针对ApiCloud框架应用HJZ Token分析

Lunction

名称: HJZ Token
> 类型: ApiCloud
> 环境: 雷电3.7.2
> 工具: Xposed+Uzmap Dump
> 抓包: HTTP Debugger Pro
> 推荐: Charles+Postern
> 作者: Lunction
> Q Q: 46660816

01.抓APP应用数据:

POST /api/app.php HTTP/1.1
Cookie: COR_ID=b93f21d56b8f212fac2a1c2dc83635522ec5438b; COR_ID=b93f21d56b8f212fac2a1c2dc83635522ec5438b;
Charset: UTF-8
User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; f100 Build/LYZ28N) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/39.0.0.0 Mobile Safari/537.36
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Host: hjz-coin.com
Accept-Encoding: gzip, deflate
Content-Length: 508

{"model":"user","action":"login","remember":1,"devicename":"gionee+f100","progress":true,"username":"13800138000","password":"a123456","mobile_code":"","phone_code":"","mobile_phone":"","":"登录","deviceid":"865166020436278","os":"android","version":"5.2.2","appid":"20161027"}

02.查看APK文件结构

1. 关键文件 : uzmap,widget

2. 打开文件 : 发现乱码

3. 推荐工具 Xposed +Uzmap Dump(xp插件)

4.导出文件到电脑桌面

4.验证文件是否解密

03.查找SIGN加密参数

04.验证sign结果对比

05.遇到坑点:

• HTTP Debugger Pro抓包

devicename":"gionee+f100"

• Charles抓包

devicename":"gionee f100"

• MD5加密参数有中文!!!
• APP检测xposed框架[重点]

Hwak

zenghuan 发表于 2020-8-30 12:07
Uzmap Dump(xp插件)
插件有吗？

[原创]APICloud解密本地资源到逆向APP算法到通用资源解密https://bbs.pediy.com/thread-249457-1.htm

zenghuan

Uzmap Dump(xp插件)
插件有吗？

shayxr1314

收̶到̶收̶到̶

shayxr1314

收̶到̶

shayxr1314

我̶擦̶

okeyzero

学到了 顶你个肺