dy记录分析

秒速五厘米 2024-03-17 20:59 42阅读 0赞

X-SS=STUB:  
![在这里插入图片描述][224739f576f343e49d3194718371a52b.png]  
![在这里插入图片描述][25694d1c0cec4363bcf853fa1dbc205c.png]  
![在这里插入图片描述][77ff3889c8634f979c067cb8ffc18278.jpeg]  
搜索：x-tt-dt

![在这里插入图片描述][54b33db9ac424c6bb53bd46a365c6ecd.png]

var hashMap = Java.use("java.util.HashMap");
        hashMap.put.implementation = function (a, b) {
        
            console.log("hashMap.put: ", a, b);
            return this.put(a, b);
        }

[https://codeooo.blog.csdn.net//article/details/120025814][https_codeooo.blog.csdn.net_article_details_120025814]  
![在这里插入图片描述][d26d5c7bdd1946678e935e3e2ff9e320.png]

jscode = """
    Java.perform(function () {
        
       var hashMap = Java.use("java.util.HashMap");
        hashMap.put.implementation = function (a, b) {
        
            console.log("hashMap.put: ", a, b);
            return this.put(a, b);
        }
    });
    """

先降级抓包：

// frida -U -l proxy.js -no-pause -f com.ss.android.ugc.aweme
    setImmediate(function () {
        
        Java.perform(function () {
        
            var targetClass = 'org.chromium.CronetClient';
            var methodName = 'tryCreateCronetEngine';
            var gclass = Java.use(targetClass);
            gclass[methodName].overload('android.content.Context', 'boolean', 'boolean', 'boolean', 'boolean', 'java.lang.String', 'java.util.concurrent.Executor', 'boolean').implementation = function (arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7) {
        
            }
        });
        Java.perform(function () {
        
            let a = Java.use("ms.bd.c.j2$a");
            var TreeMap = Java.use('java.util.TreeMap');
            var HashMap = Java.use('java.util.HashMap');
    
            a["onCallToAddSecurityFactor"].implementation = function (str, map) {
        
                console.log(`a.onCallToAddSecurityFactor is called: str=${str}, map=${Java.cast(map, TreeMap).toString()}`);
                let result = this["onCallToAddSecurityFactor"](str, map);
                console.log("result：" + Java.cast(result, HashMap).toString());
                return result;
            };
        });
    });

![在这里插入图片描述][c1686923f1394e1c821860db97e6c2e6.png]

import frida
    import sys
    
    jscode = """
    Java.perform(function () {
        
       var hashMap = Java.use("java.util.HashMap");
        hashMap.put.implementation = function (a, b) {
        
            console.log("hashMap.put: ", a, b);
            if(a.equals("X-Ladon")){
        
                console.log("=================================================");
                console.log("hashMap.put: ", a, b);
                console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));
            }
            return this.put(a, b);
        }
    });
    """
    
    def message(msg, data):
        if msg["type"] == 'send':
            print("[*] {0}".format(msg['payload']))
        else:
            print(msg)
    
    
    # 指定要附加的设备app
    # com.ss.android.ugc.aweme
    process = frida.get_usb_device().attach('抖音')
    #
    script = process.create_script(jscode)
    script.on("message", message)
    script.load()
    sys.stdin.read()

![在这里插入图片描述][a3d8db1cc2404d3b859b0e219aed9778.png]  
![在这里插入图片描述][cb575f838c9242399864454cc6dbaef7.png]  
![在这里插入图片描述][d49e881bd88144aba7aca9eafed5b1cb.png]  
![在这里插入图片描述][38cecbec577644d8bbd3e8711eb5f9cb.png]  
![在这里插入图片描述][a785c35f2c6442d597e547c86a5f3d72.png]  
![在这里插入图片描述][9c656b108c87450a9f6a65476dd5bddf.png]

![在这里插入图片描述][37891bec7d844170a2ed675e4ed8dd26.png]  
![在这里插入图片描述][6d112b6ba0d64239a1124c52380f113f.png]  
![在这里插入图片描述][26ec88b284fc46b79596db0b26db49d3.jpeg]  
![在这里插入图片描述][e863f18878374faeb6ecc61a43bbc828.jpeg]  
![在这里插入图片描述][48101b0f8c2140b38b31a19b2f06e38e.jpeg]  
![在这里插入图片描述][99f85c0b2de04641a13719cdc8bc5c09.jpeg]  
![在这里插入图片描述][738fc5ab121f4879a356905196065b01.png]  
![在这里插入图片描述][e30c4d35b9bd4ffbab42908b76bf56be.jpeg]

rpc:

# -*- coding: utf-8 -*-
    # @Author  : Codeooo
    # @Time    : 2023-07-14
    
    
    import hashlib
    
    import frida, sys, time
    from urllib.parse import quote
    
    keyword = quote("商品")
    now_time = int(time.time())
    
    jsCode = """
        function a_liz(str, map) {
        
            var result = "";
            var Map = Java.use("java.util.TreeMap").$new();
            var HashMap = Java.use("java.util.HashMap").$new();
            // var strObj = Java.use('java.lang.String').$new();
    
            var strArray = new Array();
            strArray = map.split(",");
            for (var i = 0; i < strArray.length; i++) {
        
                var List = Java.use('java.util.ArrayList').$new();
                var key = strArray[i].split("=")[0];
                List.add(strArray[i].split("=")[1].replace("[", "").replace("]", ""));
                Map.put(key, List);
            }
            // console.log(Map);
            Java.perform(function () {
        
                Java.choose("ms.bd.c.j2$a", {
        
                    onMatch: function (obj) {
        
                        result = Java.cast(obj.onCallToAddSecurityFactor(str, Map), HashMap).toString();
                    },
                    onComplete: function () {
        
                        console.log("end");
                    }
                });
            })
            return result;
        }
    
        rpc.exports = {
        
            encrypt: a_liz,
        };
    """
    
    data = f"keyword={keyword}&offset=0&count=12&source=video_search&from_user=&search_source=normal_search&is_pull_refresh=0&hot_search=0&search_id=&query_correct_type=1&is_filter_search=0&sort_type=0&publish_time=0&search_range=0&enter_from=homepage_hot&backtrace=&user_avatar_shrink=64_64&video_cover_shrink=372_496&rs_word_count=6&location_permission=0&need_filter_settings=0&enable_history=1"
    X_SS_STUB = hashlib.md5(data.encode()).hexdigest().upper()
    str = "https://aweme.snssdk.com/aweme/v1/general/search/stream/?os_api=25&device_type=SM-G955N&ssmix=a&manifest_version_code=170901&dpi=320&is_guest_mode=0&uuid=354730496749510&app_name=aweme&version_name=17.9.0&ts=1681442612&cpu_support64=true&app_type=normal&appTheme=light&ac=wifi&host_abi=armeabi-v7a&channel=tengxun_1128_0928&update_version_code=17909900&_rticket=1681442613227&device_platform=android&iid=3732170013938503&version_code=170900&cdid=9a274230-9bbe-4f4e-b7a8-fe63b300671b&os=android&is_android_pad=0&openudid=5ec41edd562442a7&device_id=580969567366631&package=com.ss.android.ugc.aweme&resolution=900*1600&device_brand=samsung&language=zh&os_version=7.1.2&need_personal_recommend=1&aid=1128&minor_status=0&mcc_mnc=46007"
    map = "accept-encoding=[gzip], activity_now_client=[1681462266302], cookie=[store-region=cn-js; store-region-src=did; install_id=3732170013938503; ttreq=1$3d3ed40a54b302113f09f78bcadee4bf1be05acb; odin_tt=ff258b7589c691a89eeeea8fe0a412ff9eb167536130a2f7f57b3db418cb21c8e07dca0a2066b08237cdee7ab88847fa3b2b3f0b5765f7530308aa98a9a38115491c5071a3c0e73951d81dc245a17660; msToken=68aMp02Fs6w7X8bVU3nJfd9qwNG6N13ZsdWWlrW2vn86oDmrygIJDgKZ-OpB9Sp7GZqEMrRXGmSihg1QkZVd_1OuGHX45WsCEtojly9p4DM=; MONITOR_WEB_ID=20416beb-e7d6-44c7-9070-30ebbd0ff8db], passport-sdk-version=[20356], sdk-version=[2], x-ss-req-ticket=[1681462264870], x-ss-stub=[094A2062302E33904E611337243B1623], x-tt-dt=[AAATGDCFDGLWM6RUIPRDT7RBJKJQ32W3VGYDKYRVKCFJW5UDBNZ72B2X7Y35PYZJFKSXKI5R4QHROINCK6FL4SRGJB2FOK5WTG35CRXQGCO2LA2JJZGKSXJ4UKQC26LUAEOARSZCWRY32G7NUH32VDQ], x-vc-bdturing-sdk-version=[2.2.1.cn]"
    # data = [a1, a2, a3, a4, a5]
    process = frida.get_device_manager().add_remote_device().attach('抖音')
    script = process.create_script(jsCode)
    script.load()
    result = script.exports.encrypt(str, map)
    print(result)
    
    sys.stdin.read()

// frida -U -l proxy.js -no-pause -f com.ss.android.ugc.aweme
    function enableProxy() {
        
        Java.perform(function () {
        
            var targetClass = 'org.chromium.CronetClient';
            var methodName = 'tryCreateCronetEngine';
            var gclass = Java.use(targetClass);
            gclass[methodName].overload('android.content.Context', 'boolean', 'boolean', 'boolean', 'boolean', 'java.lang.String', 'java.util.concurrent.Executor', 'boolean').implementation = function (arg0, arg1, arg2, arg3, arg4, arg5, arg6, arg7) {
        
            }
        })
    }
    
    // 239
    function hookOnCallToAddSecurityFactor() {
        
        Java.perform(function () {
        
            let a = Java.use("ms.bd.c.j2$a");
            a["onCallToAddSecurityFactor"].implementation = function (str, map) {
        
                console.log(`a.onCallToAddSecurityFactor is called: str=${
          str}, map=${
          map}`);
                let result = this["onCallToAddSecurityFactor"](str, map);
                console.log(`a.onCallToAddSecurityFactor result=${
          result}`);
                var TreeMap = Java.use('java.util.TreeMap');
                console.log("map：" + Java.cast(map, TreeMap).toString());
                var HashMap = Java.use('java.util.HashMap');
                console.log("result：" + Java.cast(result, HashMap).toString());
                return result;
            };
        });
    }
    
    
    
    function hook2610God() {
        
        Java.perform(function () {
        
            let a = Java.use("ms.bd.c.q2$a");
            a["onCallToAddSecurityFactor"].implementation = function (str, map) {
        
                console.log(`a.onCallToAddSecurityFactor is called: str=${
          str}, map=${
          map}`);
                let result = this["onCallToAddSecurityFactor"](str, map);
                console.log(`a.onCallToAddSecurityFactor result=${
          result}`);
                var TreeMap = Java.use('java.util.TreeMap');
                console.log("map：" + Java.cast(map, TreeMap).toString());
                var HashMap = Java.use('java.util.HashMap');
                console.log("result：" + Java.cast(result, HashMap).toString());
                return result;
            };
        });
    }
    
    function hookHashMap() {
        
        Java.perform(function () {
        
            setTimeout(() => {
        
                var hashMap = Java.use("java.util.HashMap");
                hashMap.put.implementation = function (a, b) {
        
                    console.log("hashMap.put: ", a, b);
                    return this.put(a, b);
                }
            }, 5000);
    
        });
    }
    
    //239
    function hookHashMapAndThrowable() {
        
        Java.perform(function () {
        
            setTimeout(() => {
        
                var hashMap = Java.use("java.util.HashMap");
                hashMap.put.implementation = function (a, b) {
        
                    if (a.equals("X-Helios")) {
        
                        console.log(Java.use("android.util.Log").getStackTraceString(Java.use("java.lang.Throwable").$new()));
                    }
                    return this.put(a, b);
                }
            }, 10000)
        });
    }
    
    function a_liz(str, map) {
        
        var result = "";
        var Map = Java.use("java.util.TreeMap").$new();
        var HashMap = Java.use("java.util.HashMap").$new();
        // var strObj = Java.use('java.lang.String').$new();
    
        var strArray = new Array();
        strArray = map.split(",");
        for (var i = 0; i < strArray.length; i++) {
        
            var List = Java.use('java.util.ArrayList').$new();
            var key = strArray[i].split("=")[0];
           List.add(strArray[i].split("=")[1].replace("[", "").replace("]", ""));
            // List.add(strArray[i].replace(key + '=', '').replace("[", "").replace("]", ""));
            Map.put(key, List);
        }
          console.log(Map);
        Java.perform(function () {
        
            Java.choose("ms.bd.c.j2$a", {
        
                onMatch: function (obj) {
        
                    console.log(123123);
                    result = Java.cast(obj.onCallToAddSecurityFactor(str, Map), HashMap).toString();
                },
                onComplete: function () {
        
                    console.log("end");
                }
            });
        })
        console.log('-------------------------');
        return result;
    }
    
    // rpc.exports = {
        
    //     encrypt: a_liz,
    // };
    
    // a_liz("https://aweme.snssdk.com/aweme/v1/general/search/stream/?os_api=25&device_type=SM-G955N&ssmix=a&manifest_version_code=170901&dpi=320&is_guest_mode=0&uuid=354730496749510&app_name=aweme&version_name=17.9.0&ts=1681442612&cpu_support64=true&app_type=normal&appTheme=light&ac=wifi&host_abi=armeabi-v7a&channel=tengxun_1128_0928&update_version_code=17909900&_rticket=1681442613227&device_platform=android&iid=3732170013938503&version_code=170900&cdid=9a274230-9bbe-4f4e-b7a8-fe63b300671b&os=android&is_android_pad=0&openudid=5ec41edd562442a7&device_id=580969567366631&package=com.ss.android.ugc.aweme&resolution=900*1600&device_brand=samsung&language=zh&os_version=7.1.2&need_personal_recommend=1&aid=1128&minor_status=0&mcc_mnc=46007", "accept-encoding=[gzip], activity_now_client=[1681462266302], cookie=[store-region=cn-js; store-region-src=did; install_id=3732170013938503; ttreq=1$3d3ed40a54b302113f09f78bcadee4bf1be05acb; odin_tt=ff258b7589c691a89eeeea8fe0a412ff9eb167536130a2f7f57b3db418cb21c8e07dca0a2066b08237cdee7ab88847fa3b2b3f0b5765f7530308aa98a9a38115491c5071a3c0e73951d81dc245a17660; msToken=68aMp02Fs6w7X8bVU3nJfd9qwNG6N13ZsdWWlrW2vn86oDmrygIJDgKZ-OpB9Sp7GZqEMrRXGmSihg1QkZVd_1OuGHX45WsCEtojly9p4DM=; MONITOR_WEB_ID=20416beb-e7d6-44c7-9070-30ebbd0ff8db], passport-sdk-version=[20356], sdk-version=[2], x-ss-req-ticket=[1681462264870], x-ss-stub=[094A2062302E33904E611337243B1623], x-tt-dt=[AAATGDCFDGLWM6RUIPRDT7RBJKJQ32W3VGYDKYRVKCFJW5UDBNZ72B2X7Y35PYZJFKSXKI5R4QHROINCK6FL4SRGJB2FOK5WTG35CRXQGCO2LA2JJZGKSXJ4UKQC26LUAEOARSZCWRY32G7NUH32VDQ], x-vc-bdturing-sdk-version=[2.2.1.cn]")
    
    setImmediate(function () {
        
        enableProxy();
        // hookHashMap();
        // hookHashMapAndThrowable()
        // hook2610God()
        // hookOnCallToAddSecurityFactor();
    });

[224739f576f343e49d3194718371a52b.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/14/cf78608e6f3644b0b95cd5ddb8d91d14.png
[25694d1c0cec4363bcf853fa1dbc205c.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/14/de984a33fa6e4813a3fcc772d7b086ac.png
[77ff3889c8634f979c067cb8ffc18278.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/14/c914778dafa64df0971bcb25fceb531a.png
[54b33db9ac424c6bb53bd46a365c6ecd.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/14/d11e84ed529f432e974a7c35f49f65a2.png
[https_codeooo.blog.csdn.net_article_details_120025814]: https://codeooo.blog.csdn.net//article/details/120025814
[d26d5c7bdd1946678e935e3e2ff9e320.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/14/e7c6a78e4c274b82a45ddc2564966854.png
[c1686923f1394e1c821860db97e6c2e6.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/14/fb1bdc46c00c4b5285405cd73d82f02f.png
[a3d8db1cc2404d3b859b0e219aed9778.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/14/38258e8bd9384aefba0595a0f2d3db88.png
[cb575f838c9242399864454cc6dbaef7.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/14/3375c431a6b647a6ab674b3f7d278b3f.png
[d49e881bd88144aba7aca9eafed5b1cb.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/14/a6521b786bd74d9ebcce3da9134957e2.png
[38cecbec577644d8bbd3e8711eb5f9cb.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/14/fa538ad82ac9439d8445466bd9e49238.png
[a785c35f2c6442d597e547c86a5f3d72.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/14/a07238136bfc487896815818b308e9a3.png
[9c656b108c87450a9f6a65476dd5bddf.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/14/e281fa1dace847b6afc2ed4ea495be6a.png
[37891bec7d844170a2ed675e4ed8dd26.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/14/d1d31ec923214c39ae7ca2f257f63a6f.png
[6d112b6ba0d64239a1124c52380f113f.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/14/716a3057a2ee4bce9520439daa53593a.png
[26ec88b284fc46b79596db0b26db49d3.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/14/16b45b23cd80418cb2ae879b24c2f341.png
[e863f18878374faeb6ecc61a43bbc828.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/14/fb50c2caf1bc4350b2964ab609860eca.png
[48101b0f8c2140b38b31a19b2f06e38e.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/14/520c54ab46fb40ba8d55dfe4c3c55aa9.png
[99f85c0b2de04641a13719cdc8bc5c09.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/14/6fe63888b7bf448995c1115b7f864df7.png
[738fc5ab121f4879a356905196065b01.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/14/69b1c15930bb49b39079bd66a2dcc145.png
[e30c4d35b9bd4ffbab42908b76bf56be.jpeg]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/14/eafeccdd5cbc4708bdf96b61622ea3d0.png