文章目录
- 前言
- 应用到的工具
- java 层分析
- frida hook aesEncode,a,sign 这三个方法
- 总结
- 预告: 下章节我们讲:陌陌X-SIGN还原
前言
学习是必然的,一路并不是平台的到道路,总要有点意外和惊喜。人嘛!太顺不好。学习是枯燥的,是乏味的,我们学习算法是为了更好的拓展自己的思维和想法。今天我带大家学习一下陌陌x-sign算法,这个我们经常用到的签名算法。
应用到的工具
- jadx-gui
- 老版本陌陌
- Fiddler 抓包工具
- frida hook 框架
java 层分析
首先我们老样子, Fiddler 抓包,登录处有我们目标想要的算法。然后我们就x-sign算法开始研究算法
jadx-gui 反编译apk,搜索X-SIGN
跳到这个方法里面,查看这个方法,代码如下:
public void d() throws Exception {String str;byte[] bArr;if (f.b()) {h();if (this.f57659g) {if (this.i == null || this.i.isEmpty()) {str = null;bArr = null;} else {JSONObject jSONObject = new JSONObject();for (String str2 : this.i.keySet()) {try {jSONObject.put(str2, this.i.get(str2));} catch (Exception e2) {a.a().a((Throwable) e2);}}String jSONObject2 = jSONObject.toString();String str3 = this.f57655c;try {byte[] bytes = jSONObject2.getBytes();byte[] bytes2 = str3.getBytes();byte[] bArr2 = new byte[Coded.getInstance().computeOutputLength(bytes.length, 1)];int aesEncode = Coded.getInstance().aesEncode(bytes, bytes.length, bytes2, bytes2.length, bArr2);byte[] bArr3 = new byte[aesEncode];for (int i2 = 0; i2 < aesEncode; i2++) {bArr3[i2] = bArr2[i2];}str = com.immomo.mmutil.a.a(bArr3);bArr = bArr3;} catch (Exception e3) {a.f57615b++;a.a().a((Throwable) e3);throw new b();}}this.i.clear();if (!TextUtils.isEmpty(str)) {this.i.put("mzip", str);}this.j.put("X-SIGN", a(bArr, this.j, this.f57655c));}if (i()) {String e4 = d.a().e();this.i.put("ck", d.a().f());this.i.put("code_version", d.a().g());this.i.put("map_id", e4);this.i.put("X-KV", d.a().h());}}}
我们看到this.j.put(“X-SIGN”, a(bArr, this.j, this.f57655c));这个代码段,看到x-sign 是a方法来的,我们看到a方法第一个参数是bArr,然而bArr是 bArr3来的, bArr3是aesEncode方法来的,我们直接去这个函数里面看看做了什么事情,代码如下:
public int aesEncode(byte[] input, int inputLen, byte[] key, int klen, byte[] output) {return a49kdEba83h(input, inputLen, key, klen, output);}
看到aesEncode又调用了a49kdEba83h
发现a49kdEba83h是so层算法加密,我们这个直接采用hook ,我们再看看a 这个方法,代码如下:
private String a(byte[] bArr, Map<String, String> map, String str) {if (j.b(str)) {return "";}byte[] bytes = str.getBytes();if (bytes.length < 8) {return "";}byte[] bytes2 = c.a(map) ? f.a().c().getBytes(Charset.forName("UTF-8")) : "".getBytes(Charset.forName("UTF-8"));if (bArr != null) {try {byte[] bArr2 = new byte[(bArr.length + bytes2.length)];for (int i2 = 0; i2 < bytes2.length; i2++) {bArr2[i2] = bytes2[i2];}for (int i3 = 0; i3 < bArr.length; i3++) {bArr2[bytes2.length + i3] = bArr[i3];}return Coded.getInstance().sign(bArr2, bytes);} catch (Exception e2) {return "";}} else if (bytes2.length > 0) {return Coded.getInstance().sign(bytes2, bytes);} else {return "";}}
我们又看到sign这个函数,我们跟进去
发现调用了sdbyecbu37x这个方法,也是在so 实现,我们直接hook 看看传入了那些数据。
frida hook aesEncode,a,sign 这三个方法
function hookTest1(){Java.perform(function(){var Coded = Java.use("com.immomo.momo.util.jni.Coded");Coded.aesEncode.implementation = function(){send("===============================aesEncode=====================================");send(arguments[0]);send(arguments[1]);send(arguments[2]);send(arguments[3]);send(arguments[4]);var retval = this.aesEncode(arguments[0],arguments[1],arguments[2],arguments[3],arguments[4]);send(retval);return retval;}var e= Java.use("com.immomo.momoenc.e");e.a.overload('[B', 'java.util.Map', 'java.lang.String').implementation = function(){send("===============================a=====================================");send(arguments[0]);var result = "";var keyset = arguments[1].keySet();var it = keyset.iterator();while(it.hasNext()){var keystr = it.next().toString();var valuestr = arguments[1].get(keystr).toString();send( keystr +":"+valuestr);} send(arguments[2]);var retval = this.a(arguments[0],arguments[1],arguments[2]);send(retval);return retval;}Coded.sign.implementation = function(){send("===============================sign=====================================");send(arguments[0]);send(arguments[1]);var retval = this.sign(arguments[0],arguments[1]);send(retval);return retval;}});
}function main(){Java.perform(function(){hookTest1();});
}
setImmediate(main);
hook结果:
[Android Emulator 5554::MOMO陌陌 ]-> message: {'type': 'send', 'payload': '===============================aesEncode====================================='} data: None
message: {'type': 'send', 'payload': [4, 54, 88, -112, -59, 118, -62, -98, 55, -92, -97, -53, 3, -92, -85, -114, 60, -110, 106, 81, -114, 119, -68, -66, -57, -39, -112, 84, 67, -76, 104, 87, 50, -60, 95, -30, 9, -63, -32, 73, 50, 44, 48, 72, 47, 44, -121, 33, 90]} data: None
message: {'type': 'send', 'payload': 49} data: None
message: {'type': 'send', 'payload': [73, 117, 48, 87, 75, 72, 70, 121]} data: None
message: {'type': 'send', 'payload': 8} data: None
message: {'type': 'send', 'payload': [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]} data: None
message: {'type': 'send', 'payload': 71} data: None
message: {'type': 'send', 'payload': '===============================aesEncode====================================='} data: None
message: {'type': 'send', 'payload': [123, 34, 100, 112, 112, 34, 58, 34, 51, 57, 49, 99, 99, 101, 101, 52, 97, 54, 100, 53, 98, 49, 57, 52, 101, 48, 54, 52, 48, 55, 49, 50, 48, 55, 50, 51, 100, 101, 55, 48, 34, 44, 34, 66, 97, 115, 101, 66, 97, 110, 100, 86, 101, 114, 115, 105, 111, 110, 34, 58, 34, 110, 111, 32, 109, 101, 115, 115, 97, 103, 101, 34, 44, 34, 100, 101, 118, 105, 99, 101, 95, 116, 121, 112, 101, 34, 58, 34, 97, 110, 100, 114, 111, 105, 100, 34, 44, 34, 115, 99, 114, 101, 101, 110, 34, 58, 34, 57, 48, 48, 120, 49, 54, 48, 48, 34, 44, 34, 105, 115, 82, 111, 111, 116, 34, 58, 34, 49, 34, 44, 34, 117, 116, 100, 105, 100, 34, 58, 34, 57, 99, 52, 50, 48, 100, 97, 56, 98, 54, 55, 97, 101, 100, 98, 50, 53, 49, 55, 54, 102, 52, 54, 99, 52, 52, 99, 102, 56, 53, 98, 49, 34, 44, 34, 112, 104, 111, 110, 101, 95, 110, 101, 116, 87, 111, 114, 107, 34, 58, 34, 50, 34, 44, 34, 67, 112, 117, 73, 110, 102, 111, 34, 58, 34, 48, 45, 51, 34, 44, 34, 109, 97, 114, 107, 101, 116, 95, 115, 111, 117, 114, 99, 101, 34, 58, 34, 55, 34, 44, 34, 114, 111, 109, 34, 58, 34, 53, 46, 49, 46, 49, 34, 44, 34, 101, 116, 121, 112, 101, 34, 58, 34, 50, 34, 44, 34, 98, 105, 110, 100, 83, 111, 117, 114, 99, 101, 34, 58, 34, 98, 105, 110, 100, 95, 115, 111, 117, 114, 99, 101, 95, 110, 101, 119, 95, 108, 111, 103, 105, 110, 34, 44, 34, 97, 110, 100, 114, 111, 105, 100, 73, 100, 34, 58, 34, 55, 99, 51, 55, 97, 99, 100, 53, 57, 102, 57, 99, 48, 57, 57, 53, 34, 44, 34, 104, 119, 34, 58, 34, 48, 99, 50, 100, 52, 51, 52, 97, 56, 98, 49, 56, 53, 57, 97, 101, 98, 99, 97, 50, 51, 53, 98, 49, 51, 48, 99, 101, 54, 53, 102, 57, 34, 44, 34, 105, 109, 101, 105, 34, 58, 34, 51, 53, 49, 53, 52, 50, 48, 50, 53, 55, 52, 49, 50, 50, 48, 34, 44, 34, 101, 109, 117, 34, 58, 34, 48, 50, 57, 102, 49, 56, 49, 100, 54, 101, 55, 98, 97, 49, 56, 56, 56, 56, 53, 99, 55, 56, 52, 54, 50, 54, 50, 51, 99, 51, 55, 97, 34, 44, 34, 118, 101, 114, 115, 105, 111, 110, 34, 58, 34, 51, 56, 51, 54, 34, 44, 34, 111, 115, 118, 101, 114, 115, 105, 111, 110, 95, 105, 110, 116, 34, 58, 34, 50, 50, 34, 44, 34, 109, 97, 110, 117, 102, 97, 99, 116, 117, 114, 101, 114, 34, 58, 34, 88, 105, 97, 111, 109, 105, 34, 44, 34, 112, 104, 111, 110, 101, 95, 116, 121, 112, 101, 34, 58, 34, 71, 83, 77, 34, 44, 34, 97, 112, 107, 115, 105, 103, 110, 34, 58, 34, 52, 102, 51, 97, 53, 51, 49, 99, 97, 102, 102, 51, 101, 51, 55, 99, 50, 55, 56, 54, 53, 57, 99, 99, 55, 56, 98, 102, 97, 101, 99, 99, 34, 44, 34, 97, 99, 99, 34, 58, 34, 49, 46, 48, 34, 44, 34, 105, 109, 115, 105, 34, 58, 34, 55, 54, 50, 50, 56, 52, 49, 48, 51, 99, 101, 51, 100, 48, 50, 50, 102, 54, 54, 50, 98, 48, 100, 51, 57, 98, 99, 51, 53, 57, 51, 57, 34, 44, 34, 115, 101, 110, 115, 111, 114, 78, 97, 109, 101, 115, 34, 58, 34, 71, 49, 36, 84, 49, 36, 76, 49, 36, 65, 49, 36, 77, 49, 36, 68, 49, 36, 87, 48, 36, 80, 48, 36, 81, 101, 48, 36, 118, 98, 48, 36, 48, 36, 99, 101, 48, 98, 50, 51, 49, 53, 54, 56, 48, 98, 49, 102, 97, 97, 52, 49, 52, 50, 56, 49, 53, 53, 50, 97, 50, 49, 100, 55, 55, 53, 34, 44, 34, 112, 97, 115, 115, 119, 111, 114, 100, 34, 58, 34, 48, 55, 52, 101, 102, 102, 99, 55, 55, 98, 100, 100, 97, 100, 49, 54, 50, 102, 54, 55, 99, 54, 51, 53, 101, 49, 99, 54, 102, 56, 56, 51, 34, 44, 34, 83, 101, 114, 105, 97, 108, 78, 117, 109, 98, 101, 114, 34, 58, 34, 48, 48, 100, 52, 56, 99, 48, 97, 34, 44, 34, 103, 97, 112, 112, 115, 34, 58, 34, 49, 34, 44, 34, 98, 117, 105, 108, 100, 110, 117, 109, 98, 101, 114, 34, 58, 34, 76, 77, 89, 52, 55, 73, 92, 47, 56, 46, 51, 46, 49, 57, 34, 44, 34, 95, 117, 105, 100, 95, 34, 58, 34, 102, 54, 54, 98, 55, 55, 52, 48, 52, 48, 99, 100, 51, 50, 50, 53, 54, 100, 51, 99, 53, 101, 51, 101, 99, 48, 101, 101, 56, 101, 51, 98, 34, 44, 34, 109, 97, 99, 34, 58, 34, 48, 48, 58, 56, 49, 58, 48, 99, 58, 99, 50, 58, 53, 55, 58, 52, 53, 34, 44, 34, 99, 117, 114, 114, 101, 110, 116, 95, 119, 105, 102, 105, 34, 58, 34, 48, 48, 58, 56, 49, 58, 52, 53, 58, 99, 50, 58, 100, 98, 58, 53, 55, 34, 44, 34, 110, 101, 116, 119, 111, 114, 107, 95, 99, 108, 97, 115, 115, 34, 58, 34, 119, 105, 102, 105, 34, 44, 34, 82, 65, 77, 83, 105, 122, 101, 34, 58, 34, 51, 49, 48, 57, 52, 49, 50, 34, 44, 34, 75, 101, 114, 110, 101, 108, 86, 101, 114, 115, 105, 111, 110, 34, 58, 34, 76, 105, 110, 117, 120, 32, 118, 101, 114, 115, 105, 111, 110, 32, 52, 46, 48, 46, 57, 32, 40, 98, 117, 105, 108, 100, 101, 114, 64, 117, 98, 117, 110, 116, 117, 41, 32, 40, 103, 99, 99, 32, 118, 101, 114, 115, 105, 111, 110, 32, 52, 46, 56, 46, 53, 32, 40, 85, 98, 117, 110, 116, 117, 32, 52, 46, 56, 46, 53, 45, 52, 117, 98, 117, 110, 116, 117, 56, 126, 49, 52, 46, 48, 52, 46, 50, 41, 32, 41, 32, 35, 49, 32, 83, 77, 80, 32, 80, 82, 69, 69, 77, 80, 84, 32, 77, 111, 110, 32, 74, 97, 110, 32, 50, 52, 32, 49, 54, 58, 53, 54, 58, 53, 48, 32, 67, 83, 84, 32, 50, 48, 50, 50, 34, 44, 34, 95, 110, 101, 116, 95, 34, 58, 34, 119, 105, 102, 105, 34, 44, 34, 108, 110, 103, 34, 58, 34, 49, 49, 54, 46, 52, 48, 51, 57, 57, 57, 51, 50, 56, 34, 44, 34, 77, 97, 99, 73, 110, 102, 111, 34, 58, 34, 48, 48, 58, 56, 49, 58, 48, 99, 58, 99, 50, 58, 53, 55, 58, 52, 53, 34, 44, 34, 114, 111, 117, 116, 101, 114, 95, 109, 97, 99, 34, 58, 34, 48, 48, 58, 56, 49, 58, 52, 53, 58, 99, 50, 58, 100, 98, 58, 53, 55, 34, 44, 34, 83, 101, 114, 105, 97, 108, 110, 111, 34, 58, 34, 48, 48, 100, 52, 56, 99, 48, 97, 34, 44, 34, 117, 105, 100, 34, 58, 34, 102, 54, 54, 98, 55, 55, 52, 48, 52, 48, 99, 100, 51, 50, 50, 53, 54, 100, 51, 99, 53, 101, 51, 101, 99, 48, 101, 101, 56, 101, 51, 98, 34, 44, 34, 97, 99, 99, 111, 117, 110, 116, 34, 58, 34, 49, 56, 48, 54, 48, 49, 51, 49, 50, 49, 48, 34, 44, 34, 108, 97, 116, 34, 58, 34, 51, 57, 46, 57, 49, 53, 48, 48, 48, 57, 49, 53, 34, 44, 34, 66, 111, 111, 116, 83, 101, 114, 105, 97, 108, 110, 111, 34, 58, 34, 48, 48, 100, 52, 56, 99, 48, 97, 34, 44, 34, 109, 111, 100, 101, 108, 34, 58, 34, 77, 73, 32, 57, 34, 125]} data: None
message: {'type': 'send', 'payload': 1355} data: None
message: {'type': 'send', 'payload': [98, 53, 67, 108, 73, 83, 98, 122, 74, 99, 71, 74, 83, 87, 105, 52, 81, 86, 113, 98, 77, 99, 65, 84, 115, 112, 70, 85, 88, 70, 43, 88, 98, 53, 67, 108, 73, 83, 98, 122, 74, 99, 71, 74, 83, 87, 105, 52]} data: None
message: {'type': 'send', 'payload': 48} data: None
message: {'type': 'send', 'payload': [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]} data: None
message: {'type': 'send', 'payload': 1367} data: None
message: {'type': 'send', 'payload': '===============================a====================================='} data: None
message: {'type': 'send', 'payload': [2, 3, 37, 118, -26, -102, 0, 38, -85, -24, 86, -23, -78, -71, 54, 43, 27, -91, -99, -101, -80, 45, 43, -55, -72, 108, -41, 3, 121, -10, -124, 125, 91, 86, -46, -31, 120, 122, 13, 33, -32, -37, 51, -39, 31, -32, 18, 102, 3, -61, 78, -9, -92, -75, -77, 8, -84, 39, 119, 84, -22, -5, 25, -20, 34, 47, 53, 40, -127, 120, -48, 48, 55, -29, -51, 43, -9, 43, 91, 24, 74, -87, 24, 112, -94, 49, 94, 74, 41, -51, 55, -40, -96, 73, 114, -102, 71, 2, -48, -2, 124, -97, 60, -67, -53, -51, 110, 66, -20, -103, 69, -103, 82, 22, 54, -116, 78, -37, -44, -67, -113, -49, -16, 127, 122, 110, -76, -4, 99, 64, 32, 24, 113, 6, 88, -19, -44, -122, -108, -119, -108, -86, -3, 70, 26, 99, 1, -43, 13, 64, -117, 113, 86, -6, 119, 26, -58, -84, -39, 106, 47, 53, 62, -21, 5, 40, 97, 110, 8, -49, -40, -75, 109, 7, 59, 13, -20, -111, 14, -53, -128, 104, 106, 27, -62, -64, -107, -5, 85, -69, -16, -84, -13, 98, -81, -50, 108, 0, 22, -128, -44, -1, 12, -5, 35, 59, -127, -99, 98, -117, 88, -100, -128, -117, -83, 88, 11, 97, -70, -7, 47, 22, 54, 3, -70, -117, 3, -59, -12, -111, -58, -99, -116, 64, 91, -47, 72, -28, -6, 99, -47, 33, -69, 36, -93, 70, 100, -57, 55, 66, 92, -82, -128, 49, -74, 26, 72, -93, -104, -15, 104, 80, -96, -75, 2, 93, -93, 97, -34, -117, -60, -90, 118, 28, 17, -50, 99, -57, 60, 122, -30, 111, -57, -50, 75, -38, 36, -20, -126, 27, 83, -27, 124, -68, -78, -125, -81, -88, 0, 72, 110, 112, -112, -121, 64, -107, -63, 39, -70, 84, -27, 117, 126, -59, 75, -87, 62, -19, 55, 65, 19, 51, 66, -90, 87, 5, -31, -60, 37, -106, 61, 37, -4, -61, -6, 54, -128, -41, 118, 25, -79, 47, 123, 104, -20, -34, -31, 10, -35, -62, 106, 72, 35, 122, -25, 87, 76, 124, 35, -119, -75, 122, 27, 42, 31, 106, -82, -54, -7, -84, -58, 49, -10, 115, 117, -5, 27, 30, 75, -28, -110, 7, -125, -38, 88, -78, -62, 42, -81, 74, -45, 32, 85, 102, -93, -113, -108, -89, -124, -118, 94, 8, -46, 69, 22, 33, -26, -38, 75, -123, -17, -126, 6, 25, -2, -106, 125, -101, -76, 3, 69, -4, -33, -98, 91, -25, -32, -121, -91, 54, -111, -92, -8, -78, -29, 80, 112, -62, 16, -109, 93, -2, 77, -29, 33, 59, -6, 124, 112, -107, 85, -23, 3, 99, -29, -14, -74, -71, 21, 72, 47, 37, 118, -74, -43, -90, -127, 43, 84, 23, -76, -100, 82, 119, -79, 113, 38, 36, 53, -21, 70, -100, -32, -93, -65, -5, 33, 75, -106, 78, 97, 117, -85, 33, -72, 83, -100, 20, 53, -9, 28, -125, -81, 99, -8, 42, -123, -28, 115, -7, -33, -84, -13, -1, -8, 38, 15, 125, 106, 7, 30, -21, -36, -33, 52, 29, -43, 83, 50, -34, -79, -29, 118, 59, -33, -100, 127, -61, 95, -16, 67, 66, 73, -125, 45, -69, -10, 22, -40, -33, 126, -94, -72, -25, -13, 57, 114, 86, 35, -36, -127, 51, -96, 125, -108, 79, -37, 20, -41, -126, -51, -33, -41, 58, -125, -111, -98, 58, -34, 8, 56, 85, -47, 15, 26, 23, -12, 89, 45, -71, 13, 23, 9, 30, -67, -96, -126, 104, -104, 10, -35, 16, 117, 51, 100, -26, -124, -51, 84, 31, -89, -6, 82, -20, 92, 73, -95, 14, -21, -8, -92, 42, 32, -16, -90, 111, -26, -62, -28, -29, -20, 74, -40, 2, 49, 66, 90, -48, -81, -85, 8, -105, -114, -106, 53, -79, -43, -14, -33, -47, -93, 111, 75, -98, 122, -33, 77, -34, -39, -23, 46, 24, 96, 56, 38, 23, -103, 101, -112, -57, -23, 10, -126, 82, 69, 104, -86, -104, -70, -104, -28, -23, 102, 94, 113, -125, 19, -57, 33, 55, 55, 35, 71, -84, -112, -38, 86, 45, 115, -93, 76, -103, -1, 62, -100, 11, -76, -48, 47, -96, -57, 53, -8, 117, -125, -87, 13, 57, -93, 113, -85, 47, -52, -12, -29, 50, 91, -12, 88, 99, 55, -88, -35, -30, 27, -36, 7, -91, -48, -16, 33, -39, 93, 35, 19, -75, -27, -16, 112, 125, 125, -54, -7, 93, -41, -85, -114, 115, 22, -76, -98, -15, 87, -9, 81, -123, -47, -5, -118, 16, 93, -51, -76, 7, -112, -11, -12, 42, 19, 118, -111, 117, 6, -111, 10, 14, -42, 87, -32, -40, 21, 83, -35, 89, -69, 45, -124, 56, -95, 114, 33, -60, 84, -19, 60, -122, -15, 55, 26, 46, -32, 79, -105, 16, 117, -2, 0, -42, -34, 81, 101, 92, -117, -46, 100, 39, 27, 46, 47, 62, -48, 48, -63, -91, -18, 3, 93, -69, 23, -63, 96, 30, 27, 114, 5, -76, 125, 51, -119, 41, 38, 24, 121, 48, -125, 52, 56, -29, -60, 10, -27, -8, -93, -32, 47, -119, 72, -60, 110, -75, 116, 113, -78, 61, -113, -15, 15, 64, 66, -66, -59, 59, -68, 1, -126, -6, 4, -72, 77, -40, -122, 120, -8, 124, 82, 26, 28, -77, -126, -41, -62, -116, 7, -54, 103, 80, -67, 40, 12, -25, -65, -87, 114, 43, -34, 114, -29, -90, -50, 44, 117, 58, 25, -16, -67, -114, -45, -49, -126, -95, -121, -11, 15, -19, 52, 62, -115, 79, 123, -7, 122, -118, 22, -31, 30, 14, 46, -87, -55, 0, -93, -5, 23, 64, 24, -18, 71, -19, -42, -91, 5, 46, -16, -28, 18, 80, 87, -68, -126, 4, -52, -30, 21, -86, 9, 15, -43, 17, -48, 107, 108, -47, 104, 35, 15, 60, 44, -12, 113, -22, -106, -42, -37, 91, 88, 95, -8, 85, 23, 78, 16, 92, -65, -3, -96, -11, 115, 20, -114, 49, -105, -80, 32, 104, 109, -45, 93, -79, -114, 40, 119, 71, -7, -12, -46, -73, 12, 123, 110, -8, -22, -66, -27, -66, -53, 40, -114, 10, 21, 86, -19, 105, 58, -16, 57, 10, -92, 11, -95, -90, -121, -35, 33, -115, 32, 26, -14, 59, 27, 51, -46, 43, 125, 107, -28, 74, -95, 80, -113, -54, 69, 59, -123, 44, -78, -44, 15, -2, 11, -114, -74, 18, -88, -67, 67, 95, -57, 95, -64, -21, 14, 109, 104, -66, -48, 10, 5, 105, 36, 39, -101, 44, 118, -116, 68, -108, 100, 88, -126, 67, -4, -97, -28, -120, -105, -113, -75, -59, 80, 40, 112, -39, -43, -53, 112, 92, 22, 13, 106, 56, 117, -31, 13, -1, -1, -27, -67, -72, -106, 17, -36, 46, -26, 70, 25, -18, 61, 33, 110, 54, -82, -16, -110, -103, -29, 84, 4, -14, -53, 121, -43, 69, 26, 23, -45, 95, 82, 91, -122, -128, 93, 44, 33, 8, -103, -38, -118, -86, 123, 20, 100, 126, -47, -34, -120, 112, 69, 70, 1, -114, -42, 116, -111, 101, 22, 105, 78, 1, -45, -90, -35, 98, 51, 80, -68, 93, -59, 31, 48, -81, 3, 27, -39, -3, -1, 58, 89, -44, -80, -87, 100, -29, -87, -63, -105, -55, 114, -86, 123, 46, 21, -88, -65, -26, 28, -67, 55, 113, 54, -103, -24, 77, -71, -49, 125, 53, 105, -65, 124, 10, -94, 104, -34, 74, 55, -53, -122, -102, 34, 62, -115, -54, -123, -99, 16, -111, 36, 61, -95, -64, -40, 42, 30, -109, 98, 127, 121, -87, 69, -115, 59, 3, -59, -59, 80, -49, 80, -116, 117, 117, 80, 101, -63, -55, -17, -38, -3, 79, -28, 43, -4, 118, 13, 119, -35, -119, -54, 102, 55, -66, 47, -43, 78, -34, -9, -80, -4, -112, 22, 16, -55, 83, 11, -32, -62, 14, 127, -56, -51, 121, -96, 44, 40, 3, -107, 123, 35, 49, 120, -21, 105, 57, 109, 15, 79, 53, -19, 115, -5, -55, 64, -22, 64, -49, -12, 5, 77, 11, 39, 68, 36, 102, 54, -109, 20, 127, -108]} data: None
message: {'type': 'send', 'payload': 'X-LV:1'} data: None
message: {'type': 'send', 'payload': 'X-KV:c9044820'} data: None
message: {'type': 'send', 'payload': 'b5ClISbzJcGJSWi4QVqbMcATspFUXF+Xb5ClISbzJcGJSWi4'} data: None
message: {'type': 'send', 'payload': '===============================sign====================================='} data: None
message: {'type': 'send', 'payload': [77, 111, 109, 111, 67, 104, 97, 116, 47, 56, 46, 49, 54, 32, 65, 110, 100, 114, 111, 105, 100, 47, 51, 56, 51, 54, 32, 40, 77, 73, 32, 57, 59, 32, 65, 110, 100, 114, 111, 105, 100, 32, 53, 46, 49, 46, 49, 59, 32, 71, 97, 112, 112, 115, 32, 49, 59, 32, 122, 104, 95, 67, 78, 59, 32, 55, 59, 32, 88, 105, 97, 111, 109, 105, 41, 2, 3, 37, 118, -26, -102, 0, 38, -85, -24, 86, -23, -78, -71, 54, 43, 27, -91, -99, -101, -80, 45, 43, -55, -72, 108, -41, 3, 121, -10, -124, 125, 91, 86, -46, -31, 120, 122, 13, 33, -32, -37, 51, -39, 31, -32, 18, 102, 3, -61, 78, -9, -92, -75, -77, 8, -84, 39, 119, 84, -22, -5, 25, -20, 34, 47, 53, 40, -127, 120, -48, 48, 55, -29, -51, 43, -9, 43, 91, 24, 74, -87, 24, 112, -94, 49, 94, 74, 41, -51, 55, -40, -96, 73, 114, -102, 71, 2, -48, -2, 124, -97, 60, -67, -53, -51, 110, 66, -20, -103, 69, -103, 82, 22, 54, -116, 78, -37, -44, -67, -113, -49, -16, 127, 122, 110, -76, -4, 99, 64, 32, 24, 113, 6, 88, -19, -44, -122, -108, -119, -108, -86, -3, 70, 26, 99, 1, -43, 13, 64, -117, 113, 86, -6, 119, 26, -58, -84, -39, 106, 47, 53, 62, -21, 5, 40, 97, 110, 8, -49, -40, -75, 109, 7, 59, 13, -20, -111, 14, -53, -128, 104, 106, 27, -62, -64, -107, -5, 85, -69, -16, -84, -13, 98, -81, -50, 108, 0, 22, -128, -44, -1, 12, -5, 35, 59, -127, -99, 98, -117, 88, -100, -128, -117, -83, 88, 11, 97, -70, -7, 47, 22, 54, 3, -70, -117, 3, -59, -12, -111, -58, -99, -116, 64, 91, -47, 72, -28, -6, 99, -47, 33, -69, 36, -93, 70, 100, -57, 55, 66, 92, -82, -128, 49, -74, 26, 72, -93, -104, -15, 104, 80, -96, -75, 2, 93, -93, 97, -34, -117, -60, -90, 118, 28, 17, -50, 99, -57, 60, 122, -30, 111, -57, -50, 75, -38, 36, -20, -126, 27, 83, -27, 124, -68, -78, -125, -81, -88, 0, 72, 110, 112, -112, -121, 64, -107, -63, 39, -70, 84, -27, 117, 126, -59, 75, -87, 62, -19, 55, 65, 19, 51, 66, -90, 87, 5, -31, -60, 37, -106, 61, 37, -4, -61, -6, 54, -128, -41, 118, 25, -79, 47, 123, 104, -20, -34, -31, 10, -35, -62, 106, 72, 35, 122, -25, 87, 76, 124, 35, -119, -75, 122, 27, 42, 31, 106, -82, -54, -7, -84, -58, 49, -10, 115, 117, -5, 27, 30, 75, -28, -110, 7, -125, -38, 88, -78, -62, 42, -81, 74, -45, 32, 85, 102, -93, -113, -108, -89, -124, -118, 94, 8, -46, 69, 22, 33, -26, -38, 75, -123, -17, -126, 6, 25, -2, -106, 125, -101, -76, 3, 69, -4, -33, -98, 91, -25, -32, -121, -91, 54, -111, -92, -8, -78, -29, 80, 112, -62, 16, -109, 93, -2, 77, -29, 33, 59, -6, 124, 112, -107, 85, -23, 3, 99, -29, -14, -74, -71, 21, 72, 47, 37, 118, -74, -43, -90, -127, 43, 84, 23, -76, -100, 82, 119, -79, 113, 38, 36, 53, -21, 70, -100, -32, -93, -65, -5, 33, 75, -106, 78, 97, 117, -85, 33, -72, 83, -100, 20, 53, -9, 28, -125, -81, 99, -8, 42, -123, -28, 115, -7, -33, -84, -13, -1, -8, 38, 15, 125, 106, 7, 30, -21, -36, -33, 52, 29, -43, 83, 50, -34, -79, -29, 118, 59, -33, -100, 127, -61, 95, -16, 67, 66, 73, -125, 45, -69, -10, 22, -40, -33, 126, -94, -72, -25, -13, 57, 114, 86, 35, -36, -127, 51, -96, 125, -108, 79, -37, 20, -41, -126, -51, -33, -41, 58, -125, -111, -98, 58, -34, 8, 56, 85, -47, 15, 26, 23, -12, 89, 45, -71, 13, 23, 9, 30, -67, -96, -126, 104, -104, 10, -35, 16, 117, 51, 100, -26, -124, -51, 84, 31, -89, -6, 82, -20, 92, 73, -95, 14, -21, -8, -92, 42, 32, -16, -90, 111, -26, -62, -28, -29, -20, 74, -40, 2, 49, 66, 90, -48, -81, -85, 8, -105, -114, -106, 53, -79, -43, -14, -33, -47, -93, 111, 75, -98, 122, -33, 77, -34, -39, -23, 46, 24, 96, 56, 38, 23, -103, 101, -112, -57, -23, 10, -126, 82, 69, 104, -86, -104, -70, -104, -28, -23, 102, 94, 113, -125, 19, -57, 33, 55, 55, 35, 71, -84, -112, -38, 86, 45, 115, -93, 76, -103, -1, 62, -100, 11, -76, -48, 47, -96, -57, 53, -8, 117, -125, -87, 13, 57, -93, 113, -85, 47, -52, -12, -29, 50, 91, -12, 88, 99, 55, -88, -35, -30, 27, -36, 7, -91, -48, -16, 33, -39, 93, 35, 19, -75, -27, -16, 112, 125, 125, -54, -7, 93, -41, -85, -114, 115, 22, -76, -98, -15, 87, -9, 81, -123, -47, -5, -118, 16, 93, -51, -76, 7, -112, -11, -12, 42, 19, 118, -111, 117, 6, -111, 10, 14, -42, 87, -32, -40, 21, 83, -35, 89, -69, 45, -124, 56, -95, 114, 33, -60, 84, -19, 60, -122, -15, 55, 26, 46, -32, 79, -105, 16, 117, -2, 0, -42, -34, 81, 101, 92, -117, -46, 100, 39, 27, 46, 47, 62, -48, 48, -63, -91, -18, 3, 93, -69, 23, -63, 96, 30, 27, 114, 5, -76, 125, 51, -119, 41, 38, 24, 121, 48, -125, 52, 56, -29, -60, 10, -27, -8, -93, -32, 47, -119, 72, -60, 110, -75, 116, 113, -78, 61, -113, -15, 15, 64, 66, -66, -59, 59, -68, 1, -126, -6, 4, -72, 77, -40, -122, 120, -8, 124, 82, 26, 28, -77, -126, -41, -62, -116, 7, -54, 103, 80, -67, 40, 12, -25, -65, -87, 114, 43, -34, 114, -29, -90, -50, 44, 117, 58, 25, -16, -67, -114, -45, -49, -126, -95, -121, -11, 15, -19, 52, 62, -115, 79, 123, -7, 122, -118, 22, -31, 30, 14, 46, -87, -55, 0, -93, -5, 23, 64, 24, -18, 71, -19, -42, -91, 5, 46, -16, -28, 18, 80, 87, -68, -126, 4, -52, -30, 21, -86, 9, 15, -43, 17, -48, 107, 108, -47, 104, 35, 15, 60, 44, -12, 113, -22, -106, -42, -37, 91, 88, 95, -8, 85, 23, 78, 16, 92, -65, -3, -96, -11, 115, 20, -114, 49, -105, -80, 32, 104, 109, -45, 93, -79, -114, 40, 119, 71, -7, -12, -46, -73, 12, 123, 110, -8, -22, -66, -27, -66, -53, 40, -114, 10, 21, 86, -19, 105, 58, -16, 57, 10, -92, 11, -95, -90, -121, -35, 33, -115, 32, 26, -14, 59, 27, 51, -46, 43, 125, 107, -28, 74, -95, 80, -113, -54, 69, 59, -123, 44, -78, -44, 15, -2, 11, -114, -74, 18, -88, -67, 67, 95, -57, 95, -64, -21, 14, 109, 104, -66, -48, 10, 5, 105, 36, 39, -101, 44, 118, -116, 68, -108, 100, 88, -126, 67, -4, -97, -28, -120, -105, -113, -75, -59, 80, 40, 112, -39, -43, -53, 112, 92, 22, 13, 106, 56, 117, -31, 13, -1, -1, -27, -67, -72, -106, 17, -36, 46, -26, 70, 25, -18, 61, 33, 110, 54, -82, -16, -110, -103, -29, 84, 4, -14, -53, 121, -43, 69, 26, 23, -45, 95, 82, 91, -122, -128, 93, 44, 33, 8, -103, -38, -118, -86, 123, 20, 100, 126, -47, -34, -120, 112, 69, 70, 1, -114, -42, 116, -111, 101, 22, 105, 78, 1, -45, -90, -35, 98, 51, 80, -68, 93, -59, 31, 48, -81, 3, 27, -39, -3, -1, 58, 89, -44, -80, -87, 100, -29, -87, -63, -105, -55, 114, -86, 123, 46, 21, -88, -65, -26, 28, -67, 55, 113, 54, -103, -24, 77, -71, -49, 125, 53, 105, -65, 124, 10, -94, 104, -34, 74, 55, -53, -122, -102, 34, 62, -115, -54, -123, -99, 16, -111, 36, 61, -95, -64, -40, 42, 30, -109, 98, 127, 121, -87, 69, -115, 59, 3, -59, -59, 80, -49, 80, -116, 117, 117, 80, 101, -63, -55, -17, -38, -3, 79, -28, 43, -4, 118, 13, 119, -35, -119, -54, 102, 55, -66, 47, -43, 78, -34, -9, -80, -4, -112, 22, 16, -55, 83, 11, -32, -62, 14, 127, -56, -51, 121, -96, 44, 40, 3, -107, 123, 35, 49, 120, -21, 105, 57, 109, 15, 79, 53, -19, 115, -5, -55, 64, -22, 64, -49, -12, 5, 77, 11, 39, 68, 36, 102, 54, -109, 20, 127, -108]} data: None
message: {'type': 'send', 'payload': [98, 53, 67, 108, 73, 83, 98, 122, 74, 99, 71, 74, 83, 87, 105, 52, 81, 86, 113, 98, 77, 99, 65, 84, 115, 112, 70, 85, 88, 70, 43, 88, 98, 53, 67, 108, 73, 83, 98, 122, 74, 99, 71, 74, 83, 87, 105, 52]} data: None
message: {'type': 'send', 'payload': 'o5DeCmQWlk2DbotiegftLs1kp+Y='} data: None
message: {'type': 'send', 'payload': 'o5DeCmQWlk2DbotiegftLs1kp+Y='} data: None
总结
java层就到这,so 层实现我们后面接着讲。java层数据还是比较容易被分析的,建议算法在so层实现,也就是像陌陌这个一样。Java层可以在做数据混淆处理。
预告: 下章节我们讲:陌陌X-SIGN还原
会在逆向区讲算法还原