记某APP登录逆向解密过程

#启动adb服务adb start-server#安装目标APPadb install 目标app.ap

import hashlib

md5 = hashlib.md5()md5.update(b"123456")print(md5.hexdigest())

adb shellsucd /data/local/tmp/ls./frida-server-16.1.7-an

import subprocess subprocess.getoutput("adb forward tcp:27042 tcp:27042")subprocess.getoutput("adb forward tcp:27043 tcp:27043")

getIMEI(context)                          # 手机的IMEIHiAnalyticsConstant.REPORT_VAL_SEPARATOR  # 固定的字符串就是 | System.nanoTime()                         # 手机开机时间 HiAnalyticsConstant.REPORT_VAL_SEPARATOR  # 固定的字符串就是 | SPUtils.getDeviceId()                     # 设备id号

public static String getIMEI(Context context) {    if (PermissionsCheckerUtil.hasReadPhoenStatePermission(context)) {        String imei = SPUtils.getIMEI();  # 从xml中 读取 SharedPreference中读取，一开始没有        if (imeiIsNull(imei)) {# 手机设备id和网卡的mac地址混合得到一个串            imei = ((TelephonyManager) context.getSystemService("phone")).getDeviceId();            if (imeiIsNull(imei)) {                String macAddress = ((WifiManager) context.getSystemService(NetworkUtil.NETWORK_TYPE_WIFI)).getConnectionInfo().getMacAddress();                if (macAddress != null) {                    try {                    } catch (UnsupportedEncodingException e) {                        e.printStackTrace();                        # 如果手机拿不到网卡信息，就返回一个随机uuid                        # return UUID.randomUUID().toString();

                        context = getIMEIbyAndroidIDandUUID(context);                    }                    if (macAddress.length() > 0 && !isInBlackList(macAddress)) {                        context = UUID.nameUUIDFromBytes(macAddress.getBytes("utf8")).toString();                        imei = context;                    }                }                # 获取随机uuid                context = getIMEIbyAndroidIDandUUID(context);                imei = context;            }            if (!imeiIsNull(imei)) {                SPUtils.saveIMEI(imei); # 只要生成过以后，以后直接放到SharedPreference中xml中            }        }        return imei;    }    return "sssss";}

import randomnano_time = random.randint(5136066335773,7136066335773)

public static String getDeviceId() {        return getSpUtil().getString(KEY_DEVICE_ID, "");    }

#这个值经过测试发现是固定的，向后端发送请求：/tradercloud/v100/push/regdevice.ashx 拿回来存入的

appapiche168comappapiche168comap

# pip install pycryptodomeimport base64from Crypto.Cipher import DES3

BS = 8pad = lambda s: s + (BS - len(s) % BS) * chr(BS - len(s) % BS)

# 3DES的MODE_CBC模式下只有前24位有意义key = b'appapiche168comappapiche168comap'[0:24]iv = b'appapich'

plaintext = pad("cf15599b-5e93-3be5-a705-a39403227dfd|13359325995159|366586").encode("utf-8")

# 使用MODE_CBC创建ciphercipher = DES3.new(key, DES3.MODE_CBC, iv)result = cipher.encrypt(plaintext)res = base64.b64encode(result)print(res)

treeMap.put("_sign", SignManager.INSTANCE.signByType(i, treeMap));

import hashlib

def md5(data_string):    obj = hashlib.md5()    obj.update(data_string.encode('utf-8'))    return obj.hexdigest()

data = "W@oC!AH_6Ew1f6%8"

data_dict = {    "_appid": "atc.android",    "appversion": "3.37.0",    "channelid": "csy",    "pwd": "e10adc3949ba59abbe56e057f20f883e",    "udid": "fBricFHfQGIN%2Bam5jCTzG5yze/fO/pLP%2BIZgbuZKaGN0HiRwd1IPVQeCzaqV QpGO0zsKKfLxUlSpiG6FGQaNxA==",    "username": "13111111111"}

result = "".join(["{}{}".format(key, data_dict[key]) for key in sorted(data_dict.keys())])

un_sign_string = f"{data}{result}{data}"sign = md5(un_sign_string).upper()print(sign)

文章来源：先知社区（小*咔）原文地址：https://xz.aliyun.com/t/14306