = this.f32693b.getString(str4, "");
                            if (!TextUtils.isEmpty(str4) && !TextUtils.isEmpty(string)) {
   
   
                                newBuilder.addHeader(TextUtil.appendStrings("QM-", str4), string