-
-
[原创]瑞幸咖啡最新协议分析
-
2023-3-21 11:51
-
sign走的是md5_crypt,具体实现在libcryptDD里，常规md5加密，拼接了一串20长度的字符串，然后四位四位运算.（下面是解密代码）
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 | import hashlibdef md5Sign(): s = "cid=你的cid;q=你的q;t=你的时间戳;uid=你的uid" md5sign = hashlib.md5((s + "puclDGB45KTsGwHb").encode("utf-8")).digest() res = "" for i in range(4): mr = int.from_bytes(md5sign[i * 4:(i + 1) * 4], byteorder="big", signed=True) if mr < 0: mr = mr * (-1) res += str(mr) return resprint(md5Sign()) |
sign就算出来了。
然后body解密跟q走的都是白盒AES。走了AESworks那个加密，然后base64的_变/，+变-。第二个参数分别是2，3代表加密解密。
加密如下：
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 | //emulator.traceCode(module.base+0xA0FC,module.base+0x000AC50); ArrayList<Object> list = new ArrayList<>(10); list.add(vm.getJNIEnv()); list.add(0); //String param1 =getTemplateContent(); String param1 = "{\"appversion\":\"5115\"}"; list.add(vm.addLocalObject(new ByteArray(vm,param1.getBytes(StandardCharsets.UTF_8)))); list.add(2); byte[] b=new byte[]{6,103,-107,-119,-40,18,-106,-8,-1,-59,-47,-49,70,50,15,-10,73,9,-6,80,-38,87,98,16,114,-89,108,124,97,-82,52,59}; list.add(vm.addLocalObject(new ByteArray(vm,b))); Number number = module.callFunction(emulator, 0x2286d, list.toArray()); Inspector.inspect((byte[]) vm.getObject(number.intValue()).getValue(),"localAESWork4Api_result"); byte[] result = (byte[]) vm.getObject(number.intValue()).getValue(); byte[] encodedHexB64 = Base64.encodeBase64(result); System.out.println(new String(encodedHexB64).replace('/','_').replace('+','-')); |
解密如下
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 | //emulator.traceCode(module.base+0xA0FC,module.base+0x000AC50); ArrayList<Object> list = new ArrayList<>(10); list.add(vm.getJNIEnv()); list.add(0); //String param1 =getTemplateContent(); String param1 = "uGBe_7dJNAkQS0hyPTzYUdZpESQgV6cg5QTn5M1KdHs="; param1.replace('_','/').replace('-','+'); byte[] decodedHexB64 = Base64.decodeBase64(param1); list.add(vm.addLocalObject(new ByteArray(vm,decodedHexB64))); list.add(3); byte[] b=new byte[]{6,103,-107,-119,-40,18,-106,-8,-1,-59,-47,-49,70,50,15,-10,73,9,-6,80,-38,87,98,16,114,-89,108,124,97,-82,52,59}; list.add(vm.addLocalObject(new ByteArray(vm,b))); Number number = module.callFunction(emulator, 0x2286d, list.toArray()); Inspector.inspect((byte[]) vm.getObject(number.intValue()).getValue(),"localAESWorks_result"); byte[] result = (byte[]) vm.getObject(number.intValue()).getValue(); System.out.println(new String(result)); |
目前是unidbg调了，有空再研究。当时想手撸白盒aes的， 
这里已经是加密结果赋值了，下面有一堆方法挤在一起的就是读取输入，对输入进行排列。（之前弄得，没图了。自己找一下可以看到。）因为没时间分析了，直接unidbg调了就行了，下次有时间的话还原一下算法。
[培训]《安卓高级研修班(网课)》月薪三万计划，掌 握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法
|
|
|---|---|
|
|
|
|
|
|
|
|
不错，多多更新，感谢~
|
|
|
|
