抖音10.5.0正式版X-Gorgon,X-Khronos

  1. public final java.util.Map<java.lang.String, java.lang.String> a(java.lang.String r12, java.util.Map<java.lang.String, java.util.List<java.lang.String>> r13) {
  2. r11 = this;
  3. r0 = new java.util.HashMap;
  4. r0.<init>();
  5. r1 = java.util.Calendar.getInstance();
  6. r1.getTimeInMillis();
  7. r1 = "";
  8. r2 = java.lang.System.currentTimeMillis();
  9. r4 = 1000; // 0x3e8 float:1.401E-42 double:4.94E-321;
  10. r2 = r2 / r4;
  11. r2 = (int) r2;
  12. r3 = r12.toLowerCase(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  13. r4 = "http";
  14. r3 = r3.contains(r4); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  15. if (r3 != 0) goto L_0x0037;
  16. L_0x0022:
  17. r3 = r12.toLowerCase(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  18. r4 = "https";
  19. r3 = r3.contains(r4); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  20. if (r3 == 0) goto L_0x002f;
  21. L_0x002e:
  22. goto L_0x0037;
  23. L_0x002f:
  24. r12 = new java.lang.NullPointerException; Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  25. r13 = "nein http/https";
  26. r12.<init>(r13); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  27. throw r12; Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  28. L_0x0037:
  29. r3 = r12.toLowerCase(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  30. r4 = "x-khronos";
  31. r3 = r3.contains(r4); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  32. if (r3 == 0) goto L_0x0058;
  33. L_0x0043:
  34. r3 = r12.toLowerCase(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  35. r4 = "x-gorgon";
  36. r3 = r3.contains(r4); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  37. if (r3 != 0) goto L_0x0050;
  38. L_0x004f:
  39. goto L_0x0058;
  40. L_0x0050:
  41. r12 = new java.lang.NullPointerException; Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  42. r13 = "it had";
  43. r12.<init>(r13); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  44. throw r12; Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  45. L_0x0058:
  46. r3 = com.ss.sys.ces.gg.tt.a(r12); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  47. if (r3 != 0) goto L_0x0179;
  48. L_0x005e:
  49. r12 = com.ss.sys.ces.gg.tt.b(r12); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  50. r3 = 0;
  51. if (r12 == 0) goto L_0x0070;
  52. L_0x0065:
  53. r4 = r12.length(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  54. if (r4 <= 0) goto L_0x0070;
  55. L_0x006b:
  56. r12 = com.ss.a.b.d.a(r12); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  57. goto L_0x0071;
  58. L_0x0070:
  59. r12 = r3;
  60. L_0x0071:
  61. r4 = -1;
  62. r13 = r13.entrySet(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  63. r13 = r13.iterator(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  64. r4 = r3;
  65. r5 = r4;
  66. r6 = -1;
  67. L_0x007d:
  68. r7 = r13.hasNext(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  69. if (r7 == 0) goto L_0x0119;
  70. L_0x0083:
  71. r7 = r13.next(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  72. r7 = (java.util.Map.Entry) r7; Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  73. r8 = r7.getKey(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  74. r8 = (java.lang.String) r8; Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  75. r8 = r8.toUpperCase(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  76. r9 = "X-SS-STUB";
  77. r8 = r8.contains(r9); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  78. r9 = 0;
  79. if (r8 == 0) goto L_0x00a8;
  80. L_0x009c:
  81. r3 = r7.getValue(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  82. r3 = (java.util.List) r3; Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  83. r3 = r3.get(r9); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  84. r3 = (java.lang.String) r3; Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  85. L_0x00a8:
  86. r8 = r7.getKey(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  87. r8 = (java.lang.String) r8; Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  88. r8 = r8.toUpperCase(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  89. r10 = "COOKIE";
  90. r8 = r8.contains(r10); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  91. if (r8 == 0) goto L_0x00e9;
  92. L_0x00ba:
  93. r8 = r7.getValue(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  94. r8 = (java.util.List) r8; Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  95. r8 = r8.get(r9); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  96. r8 = (java.lang.String) r8; Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  97. if (r8 == 0) goto L_0x00e9;
  98. L_0x00c8:
  99. r10 = r8.length(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  100. if (r10 <= 0) goto L_0x00e9;
  101. L_0x00ce:
  102. r4 = com.ss.a.b.d.a(r8); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  103. r8 = com.ss.sys.ces.gg.tt.c(r8); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  104. if (r8 == 0) goto L_0x00e9;
  105. L_0x00d8:
  106. r10 = r8.length(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  107. if (r10 <= 0) goto L_0x00e9;
  108. L_0x00de:
  109. r5 = com.ss.a.b.d.a(r8); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  110. r10 = com.ss.sys.ces.out.StcSDKFactory.getInstance(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  111. r10.setSession(r8); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  112. L_0x00e9:
  113. r8 = r7.getKey(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  114. r8 = (java.lang.String) r8; Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  115. r8 = r8.toUpperCase(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  116. r10 = "META-SHADOWMAZE";
  117. r8 = r8.contains(r10); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  118. r10 = 1;
  119. if (r8 == 0) goto L_0x007d;
  120. L_0x00fc:
  121. r7 = r7.getValue(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  122. r7 = (java.util.List) r7; Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  123. r7 = r7.get(r9); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  124. r7 = (java.lang.String) r7; Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  125. if (r7 == 0) goto L_0x007d;
  126. L_0x010a:
  127. r8 = r7.length(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  128. if (r8 <= 0) goto L_0x007d;
  129. L_0x0110:
  130. r7 = java.lang.Integer.parseInt(r7); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  131. if (r7 != r10) goto L_0x007d;
  132. L_0x0116:
  133. r6 = 1;
  134. goto L_0x007d;
  135. L_0x0119:
  136. if (r12 == 0) goto L_0x0121;
  137. L_0x011b:
  138. r13 = r12.length(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  139. if (r13 > 0) goto L_0x0123;
  140. L_0x0121:
  141. r12 = "00000000000000000000000000000000";
  142. L_0x0123:
  143. if (r3 == 0) goto L_0x012b;
  144. L_0x0125:
  145. r13 = r3.length(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  146. if (r13 > 0) goto L_0x012d;
  147. L_0x012b:
  148. r3 = "00000000000000000000000000000000";
  149. L_0x012d:
  150. if (r4 == 0) goto L_0x0135;
  151. L_0x012f:
  152. r13 = r4.length(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  153. if (r13 > 0) goto L_0x0137;
  154. L_0x0135:
  155. r4 = "00000000000000000000000000000000";
  156. L_0x0137:
  157. if (r5 == 0) goto L_0x013f;
  158. L_0x0139:
  159. r13 = r5.length(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  160. if (r13 > 0) goto L_0x0141;
  161. L_0x013f:
  162. r5 = "00000000000000000000000000000000";
  163. L_0x0141:
  164. r13 = new java.lang.StringBuilder; Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  165. r13.<init>(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  166. r13.append(r12); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  167. r13.append(r3); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  168. r13.append(r4); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  169. r13.append(r5); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  170. r12 = r13.toString(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  171. r12 = com.ss.a.b.a.a(r12); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  172. r12 = com.ss.sys.ces.a.leviathan(r6, r2, r12); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  173. r12 = com.ss.a.b.a.a(r12); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  174. r13 = "X-Khronos";
  175. r1 = new java.lang.StringBuilder;
  176. r1.<init>();
  177. r1.append(r2);
  178. r1 = r1.toString();
  179. r0.put(r13, r1);
  180. r13 = "X-Gorgon";
  181. r0.put(r13, r12);
  182. goto L_0x01b6;
  183. L_0x0179:
  184. r12 = new java.lang.NullPointerException; Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  185. r13 = "filter_1";
  186. r12.<init>(r13); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  187. throw r12; Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  188. L_0x0181:
  189. r12 = move-exception;
  190. r13 = new java.lang.StringBuilder;
  191. r13.<init>();
  192. r13.append(r2);
  193. r13 = r13.toString();
  194. r2 = "X-Khronos";
  195. r0.put(r2, r13);
  196. r13 = "X-Gorgon";
  197. r0.put(r13, r1);
  198. r13 = java.util.Calendar.getInstance();
  199. r13.getTimeInMillis();
  200. throw r12;
  201. L_0x01a0:
  202. r12 = "X-Khronos";
  203. r13 = new java.lang.StringBuilder;
  204. r13.<init>();
  205. r13.append(r2);
  206. r13 = r13.toString();
  207. r0.put(r12, r13);
  208. r12 = "X-Gorgon";
  209. r0.put(r12, r1);
  210. L_0x01b6:
  211. r12 = java.util.Calendar.getInstance();
  212. r12.getTimeInMillis();
  213. return r0;
  214. }
  215. }

 

虽然JADX不能完全解析出来,但是不影响我们分析

核心代码如下

  1. r13 = new java.lang.StringBuilder; Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  2. r13.<init>(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  3. r13.append(r12); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  4. r13.append(r3); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  5. r13.append(r4); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  6. r13.append(r5); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  7. r12 = r13.toString(); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  8. r12 = com.ss.a.b.a.a(r12); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  9. r12 = com.ss.sys.ces.a.leviathan(r6, r2, r12); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  10. r12 = com.ss.a.b.a.a(r12); Catch:{ Throwable -> 0x01a0, all -> 0x0181 }

 

下面是我自己翻译了一下

  1. r13 = new java.lang.StringBuilder;
  2. r13.<init>();
  3. r13.append(r12);
  4. r13.append(r3);
  5. r13.append(r4);
  6. r13.append(r5);
  7. r12 = r13.toString();
  8. r12 = StrTByte(r12);
  9. r12 = com.ss.sys.ces.a.leviathan(r6, r2, r12);
  10. Xg = ByteToStr(r12);

其中

r5 = com.ss.a.b.d.a(r8)=md5(r8)=[sessionid=]就是取sessioid后面那串MD5

r4=cookie

r3=X-SS-STUB后面那串MD5

r12=MD5(URL)

  1. 2020-07-19 01:56:22.710 13848-13944/com.nightteam.httpso I/yf: url=https://aweme-hl.snssdk.com/passport/mobile/send_code/v1/?account_sdk_version=380&os_api=22&device_type=OPPO%20R11%20Plus&ssmix=a&manifest_version_code=960&dpi=240&uuid=866174861732390&app_name=aweme&version_name=9.6.0&app_type=normal&ac=wifi&update_version_code=9602&channel=aweGW&device_platform=android&version_code=960&cdid=129b68e5-b390-4f59-a005-caf0b539bf92&openudid=e049a8cdf698603&resolution=720*1280&os_version=5.1.1&language=zh&device_brand=Android&aid=1128&mcc_mnc=460076&device_id=237143476940605&iid=4283346268205181&ts=1595094982&_rticket=1595094982710
  2. 2020-07-19 01:56:22.713 13848-13944/com.nightteam.httpso E/yf: x-Gorgon=040100321080078738761aede30605a36a210bc3fe84ab39cd40

“{“x-Gorgon”:”040100321080078738761aede30605a36a210bc3fe84ab39cd40″,”X-Khronos”:1595094982}”

但是认为这样就大功告成的话。请看下知乎这问答再决定

https://www.zhihu.com/question/389447990

  1. 作者:y.d
  2. 链接:https://www.zhihu.com/question/389447990/answer/1346115903
  3. 来源:知乎
  4. 著作权归作者所有。商业转载请联系作者获得授权,非商业转载请注明出处。
  5.  
  6. 抖音的验签机制很野,即使你的x-gorgon算法生成稍微和它APP本身计算的有些出入
  7. (说白了就是抖音检测到你是独立计算到),它照样会开放一些功能给你,
  8. 比如获取feed接口(热门视频),但是你会发现没法点赞,评论,私信。
  9. 后来经过frida进行一个hook验证,发现确有此事,
  10. 很多x-gorgon算法都是使用hook或者直接调用so到方式实现到,
  11. 根本没去真正解刨它里面到运算过程。再一次测试到过程中,
  12. 我把url以及x-khrons和cookie,xttsub固定起来,
  13. 使用hook或者调用so的方式去计算x-gorgon结果,发现不管你执行多少次,
  14. 结果都是一样的。但是,我使用frida来拦截抖音它自己的签名过程,
  15. 并把参数改成和上面的一样,那么它每次计算的结果都不一样。由此可见,
  16. 抖音在计算过程中肯定获取了某些全局参数,比如它签名后会把一些值存入到
  17. 一个全局变量,下次计算到时候读取,也或者它在某些功能动作到时候,会记
  18. 录一些值,影响签名到计算算法。这个事情到确实得到多次证实,用hook或者
  19. so到方式其实抖音是知道到,最后就是因为这个事情而抛弃了抖音,研究了大
  20. 半年,有些遗憾。。 毕竟技术不到位。最后,上面测试到版本是810版本到。

根据知乎的回答,我印证了一下。

如果是直接把SO拿出来调用,得到的跟APP里面得出的是不一致的。

进一步验证,我把cms的接口都HOOK住。然后看顺序。

输出结果如下

  1. decode:e0907362be49034bc1c02edb2a2ee6df000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
  2. decode:0404d08100011721cd864d7830af1b31ecb77c7393552ccfc5e6
  3. decode:69fb68f54c2f1e6fe65d8559cda5235f00000000000000000000000000000000bf211a435e2706db3d0e88c66534221600000000000000000000000000000000
  4. decode:0404f88100015cedc745a68d33a91f3ba6d1c0c96219a7b02ffb
  5. decode:c08ea58eb84819cce52ce7d7b87f1cf400000000000000000000000000000000bf211a435e2706db3d0e88c66534221600000000000000000000000000000000
  6. decode:0404f8810001abb422a8a68d33a91f3ba6d1c0c96219a7b02f14
  7. decode:aa1452d172aad28348c5178e1baab08500000000000000000000000000000000bf211a435e2706db3d0e88c66534221600000000000000000000000000000000
  8. decode:0404f881000197ce2607a68d33a91f3ba6d1c0c96219a7b02f28
  9. decode:7a5218edf3abcbc8a058d7bf8bd3684f6954b64d66b41ee388859c5c2786c155bf211a435e2706db3d0e88c66534221600000000000000000000000000000000
  10. decode:0404f881000145ba3f52e54257821f3ba6d1c0c96219a7b02f63
  11. decode:4a16afa4818ccfcc856e413a4c5b7badfd119302e8948f17f44f7340270cb4ca435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  12. decode:0404f8810001a7757352d5ccef92b211ccb8c0c96219a7b0cf2a
  13. decode:00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
  14. decode:0404f8810001ea0609bfa68d3354442be1fdc0c96219a7b0cf98
  15. decode:46d720b17617e9967132daf88938f884d292f37aa28c3ad2cf1beb72373a0d5c435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  16. decode:0404c8830001e2e7f53164e3d0af55dbe27e7cd6336db09089a0
  17. decode:e8e6a2ec75142c30409593a51bc8186af07d9584eb61b648725a469a4a7d7306435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  18. decode:0404d883000107771b08f45c9f6794d420fdb467bb5d20f46585
  19. 123
  20. decode:637df4eb1f42dd3aaad0237499157633c8755e91e67a4375242237ca7faffae1435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  21. decode:04044884000176c7c9e9f888822e470ad8710ed184f613505f78
  22. decode:df717ce6552aff77eb2fea59463cc309cae11c8e09e9b629a0cbec4011c8a255435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  23. decode:04044884000195d568a2d5585ea1470ad8710ed184f613505fbf
  24. decode:77681dc7b6b3af07270be968b721ceb397ccb1ed0e0e19afdfda0100c82d1d2c435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  25. decode:0404488400015cda8450caa6c3cd470ad8710ed184f613505f2c
  26. decode:0a6d15e9d82248935890efc8389247862e0abe52bc9836b8622fc47d42783eb6435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  27. decode:04044884000117c0f18a70603112470ad8710ed184f61350dff6
  28. 131
  29. 129
  30. 126
  31. 120
  32. decode:e448d91fe75474b88371f840d7df20b500000000000000000000000000000000435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  33. decode:0404f8fc000178d9dd165c151cce7b974c3e78bb8bfaaca06ffb
  34. decode:2a463f50bd8aa74d72e7dba19d97bfa200000000000000000000000000000000435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  35. decode:0404c00a000174cad59842a98d2d8e2e9a6b46ff243d81ccc6e5
  36. decode:8ccb7a33f6e1274e819767a3ce7d595700000000000000000000000000000000435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  37. decode:0404c00a0001937339f442a98d2d8e2e9a6b46ff243d81ccc602
  38. decode:2e5bcce999acc40f4bd5b2c2f6dcd55300000000000000000000000000000000435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  39. decode:0404c00a0001ce8eb44142a98d2d8e2e9a6b46ff243d81ccc6b8
  40. 140
  41. 127
  42. 128
  43. 122
  44. 121
  45. decode:ba698c3712bfb183ac87b665a106515000000000000000000000000000000000435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  46. decode:04047857000109fde28a35e617a3edae3dc47138fa1d3087f9cd
  47. 130
  48. 124
  49. 125
  50. 226
  51. 134
  52. 133
  53. 234
  54. decode:82bd82426db4e2d305f786d820ff51320fc8e3c49bdcca29f582969921f52f9bfd5bb064ce8b4624f840a4d4b990fa5900000000000000000000000000000000
  55. decode:040400100001e4f7bf6ee417144e16962cba74bca55d75390e1e
  56. decode:e3fddc5a58709d107fe2b3c63500de2c00000000000000000000000000000000435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  57. decode:0404001000018ead001ff8e14b01c10cf79d74bca55d75398e40
  58. decode:ecad7066d709bc299a35ce2f2fdbd07024d0a027ba0f276ca66203026eecc338435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  59. decode:0404001000018b386ff8b154ff4fc10cf79d74bca55d75398ee0
  60. decode:5dfc13b6e9b1a8131ec9fe3546ce6e4900000000000000000000000000000000435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  61. decode:040400100001d956086cf8e14b01c10cf79d74bca55d75394ea6
  62. decode:153a6e2fbe986c0472603ddb349fd95d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
  63. decode:0404001000019bde7af5f8e14bc33736dad874bca55d75395665
  64. decode:f3e0258d2bb713f718dd8a335109228a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
  65. decode:040400100001b6b912a1f8e14bc33736dad874bca55d753956d1
  66. decode:00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
  67. decode:0404001000014d6de9baf8e14bc33736dad874bca55d7539560e
  68. decode:153a6e2fbe986c0472603ddb349fd95d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
  69. decode:0404001000019bde7af5f8e14bc33736dad874bca55d7539d66d
  70. decode:153a6e2fbe986c0472603ddb349fd95d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
  71. decode:0404001000019bde7af5f8e14bc33736dad874bca55d7539d66d
  72. decode:18cb57ab5a5e6c4e281a59e850958c6614e1e5f771c631bc1195c3725673279c435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000

调用了META接口之后,XG有明显的变化。在经过234编号后就无明显变化。

XG的计算不单纯是简单的几个参数串在一起调用SO就完事的。

我为了严谨再次确认,从软件启动的时候每隔3秒调用一次。输出如下。

‘ * “0404d07100019a0e1440e23f320ce4a518a2316455f6681c77ff|1595258812”
‘ * “0404d07100019a0e1440e23f320ce4a518a2316455f6681cb7f3|1595258815”
‘ * “0404d07100019a0e1440e23f320ce4a518a2316455f6681c0918|1595258818”
‘ * “0404f871000116414c1cb5ff90d058381eac0ff8b86f5b6cf841|1595258821”
‘ * “0404c0fa0001b283c4aa6d8371ce4786276f68d39bbfbe3ff76b|1595258824”
‘ * “04047847000199e497dc87cc722beb6b04bec1dc480ba39ce3b6|1595258827”
‘ * “04040000000116faf9c9565f3c17c9e2a8d723bfb55edbb34c29|1595258830”
‘ * “04040000000116faf9c9565f3c17c9e2a8d723bfb55edbb3b4a6|1595258833”
‘ * “04040000000116faf9c9565f3c17c9e2a8d723bfb55edbb314ac|1595258836”
‘ * “04040000000116faf9c9565f3c17c9e2a8d723bfb55edbb324af|1595258840”
‘ * “04040000000116faf9c9565f3c17c9e2a8d723bfb55edbb3e4a3|1595258843”
‘ * “04040000000116faf9c9565f3c17c9e2a8d723bfb55edbb344a9|1595258846”
‘ * “04040000000116faf9c9565f3c17c9e2a8d723bfb55edbb3b866|1595258849”
‘ * “04040000000116faf9c9565f3c17c9e2a8d723bfb55edbb3186c|1595258852”
‘ * “04040000000116faf9c9565f3c17c9e2a8d723bfb55edbb3d860|1595258855”
‘ * “04040000000116faf9c9565f3c17c9e2a8d723bfb55edbb3686b|1595258858”

所以如需一探XG就需要攻破SO,在SO里面的出答案。

看来我也要抛弃抖音了,研究了大 半个月,有些遗憾。。 毕竟技术不到位

  1. 晓风不寐说道:

    XG我已经解决了,现在,用提取的账号,可以刷视频,但是给视频点赞,点不上,偶尔有一个成功,没找到原因

发表评论

邮箱地址不会被公开。 必填项已用*标注