其他
APK 协议分析
{"cod":"0","type":"5","msg":"\u83b7\u53d6\u6210\u529f", "username":"ii12qqaa", "vip":"\u666e\u901a\u4f1a\u5458","time":"8888888888","jifen":"0","login":"106", "userid":"4232206e2a", "token":"9f1ff9900178b5d0fe3db2a37d078ac5201c02380ebb0ba71a3bbf71bb2a8b2c0e18907e0383e8341dc00ee45fbc6923be0313f558197894"}
{"cod":"0","type":"2", "msg":"\u6ce8\u518c\u6210\u529f", "username":"yyyyyy1234qq", "vip":"\u666e\u901a\u4f1a\u5458", "time":"8888888888","jifen":"0","login":"0","userid":"06ef899b13", "token":"9f1ff9900178b5d0fe3db2a77951decf2913053b5cbb0ba71a3bbf71bb2a8b2c0e18907e0383e8341dc00ee45fbc6923be0313f558197894"}
void __fastcall 29E6C(int m_off, _DWORD *a2, int a3, int a4, int a5, int a6, ){ v21 = m_off; v22 = *(_DWORD *)off_ABBA8;//获得这个位置的值在函数末尾再次获取 *a2 = 99; v23 = *(_DWORD *)(m_off + 16); (*(void (**)(void))(**(_DWORD **)(m_off + 12) + 692))();// JNI::GetObjectArrayElement v24 = *(_DWORD *)(v21 + 12); sub_9A568();//处理age[0] (hash+time+6.3) v25 = *(_DWORD *)(v21 + 16); sub_9C6E0(*(JNIEnv **)(v21 + 12));//处理age[1] key sub_9C7AC(*(_DWORD *)(v21 + 12), *(_DWORD *)(v21 + 16), 2);//处理age[2] 调用intValue v26 = *(_DWORD *)(v21 + 16); sub_9C6E0(*(JNIEnv **)(v21 + 12));处理age[3] sub_29F9C()} v8 = ((int (__fastcall *)(JNIEnv *, int, int))(*v4)->GetObjectArrayElement)(v4, v12, v7) == 0; v9 = 0; if ( !v8 ) sub_9A138(); *(_DWORD *)(v13 + 4 * v7++) = v9;malloc_8= (_DWORD *)malloc_0(8); if ( !malloc_8) { sub_A1308(0, v22, v23, v24, 0, v22); __asm { LDCL p15, c15, [R8], {0xFF} } } *malloc_8= 0; malloc_8[1] = 0; v23 = 4 * number; *malloc_8 = **(_DWORD **)(hashobj + 4 * number); malloc_8[1] = *(_DWORD *)(*(_DWORD *)(hashobj + 4 * number) + 4); *(_DWORD *)(malloc_off+ 4 * number) = malloc_8;int __fastcall Decryptkey(int key2_malloc, int hash){hash_ = hash; v48 = *off_ABBA8; v3 = 0; if ( key2_malloc ) { if ( hash ) { key2_size = *(key2_malloc + 4); if ( key2_size ) { if ( *(hash_ + 4) ) { if ( key2_size < 65 ) v5 = (*(key2_malloc + 40))(); // 创建个malloc_56结构体，将key2copy过去 else sub_78530(); v7 = v5; m_key2 = 0; if ( v5 ) { v9 = *(v5 + 4) == 0; v10 = 0; v11 = 0; v3 = 0; if ( !v9 ) { v44 = mirror_key2_1; key2 = v7; v45 = v7; aeabi_memclr4(mirror_key2_1, 64); aeabi_memclr4(mirror_key2_2, 64); memcpy8(mirror_key2_1, *key2, key2[1]); memcpy8(mirror_key2_2, *key2, key2[1]); i = 0; do { mirror_key2_1[-i] ^= 0x36u; mirror_key2_2[-i] ^= 0x5Cu; --i; } while ( i != -64 ); sub_97DA4(); // 申请 malloc_56_100 m_key2 = malloc_56_100; (*(malloc_56_100 + 12))(); // copy mirror_key2_1 (*(m_key2 + 48))(m_key2, hash_); // mirror_key2_1后面加上hash sub_78530(); // 这里面的算法不想看了 v16 = v15; v11 = 0; if ( v15 ) { v3 = 0; v7 = v45; if ( *(v15 + 4) ) { sub_98594(); // 申请malloc_56,里面的数据大小为0x40,并copy过去mirror_key_2_2 v18 = v17; (*(v17 + 48))(); // 在刚刚申请的malloc_56的数据mirror_key2_2后面拼接上hash sub_78530(); // 再次执行这个函数执行后的返回值就是key_3 v11 = v18; v7 = v45; v3 = v19; } } else { v3 = 0; v7 = v45; } v10 = v16; } } else { v10 = 0; v11 = 0; v3 = 0; } v20 = v10; free_malloc56(v7, v7, v11, v6, v43, v44, v45, v11); free_malloc56(m_key2, v21, v22, v23, v24, v25, v26, v27); free_malloc56(v20, v28, v29, v30, v31, v32, v33, v34); free_malloc56(v41, v35, v36, v37, v38, v39, v40, v41); } } } } result = *off_ABBA8 - v48; if ( *off_ABBA8 == v48 ) result = v3; return result;} do { _byte = *(*key_3 - i); // 作用 v7 = (_byte >> 4) + 87; // 循环获取key_3里的一个byte值 if ( _byte >> 5 <= 4 ) // 如果byte小于0x80,就将byte逻辑右移4位后逻辑或上0x30 // 不小于就byte逻辑右移4位后加上87(0x57) v7 = (_byte >> 4) | 0x30; offset = 2 * i; *(*sign - 2 * i) = v7; // 得到的值放入sign(结果)中 i是为负数 v9 = _byte & 0xF; // byte与0xf,结果小于0xa就或上0x30 // 否则结果加上0x5c // 熟悉ascll码就知道0x30-0x39对应0-9，0x61-0x7a对应小写的字母 if ( v9 < 0xA ) { v11 = v9 | 0x30; sign_off = *sign - offset; } else { sign_off = *sign - offset; v11 = v9 + 87; } *(sign_off + 1) = v11; // 放入sign中 --i; key_3 = key_3_; } while ( -var_0x14 != i );看雪ID：你咋不上天呢
https://bbs.pediy.com/user-840122.htm
推荐文章++++
好书推荐