当前位置：隐士博客 > 零碎记录 > 抖音 > 抖音10.5.0正式版X-Gorgon,X-Khronos

抖音10.5.0正式版X-Gorgon,X-Khronos

2020-07-19 1 评 3,649 阅 4 赞 
  1. public final java.util.Map<java.lang.String, java.lang.String> a(java.lang.String r12, java.util.Map<java.lang.String, java.util.List<java.lang.String>> r13) {
  2.             r11 = this;
  3.             r0 = new java.util.HashMap;
  4.             r0.<init>();
  5.             r1 = java.util.Calendar.getInstance();
  6.             r1.getTimeInMillis();
  7.             r1 = "";
  8.             r2 = java.lang.System.currentTimeMillis();
  9.             r4 = 1000; // 0x3e8 float:1.401E-42 double:4.94E-321;
  10.             r2 = r2 / r4;
  11.             r2 = (int) r2;
  12.             r3 = r12.toLowerCase();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  13.             r4 = "http";
  14.             r3 = r3.contains(r4);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  15.             if (r3 != 0) goto L_0x0037;
  16.         L_0x0022:
  17.             r3 = r12.toLowerCase();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  18.             r4 = "https";
  19.             r3 = r3.contains(r4);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  20.             if (r3 == 0) goto L_0x002f;
  21.         L_0x002e:
  22.             goto L_0x0037;
  23.         L_0x002f:
  24.             r12 = new java.lang.NullPointerException;	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  25.             r13 = "nein http/https";
  26.             r12.<init>(r13);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  27.             throw r12;	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  28.         L_0x0037:
  29.             r3 = r12.toLowerCase();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  30.             r4 = "x-khronos";
  31.             r3 = r3.contains(r4);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  32.             if (r3 == 0) goto L_0x0058;
  33.         L_0x0043:
  34.             r3 = r12.toLowerCase();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  35.             r4 = "x-gorgon";
  36.             r3 = r3.contains(r4);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  37.             if (r3 != 0) goto L_0x0050;
  38.         L_0x004f:
  39.             goto L_0x0058;
  40.         L_0x0050:
  41.             r12 = new java.lang.NullPointerException;	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  42.             r13 = "it had";
  43.             r12.<init>(r13);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  44.             throw r12;	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  45.         L_0x0058:
  46.             r3 = com.ss.sys.ces.gg.tt.a(r12);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  47.             if (r3 != 0) goto L_0x0179;
  48.         L_0x005e:
  49.             r12 = com.ss.sys.ces.gg.tt.b(r12);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  50.             r3 = 0;
  51.             if (r12 == 0) goto L_0x0070;
  52.         L_0x0065:
  53.             r4 = r12.length();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  54.             if (r4 <= 0) goto L_0x0070;
  55.         L_0x006b:
  56.             r12 = com.ss.a.b.d.a(r12);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  57.             goto L_0x0071;
  58.         L_0x0070:
  59.             r12 = r3;
  60.         L_0x0071:
  61.             r4 = -1;
  62.             r13 = r13.entrySet();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  63.             r13 = r13.iterator();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  64.             r4 = r3;
  65.             r5 = r4;
  66.             r6 = -1;
  67.         L_0x007d:
  68.             r7 = r13.hasNext();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  69.             if (r7 == 0) goto L_0x0119;
  70.         L_0x0083:
  71.             r7 = r13.next();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  72.             r7 = (java.util.Map.Entry) r7;	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  73.             r8 = r7.getKey();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  74.             r8 = (java.lang.String) r8;	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  75.             r8 = r8.toUpperCase();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  76.             r9 = "X-SS-STUB";
  77.             r8 = r8.contains(r9);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  78.             r9 = 0;
  79.             if (r8 == 0) goto L_0x00a8;
  80.         L_0x009c:
  81.             r3 = r7.getValue();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  82.             r3 = (java.util.List) r3;	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  83.             r3 = r3.get(r9);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  84.             r3 = (java.lang.String) r3;	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  85.         L_0x00a8:
  86.             r8 = r7.getKey();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  87.             r8 = (java.lang.String) r8;	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  88.             r8 = r8.toUpperCase();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  89.             r10 = "COOKIE";
  90.             r8 = r8.contains(r10);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  91.             if (r8 == 0) goto L_0x00e9;
  92.         L_0x00ba:
  93.             r8 = r7.getValue();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  94.             r8 = (java.util.List) r8;	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  95.             r8 = r8.get(r9);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  96.             r8 = (java.lang.String) r8;	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  97.             if (r8 == 0) goto L_0x00e9;
  98.         L_0x00c8:
  99.             r10 = r8.length();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  100.             if (r10 <= 0) goto L_0x00e9;
  101.         L_0x00ce:
  102.             r4 = com.ss.a.b.d.a(r8);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  103.             r8 = com.ss.sys.ces.gg.tt.c(r8);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  104.             if (r8 == 0) goto L_0x00e9;
  105.         L_0x00d8:
  106.             r10 = r8.length();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  107.             if (r10 <= 0) goto L_0x00e9;
  108.         L_0x00de:
  109.             r5 = com.ss.a.b.d.a(r8);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  110.             r10 = com.ss.sys.ces.out.StcSDKFactory.getInstance();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  111.             r10.setSession(r8);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  112.         L_0x00e9:
  113.             r8 = r7.getKey();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  114.             r8 = (java.lang.String) r8;	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  115.             r8 = r8.toUpperCase();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  116.             r10 = "META-SHADOWMAZE";
  117.             r8 = r8.contains(r10);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  118.             r10 = 1;
  119.             if (r8 == 0) goto L_0x007d;
  120.         L_0x00fc:
  121.             r7 = r7.getValue();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  122.             r7 = (java.util.List) r7;	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  123.             r7 = r7.get(r9);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  124.             r7 = (java.lang.String) r7;	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  125.             if (r7 == 0) goto L_0x007d;
  126.         L_0x010a:
  127.             r8 = r7.length();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  128.             if (r8 <= 0) goto L_0x007d;
  129.         L_0x0110:
  130.             r7 = java.lang.Integer.parseInt(r7);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  131.             if (r7 != r10) goto L_0x007d;
  132.         L_0x0116:
  133.             r6 = 1;
  134.             goto L_0x007d;
  135.         L_0x0119:
  136.             if (r12 == 0) goto L_0x0121;
  137.         L_0x011b:
  138.             r13 = r12.length();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  139.             if (r13 > 0) goto L_0x0123;
  140.         L_0x0121:
  141.             r12 = "00000000000000000000000000000000";
  142.         L_0x0123:
  143.             if (r3 == 0) goto L_0x012b;
  144.         L_0x0125:
  145.             r13 = r3.length();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  146.             if (r13 > 0) goto L_0x012d;
  147.         L_0x012b:
  148.             r3 = "00000000000000000000000000000000";
  149.         L_0x012d:
  150.             if (r4 == 0) goto L_0x0135;
  151.         L_0x012f:
  152.             r13 = r4.length();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  153.             if (r13 > 0) goto L_0x0137;
  154.         L_0x0135:
  155.             r4 = "00000000000000000000000000000000";
  156.         L_0x0137:
  157.             if (r5 == 0) goto L_0x013f;
  158.         L_0x0139:
  159.             r13 = r5.length();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  160.             if (r13 > 0) goto L_0x0141;
  161.         L_0x013f:
  162.             r5 = "00000000000000000000000000000000";
  163.         L_0x0141:
  164.             r13 = new java.lang.StringBuilder;	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  165.             r13.<init>();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  166.             r13.append(r12);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  167.             r13.append(r3);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  168.             r13.append(r4);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  169.             r13.append(r5);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  170.             r12 = r13.toString();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  171.             r12 = com.ss.a.b.a.a(r12);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  172.             r12 = com.ss.sys.ces.a.leviathan(r6, r2, r12);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  173.             r12 = com.ss.a.b.a.a(r12);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  174.             r13 = "X-Khronos";
  175.             r1 = new java.lang.StringBuilder;
  176.             r1.<init>();
  177.             r1.append(r2);
  178.             r1 = r1.toString();
  179.             r0.put(r13, r1);
  180.             r13 = "X-Gorgon";
  181.             r0.put(r13, r12);
  182.             goto L_0x01b6;
  183.         L_0x0179:
  184.             r12 = new java.lang.NullPointerException;	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  185.             r13 = "filter_1";
  186.             r12.<init>(r13);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  187.             throw r12;	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  188.         L_0x0181:
  189.             r12 = move-exception;
  190.             r13 = new java.lang.StringBuilder;
  191.             r13.<init>();
  192.             r13.append(r2);
  193.             r13 = r13.toString();
  194.             r2 = "X-Khronos";
  195.             r0.put(r2, r13);
  196.             r13 = "X-Gorgon";
  197.             r0.put(r13, r1);
  198.             r13 = java.util.Calendar.getInstance();
  199.             r13.getTimeInMillis();
  200.             throw r12;
  201.         L_0x01a0:
  202.             r12 = "X-Khronos";
  203.             r13 = new java.lang.StringBuilder;
  204.             r13.<init>();
  205.             r13.append(r2);
  206.             r13 = r13.toString();
  207.             r0.put(r12, r13);
  208.             r12 = "X-Gorgon";
  209.             r0.put(r12, r1);
  210.         L_0x01b6:
  211.             r12 = java.util.Calendar.getInstance();
  212.             r12.getTimeInMillis();
  213.             return r0;
  214.         }
  215.     }

 

虽然JADX不能完全解析出来，但是不影响我们分析

核心代码如下

  1. r13 = new java.lang.StringBuilder;	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  2.             r13.<init>();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  3.             r13.append(r12);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  4.             r13.append(r3);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  5.             r13.append(r4);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  6.             r13.append(r5);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  7.             r12 = r13.toString();	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  8.             r12 = com.ss.a.b.a.a(r12);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  9.             r12 = com.ss.sys.ces.a.leviathan(r6, r2, r12);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }
  10.             r12 = com.ss.a.b.a.a(r12);	 Catch:{ Throwable -> 0x01a0, all -> 0x0181 }

 

下面是我自己翻译了一下

  1. r13 = new java.lang.StringBuilder;
  2.             r13.<init>();	
  3.             r13.append(r12);	 
  4.             r13.append(r3);	 
  5.             r13.append(r4);	 
  6.             r13.append(r5);
  7.             r12 = r13.toString();	
  8.             r12 = StrTByte(r12);	 
  9.             r12 = com.ss.sys.ces.a.leviathan(r6, r2, r12);	 
  10.             Xg = ByteToStr(r12);

其中

r5 = com.ss.a.b.d.a(r8)=md5(r8)=[sessionid=]就是取sessioid后面那串MD5

r4=cookie

r3=X-SS-STUB后面那串MD5

r12=MD5(URL)

  1. 2020-07-19 01:56:22.710 13848-13944/com.nightteam.httpso I/yf: url=https://aweme-hl.snssdk.com/passport/mobile/send_code/v1/?account_sdk_version=380&os_api=22&device_type=OPPO%20R11%20Plus&ssmix=a&manifest_version_code=960&dpi=240&uuid=866174861732390&app_name=aweme&version_name=9.6.0&app_type=normal&ac=wifi&update_version_code=9602&channel=aweGW&device_platform=android&version_code=960&cdid=129b68e5-b390-4f59-a005-caf0b539bf92&openudid=e049a8cdf698603&resolution=720*1280&os_version=5.1.1&language=zh&device_brand=Android&aid=1128&mcc_mnc=460076&device_id=237143476940605&iid=4283346268205181&ts=1595094982&_rticket=1595094982710
  2. 2020-07-19 01:56:22.713 13848-13944/com.nightteam.httpso E/yf: x-Gorgon=040100321080078738761aede30605a36a210bc3fe84ab39cd40

“{“x-Gorgon”:”040100321080078738761aede30605a36a210bc3fe84ab39cd40″,”X-Khronos”:1595094982}”

但是认为这样就大功告成的话。请看下知乎这问答再决定

https://www.zhihu.com/question/389447990

  1. 作者：y.d
  2. 链接：https://www.zhihu.com/question/389447990/answer/1346115903
  3. 来源：知乎
  4. 著作权归作者所有。商业转载请联系作者获得授权，非商业转载请注明出处。
  5.  
  6. 抖音的验签机制很野，即使你的x-gorgon算法生成稍微和它APP本身计算的有些出入
  7. （说白了就是抖音检测到你是独立计算到），它照样会开放一些功能给你，
  8. 比如获取feed接口（热门视频），但是你会发现没法点赞，评论，私信。
  9. 后来经过frida进行一个hook验证，发现确有此事，
  10. 很多x-gorgon算法都是使用hook或者直接调用so到方式实现到，
  11. 根本没去真正解刨它里面到运算过程。再一次测试到过程中，
  12. 我把url以及x-khrons和cookie，xttsub固定起来，
  13. 使用hook或者调用so的方式去计算x-gorgon结果，发现不管你执行多少次，
  14. 结果都是一样的。但是，我使用frida来拦截抖音它自己的签名过程，
  15. 并把参数改成和上面的一样，那么它每次计算的结果都不一样。由此可见，
  16. 抖音在计算过程中肯定获取了某些全局参数，比如它签名后会把一些值存入到
  17. 一个全局变量，下次计算到时候读取，也或者它在某些功能动作到时候，会记
  18. 录一些值，影响签名到计算算法。这个事情到确实得到多次证实，用hook或者
  19. so到方式其实抖音是知道到，最后就是因为这个事情而抛弃了抖音，研究了大
  20. 半年，有些遗憾。。 毕竟技术不到位。最后，上面测试到版本是8～10版本到。

根据知乎的回答，我印证了一下。

如果是直接把SO拿出来调用，得到的跟APP里面得出的是不一致的。

进一步验证，我把cms的接口都HOOK住。然后看顺序。

输出结果如下

  1. decode：e0907362be49034bc1c02edb2a2ee6df000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
  2. decode：0404d08100011721cd864d7830af1b31ecb77c7393552ccfc5e6
  3. decode：69fb68f54c2f1e6fe65d8559cda5235f00000000000000000000000000000000bf211a435e2706db3d0e88c66534221600000000000000000000000000000000
  4. decode：0404f88100015cedc745a68d33a91f3ba6d1c0c96219a7b02ffb
  5. decode：c08ea58eb84819cce52ce7d7b87f1cf400000000000000000000000000000000bf211a435e2706db3d0e88c66534221600000000000000000000000000000000
  6. decode：0404f8810001abb422a8a68d33a91f3ba6d1c0c96219a7b02f14
  7. decode：aa1452d172aad28348c5178e1baab08500000000000000000000000000000000bf211a435e2706db3d0e88c66534221600000000000000000000000000000000
  8. decode：0404f881000197ce2607a68d33a91f3ba6d1c0c96219a7b02f28
  9. decode：7a5218edf3abcbc8a058d7bf8bd3684f6954b64d66b41ee388859c5c2786c155bf211a435e2706db3d0e88c66534221600000000000000000000000000000000
  10. decode：0404f881000145ba3f52e54257821f3ba6d1c0c96219a7b02f63
  11. decode：4a16afa4818ccfcc856e413a4c5b7badfd119302e8948f17f44f7340270cb4ca435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  12. decode：0404f8810001a7757352d5ccef92b211ccb8c0c96219a7b0cf2a
  13. decode：00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
  14. decode：0404f8810001ea0609bfa68d3354442be1fdc0c96219a7b0cf98
  15. decode：46d720b17617e9967132daf88938f884d292f37aa28c3ad2cf1beb72373a0d5c435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  16. decode：0404c8830001e2e7f53164e3d0af55dbe27e7cd6336db09089a0
  17. decode：e8e6a2ec75142c30409593a51bc8186af07d9584eb61b648725a469a4a7d7306435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  18. decode：0404d883000107771b08f45c9f6794d420fdb467bb5d20f46585
  19. 123
  20. decode：637df4eb1f42dd3aaad0237499157633c8755e91e67a4375242237ca7faffae1435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  21. decode：04044884000176c7c9e9f888822e470ad8710ed184f613505f78
  22. decode：df717ce6552aff77eb2fea59463cc309cae11c8e09e9b629a0cbec4011c8a255435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  23. decode：04044884000195d568a2d5585ea1470ad8710ed184f613505fbf
  24. decode：77681dc7b6b3af07270be968b721ceb397ccb1ed0e0e19afdfda0100c82d1d2c435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  25. decode：0404488400015cda8450caa6c3cd470ad8710ed184f613505f2c
  26. decode：0a6d15e9d82248935890efc8389247862e0abe52bc9836b8622fc47d42783eb6435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  27. decode：04044884000117c0f18a70603112470ad8710ed184f61350dff6
  28. 131
  29. 129
  30. 126
  31. 120
  32. decode：e448d91fe75474b88371f840d7df20b500000000000000000000000000000000435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  33. decode：0404f8fc000178d9dd165c151cce7b974c3e78bb8bfaaca06ffb
  34. decode：2a463f50bd8aa74d72e7dba19d97bfa200000000000000000000000000000000435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  35. decode：0404c00a000174cad59842a98d2d8e2e9a6b46ff243d81ccc6e5
  36. decode：8ccb7a33f6e1274e819767a3ce7d595700000000000000000000000000000000435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  37. decode：0404c00a0001937339f442a98d2d8e2e9a6b46ff243d81ccc602
  38. decode：2e5bcce999acc40f4bd5b2c2f6dcd55300000000000000000000000000000000435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  39. decode：0404c00a0001ce8eb44142a98d2d8e2e9a6b46ff243d81ccc6b8
  40. 140
  41. 127
  42. 128
  43. 122
  44. 121
  45. decode：ba698c3712bfb183ac87b665a106515000000000000000000000000000000000435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  46. decode：04047857000109fde28a35e617a3edae3dc47138fa1d3087f9cd
  47. 130
  48. 124
  49. 125
  50. 226
  51. 134
  52. 133
  53. 234
  54. decode：82bd82426db4e2d305f786d820ff51320fc8e3c49bdcca29f582969921f52f9bfd5bb064ce8b4624f840a4d4b990fa5900000000000000000000000000000000
  55. decode：040400100001e4f7bf6ee417144e16962cba74bca55d75390e1e
  56. decode：e3fddc5a58709d107fe2b3c63500de2c00000000000000000000000000000000435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  57. decode：0404001000018ead001ff8e14b01c10cf79d74bca55d75398e40
  58. decode：ecad7066d709bc299a35ce2f2fdbd07024d0a027ba0f276ca66203026eecc338435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  59. decode：0404001000018b386ff8b154ff4fc10cf79d74bca55d75398ee0
  60. decode：5dfc13b6e9b1a8131ec9fe3546ce6e4900000000000000000000000000000000435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000
  61. decode：040400100001d956086cf8e14b01c10cf79d74bca55d75394ea6
  62. decode：153a6e2fbe986c0472603ddb349fd95d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
  63. decode：0404001000019bde7af5f8e14bc33736dad874bca55d75395665
  64. decode：f3e0258d2bb713f718dd8a335109228a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
  65. decode：040400100001b6b912a1f8e14bc33736dad874bca55d753956d1
  66. decode：00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
  67. decode：0404001000014d6de9baf8e14bc33736dad874bca55d7539560e
  68. decode：153a6e2fbe986c0472603ddb349fd95d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
  69. decode：0404001000019bde7af5f8e14bc33736dad874bca55d7539d66d
  70. decode：153a6e2fbe986c0472603ddb349fd95d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
  71. decode：0404001000019bde7af5f8e14bc33736dad874bca55d7539d66d
  72. decode：18cb57ab5a5e6c4e281a59e850958c6614e1e5f771c631bc1195c3725673279c435be92aa3259d3fdbed7d341f16d2da00000000000000000000000000000000

调用了META接口之后，XG有明显的变化。在经过234编号后就无明显变化。

XG的计算不单纯是简单的几个参数串在一起调用SO就完事的。

我为了严谨再次确认，从软件启动的时候每隔3秒调用一次。输出如下。

‘ * “0404d07100019a0e1440e23f320ce4a518a2316455f6681c77ff|1595258812”
‘ * “0404d07100019a0e1440e23f320ce4a518a2316455f6681cb7f3|1595258815”
‘ * “0404d07100019a0e1440e23f320ce4a518a2316455f6681c0918|1595258818”
‘ * “0404f871000116414c1cb5ff90d058381eac0ff8b86f5b6cf841|1595258821”
‘ * “0404c0fa0001b283c4aa6d8371ce4786276f68d39bbfbe3ff76b|1595258824”
‘ * “04047847000199e497dc87cc722beb6b04bec1dc480ba39ce3b6|1595258827”
‘ * “04040000000116faf9c9565f3c17c9e2a8d723bfb55edbb34c29|1595258830”
‘ * “04040000000116faf9c9565f3c17c9e2a8d723bfb55edbb3b4a6|1595258833”
‘ * “04040000000116faf9c9565f3c17c9e2a8d723bfb55edbb314ac|1595258836”
‘ * “04040000000116faf9c9565f3c17c9e2a8d723bfb55edbb324af|1595258840”
‘ * “04040000000116faf9c9565f3c17c9e2a8d723bfb55edbb3e4a3|1595258843”
‘ * “04040000000116faf9c9565f3c17c9e2a8d723bfb55edbb344a9|1595258846”
‘ * “04040000000116faf9c9565f3c17c9e2a8d723bfb55edbb3b866|1595258849”
‘ * “04040000000116faf9c9565f3c17c9e2a8d723bfb55edbb3186c|1595258852”
‘ * “04040000000116faf9c9565f3c17c9e2a8d723bfb55edbb3d860|1595258855”
‘ * “04040000000116faf9c9565f3c17c9e2a8d723bfb55edbb3686b|1595258858”

所以如需一探XG就需要攻破SO，在SO里面的出答案。

看来我也要抛弃抖音了，研究了大 半个月，有些遗憾。。 毕竟技术不到位

免责声明：本博客的提供安全工具、程序(方法)可能带有攻击性，仅供安全研究与教学之用，风险自负!

相关文章

  1. 晓风不寐说道：
    2020-08-24 下午3:26

    XG我已经解决了，现在，用提取的账号，可以刷视频，但是给视频点赞，点不上，偶尔有一个成功，没找到原因

    回复

向晓风不寐进行回复 取消回复

邮箱地址不会被公开。 必填项已用*标注