驾校宝典的Login数据分析

Lunction

1. POST https://auth.mucang.cn/api/open/v2/login/submit.htm?_platform=android&_srv=t&_appName=jiaolianbaodian&_product=%E6%95%99%E7%BB%83%E5%AE%9D%E5%85%B8&_vendor=myapp&_renyuan=YW&_version=7.3.6&_system=MRA58K&_manufacturer=LGE&_systemVersion=6.0&_device=Nexus%205&_imei=359125051738526&_productCategory=jiaolianbaodian&_operator=&_androidId=1bcbe8011e668a1f&_mac=cc%3Afa%3A00%3Ae9%3A2e%3A82&_appUser=21299766641a4b88b4dee4c645988f77&_pkgName=com.handsgo.jiakao.android.kehuo&_screenDpi=3.0&_screenWidth=1080&_screenHeight=1776&_network=wifi&_launch=7&_firstTime=2018-06-24%2011%3A40%3A07&_apiLevel=23&_userCity=&_p=&_gpsType=gcj&_cityName=%E9%87%8D%E5%BA%86%E5%B8%82&_cityCode=500000&_gpsCity=500000&_longitude=108.164498&_latitude=29.290712&_j=1.0&schoolName=&schoolCode=&_webviewVersion=4.7&_mcProtocol=4.0&_r=6de189b305ae49c4913b9be0677efde6&sign=11517d35fc2c3c26e457f4fe5b573d8e01 HTTP/1.1
   
2. User-Agent: Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58K; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/44.0.2403.117 Mobile Safari/537.36
   
3. Accept-Encoding: gzip
   
4. Accept-Encoding: tnpn4
   
5. Content-Type: application/x-www-form-urlencoded
   
6. Content-Length: 107
   
7. Host: auth.mucang.cn
   
8. Connection: Keep-Alive
   
9. 
   
10. phoneNumber=13046615888&password=dc483e80a7a0bd9ef71d8cf973673924&from=%E6%95%99%E7%BB%83%E5%AE%9D%E5%85%B8
    
11. 
    
12. 
    
13. _appUser是随机生成的
    
14. _r=     是随机生成的
    
15. "_r=" + UUID.randomUUID().toString().replace("-", "")
    
16. 
    
17. sign:是md5,
    
18. md5Key:Kek1KYmFfxHyxNATAx
    
19. 
    
20. md5原文:
    
21. /api/open/v2/login/submit.htm?_platform=android&_srv=t&_appName=jiaolianbaodian&_product=%E6%95%99%E7%BB%83%E5%AE%9D%E5%85%B8&_vendor=myapp&_renyuan=YW&_version=7.3.6&_system=MRA58K&_manufacturer=LGE&_systemVersion=6.0&_device=Nexus%205&_imei=359125051738526&_productCategory=jiaolianbaodian&_operator=&_androidId=1bcbe8011e668a1f&_mac=cc%3Afa%3A00%3Ae9%3A2e%3A82&_appUser=21299766641a4b88b4dee4c645988f77&_pkgName=com.handsgo.jiakao.android.kehuo&_screenDpi=3.0&_screenWidth=1080&_screenHeight=1776&_network=wifi&_launch=7&_firstTime=2018-06-24%2011%3A40%3A07&_apiLevel=23&_userCity=&_p=&_gpsType=gcj&_cityName=%E9%87%8D%E5%BA%86%E5%B8%82&_cityCode=500000&_gpsCity=500000&_longitude=108.164498&_latitude=29.290712&_j=1.0&schoolName=&schoolCode=&_webviewVersion=4.7&_mcProtocol=4.0&_r=6de189b305ae49c4913b9be0677efde6Kek1KYmFfxHyxNATAx
    
22. 
    
23. md5后，未尾加上01即是sign值
    
24. 
    
25. 下面是hook的native方法
    
26. 06-24 13:42:37.156 8380-8426/? I/*** rcb ***: s para1： /api/open/v2/login/submit.htm?_platform=android&_srv=t&_appName=jiaolianbaodian&_product=%E6%95%99%E7%BB%83%E5%AE%9D%E5%85%B8&_vendor=myapp&_renyuan=YW&_version=7.3.6&_system=MRA58K&_manufacturer=LGE&_systemVersion=6.0&_device=Nexus%205&_imei=359125051738526&_productCategory=jiaolianbaodian&_operator=&_androidId=1bcbe8011e668a1f&_mac=cc%3Afa%3A00%3Ae9%3A2e%3A82&_appUser=21299766641a4b88b4dee4c645988f77&_pkgName=com.handsgo.jiakao.android.kehuo&_screenDpi=3.0&_screenWidth=1080&_screenHeight=1776&_network=wifi&_launch=7&_firstTime=2018-06-24%2011%3A40%3A07&_apiLevel=23&_userCity=&_p=&_gpsType=gcj&_cityName=%E9%87%8D%E5%BA%86%E5%B8%82&_cityCode=500000&_gpsCity=500000&_longitude=108.164498&_latitude=29.290712&_j=1.0&schoolName=&schoolCode=&_webviewVersion=4.7&_mcProtocol=4.0&_r=6de189b305ae49c4913b9be0677efde6
    
27. 06-24 13:42:37.156 8380-8426/? I/*** rcb ***: s para2： *#06#i3lrRYudcZZ2fIx9fI6VqJV8
    
28. 06-24 13:43:46.189 8380-8426/? D/*** rcb ***: s加密结果 = 11517d35fc2c3c26e457f4fe5b573d8e01
    
29. 
    
30. 
    

复制代码

duanyijun

内行看不上 外行看不懂

isoft168

以下连接的sign,是怎么加密的：
http://telepathy.kakamobi.com/api/open/v3/article/detail.htm?_platform=android&_srv=t&_appName=maichebaodian&_product=%E4%B9%B0%E8%BD%A6%E5%AE%9D%E5%85%B8&_vendor=myapp&_renyuan=YW&_version=3.12.2&_system=V417IR&_manufacturer=Netease&_systemVersion=6.0.1&_device=MuMu&_imei=008796755272739&_productCategory=qichebaojia&_operator=&_androidId=97e7fd5605c7418d&_deviceId=97e7fd5605c7418d&_mac=02%3A00%3A00%3A00%3A00%3A00&_appUser=f603f7fbc3e64859a6c18d05f0e1f6cc&_pkgName=com.baojiazhijia.qichebaojia&_screenDpi=1.4562501&_screenWidth=700&_screenHeight=1120&_network=wifi&_launch=2&_firstTime=2019-10-21%2012%3A11%3A04&_apiLevel=23&_userCity=110000&_p=&_ipCity=110100&_j=1.0&_webviewVersion=4.7&_mcProtocol=4.1&ttDna=0&localCityCode=0&_r=1e64be766c7142b8901f6267d2e415ac&ttVersion=7&articleId=1880152&carService=maiche&channelId=-3&incomingType=search&sign=e4eb8860fcfc34a9d4f037783453575501

补充内容 (2019-11-21 12:46):
已经不需要了，通过其它方式解决了加密的问题了

柚子阿

谢谢开源。

8858464

支持开源~！感谢分享

2466564159

感谢分享6666666

晓天信

v0.appendQueryParameter("sign", AppMD5.getSignMD5String(v0.build().getEncodedQuery()));
找到这一步就找不动；

晓天信

Lunction 发表于 2018-7-4 20:07
SO

so```` so怎么找··大佬不上个视频么

Lunction

晓天信 发表于 2018-7-4 20:06
_r=  找到了获取来源· 密码加密的MD5也找到了·
可是就是没找到sign的加密地方·！！！ 啊啊啊啊啊
找 ...

SO                     

晓天信

_r=  找到了获取来源· 密码加密的MD5也找到了·
可是就是没找到sign的加密地方·！！！ 啊啊啊啊啊
找了好几个地方 在JEB里面下断都没断下来

晓天信

_androidId=1bcbe8011e668a1f  请问下这个值是怎么来的？