(簡書封的越來越厲害了)

App: jvmeiyoupin
登錄接口有一個antifraud_sign, 通過抓包克制始終變的就這一個,

j0.png

jadx打開apk, 搜索該參數(shù), 巴拉巴拉的就不贅述了:

#com.jm.android.jumei.baselib.jmtoken.SignBean
#com.jm.android.jumei.b.a
#com.jm.android.jumei.baselib.jmtoken.BaseJuMeiSign.j
#com.jm.android.jumei.baselib.jmtoken.BaseJuMeiSign.a(String s, String charset)
#com.jm.android.jumei.baselib.jmtoken.DesToolProxy.b
#com.jm.android.jmtoken.DesTool.b

hook a(String s, String charset)得到:

a:3:c|7:c|123:a|131:c|150:b|160:c|177:video2t5|179:video3t1|186:video4t9|191:c|666:a|703:wvgre_a|909:a|1001:a|1200:a5|1300:normal|1302:a5|1806:normal|1807:e|1808:a9|1809:a9|1810:normal|6680:a|9081:c|9108:videofeeda|9902:e534de2e7cf5b4d2308.759nexus 6phuawei6.0.1on1080j8qfZp+O3VfjvwMMAsqg==androidgoogleNexus 6PphoneGTPushbjqq-appstoreYNrYsUX5ecgDAEccNYA9uI6H131152111144541625028605d31f0c6ba4030cd731a424777b1b2481v:v3
b:UTF-8
q結(jié)果:d58c1ca0572397686eb83f258bf64280

也就是參數(shù)a的MD5加密, a參數(shù)就是我們抓包的form每一項拼起來的str,
hook DesToolProxy.b,

a:4538791e1fad57445a5ccbdb5d85f0c2
q結(jié)果:54475daf1e19783542c0f58d5bdbcc5a

也就是將str加密后在處理得到的一串32位str,
我們看DesTool.b方法

j1.png

IDA打開so文件,

j3.png

j4.png

j5.png

通過幾次抓包, 比較每次字符串的關(guān)系, 得到如下規(guī)則

#新str每位的索引:舊str每位的索引
0:16
1:15
2:14
3:13
4:12
5:11
6:10
7:9
8:8
9:7
10:6
11:5
12:4
13:3
14:2
15:1
16:0
17:31
18:30
19:29
20:28
21:27
22:26
23:25
24:24
25:23
26:22
27:21
28:20
29:19
30:18
31:17
#Python代碼
_str=f'3:c|7:c|123:a|131:c|150:b|160:c|177:video2t5|179:video3t1|186:video4t9|191:c|666:a|703:wvgre_a|909:a|1001:a|1200:a5|1300:normal|1302:a5|1806:normal|1807:e|1808:a9|1809:a9|1810:normal|6680:a|9081:c|9108:videofeeda|9902:e534de2e7cf5b4d2308.759nexus 6phuawei6.0.1on1080j8qfZp+O3VfjvwMMAsqg==androidgoogleNexus 6PphoneGTPushbjqq-appstoreYNrYsUX5ecgDAEccNYA9uI6H131{phone}{time_s}d31f0c6ba4030cd731a424777b1b2481v:v3'
ef get_md5(_str):
    md5 = hashlib.md5()
    md5.update(_str.encode('utf_8'))
    str_arg = md5.hexdigest()
    return str_arg

def revertStr(_str):
    _str=get_md5(_str)
    _str0=''
    for i in range(16,-1,-1):
        _str0+=_str[i]
    for i in range(31,16,-1):
        _str0+=_str[i]
    return _str0

得到的結(jié)果用在data請求就可以了