得物app frida-rpc hook 搜索功能

最新推荐文章于 2024-08-29 16:35:20 发布

十二有bug

最新推荐文章于 2024-08-29 16:35:20 发布

阅读量3.2k

点赞数 3

分类专栏： python frida-rpc 文章标签： fastapi python 爬虫

本文链接：https://blog.csdn.net/qq_33403388/article/details/126639606

版权

python 同时被 2 个专栏收录

3 篇文章 0 订阅

订阅专栏

frida-rpc

1 篇文章 0 订阅

订阅专栏

1.使用charles对得物app 的搜索进行抓包

https://app.dewu.com/api/v1/app/search/ice/community/search/list?hideAddProduct=0&title=%E6%A4%8D%E6%9D%91%E7%A7%80%E5%B0%8F%E6%96%B9%E7%93%B6%01&sortMode=1&typeId=0&sortType=0&showHot=1&catId=0&page=0&limit=20&scene=community_trans_product&newSign=6ad469aaeb1a66e2dbe3f8b7aad11312

经过测试发现newsign是时时变动的

所以先把得物app使用jadx反编译然后全局搜newsign

搜到后去这c里面看看

发现有几个map.put参数

使用frida对这个地方进行hook下

import frida
import sys
import os
os.system("adb forward tcp:27042 tcp:27042")
os.system("adb forward tcp:27043 tcp:27043")
# 远程链接手机上的frida
rdev = frida.get_remote_device()
# 需要hook的包
session = rdev.attach("得物(毒)")
print(session)
scr = """
Java.perform(function () {
    var RequestUtils= Java.use('com.shizhuang.duapp.common.utils.RequestUtils');
    RequestUtils.c.implementation = function(a,b){
            console.log("c方法-------------------------------")
             console.log(a)
            console.log(b)
            var result = this.c(a,b);
            console.log("a= " + a.entrySet().toArray());
            console.log("b= " + b);
            console.log(result)
            return result;
    }
})
"""
script = session.create_script(scr)
def on_message(message, data):
    print(message)
    print(data)
# 执行回调函数
script.on("message", on_message)
script.load()

sys.stdin.read()

经过反复对比发现一开始传进去固定的参数然后他会在内部进行增加

最后经过那个c进行生成

所以直接上代码


jsCode = """
    function newsign(arg_f,j2) {
//arg_f 请求的参数
//{hideAddProduct=0, title=植村秀小方瓶, sortMode=1, typeId=0, sortType=0, catId=0, showHot=1, page=0, limit=20, scene=community_trans_product}
//j2 是时间戳

        let result = "";
        Java.perform(function () {
            let map = Java.use("java.util.HashMap").$new();
            for (let key in arg_f) {
                map.put(key + "", arg_f[key] + "")
            }
       console.log(map)
        result = Java.use("com.shizhuang.duapp.common.utils.RequestUtils").c(map, j2)
        console.log(map)
        console.log(result)
       })
        return result;
}
    rpc.exports = {
        newsign:newsign
    };
"""

只需要安装这个格式给他生成参数就行下面是完整代码

from fastapi import FastAPI
import uvicorn
import frida

jsCode = """
    function newsign(arg_f,j2) {
        let result = "";
        Java.perform(function () {
            let map = Java.use("java.util.HashMap").$new();
            for (let key in arg_f) {
                map.put(key + "", arg_f[key] + "")
            }
       console.log(map)
        result = Java.use("com.shizhuang.duapp.common.utils.RequestUtils").c(map, j2)
        console.log(map)
        console.log(result)
       })
        return result;
}
    rpc.exports = {
        newsign:newsign
    };
"""

rdev = frida.get_remote_device()
# 需要hook的包
process = rdev.attach("得物(毒)")
script = process.create_script(jsCode)
script.load()
from pydantic import BaseModel
app = FastAPI()
class Item(BaseModel):
    m: dict
    j2: int
@app.post("/getnewsign")
async def getencrypt(item: Item):
    print(item.m)
    print(item.j2)
    result = script.exports.newsign(item.m, item.j2)

    return {"data": result}

if __name__ == '__main__':
    uvicorn.run(app, host="0.0.0.0", port=8080)

上面是如何生成加密参数

下面是如何提交

import requests
import time
import json
from fastapi import FastAPI, Query
import uvicorn

import urllib.parse
app = FastAPI()
@app.get("/")
async def server2(title=Query(None), page=Query(None)):
    print(111)
    print(title)
    timestamp = int(time.time() * 1000)
    //得物的title 是需要进行urlencode编码的
    titles ={}
    titles['title']=title
    titleurlencode =urllib.parse.urlencode(titles)
    page =page
     //需要加密的参数
    params ={'hideAddProduct':0, 'title':title, 'sortMode':1, 'typeId':0, 'sortType':0, 'catId':0, 'showHot':1, 'page':page, 'limit':20, 'scene':'community_trans_product'}

    data = {
        "m": params,
        "j2": timestamp,
    }
    print(timestamp)
    r = requests.post("http://127.0.0.1:8080/getnewsign", data=json.dumps(data))
    sign = r.json().get("data")
    # ########### 加密newsign end
    params["newSign"] = sign
    print(sign)
    url  ='https://fast.dewu.com/api/v1/app/search/ice/community/search/list?hideAddProduct=0&'+titleurlencode+'&sortMode=1&typeId=0&sortType=0&showHot=1&catId=0&page='+str(page)+'&limit=20&scene=community_trans_product&newSign='+sign
    print(url)
    print('!!!!!!!!!!!!!!')

    header ={
                'duplatform':'android',
                'appId':'duapp',
                'duchannel':'pp',
                'humeChannel':'',
                'duv':'4.80.0',
                'duloginToken':'0e604806|51525851|fafb23432de413d6',
                'dudeviceTrait':'MuMu',
                'dudeviceBrand':'Android',
                'timestamp':f'{timestamp}',
                'shumeiid':'20220828135024fae2e59a8dcdc8f7da4d60545cc47536011c01ddeca71449',
                'oaid':'',
                'User-Agent':'duapp/4.80.0(android;6.0.1)',
                'X-Auth-Token':'Bearer eyJhbGciOiJSUzI1NiJ9.eyJpYXQiOjE2NjE4NTY3MDAsImV4cCI6MTY5MzM5MjcwMCwiaXNzIjoiYjJkZDRmNWRhMTk4OTY4MyIsInN1YiI6ImIyZGQ0ZjVkYTE5ODk2ODMiLCJ1dWlkIjoiYjJkZDRmNWRhMTk4OTY4MyIsInVzZXJJZCI6NTE1MjU4NTEsImlzR3Vlc3QiOmZhbHNlfQ.GCn7953gjAAdDDpfKgaEgd_rFF04zfaOCFjMaTj-7WCzIB6NcHLaKib56PH_e7T2WnU-2XE3WHF531_qaWLQdYD0Xvxo7gLcBMLtGf21rv-CAr7HSGJhW8QfKmvzGE-MMSd90klcPkGVbkVP0scpkMCtJ9BcmlFBb1i5ddDQPF1iQrhmobsaC3OmWq5NUvl7MjvFGxJ93jtohNFIaKZvhC4KEncKG894DIgplyg45bkMAoB7Kq6Agg55-t0zcBU9giTC8x4msSdEVp8tqIYZizQQYN2jprmaq7biRoOK70UqraAlE4hvJJthk5WnOyjz4EztAvFBGCTMQ2NHk3tKTw',
                'isRoot':'0',
                'emu':'1',
                'isProxy':'0',
                'SK':'9JjqA3RNvkfMqQDDVXi8uEpA3rxbSLl0tDJ8eHKmhzjU9nqqCjrSc6BH0RwY4RYSOFLqgeY4F86NPAWx7BABGpf0Ju1t',
                'duproductid':'2D3E5AD66B14B10F6CF5D2F964F8522CBDFE24914A4EEF24D4D5C25559243BDD',
                'ducodeid':'',
                'sks':'0,adw1',
                'Host':'app.dewu.com',
                'Connection':'Keep-Alive',
                'Accept-Encoding':'gzip',
                'Cookie':'duToken=d41d8cd9|51525851|1661856700|45c0ca4eef0de68c'
    }

    r1 = requests.get(url=url, headers=header)
    # print(r1.text)
    rs =r1.text
    return rs

if __name__ == '__main__':
    uvicorn.run(app, host="0.0.0.0", port=8008)

最后请求地址

http://127.0.0.1:8008/?title=%E5%8F%A3%E7%BA%A2&page=0