苏宁某APP逆向分析

青旅半醒 2023-10-13 18:46 38阅读 0赞

版本

c3VuaW5nXzkuNS4xMTJfNTAw

分析下提交订单

1.首先抓包

使用使用postern+charles抓包能够轻松抓取到包，这块限制不多

2.分析包

首先是/[app/addcart/private/quickBuy.do][app_addcart_private_quickBuy.do]

这个主要是为了获取cart2No

String data = "{\"cartHeadInfo\":{\"userFlag\":\"0\",\"directFlag\":\"1\",\"operationChannel\":\"50\",\"operationTerminal\":\"01\",\"operationEquipment\":\"02\",\"operationUser\":\"\",\"token\":\"UDCPn1L5tJDFfgHK6)3b5cbxCAfDleOBoqjeTV7LbHA*\",\"detect\":\"%s\",\"dfpToken\":\"%s\",\"operationStoreCode\":\"\",\"provinceCode\":\"010\",\"cityCode\":\"010\",\"districtCode\":\"01013\",\"townCode\":\"0101399\",\"logContent\":\"\",\"appTerminalVersions\":\"9.5.112\",\"appVersions\":\"01\",\"destLongitude\":\"116.288536\",\"destLatitude\":\"40.203907\",\"productPageType\":\"\",\"channelType\":\"02\",\"checkOrdPurFlag\":\"0\",\"poiId\":\"2782100118468010\",\"collectionType\":\"\"},\"historyReceiverInfo\":{\"addrNum\":\"1\"},\"historyPayType\":{\"payType\":\"\",\"payPeriods\":\"\"},\"immediateBuyItems\":[{\"itemHeadInfo\":{\"itemNo\":\"1\",\"activityType\":\"07\",\"activityId\":\"\"},\"mainCmmdtyInfo\":{\"basicInfo\":{\"itemNo\":\"1\",\"cmmdtyCode\":\"000000012354857650\",\"shopCode\":\"0000000000\",\"b2cShopCode\":\"\",\"shopAddCode\":\"0030004459\",\"shopName\":\"苏宁自营\",\"overSeasFlag\":\"\",\"cmmdtyQty\":\"1\",\"serviceStoreCode\":\"\",\"serviceStoreName\":\"\",\"commodityType\":\"\",\"carShopSerWay\":\"\",\"isOneHour\":\"\",\"productType\":\"\",\"platform\":\"01\"},\"collect\":[{\"collectSort\":\"10\",\"collectType\":\"13\",\"collectCode\":\"pgcate=10008;prdtp=00027;tag=四级页;pgtitle=四级页;prdid=000000012354857650;shopid=0030004459;supid=0010212008\"}]}}],\"supportYB\":\"1\",\"publishDate\":\"20230410\",\"exclusiveCouponList\":[],\"privilegeNumList\":[]}";
    
        data = String.format(data, detect,dfptoken);

核心参数主要是两个detect和dfptoken

获取到cart2No就是提交订单了[app/V2/private/confirmOrder.do][app_V2_private_confirmOrder.do]

这个包的参数也不复杂，除dfptoken和detect和cart2No外，基本都是固定值。

重点就是dfptoken和detect两个参数的生成了，两种解决方法：

1.直接RPC获取，简单直接

2.分析JAVA层和SO层，将两个参数算法复写，费劲，但是也能够实现。

具体根据具体情况即可。

纯技术交流，请勿用于非法用途。

如有问题，请私信。

xObP8s/gudi/zrPMoaJKU7K5u7e+s7/Os8yhokpBVkHP4LnYv86zzMjn0OjSqtKyv8nS1MGqz7VRUaGjDQoNCtf31d8gUVEgNDA0NTQwMjI5

**纯技术交流，请勿用于非法用途,如有权益问题可以发私信联系我删除.**

[app_addcart_private_quickBuy.do]: https://shopping.suning.com/app/addcart/private/quickBuy.do
[app_V2_private_confirmOrder.do]: https://shopping.suning.com/app/V2/private/confirmOrder.do