解决办法:

工具: https://github.com/r0ysue/r0capture
下载到本地, 手机端开启frida-server, 采用Attach 模式:

python3 r0capture.py -U com.ylpw.ticketapp -p yongle.pcap # 图片里的iqiyi忘记改了

QQ20211203-140051@2x.png

然后用wireshark打开刚才获取到的包文件:

QQ20211203-140238@2x.png

文件不多, 每个打开看看就能找到, 然后看到了抓到的请求:

QQ20211203-140501@2x.png

QQ20211203-140614@2x.png

编辑一下就好了:

url='http://api.228.cn/customers/loginWithEncryptPassword'
headers={
        'Content-Type': 'application/x-www-form-urlencoded;charset=UTF-8',
        'Content-Length': '549',
        'User-Agent': 'Dalvik/2.1.0 (Linux; U; Android 9; Pixel XL Build/PQ3A.190505.001)',
        'Host': 'api.228.cn',
        'Connection': 'Keep-Alive',
        'Accept-Encoding': 'gzip',
        }
data={
    'access_phone_type':'android',
    'app_version':'My42Ljc%3D',
    'token':'',
    'umengDeviceToken':'AlAUhLaDUncOlEiBEiIJqk_UC-C46qdp4Mqgt2gZpa81',
    'equipmentsystem':'PixelXL_9_3.6.7_huawei',
    'channel_id2':'33',
    'validateCode':'',
    'phone_model':'Pixel%20XL',
    'deviceToken':'AlAUhLaDUncOlEiBEiIJqk_UC-C46qdp4Mqgt2gZpa81',
    'password':'577e6b90b714f1218062ee3e8f7f4b01',
    'client_version':'3.6.7',
    'phone_version':'Android9',
    'channel_id':'huawei',
 'key':'F5VSFNVsl4I38amnK4WZ3pDO4izkQWwT7ZYqIOytAHXyZZF8OaSd9phoZ5xN3ENPQQIWyljbQY4I%0A1t%2B0HnC5bSDFBLSeiQ%2BCrREtMuFexUe0kcrP9qp7wLosOSJTg3%2B1xvj41fuCxtQ%3D%0A',
    'username':'152xxxx233'
    }
response=requests.post(url,data,headers)

看到有一个加密参数: key, jadx打开apk一通搜索, 找到加密位置:

QQ20211203-141530.png

QQ20211203-141652.png

最终定位到这里, DES加密, hook该加密函数:

[*] a: {"username":"152xxxx236","password":"78b54622f6107dfb03fd536d469ab785","loginDate":"1637917192111"}
[*] b: ylpw228!@#$%^&*()_
[*] result:F5VSFNVsl4I38amnK4WZ3ud07jnGyFHV7ZYqIOytAHUm4AjaSBUXVlqPchJSp7QwFDuI6Jpr5nNl
RMb9VKUYlyOwm+wgoKZorREtMuFexUe0kcrP9qp7wBAz8AYah57POH8x9Wwst+8=

a就是我们的信息, b就是key,