飞客茶馆IHG APP HmacSHA256 算法分析

小范q

PS：APP 提供来源
app 下载 地址：
http://sj.qq.com/myapp/detail.htm?apkName=com.ideal.flyerteacafes

app 提供来源：
https://bbs.125.la/forum.php?mod=viewthread&tid=14222184&highlight=APP


第一步 抓登陆抓包：

1. POST /api/mobile/index.php?version=4&mobile=yes&cookietime=2592000&module=login&loginsubmit=yes&loginfield=auto&appkey=98bf6a79892a1148a1&token=MHwxNTM1MTI2NDQyODY1fDI3ZTEwY2IwMzJkZWVhYzc1ZThjMjcxYzQ3MTViODkwZWRiYWFiZTIyNTM2OTkzM2E1ZWRjNGM5MzNmOTM0Y2U%253D&appversion=6.24.0&transcode=yes HTTP/1.1
   
2. Cookie: cu3z_a47d_saltkey=m93mC04o; cu3z_a47d_uacc=9BDCDB5AC04DB852; cu3z_a47d_lastvisit=1535121212; cu3z_a47d_dismobilemessage=1; cu3z_a47d_nofavfid=1; cu3z_a47d_lastviewtime=0%7C1535125812; acw_tc=AQAAAGMZC0HSRAsADIhP2jtOmVhBTAPH; cu3z_a47d_mobile=2; cu3z_a47d_lastact=1535126355%09index.php%09
   
3. User-Agent: FKForum/6.24.0 (oppo oppo a59m; Android 5.1.1; Scale/540*960)
   
4. Content-Type: application/x-www-form-urlencoded;charset=UTF-8
   
5. Content-Length: 91
   
6. Host: www.flyertea.com
   
7. Connection: Keep-Alive
   
8. Accept-Encoding: gzip
   
9. 
   
10. username=13812345678&password=1234567890&Registrationid=1507bfd3f79390d77af&loadCache=false

复制代码

第二步 分析加密主要参数：

token=MHwxNTM1MTI2NDQyODY1fDI3ZTEwY2IwMzJkZWVhYzc1ZThjMjcxYzQ3MTViODkwZWRiYWFiZTIyNTM2OTkzM2E1ZWRjNGM5MzNmOTM0Y2U%253D


第三步 反编译逆向找到其主要算法

1. --------------------------------------------------------------------------------------------------------------------------
   
2.    private void usernameLogin(String arg5, String arg6) {
   
3.         this.getDialog().proDialogShow();
   
4.         XutilsHelp.clearCookie();
   
5.         FlyRequestParams v1 = new FlyRequestParams(HttpRequest.HTTP_login);
   
6.         v1.addQueryStringParameter("transcode", "(TV;)V");
   
7.         v1.addBodyParameter("username", arg5);
   
8.         v1.addBodyParameter("password", arg6);
   
9.         v1.addBodyParameter("Registrationid", JPushInterface.getRegistrationID(FlyerApplication.getContext()));
   
10.         XutilsHttp.Post(v1, new StringCallback() {
    
11.             public void flySuccess(Object arg1) {
    
12.                 this.flySuccess(((String)arg1));
    
13.             }
    
14. 
    
15.             public void flySuccess(String arg4) {
    
16.                 if(LoginVideoPresenter.this.isViewAttached()) {
    
17.                     Logger.i("<+TE;>;>;)", new Object[0]);
    
18.                     if(JsonAnalysis.isSuccessEquals1(arg4)) {
    
19.                         LoginVideoPresenter.this.loginInit(JsonAnalysis.getBean(arg4, LoginBase.class));
    
20.                     }
    
21.                     else {
    
22.                         ToastUtils.showToast(JsonAnalysis.getMessage(arg4));
    
23.                         LoginVideoPresenter.this.getDialog().proDialogDissmiss();
    
24.                     }
    
25.                 }
    
26.             }
    
27.         });
    
28.     }
    
29. ------------------------------------------------------------------------------------------------------------------
    
30. public class FlyRequestParams extends RequestParams {
    
31.     private boolean loadCache;
    
32. 
    
33.     public FlyRequestParams(String arg11) {
    
34.         super(arg11);
    
35.         this.loadCache = false;
    
36.         String v4 = UserManger.isLogin() ? UserManger.getUserInfo().getMember_uid() + ", locaPath=\'" + DateUtil.getDateline() : "0|" + DateUtil.getDateline();
    
37.         String v3 = StringTools.encodeBase64(v4 + ", locaPath=\'" + HmacSha256.getSignature(v4, "feb0e9a398bf6a79892a114825316a93").getBytes());
    
38.         this.addQueryStringParameter("appkey", "98bf6a79892a1148a1");
    
39.         this.addQueryStringParameter("token", v3);
    
40.         this.addQueryStringParameter("appversion", Tools.getVersion());
    
41.         String v0 = UserManger.getCookie();
    
42.         if(!TextUtils.isEmpty(((CharSequence)v0))) {
    
43.             this.addHeader("Cookie", v0);
    
44.         }
    
45. 
    
46.         Object v2 = FlyerApplication.getContext().getSystemService("÷");
    
47.         this.addHeader("User-Agent", "FKForum/" + Tools.getVersion() + " (" + Build.BRAND + " " + Build.MODEL + "; Android " + Build$VERSION.RELEASE + "; Scale/" + ((WindowManager)v2).getDefaultDisplay().getWidth() + "*" + ((WindowManager)v2).getDefaultDisplay().getHeight() + ") ");
    
48.     }
    
49. ------------------------------------------------------------------------------------------------------------------
    
50.     public static long getDateline() {
    
51.         return System.currentTimeMillis();
    
52.     }
    
53. ------------------------------------------------------------------------------------------------------------------
    
54.     public static String getSignature(String arg7, String arg8) {
    
55.         Mac v3;
    
56.         SecretKeySpec v5 = new SecretKeySpec(arg8.getBytes(), "HmacSHA256");
    
57.         try {
    
58.             v3 = Mac.getInstance("HmacSHA256");
    
59.             v3.init(((Key)v5));
    
60.         }
    
61.         catch(InvalidKeyException v0) {
    
62.             v0.printStackTrace();
    
63.         }
    
64.         catch(NoSuchAlgorithmException v0_1) {
    
65.             v0_1.printStackTrace();
    
66.         }
    
67. 
    
68.         return HmacSha256.byte2hex(v3.doFinal(arg7.getBytes()));
    
69.     }
    

复制代码

第四步 算法总结

Token = Base64En(v1 + ", locaPath=\'" + HmacSha256(v1, key));

PS:
① 【
v1 = UserManger.isLogin() ? UserManger.getUserInfo().getMember_uid() + ", locaPath=\'" + DateUtil.getDateline() : "0|" + DateUtil.getDateline();
简言之 当APP处于登陆状态：  
                 v1 = uid +  ", locaPath=\'" + 现行13位时间戳();
              未登录状态 ：
                 v1 = "0|" + 现行13位时间戳();
】

② key = "feb0e9a398bf6a79892a114825316a93";


第五步 算法移植

js 移植见附件

js移植.rar (3.69 KB, 下载次数: 90)

2018-8-25 00:41 上传

点击文件名下载附件

yulanlove77

算法移植

yulanlove77

算法移植

ilvjyw

感谢分享 谢谢大佬

yz0515zyp

看看能用不

A1652302901

支持，感谢楼主

akaven

支持下，给了这么多的例子和答案，谢谢

vmp360

谢谢楼主  

脚本定制专员

列害感谢分享

woshiyezhen

学习了，不错。。。