【Unidbg】海南航空hnairsign算法逆向

寻深圳逆向/爬虫坑位 , wx:cjh-18888

很简单，没难度. 直接上代码了.

package com.rytong.hnair;

import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.JSONObject;
import com.github.unidbg.AndroidEmulator;
import com.github.unidbg.Module;
import com.github.unidbg.arm.backend.DynarmicFactory;
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
import com.github.unidbg.linux.android.AndroidResolver;
import com.github.unidbg.linux.android.dvm.*;
import com.github.unidbg.linux.android.dvm.jni.ProxyDvmObject;
import com.github.unidbg.memory.Memory;
import sun.misc.BASE64Decoder;

import java.io.File;
import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.util.ArrayList;
import java.util.List;


public class HNASignature extends AbstractJni {
    private final AndroidEmulator emulator;
    private final Module module;
    private final VM vm;
    public HNASignature() {
        emulator = AndroidEmulatorBuilder.for32Bit()
                .addBackendFactory(new DynarmicFactory(true))
                .build();
        Memory memory = emulator.getMemory();
        memory.setLibraryResolver(new AndroidResolver(23));
        vm = emulator.createDalvikVM(new File("G:\\code\\java\\unidbg-master\\unidbg-android\\src\\test\\java\\com\\com\\rytong\\hnair\\base.apk"));
        vm.setJni(this);
        vm.setVerbose(false);
        DalvikModule dm = vm.loadLibrary(new File("G:\\code\\java\\unidbg-master\\unidbg-android\\src\\test\\java\\com\\com\\rytong\\hnair\\libsignature.so"), false);

        module = dm.getModule();
        dm.callJNI_OnLoad(emulator);
    }

    public void callSign(String encryptData){
        List<Object> list = new ArrayList<>(7);
        list.add(vm.getJNIEnv());
        list.add(0);
        String str1 = "{}";
        list.add(vm.addLocalObject(new StringObject(vm,str1)));
        String str2 = "{}";
        list.add(vm.addLocalObject(new StringObject(vm,str2)));
        list.add(vm.addLocalObject(new StringObject(vm,encryptData)));
        String str4 = "21047C596EAD45209346AE29F0350491";
        list.add(vm.addLocalObject(new StringObject(vm,str4)));
        String str5 = "F6B15ABD66F91951036C955CB25B069F";
        list.add(vm.addLocalObject(new StringObject(vm,str5)));

        Number number = module.callFunction(emulator,0xA49C+1,list.toArray())[0];
        DvmObject result = vm.getObject(number.intValue());
        String value = (String) result.getValue();
        System.out.println("result ->"  + value.split(">>")[0]);

    }



    public static void main(String[] args) throws IOException {
        HNASignature hnsign = new HNASignature();
        String encryptData = "{\"akey\":\"184C5F04D8BE43DCBD2EE3ABC928F616\",\"aname\":\"com.rytong.hnair\",\"atarget\":\"standard\",\"aver\":\"8.14.2\",\"did\":\"cdb090d2dd80442c\",\"dname\":\"Google_Pixel 3\",\"mchannel\":\"official\",\"schannel\":\"AD\",\"slang\":\"zh-CN\",\"sname\":\"google\\/blueline\\/blueline:9\\/PQ2A.190405.003\\/5310204:user\\/release-keys\",\"stime\":\"1650656867061\",\"sver\":\"9\",\"system\":\"AD\",\"szone\":\"-0500\",\"abuild\":\"62316\",\"riskToken\":\"62625d336v5NyL6OaDct0Fv0PVM5Yq5I1fFN6RJ3\",\"captchaToken\":\"\",\"hver\":\"8.14.2.23509.4f05a2e32.standard\",\"number\":\"13544221111\",\"pin\":\"F\\/rIccwe6CkRrHDXyr8Z4kjvfUQ932Co0XHIK6yyj74SHG9dla3S4GQlpSO7hWlh0HYgNLpdeCqL\\n\\/Wh7i6X5vr3Fs5w\\/qV8yjutwGo4IntwMx6\\/IDtQlbcX4iQ+R4lsPSASZAbbu8SRhX08YiCXZoLzI\\nVBpTjsQ+dU9A78O3HxE=\\n\",\"toSave\":true}";
        System.out.println(encryptData);
        hnsign.callSign(encryptData);

    }


}