[原创]乐校园跑协议分析-Android安全-看雪安全社区

##### 乐健XX协议分析

###### 登陆请求

请求体主要是一个时间戳，和密文，猜测猜测一下是将时间戳做某种运算然后作为加密的key

~~~
{
  "t": 1783042426239,
  "pyd": "U3XEJtKmGWKJihssFpquZVRWn2diRGvmT587mP8Q29pzULYFbjwNeKml4/+dY2aLa2hkNcWPoPna\nu1f92Fp+xHtroa29XX/uiVZtk6ZlXh1yfKsa7qY08io1MUr8e8iSj4GeRJdQGnKLszbQzDpNh9Yf\nbye0XtM+XkRnjrzz1WM3jftFnrjD265b/uwHivHiUFccuzUhKklPCfJR1Bfjl3InC8VWeUHQqToA\nPDBmBxJ5Wnzxwh+YHQ/voSThbSSJbpH5Xe4bbMgr/ysWdfUPW957JN/cbtz5ZvsPMMEaJwo=\n"
}
~~~

然后通过simplHook工具定位一下，发现没有com.legym.security.NativeLib这个类，所以这个类可能是动态加载的，所以脱一下壳，就能看到了

~~~
类型：AES/ECB/PKCS5Padding
加密/解密：加密
密钥Key(String)：207872402881ea7c
密钥Key(Base64)：MjA3ODcyNDAyODgxZWE3Yw==

密钥Key(Hex)：32303738373234303238383165613763
原始数据(String)：{"entrance":"1","password":"gdxghyff","phone":"18281111111","signDigital":"3e4a8ce6b2a6dfc43f32bfcd2619f2af1ffa0631","userName":"18281111111","authType":"Bearer","baseUrl":"<mark class="encrypted">44cK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0M7r3g2K6i4K6u0W2L8r3g2Y4P5h3#2Q4x3X3g2U0L8W2)9J5c8R3`.`.</mark>","page":"","type":""}
原始数据(Base64)：eyJlbnRyYW5jZSI6IjEiLCJwYXNzd29yZCI6ImdkeGdoeWZmIiwicGhvbmUiOiIxODI4MTExMTEx
MSIsInNpZ25EaWdpdGFsIjoiM2U0YThjZTZiMmE2ZGZjNDNmMzJiZmNkMjYxOWYyYWYxZmZhMDYz
MSIsInVzZXJOYW1lIjoiMTgyODExMTExMTEiLCJhdXRoVHlwZSI6IkJlYXJlciIsImJhc2VVcmwi
OiJodHRwczovL2NwZXMubGVneW0uY24vIiwicGFnZSI6IiIsInR5cGUiOiIifQ==

LSPHooker_ --> doFinal(line:11)
com.legym.security.NativeLib --> encrypt(line:14)
com.legym.security.NativeLib --> encrypt(line:9)
com.legym.security.NativeLib --> encodeNs(line:4)
com.legym.security.SecurityRequestBodyConverter --> convert(line:36)
com.legym.security.SecurityRequestBodyConverter --> convert(line:0)
retrofit2.ParameterHandler$Body --> apply(line:1)
retrofit2.RequestFactory --> create(line:8)
retrofit2.OkHttpCall --> createRawCall(line:1)
retrofit2.OkHttpCall --> enqueue(line:7)
retrofit2.KotlinExtensions --> await(line:3)
retrofit2.HttpServiceMethod$SuspendForBody --> adapt(line:5)
~~~

根据调用栈大概率就是getDykey生成的密钥

~~~
    public static String encodeNs(String str, String str2) {
        return encrypt(str, getDyKey(str2));
    }
~~~

写个frida hook一下

~~~js
function main() {
    Java.perform(function () {
        Java.enumerateClassLoaders({
            onMatch: function (loader) {
                try {
                    if (loader.findClass("com.legym.security.NativeLib")) {
                        Java.classFactory.loader = loader;
                    }
                } catch (error) {
                }
            }, onComplete: function () {
            }
        });
        var NativeLib = Java.use("com.legym.security.NativeLib");
        NativeLib["encodeNs"].implementation = function (str, str2) {
            console.log(`NativeLib.encodeNs is called: str=${str}, str2=${str2}`);
            let result = this["encodeNs"](str, str2);
            console.log(`NativeLib.encodeNs result=${result}`);
            return result;
        };
        NativeLib["getDyKey"].implementation = function (str) {
            console.log(`NativeLib.getDyKey is called: str=${str}`);
            let result = this["getDyKey"](str);
            console.log(`NativeLib.getDyKey result=${result}`);
            return result;
        };
    });
}
~~~

~~~
[M2011K2C::com.ledreamer.zz ]-> NativeLib.encodeNs is called: str={"entrance":"1","password":"$\u0026-__3","phone":"18111111111","signDigital":"984bdd5510c14475a0670c22214bfc8f7a4e135e","userName":"18111111111","authType":"Bearer","baseUrl":"<mark class="encrypted">4a6K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6U0M7r3g2K6i4K6u0W2L8r3g2Y4P5h3#2Q4x3X3g2U0L8W2)9J5c8R3`.`.</mark>","page":"","type":""}, str2=1783121690685
NativeLib.getDyKey is called: str=1783121690685
NativeLib.getDyKey result=12320402881ea7c39c5d5017c39d143a8062b
NativeLib.encodeNs result=/bHPd7houbCeH7yxyt0FWfTX3Pz8DH4ZXn8qMq3X1Enuib3Xt9azgFBz6+gWuWkBqMIqhja7B0nt
VVfKxzPf8IO5fZ+h0qYeqzWT1VLu6sv+sgUvWPNX6dLn0rp2WziTyEaEgVjQhSonE1qyiIre6r2R
V2HwHTQEZUR9iU3/nht71GdltW8l4lEhpNJiwTuBpRNcHlfP7oOqr6jyYyvC0r78jxcnRKMEHNl2
XZh0UegHIc+Fq3UqHaKsGeKp1CtgSjcYpPLz4vv+/X03xkBPM0DsbT7cKXoA9hXTu7+DBto=
~~~

~~~
public static native String getDyKey(String str);

static {
        System.loadLibrary("security");
    }

~~~

然后看一下JNI_OnLoad

~~~
  if ( v5 )
    (*v4)->RegisterNatives(
      v4,
      v5,
      off_E020,                                 // "checkSignature"
      5);
.data:000000000000E020 off_E020        DCQ aChecksignature_0   ; DATA XREF: JNI_OnLoad+90↑o
.data:000000000000E020                                         ; JNI_OnLoad+98↑o
.data:000000000000E020                                         ; "checkSignature"
.data:000000000000E028                 DCQ aLjavaLangObjec     ; "(Ljava/lang/Object;)I"
.data:000000000000E030                 DCQ checkSignature
.data:000000000000E038                 DCQ aGetdykey_0         ; "getDyKey"
.data:000000000000E040                 DCQ aLjavaLangStrin_2   ; "(Ljava/lang/String;)Ljava/lang/String;"
.data:000000000000E048                 DCQ getDyKey
.data:000000000000E050                 DCQ aGetgskey_0         ; "getGsKey"
.data:000000000000E058                 DCQ aLjavaLangStrin_1   ; "(Ljava/lang/String;Ljava/lang/String;)L"...
.data:000000000000E060                 DCQ getSGKey
.data:000000000000E068                 DCQ aSignrundata_0      ; "signRunData"
.data:000000000000E070                 DCQ aLjavaLangObjec_0   ; "(Ljava/lang/Object;Ljava/lang/String;Lj"...
.data:000000000000E078                 DCQ signRunData
.data:000000000000E080                 DCQ aGetrnkey_0         ; "getRnKey"
.data:000000000000E088                 DCQ aLjavaLangStrin_1   ; "(Ljava/lang/String;Ljava/lang/String;)L"...
.data:000000000000E090                 DCQ getRnKey
.data:000000000000E090 ; .data         ends
~~~

~~~
    v16 = (*a1)->GetStringUTFChars(a1, a3, nullptr);
    if ( v16 && (v17 = v16, DynamicKey = getDynamicKey(), (*a1)->ReleaseStringUTFChars(a1, a3, v17), DynamicKey) )
    {
      v19 = *a1;
      v20 = strlen(DynamicKey);
      v21 = v19->FindClass(a1, "java/lang/String");
      v22 = v19->NewStringUTF(a1, "UTF-8");
      v23 = v19->GetMethodID(a1, v21, "<init>", "([BLjava/lang/String;)V");
      v24 = v19->NewByteArray(a1, v20);
      v19->SetByteArrayRegion(a1, v24, 0, v20, DynamicKey);
      v25 = v19->NewObject(a1, v21, v23, v24, v22);
      free(DynamicKey);
      return v25;
    }
~~~

看一下getDynamicKey

~~~
void *__fastcall getDynamicKey(const char *s_1)
{
  const char *s; // x19
  char v2; // w8
  int v3; // w8
  int v4; // w19
  int v5; // w19
  char *n; // x20
  int v7; // w0
  void *v8; // x0
  void *v9; // x21
  char nptr_1[4]; // [xsp+8h] [xbp-38h] BYREF
  char nptr[8]; // [xsp+Ch] [xbp-34h] BYREF
  char dest[4]; // [xsp+14h] [xbp-2Ch] BYREF
  __int64 v14; // [xsp+18h] [xbp-28h]

s = s_1;
  v14 = *(_ReadStatusReg(TPIDR_EL0) + 40);
  strncpy(dest, s_1 + 2, 3u);
  dest[3] = 0;
  strncpy(nptr, s + 4, 4u);
  nptr[4] = 0;
  v2 = s[strlen(s) - 1];
  nptr_1[1] = 0;
  nptr_1[0] = v2;
  LODWORD(s) = atoi(dest);
  v3 = s - atoi(nptr);
  if ( v3 >= 0 )
    v4 = v3;
  else
    v4 = -v3;
  v5 = v4 << atoi(nptr_1);
  n = malloc(0x21u);
  strcpy(n, "402881ea7c39c5d5017c39d143a8062b");
  v7 = sub_2AEC(0, -1, 0, "%d%s", v5, n);
  v8 = malloc(v7 + 1LL);
  v9 = v8;
  if ( v8 )
  {
    sub_2D34(v8, -1);
    free(n);
  }
  return v9;
}
~~~

很简单的一个算法，并且hook一下看看结果，能对上

~~~
def getKey(tm):
    salt = ""
    s1 = tm[2:5]
    s2 = tm[4:8]
    result = abs(int(s1) - int(s2))
    end = int(tm[-1])
    key = (str(result << end) + salt)[0:16]
    return key
~~~

~~~
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
7c98a472d0  31 37 38 33 31 32 33 31 32 38 32 32 37 00 00 00  1783123128227...
7c98a472e0  01 81 00 00 00 00 90 6a 00 00 00 00 00 00 00 00  .......j........
7c98a472f0  50 2e a3 08 7c 00 00 b4 69 64 00 60 00 00 60 00  P...|...id.`..`.
7c98a47300  01 81 00 00 00 00 80 83 00 00 00 00 00 00 00 00  ................
7c98a47310  d0 ab a2 48 7c 00 00 00 43 67 72 6f 75 70 00 00  ...H|...Cgroup..
7c98a47320  01 81 00 00 00 00 b2 fe 00 00 00 00 00 00 00 00  ................
7c98a47330  90 1e a3 08 7c 00 00 b4 00 00 00 00 00 00 00 00  ....|...........
7c98a47340  01 41 00 00 00 00 b3 ff 00 00 00 00 00 00 00 00  .A..............
7c98a47350  74 68 67 77 a3 51 ff 7f 00 72 00 00 00 00 00 00  thgw.Q...r......
7c98a47360  01 81 00 00 00 00 d6 04 00 00 00 00 00 00 00 00  ................
7c98a47370  60 1c a3 08 7c 00 00 b4 65 72 00 00 00 00 00 00  `...|...er......
7c98a47380  01 81 00 00 00 00 49 77 00 00 00 00 00 00 00 00  ......Iw........
7c98a47390  20 25 a3 08 7c 00 00 b4 00 00 00 00 00 00 00 00   %..|...........
7c98a473a0  01 40 00 00 00 00 e7 c8 00 00 00 00 00 00 00 00  .@..............
7c98a473b0  0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
7c98a473c0  01 80 00 00 00 00 e6 c9 00 00 00 00 00 00 00 00  ................
             0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F  0123456789ABCDEF
7cc8a65a90  35 31 32 30 30 34 30 32 38 38 31 65 61 37 63 33  51200402881ea7c3
7cc8a65aa0  39 63 35 64 35 30 31 37 63 33 39 64 31 34 33 61  9c5d5017c39d143a
7cc8a65ab0  38 30 36 32 62 00 00 00 00 00 00 00 00 00 00 00  8062b...........
7cc8a65ac0  03 81 02 00 00 00 64 25 00 00 00 00 00 00 00 00  ......d%........
7cc8a65ad0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
7cc8a65ae0  88 19 a3 08 7c 00 00 b4 01 00 00 00 00 00 00 00  ....|...........
7cc8a65af0  f0 5a a4 82 7b 00 00 00 00 00 00 00 00 00 00 00  .Z..{...........
7cc8a65b00  03 81 02 00 00 00 46 b1 00 00 00 00 00 00 00 00  ......F.........
7cc8a65b10  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
7cc8a65b20  50 c0 a3 c8 7c 00 00 00 01 00 00 00 00 00 00 00  P...|...........
7cc8a65b30  f0 cc a2 f8 7b 00 00 b4 00 00 00 00 00 00 00 00  ....{...........
7cc8a65b40  03 81 02 00 00 00 22 4b 00 00 00 00 00 00 00 00  ......"K........
7cc8a65b50  18 ae 33 71 00 00 00 00 30 ae 33 71 00 00 00 00  ..3q....0.3q....
7cc8a65b60  34 ae 33 71 00 00 00 00 38 ae 33 71 00 00 00 00  4.3q....8.3q....
7cc8a65b70  a0 b1 33 71 00 00 00 00 00 00 00 00 00 00 00 00  ..3q............
7cc8a65b80  03 81 02 00 00 00 8f 45 00 00 00 00 00 00 00 00  .......E........
~~~

signDigital参数定位，点进去交叉引用

![image-20260704100221500](./upload/attach/202607/1043807_EHYZ47DWU3M5SAD.png)

![image-20260704100257094](./upload/attach/202607/1043807_WXTDGGHRA6EBSN4.png)

是一个native的函数，看到上面vmp调用特挺感慨的

![image-20260704133734183](./upload/attach/202607/1043807_RW2VW93SHG4W256.png)

看一下so,发现加密了，dump修一下

![image-20260704134033428](./upload/attach/202607/1043807_SAKV3B6G3QHZJVR.png)

修好之后看一下静态函数

~~~
__int64 __fastcall Java_cn_legym_ai_util_Rengis_hs(JNIEnv *a1, __int64 a2, void *a3)
~~~

定位返回地址，可以看到是一个sha1符号都没有去

~~~
return SHA1::finalize(v23);
~~~

看到这一行很可能是进行一下加盐的操作，然后代码点进去发现还是加密的，所以直接hook SHA1 *__fastcall SHA1::finalize(SHA1 *this)

~~~
    v13 = sub_58560(v10);
    v14 = sub_583E0(&v29, v10, v13);
    sub_583E0(v14, "itauVfnexHiRigZ6", 16);
    sub_59BE0(v26, (char *)&v29 + 8);
~~~

~~~
function so(){
    var module = Process.getModuleByName("libsportaction.so").base
    Interceptor.attach(module.add(0xA4B70),{
        onEnter:function (args){
            console.log(hexdump(args[0]))
            this.arg0 = args[0]
        },
        onLeave:function (retval){
            console.log(hexdump(this.arg0))
        }
    })
}
~~~

然后在内存中看见了明文，账号+密码+“1”+”itauVfnexHiRigZ6“，然后sha1

~~~
7fcc6eb410  aa 03 6e f3 91 23 35 80 96 16 67 00 69 0d 8b ba  ..n..#5...g.i...
7fcc6eb420  b6 ce f6 a0 31 38 31 38 37 34 35 38 38 34 35 78  ....18187458845x
7fcc6eb430  78 73 73 73 76 31 69 74 61 75 56 66 6e 65 78 48  xsssv1itauVfnexH
7fcc6eb440  69 52 69 67 5a 36 80 00 00 00 00 00 00 00 00 00  iRigZ6..........
~~~

~~~
\"password\":\"gdxghyff\",\"phone\":\"18281111111\",\"signDigital\":\"3e4a8ce6b2a6dfc43f32bfcd2619f2af1ffa0631\"
~~~

![image-20260704142855866](./upload/attach/202607/1043807_RT6EAQ4A46E7CT2.png)

请求一下，成功获得数据，而且后面也带了一个时间戳，猜一下加密和解密一样的逻辑，并且也进行了验证

![image-20260704143316898](./upload/attach/202607/1043807_96YJPCND935JZT2.png)

###### 跑步协议

先看请求体

~~~
headers = {
    'User-Agent': 'okhttp/4.8.1',
    'Content-Type': 'application/json',
    'charset': 'UTF-8',
    'authorization': 'Bearer 02f80b80-8dae-4788-ada0-XXXXX', 这个是服务器返回
}

json_data = {
    'appVersion': '3.10.3',
    'avePace': 443465.0,
    'calorie': 40,
    'deviceType': 'Xiaomi M2011K2C',
    'effectiveMileage': 0.0,
    'effectivePart': 1,
    'endTime': '2026-07-02 23:25:34',
    'endTimeDate': 1783005934060,
    'gpsMileage': 0.6679,
    'keepTime': 296,
    'limitationsGoalsSexInfoId': '8a9780927c6fae4d017c971460ad1508',
    'oct': 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX',跑步数据也是一个aes
    'paceNumber': 0,
    'paceRange': 0,
    'routineLine':[],
    'scoringType': 1,
    'semesterId': '8a97806d9cf68025019cfafbb22b0959',
    'signDigital': 'e1d7de5f8d71fd51882927656f18bf49393258e2',就是上面那个sha1，参数就是这里面的一些内容拼的串
    'signPoint': [],
    'signTime': '2026-07-02 23:25:44',时间签名
    'startTime': '2026-07-02 23:20:25',
    'systemVersion': '16',
    'totalMileage': 0.6679,
    'totalPart': 0.0,
    'type': '范围跑',
    'uneffectiveReason': '非规定时间内运动',
}
~~~

~~~
signDigital = '4.01' + startTime + '' + kill + '' + ap + '' + kt + '0' + mileage + 'itauVfnexHiRigZ6'
~~~

~~~
oct不看了
~~~

signTime定位，太久了忘了，不过基本操作应该都是hook跑步数据的构造函数，和set函数，以前一层一层跟的，这里直接给出答案了

~~~
     if ( strptime(s, "%Y-%m-%d %H:%M:%S", &tp) )
          {
            v21 = mktime(&tp);
            if ( v21 )
              v19 = 1000 * v21;
          }
          v91 = a5;
          s_3 = malloc(0x14u);
          if ( !s_3 )
          {
            fwrite("Memory allocation failed\n", 0x19u, 1u, stderr);
            exit(1);
          }
          s_1 = s_3;
          *&tp.tm_sec = (v19 + 1000 * (v16 % 11)) / 1000;
          tp_1 = localtime(&tp.tm_sec);
          strftime(s_1, 0x14u, "%Y-%m-%d %H:%M:%S", tp_1);
          v25 = *a1;
          v26 = __strlen_chk(s_1, 0x14u);
          v27 = v25->FindClass(a1, "java/lang/String");
          v28 = v25->NewStringUTF(a1, "UTF-8");
          v29 = v25->GetMethodID(a1, v27, "<init>", "([BLjava/lang/String;)V");
          v30 = v25->NewByteArray(a1, v26);
          v25->SetByteArrayRegion(a1, v30, 0, v26, s_1);
          v31 = v25->NewObject(a1, v27, v29, v30, v28);
          v32 = (*a1)->GetFieldID(a1, v10, "signTime", "Ljava/lang/String;");
          (*a1)->SetObjectField(a1, v92, v32, v31);
          (*a1)->ReleaseStringUTFChars(a1, v17, s_2);
~~~

直接还原，大概就是这样了

~~~
def getSianTime(end_time, keep_time):
    end_time = time.strptime(end_time, "%Y-%m-%d %H:%M:%S")
    sign_time = (time.mktime(end_time) + 1000 * (keep_time % 11) / 1000)
    return time.strftime("%Y-%m-%d %H:%M:%S", time.localtime(sign_time))
~~~

看下效果，非常的nice

![image-20260704152042444](./upload/attach/202607/1043807_KPVXHNNKR8TPSGR.png)

总结就是，aes密钥下沉到so,结果加密还是通过java库函数进行，导致极其容易定位emmmmm，还有就是so有frida检测不过好像只有maps的，保存一份好的替换一下就行了

~~~
function anti() {
    var open = Module.getGlobalExportByName("open");
    var openat = Module.getGlobalExportByName("openat");
    var fakeMaps = "/data/local/tmp/maps";
    var redirect = function (args, pathIndex) {
        var path = ptr(args[pathIndex]).readCString()
        if (path && path.indexOf("/maps") !== -1 && path.indexOf("proc") !== -1) {
            console.log("[*] Detected maps check: " + path);
            console.log("    -> Redirecting to: " + fakeMaps);
            var fakePathPtr = Memory.allocUtf8String(fakeMaps);
            args[pathIndex] = fakePathPtr;
        }
    }
    if (open) {
        Interceptor.attach(open, {
            onEnter: function (args) {
                redirect(args, 0);
            }
        });
    }
    if (openat) {
        Interceptor.attach(openat, {
            onEnter: function (args) {
                redirect(args, 1);
            }
        });
    }
}
~~~

完结，点点赞有问尽量回答

回复或点赞可查看完整内容

传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！！

最新回复 (62) 1 2 3 ▶
OverCL0ck 雪币： 33 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 15 粉丝 0 关注私信	OverCL0ck 2 楼 1 2026-7-4 16:04 0
mb_elqwyvnm 雪币： 2697 活跃值： (3393) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 164 粉丝 0 关注私信	mb_elqwyvnm 3 楼 2333 2026-7-4 16:13 0
温泉划水鱼雪币： 94 能力值： ( LV1，RANK：0 ) 在线值：发帖 6 回帖 226 粉丝 28 关注私信	温泉划水鱼 4 楼 1 2026-7-4 16:32 0
欲拭泪雪币： 21 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 3 粉丝 0 关注私信	欲拭泪 5 楼 simplHook工具是？ 2026-7-4 19:10 0
lingyi223 雪币： 1107 活跃值： (3355) 能力值： ( LV4，RANK：40 ) 在线值：发帖 6 回帖 35 粉丝 11 关注私信	lingyi223 6 楼欲拭泪 simplHook工具是？ 286K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6D9K9i4c8@1L8r3g2i4K9r3W2@1k6f1c8#2j5$3E0Q4x3V1k6e0K9h3#2H3L8r3g2t1L8$3!0C8 2026-7-4 20:44 0
ldehua 雪币： 158 活跃值： (2726) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 111 粉丝 0 关注私信	ldehua 7 楼为你点赞！ 2026-7-4 20:49 1
mb_wqvhhpxn 雪币： 0 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 10 粉丝 0 关注私信	mb_wqvhhpxn 8 楼学习 2026-7-6 09:58 0
回忆呵呵雪币： 263 活跃值： (1565) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 22 粉丝 0 关注私信	回忆呵呵 9 楼支持一下 2026-7-6 11:05 0
随风而行aa 雪币： 7769 活跃值： (25189) 能力值： ( LV12，RANK：550 ) 在线值：发帖 39 回帖 429 粉丝 1586 关注私信	随风而行aa 10 10 楼看看 2026-7-6 11:12 0
4Chan 雪币： 375 活跃值： (4087) 能力值： ( LV3，RANK：30 ) 在线值：发帖 9 回帖 202 粉丝 12 关注私信	4Chan 11 楼学习一下 2026-7-6 13:48 0
shuyangzjg 雪币： 8892 活跃值： (5041) 能力值： ( LV2，RANK：10 ) 在线值：发帖 2 回帖 256 粉丝 2 关注私信	shuyangzjg 12 楼看看 2026-7-6 14:42 0
iBa0 雪币： 1901 活跃值： (5873) 能力值： ( LV4，RANK：40 ) 在线值：发帖 6 回帖 483 粉丝 37 关注私信	iBa0 13 楼 123 2026-7-6 20:23 0
mb_rztmbvgb 雪币： 4 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 51 粉丝 0 关注私信	mb_rztmbvgb 14 楼 12 2026-7-7 01:24 0
Imxz 雪币： 110 活跃值： (9496) 能力值： ( LV2，RANK：10 ) 在线值：发帖 6 回帖 760 粉丝 9 关注私信	Imxz 15 楼 tql 2026-7-7 16:11 0
mb_qimctavn 雪币： 5298 活跃值： (6720) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 395 粉丝 1 关注私信	mb_qimctavn 16 楼 6 2026-7-8 08:30 0
九黎雪币： 51 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 92 粉丝 0 关注私信	九黎 17 楼 tql 2026-7-8 09:13 0
console_ 雪币： 675 能力值： ( LV1，RANK：0 ) 在线值：发帖 1 回帖 64 粉丝 8 关注私信	console_ 18 楼 tql 2026-7-8 09:15 0
大胖狗雪币： 222 能力值： ( LV1，RANK：0 ) 在线值：发帖 1 回帖 1 粉丝 0 关注私信	大胖狗 19 楼 tql 2026-7-8 19:01 0
吾苏同在雪币： 578 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 12 粉丝 0 关注私信	吾苏同在 20 楼感谢分享 2026-7-9 07:19 0
wx_kx92911 雪币： 0 活跃值： (360) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 63 粉丝 0 关注私信	wx_kx92911 21 楼感谢分析 2026-7-9 09:51 0
mb_rbaigqfb 雪币： 206 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 27 粉丝 0 关注私信	mb_rbaigqfb 22 楼感谢分析 2026-7-9 10:58 0
mb_ajxntfzc 雪币： 3184 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 47 粉丝 0 关注私信	mb_ajxntfzc 23 楼 666 2026-7-10 05:44 0
yuanyouran 雪币： 287 活跃值： (3105) 能力值： ( LV2，RANK：10 ) 在线值：发帖 5 回帖 184 粉丝 0 关注私信	yuanyouran 24 楼 666 2026-7-10 08:44 0
hanjiefang 雪币： 219 能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 120 粉丝 0 关注私信	hanjiefang 25 楼 666 2026-7-10 16:23 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复