dy六神参数记录分析（立秋篇）

左手的ㄟ右手 2023-10-13 19:39 40阅读 0赞

version： 23.9

X-SS=STUB:  
![在这里插入图片描述][224739f576f343e49d3194718371a52b.png]  
![在这里插入图片描述][25694d1c0cec4363bcf853fa1dbc205c.png]  
![在这里插入图片描述][77ff3889c8634f979c067cb8ffc18278.jpeg]  
搜索：x-tt-dt

![在这里插入图片描述][54b33db9ac424c6bb53bd46a365c6ecd.png]

var hashMap = Java.use("java.util.HashMap");
        hashMap.put.implementation = function (a, b) {
        
            console.log("hashMap.put: ", a, b);
            return this.put(a, b);
        }

[https://codeooo.blog.csdn.net//article/details/120025814][https_codeooo.blog.csdn.net_article_details_120025814]  
![在这里插入图片描述][d26d5c7bdd1946678e935e3e2ff9e320.png]

jscode = """
    Java.perform(function () {
        
       var hashMap = Java.use("java.util.HashMap");
        hashMap.put.implementation = function (a, b) {
        
            console.log("hashMap.put: ", a, b);
            return this.put(a, b);
        }
    });
    """

先降级抓包：

// frida -U -l proxy.js -no-pause -f com.ss.android.ugc.aweme
    setImmediate(function () {
        
        Java.perform(function () {
        
            var targetClass = 'org.chromium.CronetClient';
            var methodName = 'tryCreateCronetEngine';
            var gclass = Java.use(targetClass);
            gclass[methodName].overload('android.content.Context', 'boolean', 'boolean', 'boolean', 'boolean', 'java.lang.String', 'java.util.concurrent.Executor', 'boolean').implementation = function (arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7) {
        
            }
        });
        Java.perform(function () {
        
            let a = Java.use("ms.bd.c.j2$a");
            var TreeMap = Java.use('java.util.TreeMap');
            var HashMap = Java.use('java.util.HashMap');
    
            a["onCallToAddSecurityFactor"].implementation = function (str, map) {
        
                console.log(`a.onCallToAddSecurityFactor is called: str=${str}, map=${Java.cast(map, TreeMap).toString()}`);
                let result = this["onCallToAddSecurityFactor"](str, map);
                console.log("result：" + Java.cast(result, HashMap).toString());
                return result;
            };
        });
    });

![在这里插入图片描述][c1686923f1394e1c821860db97e6c2e6.png]

import frida
    import sys
    
    jscode = """
    Java.perform(function () {
        
       var hashMap = Java.use("java.util.HashMap");
        hashMap.put.implementation = function (a, b) {
        
            console.log("hashMap.put: ", a, b);
            if(a.equals("X-Ladon")){
        
                console.log("=================================================");
                console.log("hashMap.put: ", a, b);
                console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));
            }
            return this.put(a, b);
        }
    });
    """
    
    def message(msg, data):
        if msg["type"] == 'send':
            print("[*] {0}".format(msg['payload']))
        else:
            print(msg)
    
    
    # 指定要附加的设备app
    # com.ss.android.ugc.aweme
    process = frida.get_usb_device().attach('抖音')
    #
    script = process.create_script(jscode)
    script.on("message", message)
    script.load()
    sys.stdin.read()

![在这里插入图片描述][a3d8db1cc2404d3b859b0e219aed9778.png]  
![在这里插入图片描述][cb575f838c9242399864454cc6dbaef7.png]  
![在这里插入图片描述][d49e881bd88144aba7aca9eafed5b1cb.png]  
![在这里插入图片描述][38cecbec577644d8bbd3e8711eb5f9cb.png]  
![在这里插入图片描述][a785c35f2c6442d597e547c86a5f3d72.png]  
![在这里插入图片描述][9c656b108c87450a9f6a65476dd5bddf.png]

![在这里插入图片描述][37891bec7d844170a2ed675e4ed8dd26.png]  
![在这里插入图片描述][6d112b6ba0d64239a1124c52380f113f.png]  
![在这里插入图片描述][26ec88b284fc46b79596db0b26db49d3.jpeg]  
![在这里插入图片描述][e863f18878374faeb6ecc61a43bbc828.jpeg]  
![在这里插入图片描述][48101b0f8c2140b38b31a19b2f06e38e.jpeg]  
![在这里插入图片描述][99f85c0b2de04641a13719cdc8bc5c09.jpeg]  
![在这里插入图片描述][738fc5ab121f4879a356905196065b01.png]  
![在这里插入图片描述][e30c4d35b9bd4ffbab42908b76bf56be.jpeg]

rpc:

# -*- coding: utf-8 -*-
    # @Author  : Codeooo
    # @Time    : 2023-07-14
    
    
    import hashlib
    
    import frida, sys, time
    from urllib.parse import quote
    
    keyword = quote("商品")
    now_time = int(time.time())
    
    jsCode = """
        function a_liz(str, map) {
        
            var result = "";
            var Map = Java.use("java.util.TreeMap").$new();
            var HashMap = Java.use("java.util.HashMap").$new();
            // var strObj = Java.use('java.lang.String').$new();
    
            var strArray = new Array();
            strArray = map.split(",");
            for (var i = 0; i < strArray.length; i++) {
        
                var List = Java.use('java.util.ArrayList').$new();
                var key = strArray[i].split("=")[0];
                List.add(strArray[i].split("=")[1].replace("[", "").replace("]", ""));
                Map.put(key, List);
            }
            // console.log(Map);
            Java.perform(function () {
        
                Java.choose("ms.bd.c.j2$a", {
        
                    onMatch: function (obj) {
        
                        result = Java.cast(obj.onCallToAddSecurityFactor(str, Map), HashMap).toString();
                    },
                    onComplete: function () {
        
                        console.log("end");
                    }
                });
            })
            return result;
        }
    
        rpc.exports = {
        
            encrypt: a_liz,
        };
    """
    
    data = f"keyword={keyword}&offset=0&count=12&source=video_search&from_user=&search_source=normal_search&is_pull_refresh=0&hot_search=0&search_id=&query_correct_type=1&is_filter_search=0&sort_type=0&publish_time=0&search_range=0&enter_from=homepage_hot&backtrace=&user_avatar_shrink=64_64&video_cover_shrink=372_496&rs_word_count=6&location_permission=0&need_filter_settings=0&enable_history=1"
    X_SS_STUB = hashlib.md5(data.encode()).hexdigest().upper()
    str = "https://aweme.snssdk.com/aweme/v1/general/search/stream/xxxxxxxxx"
    map = "accept-encoding=[gzip], activity_now_client=[1681462266302], cookie=[store-region=cn-js; store-region-src=did; install_id=3732170013938503; ttreq=1$3d3ed40a54b302113f09f78bcadee4bf1be05acb; odin_tt=ff258b7589c691a89eeeea8fe0a412ff9eb167536130a2f7f57b3db418cb21c8e07dca0a2066b08237cdee7ab88847fa3b2b3f0b5765f7530308aa98a9a38115491c5071a3c0e73951d81dc245a17660; msToken=68aMp02Fs6w7X8bVU3nJfd9qwNG6N13ZsdWWlrW2vn86oDmrygIJDgKZ-OpB9Sp7GZqEMrRXGmSihg1QkZVd_1OuGHX45WsCEtojly9p4DM=; MONITOR_WEB_ID=20416beb-e7d6-44c7-9070-30ebbd0ff8db], passport-sdk-version=[20356], sdk-version=[2], x-ss-req-ticket=[1681462264870], x-ss-stub=[094A2062302E33904E611337243B1623], x-tt-dt=[AAATGDCFDGLWM6RUIPRDT7RBJKJQ32W3VGYDKYRVKCFJW5UDBNZ72B2X7Y35PYZJFKSXKI5R4QHROINCK6FL4SRGJB2FOK5WTG35CRXQGCO2LA2JJZGKSXJ4UKQC26LUAEOARSZCWRY32G7NUH32VDQ], x-vc-bdturing-sdk-version=[2.2.1.cn]"
    # data = [a1, a2, a3, a4, a5]
    process = frida.get_device_manager().add_remote_device().attach('抖音')
    script = process.create_script(jsCode)
    script.load()
    result = script.exports.encrypt(str, map)
    print(result)
    
    sys.stdin.read()

[224739f576f343e49d3194718371a52b.png]: https://img-blog.csdnimg.cn/224739f576f343e49d3194718371a52b.png
[25694d1c0cec4363bcf853fa1dbc205c.png]: https://img-blog.csdnimg.cn/25694d1c0cec4363bcf853fa1dbc205c.png
[77ff3889c8634f979c067cb8ffc18278.jpeg]: https://img-blog.csdnimg.cn/77ff3889c8634f979c067cb8ffc18278.jpeg
[54b33db9ac424c6bb53bd46a365c6ecd.png]: https://img-blog.csdnimg.cn/54b33db9ac424c6bb53bd46a365c6ecd.png
[https_codeooo.blog.csdn.net_article_details_120025814]: https://codeooo.blog.csdn.net//article/details/120025814
[d26d5c7bdd1946678e935e3e2ff9e320.png]: https://img-blog.csdnimg.cn/d26d5c7bdd1946678e935e3e2ff9e320.png
[c1686923f1394e1c821860db97e6c2e6.png]: https://img-blog.csdnimg.cn/c1686923f1394e1c821860db97e6c2e6.png
[a3d8db1cc2404d3b859b0e219aed9778.png]: https://img-blog.csdnimg.cn/a3d8db1cc2404d3b859b0e219aed9778.png
[cb575f838c9242399864454cc6dbaef7.png]: https://img-blog.csdnimg.cn/cb575f838c9242399864454cc6dbaef7.png
[d49e881bd88144aba7aca9eafed5b1cb.png]: https://img-blog.csdnimg.cn/d49e881bd88144aba7aca9eafed5b1cb.png
[38cecbec577644d8bbd3e8711eb5f9cb.png]: https://img-blog.csdnimg.cn/38cecbec577644d8bbd3e8711eb5f9cb.png
[a785c35f2c6442d597e547c86a5f3d72.png]: https://img-blog.csdnimg.cn/a785c35f2c6442d597e547c86a5f3d72.png
[9c656b108c87450a9f6a65476dd5bddf.png]: https://img-blog.csdnimg.cn/9c656b108c87450a9f6a65476dd5bddf.png
[37891bec7d844170a2ed675e4ed8dd26.png]: https://img-blog.csdnimg.cn/37891bec7d844170a2ed675e4ed8dd26.png
[6d112b6ba0d64239a1124c52380f113f.png]: https://img-blog.csdnimg.cn/6d112b6ba0d64239a1124c52380f113f.png
[26ec88b284fc46b79596db0b26db49d3.jpeg]: https://img-blog.csdnimg.cn/26ec88b284fc46b79596db0b26db49d3.jpeg
[e863f18878374faeb6ecc61a43bbc828.jpeg]: https://img-blog.csdnimg.cn/e863f18878374faeb6ecc61a43bbc828.jpeg
[48101b0f8c2140b38b31a19b2f06e38e.jpeg]: https://img-blog.csdnimg.cn/48101b0f8c2140b38b31a19b2f06e38e.jpeg
[99f85c0b2de04641a13719cdc8bc5c09.jpeg]: https://img-blog.csdnimg.cn/99f85c0b2de04641a13719cdc8bc5c09.jpeg
[738fc5ab121f4879a356905196065b01.png]: https://img-blog.csdnimg.cn/738fc5ab121f4879a356905196065b01.png
[e30c4d35b9bd4ffbab42908b76bf56be.jpeg]: https://img-blog.csdnimg.cn/e30c4d35b9bd4ffbab42908b76bf56be.jpeg