安卓逆向 | JEB静态分析APK

.field public static final indexPath:String = "/api/movie"

package com.goldze.mvvmhabit.data.source.http.service;

import io.reactivex.Observable;import retrofit2.http.GET;import retrofit2.http.Query;

public interface MovieApiService {    public static final String indexPath = "/api/movie";

    @GET("/api/movie")    Observable index(@Query("offset") int arg1, @Query("limit") int arg2, @Query("token") String arg3);}

    public Observable index(int arg3, int arg4) {        ArrayList v1 = new ArrayList();        v1.add("/api/movie");        String v0 = Encrypt.encrypt(v1);        return this.apiService.index((arg3 - 1) * arg4, arg4, v0);    }}

package com.goldze.mvvmhabit.utils;

import android.text.TextUtils;import android.util.Base64;import java.security.MessageDigest;import java.security.NoSuchAlgorithmException;import java.sql.Timestamp;import java.util.ArrayList;import java.util.List;

public class Encrypt {    public static String bytes2Hex(byte[] arg5) {        String v0 = "";        int v1;        for(v1 = 0; v1 < arg5.length; ++v1) {            String v2 = Integer.toHexString(arg5[v1] & 0xFF);            if(v2.length() == 1) {                v0 = v0 + "0";            }

            v0 = v0 + v2;        }

        return v0;    }

    public static String encrypt(List arg4) {        String v0 = String.valueOf(new Timestamp(System.currentTimeMillis()).getTime() / 1000L);  // 时间戳        arg4.add(v0);  // arg4 = ['/api/movie','时间戳']        String v4 = Encrypt.shaEncrypt(TextUtils.join(",", arg4)); // 字符串拼接后加密        ArrayList v1 = new ArrayList();        v1.add(v4);        v1.add(v0);  // v1 = [sha1(v4),‘时间戳’]        return Base64.encodeToString(TextUtils.join(",", v1).getBytes(), 0); // return base64((v4,时间戳)) , 0表示没有任何标志位    }

    public static String shaEncrypt(String arg1) {  // sha1加密        try {            MessageDigest v0 = MessageDigest.getInstance("SHA-1");            v0.update(arg1.getBytes());            return Encrypt.bytes2Hex(v0.digest());        }        catch(NoSuchAlgorithmException unused_ex) {            return null;        }    }}

import hashlibimport base64import timeimport requests

url = "https://xxx/api/movie/?offset={offset}&limit={limit}&token={token}"

offset = 0limit = 100v4 = ['/api/movie']

def gen_token(v4):    timestamp = str(int(time.time()))    v4.append(timestamp)

    str_sha = hashlib.sha1(','.join(v4).encode('utf-8')).hexdigest()    str_bases = base64.b64encode(','.join([str_sha,timestamp]).encode('utf-8')).decode('utf-8')    return str_bases

token = gen_token(v4)

url = url.format(offset=offset,limit=limit,token=token)

res = requests.get(url)print(res.text)# print(url)

# print(gen_token(v4))