so逆向: AES解密思路

app: kang`aiduo WX20211021-142103@2x.png

在登录页面输入账密, 会提示是否注册


抓包有一个加密参数: text,

headers = {
    'Host': 'app.360kad.com',
    'User-Agent': 'okhttp/3.6.0',
}

params = (
    ('text', 'ZUbOnx1MmPkqWm1KGitxfSBum2ZJWvyg%2FbLc1nwssZEs0xNEW1wS3NaFZQ00bWY6Ma9umsigB4SSrsdJUlOpEA%3D%3D'),
    ('kclientid', '217f0fa6bda578f671e511c1bd89fa90'),
    ('gtclientid', '7af664c82b15b9f44a6515948fee795d'),
    ('utm_medium', 'Android'),
    ('utm_source', 'yingyongbao'),
    ('versionno', '164'),
    ('versionname', '3.21.5'),
)

response = requests.get('https://app.360kad.com/Login/SCYLoginV2', headers=headers, params=params)
response.json()

jadx打开看看, 一顿搜索, 找到如下位置:

WX20211021-142559.png

在这个class里找到了这个login()调用位置:

WX20211021-142818.png
hook看看这3个参数是啥:

a: 152xxxx2266
b: kkk123456
c: 

就是我们的账密嘛, 第3个参数是null, 再看看623行的toEncryptLogin:

WX20211021-143756.png

IDA打开com.unique.app.zip/lib/armeabi-v7a/libutil.so, 找到toEncryptLogin():

WX20211021-144230@2x.png

看到了31行显眼的'IV', 猜测是AES(CBC)加密, 还有LOGIN_KEYS,八成是了

双击35行: QQ20211022-0.png

toLoginJson:

WX20211021-144451@2x.png

分别双击key和iv:

WX20211021-144703@2x.png

iv='W+\~f4,Kr)b$=adr' # VytcfmY0LEtyKWIkPWFkcg==
key = '660EC328EC500D9DC03F8FEB1409648D' # NjYwRUMzMjhFQzUwMEQ5REMwM0Y4RkVCMTQwOTY0OEQ=

双击至此大概清晰了, 但是还不能确定字符串, 所以用iv和key解密一下:

WX20211021-145120@2x.png

和预想的差不多, 附上代码:

def add_to_16(text):
    if len(text.encode('utf-8')) % 16:add = 16 - (len(text.encode('utf-8')) % 16)
    else:add = 0
    text = text + ('\0' * add)
    return text.encode('utf-8')

def encryt_cbc(text, key, iv):
    '''CBC '''
    cipher = AES.new(key, AES.MODE_CBC,iv)
    x = AES.block_size - (len(text) % AES.block_size)
    if x != 0:text = text + chr(x)*x
    msg = cipher.encrypt(text)
    # msg = base64.urlsafe_b64encode(msg).replace('=', '')
    msg = base64.b64encode(msg)
    return msg.decode()

iv='W+\~f4,Kr)b$=adr'.encode()
phone='152xxxxx66'
# 注意不要有空格, 不过这个案例有空格也能返回正确信息
text='{"userName":"'+phone+'","userPwd":"kkk123456","vcode":""}'
key = '660EC328EC500D9DC03F8FEB1409648D'.encode('utf-8')
text=encryt_cbc(text,key,iv)

headers = {
    'Host': 'app.360kad.com',
    'User-Agent': 'okhttp/3.6.0',
}

params = (
    ('text', text),
    ('kclientid', '217f0fa6bda578f671e511c1bd89fa90'),
    ('gtclientid', '7af664c82b15b9f44a6515948fee795d'),
    ('utm_medium', 'Android'),
    ('utm_source', 'yingyongbao'),
    ('versionno', '164'),
    ('versionname', '3.21.5'),
)

response = requests.get('https://app.360kad.com/Login/SCYLoginV2', headers=headers, params=params)
response.json()
#{'Result': False, 'Code': 4, 'Message': '账户名不存在', 'Key': None, 'ThirdMobile': '', 'KadMobile': ''}