[原创]【银行逆向百例】15小程序逆向之支付宝提取data文件为tar格式-WEB安全-看雪安全社区

[原创]【银行逆向百例】15小程序逆向之支付宝提取data文件为tar格式

发表于: 2026-5-22 14:22 2435

[原创]【银行逆向百例】15小程序逆向之支付宝提取data文件为tar格式

差不多的张三

2026-5-22 14:22

2435

“ 万分抱歉我不懂周全，反正我从来没上过版面。——《歌手》”
# 01环境版本
环境：
电脑，Windows 11 专业版 23H2
<a href="elink@011K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6v1K9h3q4G2f1%4g2u0L8X3k6G2f1$3g2U0i4K6u0r3d9X3W2S2L8#2y4#2d9h3&6X3L8#2y4W2j5#2)9#2k6W2b7H3x3r3I4K6i4K6g2X3g2$3W2F1x3e0p5`.">JiaoSuInfoSec/JiaoSuInfoSec_T00ls_Win11: 角宿武器库官方发布页面</a>

软件：
Android 支付宝，10.5.60.8000
<a href="elink@32bK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2%4j5h3&6V1L8%4g2B7K9h3q4Q4x3X3g2U0L8$3#2Q4x3V1k6S2M7s2m8K6i4K6u0r3x3U0M7&6z5e0M7&6i4K6u0r3K9r3W2K6N6r3!0J5P5g2)9#2k6Y4j5&6y4K6p5`.">2023支付宝v10.5.60.8000老旧历史版本安装包官方免费下载_豌豆荚</a>
Mumu模拟器，5.14.2
<a href="elink@e4bK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6E0N6h3#2#2i4K6u0W2x3e0j5K6i4K6u0W2j5$3!0E0i4K6u0r3k6r3!0%4L8X3I4G2j5h3c8Q4x3V1j5`.">MuMu模拟器下载_支持Windows/macOS系统</a>

# 02操作步骤
1、豌豆荚下载支付宝v10.5.60.8000版本
```
https://www.wandoujia.com/apps/279979/history_v971
```
 ![图片描述](upload/attach/202605/1037623_XJEJEM73Q73CYKN.webp)
2、服务
 ![图片描述](upload/attach/202605/1037623_4B3RTW4UUPKUSUR.webp)
3、参考文章
<a href="elink@57aK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6T1L8r3!0Y4i4K6u0W2j5%4y4V1L8W2)9J5k6h3&6W2N6q4)9J5c8Y4N6W2K9i4S2A6L8W2)9#2k6U0f1J5x3K6R3I4z5o6M7@1i4K6u0r3j5i4u0@1K9h3y4D9k6g2)9J5c8X3c8W2N6r3q4A6L8s2y4Q4x3V1j5I4y4o6p5%4x3e0x3K6x3e0p5`.">支付宝小程序反编译-CSDN博客</a>
 ![图片描述](upload/attach/202605/1037623_PSBXFXGX9VBJTWK.webp)
4、打开小程序后，使用mumu自带adb，全局查找所有 0.data 文件，按修改时间从新到旧排序，保存输出结果到1.txt
```
cd D:\MuMu\nx_main
adb shell
su
find /data/data/com.eg.android.AlipayGphone/files/Sandbox -name "0.data" -exec ls -lt {} + 2>/dev/null > /data/local/tmp/1.txt
```
 ![图片描述](upload/attach/202605/1037623_8NGEH7H2J25Y4GS.webp)
5、查看最新的文件前20个
```
cat /data/local/tmp/1.txt | head -n 20
```
 ![图片描述](upload/attach/202605/1037623_6C7A2CSCEFJ9UYN.webp)
6、新建xcx目录，从 1.txt 中读取前20行，提取出每一行的最后一列，提取父目录的名字作为新文件名
```
mkdir -p /data/local/tmp/xcx

cat /data/local/tmp/1.txt | head -n 20 | awk '{print $NF}' | while read filepath; do
  if [ -f "$filepath" ]; then
    new_name=$(basename $(dirname "$filepath"))
    echo "copy: $filepath"
    cp "$filepath" "/data/local/tmp/xcx/$new_name.data"
  else
    echo "not found: $filepath"
  fi
done
```
 ![图片描述](upload/attach/202605/1037623_UHUHB9VPSZMEV5E.webp)
7、先给权限，然后pull下来
```
chmod -R 777 /data/local/tmp/xcx
exit
exit
adb pull /data/local/tmp/xcx .
```
 ![图片描述](upload/attach/202605/1037623_JSGCP9ZT77GYVZG.webp)
8、直接修改扩展名为tar，打开报错
 ![图片描述](upload/attach/202605/1037623_65AHUCTQE9E3CUZ.webp)
9、使用python批量提取data为tar，py和xcx放在同级目录
```
import os
INPUT_DIR_NAME = "xcx"
OUTPUT_DIR_NAME = "tars"
TAR_MAGIC_SIGNATURE = b'ustar'
TAR_HEADER_OFFSET = 257
def extract_tar_from_container(container_path, result_path):
    if not os.path.exists(container_path):
        return False
    try:
        with open(container_path, 'rb') as f:
            content = f.read()
        signature_index = content.find(TAR_MAGIC_SIGNATURE)
        if signature_index != -1:
            tar_start_offset = signature_index - TAR_HEADER_OFFSET
            if tar_start_offset >= 0:
                tar_data = content[tar_start_offset:]
                with open(result_path, 'wb') as f_out:
                    f_out.write(tar_data)
                return True
    except Exception:
        return False
    return False
def batch_process():
    current_dir = os.getcwd()
    input_dir = os.path.join(current_dir, INPUT_DIR_NAME)
    output_dir = os.path.join(current_dir, OUTPUT_DIR_NAME)
    if not os.path.isdir(input_dir):
        return
    if not os.path.exists(output_dir):
        os.makedirs(output_dir)
    for filename in os.listdir(input_dir):
        if filename.endswith(".data"):
            input_path = os.path.join(input_dir, filename)
            output_filename = os.path.splitext(filename)[0] + ".tar"
            output_path = os.path.join(output_dir, output_filename)
            extract_tar_from_container(input_path, output_path)
if __name__ == "__main__":
    batch_process()
```
 ![图片描述](upload/attach/202605/1037623_SXCUANTJ9ZCU2AQ.webp)
10、解压tar发现格式与文章中一致
 ![图片描述](upload/attach/202605/1037623_Q5FY6W2JBFP85RR.webp)
11、全局搜索目标系统关键字定位到小程序代码
 ![图片描述](upload/attach/202605/1037623_DSMWQRTQXDZW5WV.webp)

传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！！

最后于 2026-5-22 22:23 被差不多的张三编辑，原因：

收藏・1

点赞・2

打赏