0x01 需求

通过frida rpc调用真机获取指定关键字的搜索结果数据。
本文仅供大家学习及研究使用、切勿用于各种非法用途。

0x02 rpc 简介

frida 提供了一种跨平台的 rpc （远程过程调用）机制，通过 frida rpc 可以在主机和目标设备之间进行通信，并在目标设备上执行代码，可实现功能如下：
1、动态地修改函数和方法的参数和返回值。
2、监视和拦截特定函数和方法的调用。
3、修改内存中的数据和指令。
4、与目标设备上的应用程序进行交互，发送和接收数据。
5、在运行时加载自己的 JavaScript 脚本，从而实现自定义的行为修改。

0x03 软硬件工具

app 版本：7.4.70
设备：K40 刷 piexl 11 rom
抓包工具：Charles
反汇编工具：JEB、JADX、IDA
inject：frida

0x04 抓包

POST /gw/mtop.taobao.idle.search.glue/8.0/ HTTP/1.1
x-sgext: JAfKISv0W5XonL3HUeX4UiH7EfgS%2BwL4F%2FIX8wL7F%2FoC%2BQ3%2FDfoN%2Bw37DfsN%2Bw37DfsN%2Bw35E%2BYQ5hL4DfkT5hHmEeYR5hHmEeYR5hHmEeYR5hHmEOYX%2Bg38EeYT%2Bg36DfoN%2BBnpEPwW%2BBH%2FF%2FoQ%2FQL6E6lA%2BhH6EPlH%2FRWoFvMT6RD%2FGekY6RL%2BAvoR%2BhbpEukQ6RDpEOkQ6RDpE%2BkQ6RP6AvkC%2FwKpAvoC%2BgL6AvoC%2BgLpROlHrwL6AqxEr0T6FukR%2BhH6EQ%3D%3D
umid: Y6mM0d1XDnwDAAZc4d8Tk60B
x-sign: azU7Bc002xAAJzB6M9wiB4WMskX6dzB3PW%2F64QfVy78rMahh4hODtL0DoF9kmgIWRqfEkGhlFlqjHfQDYE50A5EzkuewtzB3MLcwdz
x-nettype: WIFI
x-pv: 6.3
x-nq: WIFI
EagleEye-UserData: spm-cnt=a2170.8011571.0.0&spm-url=a2170.unknown.0.0
first_open: 1
x-features: 27
x-app-conf-v: 0
x-mini-wua: HHnB_QQx7EhGYzt0aRv0%2BjcjSfSTdMh9NXopIhtlxCcIGWkyEPONy4fMU296Q4NG4PEFmdynoG21RVXefkf%2Ff8G%2Fqlkl8cahX%2BEk3JT5GB2Uh4TNEqzzblgemWV%2Bitf42AKL%2FrWZLKkzalExnviNeICDt5A%3D%3D
content-type: application/x-www-form-urlencoded;charset=UTF-8
Content-Length: 630
x-t: 1672056548
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
x-bx-version: 6.5.56
f-refer: mtop
x-extdata: openappkey%3DDEFAULT_AUTH
x-ttid: 231200%40fleamarket_android_7.4.70
x-app-ver: 7.4.70
x-c-traceid: Y6mM0d1XDnwDAAZc4d8Tk60B16720565484910160126869
x-location: 0%2C0
x-umt: 2QMB7AlLPMcI7wKFTpWcJNO9Tq3ykFES
a-orange-q: appKey=21407387&appVersion=7.4.70&clientAppIndexVersion=1120221225203700833&clientVersionIndexVersion=0
x-utdid: Y6mM0d1XDnwDAAZc4d8Tk60B
x-appkey: 21407387
x-devid: AnlVbDHuTb2u0LWMPSEZxO4CdI4PNLcEAjN85BBOipB9
user-agent: MTOPSDK%2F3.1.1.7+%28Android%3B11%3BXiaomi%3BM2012K11AC%29
Host: g-acs.m.goofish.com
Accept-Encoding: gzip
Connection: Keep-Alive
data=%7B%22activeSearch%22%3Afalse%2C%22bizFrom%22%3A%22home%22%2C%22disableHierarchicalSort%22%3A0%2C%22forceUseInputKeyword%22%3Afalse%2C%22forceUseTppRepair%22%3Afalse%2C%22fromFilter%22%3Afalse%2C%22fromKits%22%3Afalse%2C%22fromLeaf%22%3Afalse%2C%22fromShade%22%3Afalse%2C%22fromSuggest%22%3Afalse%2C%22keyword%22%3A%22%E4%B8%9D%E8%A2%9C%22%2C%22pageNumber%22%3A1%2C%22resultListLastIndex%22%3A0%2C%22rowsPerPage%22%3A10%2C%22searchReqFromActivatePagePart%22%3A%22historyItem%22%2C%22searchReqFromPage%22%3A%22xyHome%22%2C%22searchTabType%22%3A%22SEARCH_TAB_MAIN%22%2C%22shadeBucketNum%22%3A-1%2C%22suggestBucketNum%22%3A27%7D

多次抓包，发现变化的字段有：

x-sgext、x-sign、x-mini-wua、x-c-traceid、x-t、Content-Length

0x04 参数分析

先从 x-sign 值入手， apk 包拖入 jadx 搜索，得到以下结果：
图片描述

一个个点进去查看，发现并没有有价值的东西，仅仅只是构建字段名等操作，并且我尝试 hook 这些点，并没有得到有用的信息，换 JEB 看看，反复搜索观察，最终定位到 getUnifiedSign 这个函数：
图片描述

跟进查看它有三处调用点：

Lmtopsdk/security/ISign;->getUnifiedSign(Ljava/util/HashMap;Ljava/util/HashMap;Ljava/lang/String;Ljava/lang/String;ZLjava/lang/String;)Ljava/util/HashMap;,,
 
Lmtopsdk/security/AbstractSignImpl;->getUnifiedSign(Ljava/util/HashMap;Ljava/util/HashMap;Ljava/lang/String;Ljava/lang/String;ZLjava/lang/String;)Ljava/util/HashMap;,,
 
Lmtopsdk/security/InnerSignImpl;->getUnifiedSign(Ljava/util/HashMap;Ljava/util/HashMap;Ljava/lang/String;Ljava/lang/String;ZLjava/lang/String;)Ljava/util/HashMap;,,

解析：
第 1 处定义了 ISign 的接口，并写了 getUnifiedSign 方法，代码有删减：

public interface ISign {
    HashMap getUnifiedSign(HashMap arg1, HashMap arg2, String arg3, String arg4, boolean arg5, String arg6);
}

第 2 处定义了一个抽象类 AbstractSignImpl 实现了 ISign 接口中的 getUnifiedSign 方法，当类实现接口的时候，类要实现接口中所有的方法。否则，类必须声明为抽象的类。该处声明的为抽象类，并不需要实现接口，代码有删减：

public abstract class AbstractSignImpl implements ISign {
    @Override  // mtopsdk.security.ISign
    public HashMap getUnifiedSign(HashMap arg2, HashMap arg3, String appKey, String authCode, boolean useWua, String requestId) {
        return null;
    }
}

第 3 处定义了 InnerSignImpl 类继承 AbstractSignImpl，java中规定抽象类的子类必须给出抽象类中的抽象方法的具体实现，除非该子类也是抽象类。InnerSignImpl 并不是抽象类，也可以看出它实现了 getUnifiedSign 方法，代码有删减：

public class InnerSignImpl extends AbstractSignImpl {
    @Override  // mtopsdk.security.AbstractSignImpl
    public HashMap getUnifiedSign(HashMap arg17, HashMap arg18, String appKey, String authCode, boolean useWua, String requestId) {
        String instanceId = this.c();
        if(appKey == null) {
            arg17.put("SG_ERROR_CODE", "AppKey is null");
            TBSdkLog.e("mtopsdk.InnerSignImpl", instanceId + " [getUnifiedSign] AppKey is null.");
            return null;
        }
 
        if(arg17 == null) {
            TBSdkLog.e("mtopsdk.InnerSignImpl", instanceId + " [getUnifiedSign] params is null.appKey=" + appKey);
            return null;
        }
 
        if(this.f == null) {
            arg17.put("SG_ERROR_CODE", "unified is null");
            TBSdkLog.e("mtopsdk.InnerSignImpl", instanceId + " [getUnifiedSign]sg unified sign is null, please call ISign init()");
            return null;
        }
 
        try {
            HashMap input = new HashMap();
            String data = (String)this.a(arg17, appKey, true).get("INPUT");
            boolean v10 = StringUtils.isBlank(data);
            if(v10) {
                TBSdkLog.e("mtopsdk.InnerSignImpl", this.c() + " [getUnifiedSign]get sign failed with sign data empty ", "appKeyIndex=" + this.a.k + ",authCode=" + this.a.i);
                return null;
            }
 
            input.put("appkey", appKey);
            input.put("data", data);
            input.put("useWua", Boolean.valueOf(useWua));
            input.put("env", Integer.valueOf(this.d()));
            input.put("authCode", authCode);
            input.put("extendParas", arg18);
            input.put("requestId", requestId);
            input.put("api", arg17.get("api"));
            HashMap output = this.f.getSecurityFactors(input);
            if(output != null && !output.isEmpty()) {
                return output;
            }
 
            TBSdkLog.e("mtopsdk.InnerSignImpl", this.c() + " [getUnifiedSign]get sign failed with no output ", "appKeyIndex=" + this.a.k + ",authCode=" + this.a.i);
        }
        catch(SecException v0_1) {
            TBSdkLog.e("mtopsdk.InnerSignImpl", this.c() + " [getUnifiedSign]get sign failed and SecException errorCode " + v0_1.getErrorCode() + ",appKeyIndex=" + this.a.k + ",authCode=" + this.a.i, v0_1);
        }
        catch(Throwable v0) {
            TBSdkLog.e("mtopsdk.InnerSignImpl", this.c() + " [getUnifiedSign]get sign failed exception ,appKeyIndex=" + this.a.k + ",authCode=" + this.a.i, v0);
        }
 
        return null;
    }
}

从该函数中不难发现里面包含了许多抓包中的参数信息，有理由怀疑程序就是在此处进行组包并请求信息的！

0x05 hook getUnifiedSign

分析到这了，先 hook 看看 getUnifiedSign 函数请求和返回都是些啥，hook 代码：

function main() {
    Java.perform(function () {
        var InnerSignImpl = Java.use("mtopsdk.security.InnerSignImpl");
        InnerSignImpl["getUnifiedSign"].implementation = function (params, ext, appKey, authCode, useWua, requestId) {
           console.log('\ngetUnifiedSign is called' + ', ' + '\nparams: \n' + params + '\n' + 'ext: \n' + ext + '\n' + 'appKey: \n' + appKey + '\n' + 'authCode: \n' + authCode + '\n' + 'useWua: \n' + useWua + '\n' + 'requestId: \n' + requestId);
            var ret = this.getUnifiedSign(params, ext, appKey, authCode, useWua, requestId);
            console.log('getUnifiedSign ret value is ' + ret);
            return ret;
        };
    });
}
setImmediate(main)

搜索关键字：黑丝。
结果：

getUnifiedSign is called,
params:
{data={"activeSearch":false,"bizFrom":"home","disableHierarchicalSort":0,"forceUseInputKeyword":false,"forceUseTppRepair":false,"fromFilter":false,"fromKits":false,"fromLeaf":false,"fromShade":false,"fromSuggest":false,"keyword":"黑丝","pageNumber":1,"resultListLastIndex":0,"rowsPerPage":10,"searchReqFromActivatePagePart":"searchButton","searchReqFromPage":"xyHome","searchTabType":"SEARCH_TAB_MAIN","shadeBucketNum":-1,"suggestBucketNum":27}, deviceId=AnlVbDHuTb2u0LWMPSEZxO4CdI4PNLcEAjN85BBOipB9, sid=null, uid=null, x-features=27, appKey=21407387, api=mtop.taobao.idle.search.glue, lat=0, lng=0, utdid=Y6mM0d1XDnwDAAZc4d8Tk60B, extdata=openappkey=DEFAULT_AUTH, ttid=231200@fleamarket_android_7.4.70, t=1672065081, v=8.0}
ext:
{pageId=, pageName=}
appKey:
21407387
authCode:
null
useWua:
false
requestId:
r_342
getUnifiedSign ret value is
{x-sgext=JAc6QkgEOGWLbN43MhWbokILcghxC2EIdAJ0A2EJdghhCW4PbgpuC24LbgtuC24LbgtuC24MdRZzFnQNbgx1FnIWchZyFnIWchZyFnIWchZyFnIWcxZzDncWcw53FnEWchZyFnACYQt0DXAKdwxyC3UZcgghW3IKcgtxXHUOIA17CGEJdgphA2EJdhlyCnINYQlhC2ELYQthC2ELYQhhC2EOcRlxGXUZcw5hCmEKYQphCmEKYRknGSRfYQphXCdfJwInGXIKcgpy, x-umt=2QMB7AlLPMcI7wKFTpWcJNO9Tq3ykFES, x-mini-wua=HHnB_LsOm2MbDDQX8pocsAv844s/AJ3eeRpQBvQ0ruCym5E4E9z73i+wqyWX+kYoOCLjd0M+Af0hvQxs8NJyeS1/+qAd+g60eGM0Y7snvKtTeCvVhBnNESbEFrPu+orzouidZjoRxOAXN2Cpe1icpSFPKMA==, x-sign=azU7Bc002xAAJAe6xWI/sfnl+vxS1Be0CqzNIjAW/Hwc8p+i1dC0d4rAl5xTWTXVcWTzU1+mIZmU3sPAV41DwKbwpS1llAe0BZQHtA}

参数都在这了，这就好办了，rpc 调用就能解决，注意这边的 data 数据是进行了 url 编码的，需进行进一步转化。
rpc 调用代码可参考我写的：原创] 安卓协议逆向 cxdx 分析与实现一文。

[培训]二进制漏洞攻防（第3期）；满10人开班；模糊测试与工具使用二次开发；网络协议漏洞挖掘；Linux内核漏洞挖掘与利用；AOSP漏洞挖掘与利用；代码审计。

#逆向分析 #协议分析 #HOOK注入

收藏・18

点赞・8

打赏

最新回复 (5)
codeoooo 雪币： 510 活跃值： (3811) 能力值： ( LV2，RANK：10 ) 在线值：发帖 1 回帖 111 粉丝 6 关注私信	codeoooo 2023-6-26 17:03 2 楼 0 沙发
suuuuu 雪币： 839 活跃值： (5009) 能力值： ( LV2，RANK：10 ) 在线值：发帖 22 回帖 295 粉丝 7 关注私信	suuuuu 2023-7-3 17:28 3 楼 0 搜索白丝儿
秋狝雪币： 19349 活跃值： (28971) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 1565 粉丝 29 关注私信	秋狝 2023-7-3 21:11 4 楼 1 感谢分享
kkte 雪币： 185 活跃值： (506) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 8 粉丝 1 关注私信	kkte 2024-1-9 20:21 5 楼 0 试了一下，似乎走到这里了，TBSdkLog.e("mtopsdk.InnerSignImpl", instanceId + " [getUnifiedSign]sg unified sign is null, please call ISign init()");
kkte 雪币： 185 活跃值： (506) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 8 粉丝 1 关注私信	kkte 2024-1-9 20:21 6 楼 0 看起来rpc还是要补上下文环境呐
	游客登录 \| 注册方可回帖　回帖　表情雪币赚取及消费高级回复