一、抓包
1、环境搭建
某音app版本31.7.0
已安装Magisk+lsposed的手机(一般是小米手机)
Charles抓包工具(v4.6.5)
Postem(手机端转发端口)
Magisk+lsposed(root环境)
2、抓包原理
charles+Magisk+lsposed+Postem
3、hook源码
package utils;
import android.app.AndroidAppHelper;
import android.content.Context;
import android.content.Intent;
import android.net.Uri;
import android.util.Log;
import android.os.Bundle;
import android.util.Base64;
import android.util.Log;
import android.widget.Toast;
import org.json.JSONObject;
import java.io.InputStream;
import java.lang.reflect.Field;
import java.net.HttpURLConnection;
import java.net.URL;
import java.nio.charset.StandardCharsets;
import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XC_MethodReplacement;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage;
import java.io.UnsupportedEncodingException;
import java.net.URLDecoder;
import java.net.URLEncoder;
public class MainHook implements IXposedHookLoadPackage {
@Override
public void handleLoadPackage(XC_LoadPackage.LoadPackageParam loadPackageParam) throws Throwable {
Log.i("byc","===================dy-start1=========================");
//XposedBridge.log("===================dy-start1==========================");
// 判断当前启动的目标程序是否是要hook的应用程序
// 通杀dy|dy极速版|短视频等 author by byc6352 or metabycf
if (loadPackageParam.packageName.contains("com.ss.android.ugc.aweme")) {
XposedBridge.log("=======dyCapture=====================");
Class CronetClient = XposedHelpers.findClass("org.chromium.CronetClient", loadPackageParam.classLoader);
XposedBridge.hookAllMethods(CronetClient, "tryCreateCronetEngine",
new XC_MethodReplacement() {
@Override
protected Object replaceHookedMethod(XC_MethodHook.MethodHookParam methodHookParam) throws Throwable {
return null;
}
});
}
}
}
4、抓包示例(成功抓到数据):
图1(Charles抓包商品详情)
二、Scheme跳转链接
1、商品详情的跳转链接是:
snssdk1128://goods/seeding/?promotion_id=3712628099427467440
可以从安卓app或浏览器通过scheme跳转直接打开指定的商品详情页
2、网页跳转商品页源码
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>应用内跳转</title>
<link rel="stylesheet" href="static/css/css.min.css">
<script src="static/js/jquery.js"></script>
<meta http-equiv="x-dns-prefetch-control" content="on">
<meta name="viewport" content="width=device-width,initial-scale=1&#