抓包可得:https://log.snssdk.com/service/2/device_register/
数据的大致是如下数据,然后将数据进行压缩加密就可以了
{“header”:{“magic_tag”:”ss_app_log”,””build_serial”:”*”,”version_code”:*,”timezone”:8,” +
“”mc”:”” + * + “”,”sim_serial_number”:[{“sim_serial_number”:”*”}],” +”sim_region”:”CN”,”region”:”CN”,”package”:”com.ss.android.ugc.aweme”,” “”appkey”:”*”,”app_version”:”*”,”resolution”:”1280×720″,”aid”:1128,” “”display_density”:”hdpi”,”sig_hash”:”*”,” + “”not_request_sender”:0,”openudid”:””+ sOpenId +”*”,release_build”:”*”,”tz_offset”:*,”rom_version”:”*”,” +
“”rom”:”*”,”clientudid”:”” +*+ “”,”os_api”:*,”mcc_mnc”:”*”,” +
“”sdk_version”:”*”,”device_id”:””+ sDeviceId+””,”*”:””+ * +””,”device_brand”:”*”,” +
“manifest_version_code”:*,”serial_number”:”*”,”os_version”:”*”,” +
“”display_name”:”抖音短视频”,”cpu_abi”:”armeabi-v7a”,”update_version_code”:*,”language”:”zh”,” +
“”channel”:”*”,”tz_name”:”Asia\\/Shanghai”,”density_dpi”:240},”_gen_time”:”” “” +””}
包含了各种设备的一些消息,首先使用标准Gzip压缩参数然后调AES进行加密
以上是百度搜索的前辈的结果,可以得知具体的流程,对我们分析起来会有很大的帮助。
分析笔记
版本10.5.0
拖入JADX搜索文本device_register定位到com.ss.android.c.b;类的c方法
- StringBuilder stringBuilder;
- String stringBuilder2;
- byte[] bytes = str.getBytes("UTF-8");
- if (m.a(a.a)) {
- stringBuilder = new StringBuilder("http://");
- stringBuilder.append(a.c);
- stringBuilder.append("/service/2/device_register/");
- stringBuilder2 = stringBuilder.toString();
- } else {
- stringBuilder2 = a.a;
- }
- boolean z = currentTimeMillis - b.this.o < 600000;
- b.this.o = currentTimeMillis;
- byte[] bArr = (byte[]) bytes.clone();
- if (a.b != null ? a.b.a() : true) {
- try {
- stringBuilder2 = u.h(d, bArr, b.this.i, z);//////提交加密
- if (z) {
- stringBuilder = new StringBuilder();
- stringBuilder.append(d);
- stringBuilder.append("&config_retry=b");
- d = stringBuilder.toString();
- }
- stringBuilder2 = h.d.g(d, bytes, "application/json; charset=utf-8");
- }
- } else {
- if (z) {
- stringBuilder = new StringBuilder();
- stringBuilder.append(d);
- stringBuilder.append("&config_retry=b");
- stringBuilder2 = stringBuilder.toString();
- } else {
- stringBuilder2 = d;
- }
- stringBuilder2 = h.d.g(stringBuilder2, bytes, "application/json; charset=utf-8");
- }
- if (stringBuilder2 == null) {
- return false;
- }
- if (stringBuilder2.length() == 0) {
- return false;
- }
- boolean z2;
- JSONObject jSONObject = new JSONObject(stringBuilder2);
- b.this.g = c.e;
- Editor edit = b.this.j.edit();
- edit.putLong("last_config_time", b.this.m);
- edit.putInt("last_config_version", b.this.g);
- stringBuilder2 = b.this.p;
- boolean a = m.a(g);
- d = jSONObject.optString("device_id", null);
- if (m.a(optString) || optString.equals(b.this.p) || optString.equalsIgnoreCase("0") || optString.equalsIgnoreCase("None")) {
- z2 = false;
- } else {
- b.this.p = optString;
- if (!m.a(stringBuilder2)) {
- try {
- JSONObject jSONObject2 = new JSONObject();
- jSONObject2.put("old_id", stringBuilder2);
- jSONObject2.put("new_id", optString);
- b.y("umeng", "iid_change", jSONObject2);
- }
- }
- z2 = true;
- }
- try {
- if (!(m.a(d) || d.equals(g) || d.equalsIgnoreCase("0") || d.equalsIgnoreCase("None"))) {
- if (!m.a(g)) {
- try {
- stringBuilder2 = b.this.h.b();
- optString = b.this.h.f();
- JSONObject jSONObject3 = new JSONObject();
- jSONObject3.put("old_id", g);
- jSONObject3.put("new_id", d);
- jSONObject3.put("openudid", stringBuilder2);
- jSONObject3.put("clientudid", c);
- if (!m.a(optString)) {
- jSONObject3.put("udid", optString);
- }
- if (!m.a(d2)) {
- jSONObject3.put("serial_number", d2);
- }
- if (e3 != null && e3.length > 0) {
- }
- b.y("umeng", "did_change", jSONObject3);
- }
- }
- z2 = true;
- }
- if (!(m.a(d) || d.equalsIgnoreCase("0"))) {
- d.equalsIgnoreCase("None");
- }
- if (z2) {
- try {
- b.this.k.put("install_id", b.this.p);
- b.this.k.put("device_id", d);
- edit.putString("install_id", b.this.p);
- edit.putString("device_id", d);
- }
- }
- edit.commit();
- if (z2) {
- b.this.h.g(b.this.j);
- b.this.x();
- }
- b.z(true, a);
- return true;
- e6.printStackTrace();
- return false;
- }
- }
之后 package com.ss.android.common.applog.u类的h方法
- if (m.a(str) || bArr == null || bArr.length <= 0) {
- return null;
- }
- try {
- Editor edit;
- gZIPOutputStream.write(bArr);
- byte[] toByteArray = byteArrayOutputStream.toByteArray();
- if (!i) {
- synchronized (l) {
- try {
- SharedPreferences sharedPreferences = context.getSharedPreferences(m, 0);
- k = sharedPreferences.getInt("app_log_encrypt_faild_count", 0);
- edit = sharedPreferences.edit();
- edit.putInt("app_log_encrypt_faild_count", k + 1);
- edit.apply();
- i = true;
- }
- }
- }
- Throwable th3;
- if (k < 3) {
- byte[] a = EncryptorUtil.a(toByteArray, toByteArray.length);///////NATIVE层SO方法
- if (j) {
- th3 = th;
- toByteArray = a;
- } else {
- synchronized (l) {
- try {
- edit = context.getSharedPreferences(m, 0).edit();
- if (k > 2) {
- k -= 2;
- } else {
- k = 0;
- }
- edit.putInt("app_log_encrypt_faild_count", k);
- edit.apply();
- j = true;
- }
- }
- th3 = th;
- toByteArray = a;
- }
- } else {
- th3 = null;
- }
- if (toByteArray == null || th3 == null) {
- }
- StringBuilder stringBuilder = new StringBuilder();
- stringBuilder.append(str);
- stringBuilder.append("&tt_data=a");
- if (z) {
- StringBuilder stringBuilder3 = new StringBuilder();
- stringBuilder3.append(stringBuilder2);
- stringBuilder3.append("&config_retry=b");
- stringBuilder2 = stringBuilder3.toString();
- }
- hashMap.put("Content-Type", "application/octet-stream;tt-data=a");
- return com.bytedance.a.c.h.d.c(stringBuilder2, toByteArray, hashMap);
- th = th5;
- return null;
- } finally {
- gZIPOutputStream.close();
- }
- }
package com.bytedance.frameworks.encryptor.EncryptorUtil类
- public class EncryptorUtil {
- private static native byte[] ttEncrypt(byte[] bArr, int i);
-
- static {
- try {
- e.printStackTrace();
- }
- }
-
- public static byte[] a(byte[] bArr, int i) {
- if (bArr != null && i > 0) {
- try {
- if (bArr.length == i) {
- return ttEncrypt(bArr, i);
- }
- return null;
- }
- }
- return null;
- }
- }
具体需要什么参数,后面需要HOOK抖音接口得出具体数据。时间有限,暂时到这。