Python反反爬虫 - Frida破解某安卓社区token反爬

2019-06-16 本文已影响0人 14e61d025165

不多逼逼，这个安卓社区就是酷安，以前想过要爬这软件，但是都忘了，几天前抓了下它的包，发现请求 headers 里有一个 token 验证，果断就给破了

分析过程

先抓个包

<tt-image data-tteditor-tag="tteditorTag" contenteditable="false" class="syl1560671328054" data-render-status="finished" data-syl-blot="image" style="box-sizing: border-box; cursor: text; color: rgb(34, 34, 34); font-family: "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei", "Helvetica Neue", Arial, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial; display: block;">

image

可以看到其中有个请求头 X-App-Token ，这就是验证，至于 X-App-Device这玩意儿应该是获取你手机信息的，不管它，先看看软件源代码，找到请求方法

1、jeb分析

没加固，好像也没混淆，舒服

<tt-image data-tteditor-tag="tteditorTag" contenteditable="false" class="syl1560671328059" data-render-status="finished" data-syl-blot="image" style="box-sizing: border-box; cursor: text; color: rgb(34, 34, 34); font-family: "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei", "Helvetica Neue", Arial, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial; display: block;">

image

搜索关键字： X-App-Token

<tt-image data-tteditor-tag="tteditorTag" contenteditable="false" class="syl1560671328063" data-render-status="finished" data-syl-blot="image" style="box-sizing: border-box; cursor: text; color: rgb(34, 34, 34); font-family: "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei", "Helvetica Neue", Arial, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial; display: block;">

image

很明显找到了我们要的东西了，(jeb3.0按tab键反编译)

<tt-image data-tteditor-tag="tteditorTag" contenteditable="false" class="syl1560671328068" data-render-status="finished" data-syl-blot="image" style="box-sizing: border-box; cursor: text; color: rgb(34, 34, 34); font-family: "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei", "Helvetica Neue", Arial, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial; display: block;">

image

这个 X-App-Token 是变量 v2_1，v2_1是，一个 AuthUtils 类里的 getAS 方法返回的

<tt-image data-tteditor-tag="tteditorTag" contenteditable="false" class="syl1560671328072" data-render-status="finished" data-syl-blot="image" style="box-sizing: border-box; cursor: text; color: rgb(34, 34, 34); font-family: "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei", "Helvetica Neue", Arial, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial; display: block;">

image <input class="pgc-img-caption-ipt" placeholder="图片描述(最多50字)" value="" style="box-sizing: border-box; outline: 0px; color: rgb(102, 102, 102); position: absolute; left: 187.5px; transform: translateX(-50%); padding: 6px 7px; max-width: 100%; width: 375px; text-align: center; cursor: text; font-size: 12px; line-height: 1.5; background-color: rgb(255, 255, 255); background-image: none; border: 0px solid rgb(217, 217, 217); border-radius: 4px; transition: all 0.2s cubic-bezier(0.645, 0.045, 0.355, 1) 0s;"></tt-image> <tt-image data-tteditor-tag="tteditorTag" contenteditable="false" class="syl1560671328075" data-render-status="finished" data-syl-blot="image" style="box-sizing: border-box; cursor: text; color: rgb(34, 34, 34); font-family: "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei", "Helvetica Neue", Arial, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial; display: block;">

image

跟进可以发现这是一个native方法，lib是native-lib

<tt-image data-tteditor-tag="tteditorTag" contenteditable="false" class="syl1560671328078" data-render-status="finished" data-syl-blot="image" style="box-sizing: border-box; cursor: text; color: rgb(34, 34, 34); font-family: "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei", "Helvetica Neue", Arial, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial; display: block;">

image

到这里就没法用jeb分析了，我们先看看参数2 deviceId 是个什么玩意儿

可以看到是一个 SystemUtils 类里的 getDeviceID 方法返回的，传入一个context参数

<tt-image data-tteditor-tag="tteditorTag" contenteditable="false" class="syl1560671328083" data-render-status="finished" data-syl-blot="image" style="box-sizing: border-box; cursor: text; color: rgb(34, 34, 34); font-family: "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei", "Helvetica Neue", Arial, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial; display: block;">

image

我们去app的application hook这个方法

<tt-image data-tteditor-tag="tteditorTag" contenteditable="false" class="syl1560671328086" data-render-status="finished" data-syl-blot="image" style="box-sizing: border-box; cursor: text; color: rgb(34, 34, 34); font-family: "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei", "Helvetica Neue", Arial, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial; display: block;">

image

我找到一个代码量最少的方法，这样可以帮助我们不破坏原逻辑的情况下hook

<tt-image data-tteditor-tag="tteditorTag" contenteditable="false" class="syl1560671328089" data-render-status="finished" data-syl-blot="image" style="box-sizing: border-box; cursor: text; color: rgb(34, 34, 34); font-family: "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei", "Helvetica Neue", Arial, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial; display: block;">

image

hook的代码很简单

    var deviceId = Java.use('com.coolapk.market.util.SystemUtils').getDeviceId(this);
    console.log('Device Id: ', deviceId);
    var app_token = Java.use('com.coolapk.market.util.AuthUtils').getAS(this, deviceId);
    console.log('App Token: ', app_token);
    console.log('----------');
    return 1;
}

})
复制代码
</pre>

拿到 deviceId 后分析so

ida分析

解压apk拿到 native-lib.so ，用ida打开

<tt-image data-tteditor-tag="tteditorTag" contenteditable="false" class="syl1560671328094" data-render-status="finished" data-syl-blot="image" style="box-sizing: border-box; cursor: text; color: rgb(34, 34, 34); font-family: "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei", "Helvetica Neue", Arial, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial; display: block;">

image

我们已知方法名和参数个数，那么就先搜索方法名

在 Function Window 按 option+t 搜索 getAS ，可以看到，毛都没有

<tt-image data-tteditor-tag="tteditorTag" contenteditable="false" class="syl1560671328098" data-render-status="finished" data-syl-blot="image" style="box-sizing: border-box; cursor: text; color: rgb(34, 34, 34); font-family: "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei", "Helvetica Neue", Arial, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial; display: block;">

image <input class="pgc-img-caption-ipt" placeholder="图片描述(最多50字)" value="" style="box-sizing: border-box; outline: 0px; color: rgb(102, 102, 102); position: absolute; left: 187.5px; transform: translateX(-50%); padding: 6px 7px; max-width: 100%; width: 375px; text-align: center; cursor: text; font-size: 12px; line-height: 1.5; background-color: rgb(255, 255, 255); background-image: none; border: 0px solid rgb(217, 217, 217); border-radius: 4px; transition: all 0.2s cubic-bezier(0.645, 0.045, 0.355, 1) 0s;"></tt-image> <tt-image data-tteditor-tag="tteditorTag" contenteditable="false" class="syl1560671328101" data-render-status="finished" data-syl-blot="image" style="box-sizing: border-box; cursor: text; color: rgb(34, 34, 34); font-family: "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei", "Helvetica Neue", Arial, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial; display: block;">

image

那我们就到 IDA View里搜索，快捷键一样

<tt-image data-tteditor-tag="tteditorTag" contenteditable="false" class="syl1560671328106" data-render-status="finished" data-syl-blot="image" style="box-sizing: border-box; cursor: text; color: rgb(34, 34, 34); font-family: "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei", "Helvetica Neue", Arial, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial; display: block;">

image

找到了这个，参数是两个，但这个不是方法，没法 F5 反编译

<tt-image data-tteditor-tag="tteditorTag" contenteditable="false" class="syl1560671328108" data-render-status="finished" data-syl-blot="image" style="box-sizing: border-box; cursor: text; color: rgb(34, 34, 34); font-family: "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei", "Helvetica Neue", Arial, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial; display: block;">

image

不瞒你们，这个DCB是个什么玩意儿我也不知道. 但是我在 Function Window瞎翻想找一些我能看得懂的方法名时看到了这个

<tt-image data-tteditor-tag="tteditorTag" contenteditable="false" class="syl1560671328112" data-render-status="finished" data-syl-blot="image" style="box-sizing: border-box; cursor: text; color: rgb(34, 34, 34); font-family: "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei", "Helvetica Neue", Arial, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial; display: block;">

image

我一看，这个方法好像和 getAS 有点关系就顺手 F5 了

简单看了看里面的代码,我估计我要找的是这个方法，为什么是这个方法而不是其他的

我分析了 X-App-Token 这个验证的组成，它长这样： f2c29a109fde487e9350d3e6b881036a8513efac-09ea-3709-b214-95b366f1a1850x5d024391

我之前就获取到了我的 Device Id，我无意间看到了我的 device id就在里面，然后我把它拆分成了这样：

f2c29a109fde487e9350d3e6b881036a
8513efac-09ea-3709-b214-95b366f1a185
0x5d024391

第一项很明显是md5密文，第二部分就是device id，最后是一个十六进制，不知道什么玩意儿，但我在那个 getAuthString 代码里看到了这段

<tt-image data-tteditor-tag="tteditorTag" contenteditable="false" class="syl1560671328117" data-render-status="finished" data-syl-blot="image" style="box-sizing: border-box; cursor: text; color: rgb(34, 34, 34); font-family: "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei", "Helvetica Neue", Arial, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial; display: block;">

image

这是一个字符串拼接的过程，其中 v82 是md5密文，也是字符串的头部，后面接着是 v43 （device id）、字符串0x、最后是 hex_time (这是我改了后的命名)，所以我就能确定这个方法就是我想要的；

上面说的也就是接下来要分析的，其中那个十六进制的东西就是时间戳，我们只需要分析出md5是怎么来的就行了，我们知道md5是 v61 ， v61 的加密代码在这

<tt-image data-tteditor-tag="tteditorTag" contenteditable="false" class="syl1560671328123" data-render-status="finished" data-syl-blot="image" style="box-sizing: border-box; cursor: text; color: rgb(34, 34, 34); font-family: "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei", "Helvetica Neue", Arial, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial; display: block;">

image

加密的内容是v58，v58是一个经过base64编码后的变量

<tt-image data-tteditor-tag="tteditorTag" contenteditable="false" class="syl1560671328125" data-render-status="finished" data-syl-blot="image" style="box-sizing: border-box; cursor: text; color: rgb(34, 34, 34); font-family: "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei", "Helvetica Neue", Arial, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial; display: block;">

image

我懒得去看它是什么了，我直接hook了md5加密类，有三个方法，一个是md5(应该是构造方法把)、update、finalize，hook 代码如下

var arg0, arg1, arg2, arg3
Interceptor.attach(pointer, {
        onEnter: function(args) {
            arg0 = args[0]
            arg1 = args[1]
            console.log('\n')
            console.log('=====> [MD5::MD5] -> [方法调用前]')
            console.log('参数1: {0} => {1}'.format(arg0, Memory.readCString(arg0))) // Memory.readCString 是读取地址为字符串，类似的还有readUtf8String、readUtf16String等
            console.log('参数2: {0} => {1}'.format(arg1, Memory.readCString(arg1)))
            console.log('\n')
        },
        onLeave: function(retval) {
            console.log('\n')
            console.log('=====> [MD5::MD5] -> [方法调用后]:')
            console.log('返回值: ', retval)
            console.log('参数1: {0} => {1}'.format(arg0, Memory.readCString(arg0)))
            console.log('参数2: {0} => {1}'.format(arg1, Memory.readCString(arg1)))
            console.log('\n')
        }
    }   
)

})
// MD5::update
Java.perform(function() {
var hookpointer = '0x' + parseInt(BASE_ADDR + parseInt('0x329AC')).toString(16) // 获取要hook方法的地址
var pointer = new NativePointer(hookpointer) // 根据方法地址构建NativePointer
console.log('[MD5::update] hook pointer: ', pointer)

var arg0, arg1, arg2, arg3
Interceptor.attach(pointer, {
        onEnter: function(args) {
            arg0 = args[0]
            arg1 = args[1]
            arg2 = args[2]
            console.log('\n')
            console.log('=====> [MD5::update] -> [方法调用前]')
            console.log('参数1: {0} => {1}'.format(arg0, Memory.readCString(arg0)))
            console.log('参数2: {0} => {1}'.format(arg1, Memory.readCString(arg1)))
            console.log('参数3: {0} => {1}'.format(arg2, Memory.readCString(arg2)))
            console.log('\n')
        },
        onLeave: function(retval) {
            console.log('\n')
            console.log('=====> [MD5::update] -> [方法调用后]:')
            console.log('返回值: ', retval)
            console.log('参数1: {0} => {1}'.format(arg0, Memory.readCString(arg0)))
            console.log('参数2: {0} => {1}'.format(arg1, Memory.readCString(arg1)))
            console.log('参数3: {0} => {1}'.format(arg2, Memory.readCString(arg2)))
            console.log('\n')
        }
    }   
)

})
// MD5::finalize
Java.perform(function() {
var hookpointer = '0x' + parseInt(BASE_ADDR + parseInt('0x321C4')).toString(16) // 获取要hook方法的地址
var pointer = new NativePointer(hookpointer) // 根据方法地址构建NativePointer
console.log('[MD5::finalize] hook pointer: ', pointer)
var arg0, arg1, arg2, arg3
Interceptor.attach(pointer, {
onEnter: function(args) {
arg0 = args[0]
arg1 = args[1]
arg2 = args[2]
arg3 = args[3]
console.log('\n')
console.log('=====> [MD5::finalize] -> [方法调用前]')
console.log('参数1: {0} => {1}'.format(arg0, Memory.readCString(arg0)))
console.log('参数2: {0} => {1}'.format(arg1, Memory.readCString(arg1)))
console.log('参数3: {0} => {1}'.format(arg2, Memory.readCString(arg2)))
console.log('参数4: {0} => {1}'.format(arg3, Memory.readCString(arg3)))
console.log('\n')
},
onLeave: function(retval) {
console.log('\n')
console.log('=====> [MD5::finalize] -> [方法调用后]:')
console.log('返回值: ', retval)
console.log('参数1: {0} => {1}'.format(arg0, Memory.readCString(arg0)))
console.log('参数2: {0} => {1}'.format(arg1, Memory.readCString(arg1)))
console.log('参数3: {0} => {1}'.format(arg2, Memory.readCString(arg2)))
console.log('参数4: {0} => {1}'.format(arg3, Memory.readCString(arg3)))
console.log('\n')
}
}
)
})
复制代码
</pre>

运行后得到了那个base64编码过的内容：

经过解码后：

在我看到这段代码后

<tt-image data-tteditor-tag="tteditorTag" contenteditable="false" class="syl1560671328141" data-render-status="finished" data-syl-blot="image" style="box-sizing: border-box; cursor: text; color: rgb(34, 34, 34); font-family: "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei", "Helvetica Neue", Arial, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial; display: block;">

image

上面解码后的内容可以拆分为：

token://com.coolapk.market/c67ef5943784d09750dcfbb31020f0ab?
3823215d91d29d9887ebc05f0d7fd30d
8513efac-09ea-3709-b214-95b366f1a185
com.coolapk.market

据我分析，只需要的到第二部分的md5加密的来历就行了，继续分析，找到了加密的地方

<tt-image data-tteditor-tag="tteditorTag" contenteditable="false" class="syl1560671328147" data-render-status="finished" data-syl-blot="image" style="box-sizing: border-box; cursor: text; color: rgb(34, 34, 34); font-family: "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei", "Helvetica Neue", Arial, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial; display: block;">

image

根据这图的画线，可以明确的知道这md5就是时间戳，在我hook的输出中也可以看到这个就是时间戳

<tt-image data-tteditor-tag="tteditorTag" contenteditable="false" class="syl1560671328150" data-render-status="finished" data-syl-blot="image" style="box-sizing: border-box; cursor: text; color: rgb(34, 34, 34); font-family: "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei", "Helvetica Neue", Arial, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial; display: block;">

image <input class="pgc-img-caption-ipt" placeholder="图片描述(最多50字)" value="" style="box-sizing: border-box; outline: 0px; color: rgb(102, 102, 102); position: absolute; left: 187.5px; transform: translateX(-50%); padding: 6px 7px; max-width: 100%; width: 375px; text-align: center; cursor: text; font-size: 12px; line-height: 1.5; background-color: rgb(255, 255, 255); background-image: none; border: 0px solid rgb(217, 217, 217); border-radius: 4px; transition: all 0.2s cubic-bezier(0.645, 0.045, 0.355, 1) 0s;"></tt-image> <tt-image data-tteditor-tag="tteditorTag" contenteditable="false" class="syl1560671328153" data-render-status="finished" data-syl-blot="image" style="box-sizing: border-box; cursor: text; color: rgb(34, 34, 34); font-family: "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei", "WenQuanYi Micro Hei", "Helvetica Neue", Arial, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; white-space: pre-wrap; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: rgb(255, 255, 255); text-decoration-style: initial; text-decoration-color: initial; display: block;">

image

至于 token://com.coolapk.market/c67ef5943784d09750dcfbb31020f0ab? 这个是不变的

结论

token://com.coolapk.market/c67ef5943784d09750dcfbb31020f0ab?+ md5加密后的时间戳 + $ + device id + & + com.coolapk.market (包名)，将其md5加密后得到 第一部分

token的来历就是：第一部分 + deivce id + 0x + 十六进制转换后的时间戳

简单的测试代码：

<pre spellcheck="false" style="box-sizing: border-box; margin: 5px 0px; padding: 5px 10px; border: 0px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-variant-numeric: inherit; font-variant-east-asian: inherit; font-weight: 400; font-stretch: inherit; font-size: 16px; line-height: inherit; font-family: inherit; vertical-align: baseline; cursor: text; counter-reset: list-1 0 list-2 0 list-3 0 list-4 0 list-5 0 list-6 0 list-7 0 list-8 0 list-9 0; background-color: rgb(240, 240, 240); border-radius: 3px; white-space: pre-wrap; color: rgb(34, 34, 34); letter-spacing: normal; orphans: 2; text-align: left; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-style: initial; text-decoration-color: initial;">import requests
import time
import hashlib
import base64
DEVICE_ID = "8513efac-09ea-3709-b214-95b366f1a185"
def get_app_token():
t = int(time.time())
hex_t = hex(t)
# 时间戳加密
md5_t = hashlib.md5(str(t).encode('utf-8')).hexdigest()
# 不知道什么鬼字符串拼接
a = 'token://com.coolapk.market/c67ef5943784d09750dcfbb31020f0ab?{}${}&com.coolapk.market'
.format(md5_t, DEVICE_ID)
# 不知道什么鬼字符串拼接后的字符串再次加密
md5_a = hashlib.md5(base64.b64encode(a.encode('utf-8'))).hexdigest()
token = '{}{}{}'.format(md5_a, DEVICE_ID, hex_t)
print(token)
return token
def request():
url = "https://api.coolapk.com/v6/main/indexV8?page=1"
headers = {
"User-Agent": "Dalvik/2.1.0 (Linux; U; Android 9; MI 8 SE MIUI/9.5.9) (#Build; Xiaomi; MI 8 SE; PKQ1.181121.001; 9) +CoolMarket/9.2.2-1905301"
}
headers = {
"User-Agent": "Dalvik/2.1.0 (Linux; U; Android 9; MI 8 SE MIUI/9.5.9) (#Build; Xiaomi; MI 8 SE; PKQ1.181121.001; 9) +CoolMarket/9.2.2-1905301",
"X-App-Id": "com.coolapk.market",
"X-Requested-With": "XMLHttpRequest",
"X-Sdk-Int": "28",
"X-Sdk-Locale": "zh-CN",
"X-Api-Version": "9",
"X-App-Version": "9.2.2",
"X-App-Code": "1903501",
"X-App-Device": "QRTBCOgkUTgsTat9WYphFI7kWbvFWaYByO1YjOCdjOxAjOxEkOFJjODlDI7ATNxMjM5MTOxcjMwAjN0AyOxEjNwgDNxITM2kDMzcTOgsTZzkTZlJ2MwUDNhJ2MyYzM",
"Host": "api.coolapk.com",
"X-Dark-Mode": "0",
"X-App-Token": get_app_token(),
}
resp = requests.get(url, headers=headers)
print(resp.text)
if name == 'main':
request()
复制代码
</pre>

Python反反爬虫 - Frida破解某安卓社区token反爬

猜你喜欢

热点阅读