X-SIGN: ABkKoAlXiGOixtT1tVgWMeKU27c=
X-LV: 1								
X-KV: 31e0d37e						
携带session值：cookie: SESSIONID=47E50390-FD1A-1FCB-78C1-D1406A9FCAEC

mzip=AgOEsqhrADZqZE%2B%2BQEM1Fq5RSTda0PrL9sPUxKU7RPmQwkPe3%2BDRzuWDj%2FpsculdJUzWZni9L1ClNvptmUS65a......

 jP    K   A
		b6 rt+B    , 0 d U)  y b7w ' I ? &AI.2 z  ٹ T ......

	02 03 20 6A 50 20 20 20 20 4B 20 20 20 08 41 0D
	0A 62 36 20 72 74 2B 17 42 20 20 20 20 2C 20 30
	20 64 20 7F 13 55 29 20 20 79 20 62 37 77 20 27
	20 49 1F 20 ......

X-SIGN: NJX937HCIey888zMUntRbxCfgLo=
X-LV: 1
X-KV: 31e0d37e

cookie: SESSIONID=47E50390-FD1A-1FCB-78C1-D1406A9FCAEC

mzip=AgNiOLZhALY595shFYVA14Xykx%2B8NpJGPbfB3g%2FQ9fG799C6RDvpwJCgTvW1%2FnNe6%2BBWrKRUhSAQ1lR......

 n U Q   =  t 呵 X     %-  "i       !|J% r# , B  &   yg +& i V 
		\j Y K  4   o U   ( w ;oQ ഀ / ƾ    $ [ {  J~ >G  O ,  p 5  y G SLViӧ.....

	02 03 20 6E 20 55 20 51 20 12 20 20 3D 20 20 74 
	20 BA C7 20 13 58 20 20 20 20 20 25 2D 20 20 22
	69 20 20 20 20 20 20 20 21 17 7C 4A 0E 25 20 72
	23 7F 20 2C 20 14 ......

    public void d() throws Exception {
        String v0_2;
        CharSequence v1 = null;
        if(f.b()) {
            this.h();
            if(this.g) {
                if(this.i != null && !this.i.isEmpty()) {	//this.i为post参数的Map对象
                    JSONObject v1_1 = new JSONObject();
                    Iterator v2 = this.i.keySet().iterator();
                    while(v2.hasNext()) {
                        Object v0 = v2.next();
                        try {
                            v1_1.put(((String)v0), this.i.get(v0));
                        }
                        catch(Exception v0_1) {
                            com.immomo.mmutil.b.a.a().a(((Throwable)v0_1));
                        }
                    }
					//将Map参数转为Json字符串v0_2
                    v0_2 = v1_1.toString();	
                    String v2_1 = this.c;	//this.c取出一个长度为48的字符串:GallR7c5B85g5Cy4ew+Cf9xboJnBystfGallR7c5B85g5Cy4
                    try {
                        byte[] v1_2 = v0_2.getBytes();
                        byte[] v3 = v2_1.getBytes();
                        byte[] v5 = new byte[Coded.getInstance().computeOutputLength(v1_2.length, 1)];	//computeOutputLength函数计算得到加密结果长度
                        int v2_2 = Coded.getInstance().aesEncode(v1_2, v1_2.length, v3, v3.length, v5);	//采用aes加密算法，其中v1_2为内容，v3为密钥
                        v1_2 = new byte[v2_2];
                        int v0_3;
                        for(v0_3 = 0; v0_3 < v2_2; ++v0_3) {	//将加密结果循环赋值给v1_2
                            v1_2[v0_3] = v5[v0_3];				//不同的明文，v1_2的开头结构为均为0203
                        }
                        v0_2 = com.immomo.mmutil.a.a(v1_2);	//进入a函数观察得，a为Base64的encode函数
                        goto label_50;
                    }
                }
            label_50:
                this.i.clear();
                if(!TextUtils.isEmpty(((CharSequence)v0_2))) {
                    this.i.put("mzip", v0_2);	//将v0_2关联mzip
                }
            }
        }
    }

	public int aesEncode(byte[] arg2, int arg3, byte[] arg4, int arg5, byte[] arg6) {
                return this.a49kdEba83h(arg2, arg3, arg4, arg5, arg6);
            }

    public native int a49kdEba83h(byte[] arg1, int arg2, byte[] arg3, int arg4, byte[] arg5) {
    }

		.............
	BLX             getpid
	LDR             R1, =(aProcDStatus - 0x190E)
	ADD.W           R4, SP, #0x518+s
	MOV             R2, R0
	ADD             R1, PC  ; "/proc/%d/status"		//轻量反调试
	MOV             R0, R4  ; s
	BLX             sprintf
	LDR             R1, =(aR - 0x191A)
	MOV             R0, R4  ; filename
	ADD             R1, PC  ; "r"
	BLX             fopen
	LDR.W           R9, [R7,#arg_0]
	MOV             R6, R0
		.............
	LDR             R4, =(aTracerpid - 0x192E)
	MOV             R10, R5
	ADD             R5, SP, #0x518+var_510
	ADD             R4, PC  ; "TracerPid"
		............

		........
	ADD             R4, SP, #0x40+var_30
	MOV             R1, R2
	MOV             R2, R3
	MOV             R0, R4
	BLX             __aeabi_memcpy
	MOVW            R0, #0x302		// 02 03
	ADD.W           R6, R10, #2
	STRH.W          R0, [R10]		//0203作为数据的开头，即数据的byte形式为：02 03 .....
	MOVS            R0, #0
	STRB.W          R0, [R10,#6]	//00作为第七个字节，数据的byte形式为：02 03 xx xx xx xx 00.....
	MOV             R0, R6
	MOVS            R1, #4
	BLX             j_my_RAND_pseudo_bytes
	ADD.W           R9, SP, #0x40+var_20
	MOV             R0, R6			//R6此刻指向数据byte第三个字节
	MOVS            R2, #4			//R2为4，猜测是一个长度值，及bytes[2-5]
	MOV             R1, R9
	BLX             j_iv_generate	//IV生成算法
	ADD.W           R3, R10, #7		//R3指向数据的第8个字节
	MOV             R0, R11
	MOV             R1, R9
	MOV             R2, R4
	STR.W           R8, [SP,#0x40+var_40]
	BLX             j_aesEncrypt
	ADDS            R0, #7			
		........

		...............
	MOVS            R0, #0x14 ; size	
	BLX             malloc
	MOV             R5, R0		//开辟一块空间存放sha1的值
	MOV             R0, R6
	MOV             R1, R5	
	MOV             R2, R4
	BLX             j_momoEnc_sha1
	MOV             R0, R8		//R8为参数传进来的指针
	MOV             R1, R5
	MOVS            R2, #0x10	//取16字节
	BLX             __aeabi_memcpy
	MOV             R0, R5  ; ptr
	BLX             free
		...........