miyabaobei 的params和sign参数

app: miyabaobei
需求: 账密登录, 根据错误提示判断是否注册

WX20210819-175709.png

一, 抓包看参数

WX20210819-175925.png

frida hook 全局一下看看:

WX20210819-180008.png

二, 找到了sign的函数, 看下参数:

WX20210819-180110.png

可以看到, 就是data的各项拼接起来的字符串MD5加密

三, params 解决

jadx 打开Apk, 搜索关键字:

WX20210819-180303.png
WX20210819-180331.png
WX20210819-180354.png
WX20210819-180418.png
WX20210819-180441.png
WX20210819-180507.png
WX20210819-180526.png
WX20210819-180619.png

密码每次一样就可以, params的逻辑是第二个a()返回list每个元素RSA加密再拼接的结果,代码实现:

import base64
from Crypto.Cipher import PKCS1_v1_5 as Cipher_pksc1_v1_5
from Crypto.PublicKey import RSA
 
def encrpt(str_,):
    public_key = 'MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCiwJbb2EeK9ZB4Chyj5/mIVPREod0pJrv3LM2UVtkod+2mPVjV9Xi1E06gUaoexX/ebfRXm1eBwu3LtYbklh5Ji5oFycoUCFhwzhmm8ZtjdkCIicFfxUU4I5NunL6+37+hy43EgCrao5tFgHtnkeR/vNyGfaxdxevPbVEtWlJz6wIDAQAB'

    rsakey = RSA.importKey(base64.b64decode(public_key))
    cipher = Cipher_pksc1_v1_5.new(rsakey)
    cipher_text = base64.b64encode(cipher.encrypt(str_.encode()))
    return cipher_text.decode()
 
str0='miababy1xxxx2222'
str0=(base64.b64encode(str0.encode())).decode()
str0='{"name":"'+str0+'","pas'
str1='sword":"bWlhYmFieWtkejEyMzQ1Njc\u003d"}'
l_str=[str0,str1]
params=''
for i in l_str:
    params+=encrpt(i, public_key)

四, 最后

获得了params ,拼接到str里, 加密sign

def get_md5(str_arg):
    md5 = hashlib.md5()
    md5.update(str_arg.encode('utf_8'))
    str_arg = md5.hexdigest()

    return str_arg
time1=str(int(time.time()*1000))
time2=str(int(time.time()))
data = {
    'sign': 'dfe225c8c76a86ea704c039acda54b79',
    'dvc_id': 'ca69059e58fc07e7561627f3ca950d93',
    'session': '34caf86f72d8d1674301e83b4cbf0fa7',
    'channel_code': 'wandoujia',
    'version': 'android_9_7_4',
    'bi_session_id': f'ca69059e58fc07e7561627f3ca950d93_{time1}',
    'app_id': 'android_app_id',
    'user_plus_type': '0',
    'timestamp': time2,
    'no_encrypt': '0',
    'auth_session': '',
    'params': params
}

sign=f'app_idandroid_app_idauth_sessionbi_session_idca69059e58fc07e7561627f3ca950d93_{time1}channel_codewandoujiadvc_idca69059e58fc07e7561627f3ca950d93no_encrypt0params{params}session34caf86f72d8d1674301e83b4cbf0fa7timestamp{time2}user_plus_type0versionandroid_9_7_4MiaBaoBei@0!30306'
sign=get_md5(sign)
data.update({'sign':sign})