前言# 声明文章内容仅供学习参考严禁用于商业用途否则由此产生一切后果与作者无关如有侵权请联系作者进行删除。2022.04.20前言frida, jadxidaunidbgapk版本22.03.02由于该款软件为海外软件故需要采用一些科学的方法才能访问和采集但抓包工具本身也是一层代理这不是冲突了吗还好fiddler和charles有对应功能给我们解决这个问题这里以fiddler为例由于是海外软件需要自备工具确定我们可以成功链接上app后wins寻找下internet选项中可以看到对应端口然后回到fiddler中设置网关这样就能成功抓包了解决完这些前提正式抓包本次分析的是登录页。1.逻辑分析1.1 抓包输入要登录的账号和密码后可抓到包如下好家伙全给加密了一点东西都看不到上jadx直接反编译一波一通寻找后马上可以找到好家伙在so层作为爬虫工程师对这些init函数需要非常敏感跟so层的callJniinit一般一般会让人摸不着头脑为什么报错这里通过对三个init函数进行hook可以发现当打开apk后会走initHttpParamsSNative函数传入字段0,unknown,Pixel,1650432878472,90c13502-db34-4166-8557-588509328e5f, 返回就是请求头中的zcid,看起来就很像aes这里我们保持怀疑 这些字段其实就代表了设备信息一台设备肯定就接受不了太多请求的狂轰滥炸1.2 so层定位那是动态注册还是静态注册呢在哪个so呢比起System.loadLibrary这时候我想到了前辈们造的轮子yang神的hook_RegisterNatives.js上frida运行一波找不到那就极大可能是静态注册接着利用一个骚操作就是 frida-trace -FU -i “Java_com_*”可以看到当我们操作后点击手机后会生成一个临时文件这时候就可以惊喜的发现简简单单libnative_utils就是我们定位到的so文件舒服。2. so层分析2.1 initHttpParamsSNative我们通过firda hook java层 generateSignatureNative的入参和结果initHttpParamsSNative arg1:0,unknown,Pixel,1650432878472,90c13502-db34-4166-8557-588509328e5f这里能看到这个软件还是很友好哈进到sub_13324中对可疑的函数下断点对于so层的分析往往需要去分析某些函数的入参和结果有好几种方式这里上unidbg首先先使用frida或objection去截取入参然后在unidbg种跑起来packagecom.zalo;importcom.github.unidbg.AndroidEmulator;importcom.github.unidbg.Emulator;importcom.github.unidbg.Module;importcom.github.unidbg.file.FileResult;importcom.github.unidbg.file.IOResolver;importcom.github.unidbg.linux.android.AndroidEmulatorBuilder;importcom.github.unidbg.linux.android.AndroidResolver;importcom.github.unidbg.linux.android.dvm.*;importcom.github.unidbg.memory.Memory;importjava.io.File;publicclasszaloextendsAbstractJniimplementsIOResolver{privatefinalAndroidEmulatoremulator;privatefinalModulemodule;privatefinalVMvm;privatefinalDvmClassNativeClass;publiczalo(){emulatorAndroidEmulatorBuilder.for64Bit().setProcessName(com.zing.zalo).build();// 创建模拟器实例要模拟32位或者64位在这里区分finalMemorymemoryemulator.getMemory();// 模拟器的内存操作接口memory.setLibraryResolver(newAndroidResolver(23));// 设置系统类库解析emulator.getSyscallHandler().addIOResolver(this);//注册绑定IO重定向vmemulator.createDalvikVM(newFile(unidbg-android/src/test/java/com/zalo/zalo.apk));vm.setJni(this);//设置JNIvm.setVerbose(true);// 打印日志DalvikModuledmvm.loadLibrary(native_utils,true);moduledm.getModule();// 加载好的so对应为一个模块DAB0emulator.attach().addBreakPoint(module.base0x133FC);emulator.attach().addBreakPoint(module.base0x106AC);dm.callJNI_OnLoad(emulator);// 调用JNI OnloadNativeClassvm.resolveClass(com/zing/zalocore/utils/cryptology/CoreUtils);}publicstaticvoidmain(String[]args){zalo zalonewzalo();zalo.initHttpParamsSNative();}OverridepublicFileResultresolve(Emulatoremulator,Stringpathname,intoflags){System.out.println(访问pathname);returnnull;}publicvoidinitHttpParamsSNative(){Stringarg10,unknown,Pixel,1650359262073,90c13502-db34-4166-8557-588509328e5f;StringmethodSiginitHttpParamsSNative(Ljava/lang/String;)V;NativeClass.newObject(null).callJniMethod(emulator,methodSig,arg1);}OverridepublicDvmObject?callStaticObjectMethodV(BaseVMvm,DvmClassdvmClass,Stringsignature,VaListvaList){switch(signature){casecom/zing/zalocore/CoreUtility-getAppContext()Landroid/content/Context;:{returnvm.resolveClass(android/content/Context).newObject(signature);}}returnsuper.callStaticObjectMethodV(vm,dvmClass,signature,vaList);}}在0x106AC上断了下来入参来自sub_122C4进去一看还有sub_F8E8, 像极了aes的密钥编排算法马上试试且是写死在so中的那么加密完的数据用来干什么呢我们接着往下看大概额逻辑就是zcid_input0,unknown,Pixel,1649665149902,90c13502-db34-4166-8557-588509328e5fzcid422924f0981e3b67375d352b30d556c2b1cf3643d97cf076d0e99555cf2615caf3913456d239e418a462315c83e7f8bfe8f6b2612e1b7fec42992611002c8dbca9bd41cc13508dde64217a693111b0fcaes_keyforindexinrange(0,16):aes_keyzcid[2*index]v24(len(zcid_input)4294967280)16v172*v24 v18zcid[v17-1]v19v17-3aes_keyv18foriinrange(17,32):v21zcid[v19]v19-2aes_keyv21returnaes_key可以很明显看出把加密出来的zcid的取不同的位数组成一个新32字段的值放在固定的地址中为什么这么做呢有经验的人已经猜出来了至此initHttpParamsSNative函数我们就分析完了。2.2 generateSignatureNative为加密参数sig的加密果然友好硕大的MD5Update我们通过firda hook java层 generateSignatureNative的入参和结果generateSignatureNative arg1:api_key0be3747aacc670a51a83230bcfe80173data0874802BBFDAF1526FCEEA1875D7BCC14971103443E613EAB63AA893F1838FB44D3BFC477ACAEE03CB0A3807E23DBDEBC05CE17634AA6933E2A37FFF50160C1A4EC120FC71F32A08A6D94200B5BCDDE8B1E62CD123C2D3CE26EBC930A1D6F40E4819FD81DCCFCB0A527A907FCDDB17FBCEC941963656FCA2F50AE95050FE0624F334C597D7EE151E7F62390CEBFC1DDDF9EAC7707D8D663B67C05A9352C691C9BB4C33B050D1372FBD18B1C86BCEAA478DE2018B4159C09B1B83A5BF4FD12A2EF4B39766517E2D6A358BDEDA33FB719692EBE3F1DD57C829C1E072127D614851B3604A1FA32CAD86D23CCE042CAABE834E3D0A7BD6666B818E12DA033527480854BF6DF0FA2957BC57A0C3E31D79177990B25A28C43BC573084ACE48D7596CD5461C686363A1F842B8A174697026D9D42654C7E46F41FE352A5EBDB0F22CD0A558BAB4CAB1030F8926558B73D20BD9DE8FF4B777E4A446A2E7CE8A2C342F9E1802AC3F2C4C087615B5B71B419B08030F6E2D82C1869240D5DD8356A5FA20AEB2BA2CDC400E5069E59E516481BD66CCCC2C9F857642861E4CE1EEB452AD84C589B324F90F3BC6869C264EC25C754FCD9A3063BEFD917D40B2023224975F33B897664A2C75E3AB7D51B599270F4288BA37B9CE40E699A937F1B9628DDF39C0F7260B0F97C6231E3C6827AFAFE16675E4F5AE62C4A5C6203C2D29FE908B4D435A689F875AC451C07AF16E070A6F7DFFAF49FD0C99AFFAAAEA82163E856ED03BAEF021C2F34954363DD748916934F2507F478A796FB52B4A822D6F409ADD5140EF9ADBFE2F7328F1F3E12D77D29AFC7831394D0392A881B183A2F63D3B0926E54855A44E9E693098477BDC22468C43190F22D80E3AC3E889087D522173164178990183BBD13E978457B38D63335B85C4137952F21F24CABC35D16B3D390154BB428D56F65BEAA9DD787E1BCAC4A5078AB6EA9954E2A1D060A20A14065590A97BA7513394EB6D1C8DE23D5AE9AC2B75529274BD8833491355398C40CE445F2A6A460AEA17A58859E20D36FD4EB0A9C31DFAC0636080793828D8D838A19550EAEA6AF82F10A4F57D2C181563C93AF828A1D912310407EB6998739694C9A79A292658AE7B7F2F48BFB6AF6617BA76C4F291C799FAB44EE292C5763A565BE03031FD0603325A979E5ED846BFEBFFE00C8590E0FD02E73716ACBFE8A18F85B7D063C44F98060433BBC1B44492ED30B6DD09A8746E4A2478AB56C8CEC6256DC1BFD7827BD6EC58E67A7E49BC1A92D063744B964A2312ADF8DA8387B0803119C25DC1E33A10CFB4AB5012E5CDCBA5D25A99412C05C60F0253DC09C2A796755A82F23827530111595E29F408B2A39F54C45026B4B0033B2D9BCA98E7770D0FFCBE4AFBCA6F71F26E7C607753724FC7512DCD255DDC28110962D57084C14138D3EF0FFDA66954A1B02462C914AA33B527215378B2100BFE6D4496D16A0BA238D6FA197B3F948E3D977AFE374787A9218376A9BC8724F005FEBA7A64FC195E5E3761FE41A95B7049FD80DCC7B504122C7FBB41740DF4880CB5EAB28B5FF1787FE30C0C59DFA4F828D6B6CD7E0B89715550D4FA8E799715BB4FDD534080A968BFC1623B9DD2180257AF8863A171C6FAB58F609FA1D80A325E3D698CE3773D62A6EC1F1922BF037D9907ECD05AB9BF84DCA78D864B76923617CDC226AB821ABE5D98979F776DF0FC3671AD6D90366B05D9B828721D6AE27F4D760150C5A0EB34C334B6F82331B2F7F5F94CCDD13CD186F79EB9C2B70EC838C7AB3F7B58CE00FBCE4E74F5A6D3AF5664635AB60F0CD0A3643755D74EF459890B746037D1EF2B4C346BC19570D038D7CC3CB81C31DC39C887F08518572990824407FF36730F297A348F59182258EC342C9D5223611BF035E891FD27D1DEA8C2DC485BB30C54FFBD57C7C385AA7442C6B053671988BC5091C0014B1F7C3CF278EFBABEC261A811EE3A53A89A1FD52F5A933517AB11807494AEA5115CA0BDBF881C7959E66319212619BE5DA681BB858E48C9A03465D0D0805CDCC68AB1ABB4D9D244C901F616A3827102ECC366DB787450BC1DB0B72AF82C4B452A8DCC6A6F9621AC029F2A01698C752852249FA5790030858B7023AC017D06436E2937950FC54CEC1C4019F75EFED04C262A19D0E7F39B65FACE55EB4DC1AF33CBA1ECAAB7BCD2DA6B24A201434EFBB7C12AB913DCAE6A86826CB90856E4297EC39CD5913D458E5D44D55FC99C9C468D1B7CF5D3CFBEB5936A7E19EA856B81433FAB8A10AD63BF93B8E345DD8B9415C0963F8040100533A369A42F13EDD2D052FFC2728971A97034C896BC0E707E3631E0E030B8BAF21865A3CFA6292A04686427854DC9A29E1D0C35C0B3E5EADF0C2D6196C79D6ABD862BCA698ACCE23724887EF934855F30101028346B0754920FDE5EF0A573FBCBE1A7E3BC3C31E2CB780B169EC0EFF600BB04E4270BCF00A01237A7D8B1812CA7FF73076C937449E4EE8AF4989946845B019214AA89836916B3C7033C24A517D9C75183E7E5655E47195B232178C6B17A2CC70278BDB2DD0CEBCBDF8B2777527C2B0A2E0684102F668ABEE61B6F73F003BB587A13F58583D90268087BF8AF6945E976A3DAFEE8BA2B66A80B1806585A024CE4D97671210BF1D86FB838E9950619EFE0333AB4D48D04991F2158E33147399E4EE4A9A5BBADDBB786B70D956A0AF116F110E7EA6E747E313A12D22AB9DE356D67D98D6F7C03EC693633BE69CB6CEB95FC02E82F83C284FB5401641EB96BAA7B211D4812202BEA93A59D2D9EC4B7FE3FAED93D995DE8F4D10D9F0877B67CABB262C5F829966B202972E8B7701E6FB8BF5E8050A3E2C0C893C49D907A9C4B14FA3C5AAF9FD72D67BC6AD1904344DCE38B3F11E466DA3A4FDC6E1188A201AEC83DA879888C61C022BE28950DF680A69BAC819E8C39FE1AC48C61621CF93B38D4ACDC4F1FFF2F3B24DC3827242A51398F07082F66962F079DD117659816B7216A461C8BC5B4DC297A00499A2CC1D4F5D81607A75067C354A255BFF99744CF553E11F8A7EF14268C8E8C44D650BBC667DF84F3682C6C1463A1901CDA6D0AC6769DC40B6833D2B3D37BE26ECCB76FB0A018E1962F2494290CFDD82B1E48218F76C857733E5FB5E5EE5B6C8DB8A8410F004E66D11A7715F551ACF0A778CDEA4299BF5921194BC1702ED540E25809C8F95271745321789F1FBAADFA05AAFF15EF8BC539DFB171486430890101626132166C5E8AA885967884D1BA03F10EB3E4356AE4B191962DF65F541E9D8DCB76A1FFDAACC641603850D5DF8F2E795301F12CED5F0E45243B16A9709D349604D9BBAABF86120453F549C6759130B3E8C40C2199FDEC33E55705EDA78539DA646E9A4DA03B0A1718A0C2F42823BFDFAB565F3903D750B3B0C9E55E796251F01F422599F8FC59C8D52BE9465532FDFFBE8D93CB2B9BAAFE7323AA06D3CCB880D8A56B7BC3C21B36D6E1B80E0056F0A575959F4FD3D830E844EB037A40E20CB0B6EA70EBFE003A28C6AB1B948B57A656BCFD3C280E1A40E057CC69066891C0FCD5AAA92BB663B1ABAE7D00D3179B505A04B87DD462438BC6D33307246626C51BC533860907085786430325042B7E0237D70FD583D4D17B0C23005282F287FA598F3C3D1A9657D1546C3CDB802C257427B3ACEE8BABAA835DAE07855B2EEE7C9038CB03423747C5FC7CEA5F765F5E09F8519612DDA31D0F455DCF62E01137ACB0F8D49B919C9574B7DAC0CEA5ADBB7E42CEEB32D24CD82AC6A948047DDDDF95947934C0C219BB13C31456B44656EEB94413DB836865AC1DE66C19F0E48C65736258398D28411AC208CD72E4B1D43689CCC007CF3E036B23D1118D9DFAE3B5904D00C97602A407E1AA0FA73D64F2BF96DB54BC2153F837B04A9B2BAA520774B3600646CDC9E6DF09AB62562146A721645E0B61C9B77F03 generateSignatureNative result:9dc83268575ea8a37d7ed09d0d811bff通过阅读伪代码可以看到进行了两次MD5Update 通过对MD5的了解多次Update相当于字段拼接;没错就是加盐在MD5Update 0x11648 处下断点可发现值为验证通过至此generateSignatureNative为加盐md5加密分析完成2.3 encodeHttpParamsNative为加密参数data的加密我们通过firda hook java层 encodeHttpParamsNative的入参和结果encodeHttpParamsNative arg1:{ckeyset:AAAHYfE0FG4,width:1080,captcha_value:,height:1794,error_code_fallback:1,model:Google_Pixel_10,distributor_mobile_tracking:,clientVersion:12100612,heap:512,avatarSize:160,client_version:12100612,advertising_id:90c13502-db34-4166-8557-588509328e5f,phone_num:8613888888888,build_info:{\APK_LANGUAGE\:\0\,\APPLICATION_ID\:\com.zing.zalo\,\BUILDER\:\khanhtm\,\BUILD_ID\:\4d5c1b84-cd3d-41b3-834a-4a45d6a576d6\,\BUILD_LITE_MODE\:\false\,\BUILD_MEDIUM_MODE\:\false\,\BUILD_PLAY_STORE\:\true\,\BUILD_TIME\:\2022\\\/03\\\/30 11:52:57\,\BUILD_TYPE\:\release\,\CI\:\true\,\DEBUG\:\false\,\DISABLE_MULTIDEX\:\false\,\DISTRIBUTOR\:\GOO\,\ENABLE_BITMAP_POOL\:\true\,\ENABLE_DEBUG_BRIDGE_STETHO\:\false\,\ENABLE_DEBUG_LEAK_CANARY\:\false\,\ENABLE_FINGERPRINT\:\true\,\ENABLE_FIREBASE_CRASHLYTICS\:\true\,\ENABLE_NETWORK_CONTROL\:\true\,\GIT_BRANCH\:\release_220302\,\GIT_COMMIT\:\31613a0\,\PRELOAD_BUILD\:\false\,\USE_FILE_LOGGING\:\true\,\USE_QUICK_STICKER_POPUP_MSG\:\true\,\USE_SMS_FEATURE\:\false\,\VERSION_CODE\:\12100612\,\VERSION_NAME\:\22.03.02\},mac_address:AC:37:43:E0:5F:83,device_identifier:2002.SSZ-wu8DGTLrXQddcmj2d26MfkpQKrwCUe7jfzTNMOftXw2drLKLZtA0gAhKNXk7.1,local_time:1650432907013,sign:,zcid:1_422924F0981E3B67375D352B30D556C23D5CCD3E949F3A802D97BFFF4C2B140B126C3689A11EF5D02134F7B0459E241F416C570FB604A00618764E0BB0EF80E723A516E36A7B5B4544CC4449968D36AB,network:0,time_zone:08:00,protover:1,distributor:GOO,source_type:1,language:en,android_id:16edebed9b04ce88,imei:000000,cs:7ad1cddec8101b35cc2fa47c46b8c84f,checkActiveCode:1,deviceInfo:{\CPU_Processor\:\aarch64\,\CPU_Hardware\:\\,\CPU_Architecture\:\8\,\CPU_MAXFreq\:\1593\,\CPU_MINFreq\:\307\,\CPU_NumCore\:\4\,\Model\:\Pixel\,\Battery_Technology\:\Li-ion\,\Temperature\:\34.5\,\Voltage\:\3922\,\SimCardSlot\:\1\,\SimCardNumber\:\\,\SensorStepCount\:\1\,\SensorAccelerator\:\1\,\NonMarketAllowed\:\1\},source_action:0,captcha_token:,preload_info:unknown,source_switch:0,answer_type:,user_language:en,password:9af91d5ff305b68a8b9401db6e2544ba,iso_country_code:CN,hcm_token:,api_key:0be3747aacc670a51a83230bcfe80173,certificatedKey:9487ba76b32e9e36785fb4c3540021f85af8d7b7,inc_p:1,fcm_token:ckRFcMIoQoezS_de-njfBl:APA91bGZcU6eCpbZlSpHZzHGWikBy8kiMV__omQeKzH4RFw629XKbl2qzjyzLxretQjV4HNGNAncGRU7K6hVQsy94YDZQtA5t0wFBuXFiinGFbj_U4Fb0Wnq-eTmz_iKYcH-uIQ-iklh,operator:-1,answer_value:,question_type:,clientType:1,ts:0,switch_account:,session_key:,type:1}encodeHttpParamsNative result:0874802BBFDAF1526FCEEA1875D7BCC14971103443E613EAB63AA893F1838FB44D3BFC477ACAEE03CB0A3807E23DBDEBC05CE17634AA6933E2A37FFF50160C1A4EC120FC71F32A08A6D94200B5BCDDE8B1E62CD123C2D3CE26EBC930A1D6F40E4819FD81DCCFCB0A527A907FCDDB17FBCEC941963656FCA2F50AE95050FE0624F334C597D7EE151E7F62390CEBFC1DDDF9EAC7707D8D663B67C05A9352C691C9BB4C33B050D1372FBD18B1C86BCEAA478DE2018B4159C09B1B83A5BF4FD12A2EF4B39766517E2D6A358BDEDA33FB719692EBE3F1DD57C829C1E072127D614851B3604A1FA32CAD86D23CCE042CAABE834E3D0A7BD6666B818E12DA033527480854BF6DF0FA2957BC57A0C3E31D79177990B25A28C43BC573084ACE48D7596CD5461C686363A1F842B8A174697026D9D42654C7E46F41FE352A5EBDB0F22CD0A558BAB4CAB1030F8926558B73D20BD9DE8FF4B777E4A446A2E7CE8A2C342F9E1802AC3F2C4C087615B5B71B419B08030F6E2D82C1869240D5DD8356A5FA20AEB2BA2CDC400E5069E59E516481BD66CCCC2C9F857642861E4CE1EEB452AD84C589B324F90F3BC6869C264EC25C754FCD9A3063BEFD917D40B2023224975F33B897664A2C75E3AB7D51B599270F4288BA37B9CE40E699A937F1B9628DDF39C0F7260B0F97C6231E3C6827AFAFE16675E4F5AE62C4A5C6203C2D29FE908B4D435A689F875AC451C07AF16E070A6F7DFFAF49FD0C99AFFAAAEA82163E856ED03BAEF021C2F34954363DD748916934F2507F478A796FB52B4A822D6F409ADD5140EF9ADBFE2F7328F1F3E12D77D29AFC7831394D0392A881B183A2F63D3B0926E54855A44E9E693098477BDC22468C43190F22D80E3AC3E889087D522173164178990183BBD13E978457B38D63335B85C4137952F21F24CABC35D16B3D390154BB428D56F65BEAA9DD787E1BCAC4A5078AB6EA9954E2A1D060A20A14065590A97BA7513394EB6D1C8DE23D5AE9AC2B75529274BD8833491355398C40CE445F2A6A460AEA17A58859E20D36FD4EB0A9C31DFAC0636080793828D8D838A19550EAEA6AF82F10A4F57D2C181563C93AF828A1D912310407EB6998739694C9A79A292658AE7B7F2F48BFB6AF6617BA76C4F291C799FAB44EE292C5763A565BE03031FD0603325A979E5ED846BFEBFFE00C8590E0FD02E73716ACBFE8A18F85B7D063C44F98060433BBC1B44492ED30B6DD09A8746E4A2478AB56C8CEC6256DC1BFD7827BD6EC58E67A7E49BC1A92D063744B964A2312ADF8DA8387B0803119C25DC1E33A10CFB4AB5012E5CDCBA5D25A99412C05C60F0253DC09C2A796755A82F23827530111595E29F408B2A39F54C45026B4B0033B2D9BCA98E7770D0FFCBE4AFBCA6F71F26E7C607753724FC7512DCD255DDC28110962D57084C14138D3EF0FFDA66954A1B02462C914AA33B527215378B2100BFE6D4496D16A0BA238D6FA197B3F948E3D977AFE374787A9218376A9BC8724F005FEBA7A64FC195E5E3761FE41A95B7049FD80DCC7B504122C7FBB41740DF4880CB5EAB28B5FF1787FE30C0C59DFA4F828D6B6CD7E0B89715550D4FA8E799715BB4FDD534080A968BFC1623B9DD2180257AF8863A171C6FAB58F609FA1D80A325E3D698CE3773D62A6EC1F1922BF037D9907ECD05AB9BF84DCA78D864B76923617CDC226AB821ABE5D98979F776DF0FC3671AD6D90366B05D9B828721D6AE27F4D760150C5A0EB34C334B6F82331B2F7F5F94CCDD13CD186F79EB9C2B70EC838C7AB3F7B58CE00FBCE4E74F5A6D3AF5664635AB60F0CD0A3643755D74EF459890B746037D1EF2B4C346BC19570D038D7CC3CB81C31DC39C887F08518572990824407FF36730F297A348F59182258EC342C9D5223611BF035E891FD27D1DEA8C2DC485BB30C54FFBD57C7C385AA7442C6B053671988BC5091C0014B1F7C3CF278EFBABEC261A811EE3A53A89A1FD52F5A933517AB11807494AEA5115CA0BDBF881C7959E66319212619BE5DA681BB858E48C9A03465D0D0805CDCC68AB1ABB4D9D244C901F616A3827102ECC366DB787450BC1DB0B72AF82C4B452A8DCC6A6F9621AC029F2A01698C752852249FA5790030858B7023AC017D06436E2937950FC54CEC1C4019F75EFED04C262A19D0E7F39B65FACE55EB4DC1AF33CBA1ECAAB7BCD2DA6B24A201434EFBB7C12AB913DCAE6A86826CB90856E4297EC39CD5913D458E5D44D55FC99C9C468D1B7CF5D3CFBEB5936A7E19EA856B81433FAB8A10AD63BF93B8E345DD8B9415C0963F8040100533A369A42F13EDD2D052FFC2728971A97034C896BC0E707E3631E0E030B8BAF21865A3CFA6292A04686427854DC9A29E1D0C35C0B3E5EADF0C2D6196C79D6ABD862BCA698ACCE23724887EF934855F30101028346B0754920FDE5EF0A573FBCBE1A7E3BC3C31E2CB780B169EC0EFF600BB04E4270BCF00A01237A7D8B1812CA7FF73076C937449E4EE8AF4989946845B019214AA89836916B3C7033C24A517D9C75183E7E5655E47195B232178C6B17A2CC70278BDB2DD0CEBCBDF8B2777527C2B0A2E0684102F668ABEE61B6F73F003BB587A13F58583D90268087BF8AF6945E976A3DAFEE8BA2B66A80B1806585A024CE4D97671210BF1D86FB838E9950619EFE0333AB4D48D04991F2158E33147399E4EE4A9A5BBADDBB786B70D956A0AF116F110E7EA6E747E313A12D22AB9DE356D67D98D6F7C03EC693633BE69CB6CEB95FC02E82F83C284FB5401641EB96BAA7B211D4812202BEA93A59D2D9EC4B7FE3FAED93D995DE8F4D10D9F0877B67CABB262C5F829966B202972E8B7701E6FB8BF5E8050A3E2C0C893C49D907A9C4B14FA3C5AAF9FD72D67BC6AD1904344DCE38B3F11E466DA3A4FDC6E1188A201AEC83DA879888C61C022BE28950DF680A69BAC819E8C39FE1AC48C61621CF93B38D4ACDC4F1FFF2F3B24DC3827242A51398F07082F66962F079DD117659816B7216A461C8BC5B4DC297A00499A2CC1D4F5D81607A75067C354A255BFF99744CF553E11F8A7EF14268C8E8C44D650BBC667DF84F3682C6C1463A1901CDA6D0AC6769DC40B6833D2B3D37BE26ECCB76FB0A018E1962F2494290CFDD82B1E48218F76C857733E5FB5E5EE5B6C8DB8A8410F004E66D11A7715F551ACF0A778CDEA4299BF5921194BC1702ED540E25809C8F95271745321789F1FBAADFA05AAFF15EF8BC539DFB171486430890101626132166C5E8AA885967884D1BA03F10EB3E4356AE4B191962DF65F541E9D8DCB76A1FFDAACC641603850D5DF8F2E795301F12CED5F0E45243B16A9709D349604D9BBAABF86120453F549C6759130B3E8C40C2199FDEC33E55705EDA78539DA646E9A4DA03B0A1718A0C2F42823BFDFAB565F3903D750B3B0C9E55E796251F01F422599F8FC59C8D52BE9465532FDFFBE8D93CB2B9BAAFE7323AA06D3CCB880D8A56B7BC3C21B36D6E1B80E0056F0A575959F4FD3D830E844EB037A40E20CB0B6EA70EBFE003A28C6AB1B948B57A656BCFD3C280E1A40E057CC69066891C0FCD5AAA92BB663B1ABAE7D00D3179B505A04B87DD462438BC6D33307246626C51BC533860907085786430325042B7E0237D70FD583D4D17B0C23005282F287FA598F3C3D1A9657D1546C3CDB802C257427B3ACEE8BABAA835DAE07855B2EEE7C9038CB03423747C5FC7CEA5F765F5E09F8519612DDA31D0F455DCF62E01137ACB0F8D49B919C9574B7DAC0CEA5ADBB7E42CEEB32D24CD82AC6A948047DDDDF95947934C0C219BB13C31456B44656EEB94413DB836865AC1DE66C19F0E48C65736258398D28411AC208CD72E4B1D43689CCC007CF3E036B23D1118D9DFAE3B5904D00C97602A407E1AA0FA73D64F2BF96DB54BC2153F837B04A9B2BAA520774B3600646CDC9E6DF09AB62562146A721645E0B61C9B77F03可以看到这里跟init函数一般一样用了aes加密同样通过对sub_106AC下断点可发现key为那么这个key是如何产生往上翻不就是我们前面initHttpParamsSNative的存放地址吗。验证通过。3. 风控分析通过对data数据的解析可以发现 encodeHttpParamsNative的入参涉及的信息比较多其中对设备的信息也会很敏感通过重放攻击可以得短时间内的大量请求会导致设备被风控通过新设备的重装发现aes的key会随之改变会重新走一个链接可以抓到一个包链接为https://ztevents.zaloapp.com/id/mobile/android会发送设备信息去注册返回一个deviceID也是data参数中的device_identifier发送的数据我们可以通过模拟随机模拟加密好sig成功下发伪造的设备信息然后根据伪造的设备和下发的设备id构造encodeHttpParamsNative的入参成功反回登录接口信息至此这个app的风控就分析完成了结束语最后说一下能看到这篇文章的都是对爬虫感兴趣又有兴趣去做采集的相对来说本文所说到的样本是比较适合新手的之所以这么说等到你安安静静去分析时你就会恍然大悟原来只是这样但一些坑点也是常规逆向过程中会遇到的动手会了~ 源码放在下面的链接之所以设置这个价格是希望各位看官能自己下手去提升避免伸手党如有问题可私聊或留言。