当前位置：首页 > article >正文

某车之家appso层签名逆向

article 2025/2/28 15:23:00

抓包分析

# 请求地址 
	https://a.athm.cn/i.api.autohome.com.cn/api/UserApi/StandardLogin
# 请求方式
	POST
# 请求体
	validcode	qpm3     
    Version	1
    isCheckModeratorsRemote	1
    userpwd	25d55ad283aa400af464c76d713c07ad   
    logincode	17812345678  # 账号
    _appid	app.android.uc.v2
    isapp	1
    showmob	1
    sessionid	770877b9_a59f_4449_9623_e1b28652dc80
    _sign	C3BFF63FDC0C9A0B2AA87DA19B02DF82 # 签名
    _timestamp	1733298682   # 时间戳
    platform	3
# 请求头
	reqid	770877b9_a59f_4449_9623_e1b28652dc80/1733298682158/82
	apisign	2|770877b9_a59f_4449_9623_e1b28652dc80|autohomebrush|1733298682|D3498237C24F4CD7C92BA9E2FBBC336F

使用charles修改包，发现只有sign签名校验，头部固定

分析

反编译搜索 isCheckModeratorsRemote
最终定位到分析代码

@Override // com.autohome.net.core.AHBaseServant, com.autohome.net.core.AHRequest.IRequestParams
    public Map<String, String> getPostParams() {
        String str;
        LinkedList linkedList = new LinkedList();
        String str2 = null;
        try {
            str = URLEncoder.encode(this.userName, StringUtils.GB2312);
            try {
                str2 = URLEncoder.encode(EncryptionUtil.md5s(this.passWord), StringUtils.GB2312);
            } catch (UnsupportedEncodingException unused) {
            }
        } catch (UnsupportedEncodingException unused2) {
            str = null;
        }
        linkedList.add(new BasicNameValuePair("logincode", str));
        linkedList.add(new BasicNameValuePair("userpwd", str2));
        linkedList.add(new BasicNameValuePair("validcode", this.verifyCode));
        linkedList.add(new BasicNameValuePair("_appid", SignHelper.appid));
        linkedList.add(new BasicNameValuePair("isapp", "1"));
        linkedList.add(new BasicNameValuePair("isCheckModeratorsRemote", "1"));
        linkedList.add(new BasicNameValuePair(e.e, "1"));
        if (!TextUtils.isEmpty(this.FPosition)) {
            linkedList.add(new BasicNameValuePair("fPosition", this.FPosition));
        }
        if (!TextUtils.isEmpty(this.SPosition)) {
            linkedList.add(new BasicNameValuePair("sPosition", this.SPosition));
        }
        linkedList.add(new BasicNameValuePair("platform", "3"));
        if (this.isPlanB) {
            linkedList.add(new BasicNameValuePair("showmob", "1"));
        }
        linkedList.add(new BasicNameValuePair("sessionid", AHLoginService.getInstance().getDeviceId()));
        return SignHelper.makePostParamsWithTimeStamp(linkedList, this.timestamp, SignHelper.signKey);
    }

跟进 makePostParamsWithTimeStamp

    public static Map<String, String> makePostParamsWithTimeStamp(List<NameValuePair> list, String str, String str2) {
        long currentTimeMillis = System.currentTimeMillis() / 1000;
        try {
            currentTimeMillis = Long.parseLong(str);
        } catch (Exception e) {
            e.printStackTrace();
        }
        list.add(new BasicNameValuePair("_timestamp", currentTimeMillis + ""));
        list.add(new BasicNameValuePair("_sign", BlackBoxSignHelper.getInterfaceSign(list, str2)));
       }

跟进 BlackBoxSignHelper.getInterfaceSign 发现是是个重载方法传入List str

	public static String getInterfaceSign(List<NameValuePair> list, long j) {
        beforeInterfaceSign();
        ArrayList arrayList = new ArrayList();
        if (!equalsNull(list)) {
            arrayList.addAll(list);
        }
        arrayList.add(new BasicNameValuePair("_timestamp", String.valueOf(j)));
        String interfaceSign = BlackBox.getInstance().getInterfaceSign(arrayList);
        if (interfaceSign == null || interfaceSign.length() == 0) {
            try {
                AHBBLogReporter.reportPluginContainerLog(135997, "getInterfaceSign: params:" + list.toString() + ";timeStamp:" + j + "; native result:" + interfaceSign);
            } catch (Exception e) {
                e.printStackTrace();
            }
        }
        afterInterfaceSign();
        String str = TAG;
        BlackBoxLogUtil.v(str, "[Native] getInterfaceSign --->" + interfaceSign);
        return interfaceSign;
    }

跟进 String interfaceSign = BlackBox.getInstance().getInterfaceSign(arrayList);

public native synchronized String getInterfaceSign(List<NameValuePair> list);
private static String soName = "blackBox";

到这里就开始进入so了，找到对应的so文件直接使用ida分析，文件 libblackBox.so

hook下看看 getInterfaceSign

参数： Gzul4iuY8UHhUB6bDdGo8A==
参数： [logincode=17812345678, userpwd=e10adc3949ba59abbe56e057f20f883e, validcode=3kog, _appid=app.android.uc.v2, isapp=1, isCheckModeratorsRemote=1, Version=1, platform=3, showmob=1, sessionid=770877b9_a59f_4449_9623_e1b28652dc80, _timestamp=1733303519]
返回值： D28F5F4179695CDB720E1F5EE314ABFD