安卓协议逆向

通过frida rpc调用真机获取指定关键字的搜索结果数据。

rpc 简介

frida 提供了一种跨平台的 rpc （远程过程调用）机制，通过 frida rpc 可以在主机和目标设备之间进行通信，并在目标设备上执行代码，可实现功能如下：
1、动态地修改函数和方法的参数和返回值。
2、监视和拦截特定函数和方法的调用。
3、修改内存中的数据和指令。
4、与目标设备上的应用程序进行交互，发送和接收数据。
5、在运行时加载自己的 JavaScript 脚本，从而实现自定义的行为修改。

软硬件工具

app 版本：7.4.70
设备：K40 刷 piexl 11 rom
抓包工具：Charles
反汇编工具：JEB、JADX、IDA
inject：frida

抓包

POST /gw/mtop.taobao.idle.search.glue/8.0/ HTTP/1.1
x-sgext: JAfKISv0W5XonL3HUeX4UiH7EfgS%2BwL4F%2FIX8wL7F%2FoC%2BQ3%2FDfoN%2Bw37DfsN%2Bw37DfsN%2Bw35E%2BYQ5hL4DfkT5hHmEeYR5hHmEeYR5hHmEeYR5hHmEOYX%2Bg38EeYT%2Bg36DfoN%2BBnpEPwW%2BBH%2FF%2FoQ%2FQL6E6lA%2BhH6EPlH%2FRWoFvMT6RD%2FGekY6RL%2BAvoR%2BhbpEukQ6RDpEOkQ6RDpE%2BkQ6RP6AvkC%2FwKpAvoC%2BgL6AvoC%2BgLpROlHrwL6AqxEr0T6FukR%2BhH6EQ%3D%3D
umid: Y6mM0d1XDnwDAAZc4d8Tk60B
x-sign: azU7Bc002xAAJzB6M9wiB4WMskX6dzB3PW%2F64QfVy78rMahh4hODtL0DoF9kmgIWRqfEkGhlFlqjHfQDYE50A5EzkuewtzB3MLcwdz
x-nettype: WIFI
x-pv: 6.3
x-nq: WIFI
EagleEye-UserData: spm-cnt=a2170.8011571.0.0&spm-url=a2170.unknown.0.0
first_open: 1
x-features: 27
x-app-conf-v: 0
x-mini-wua: HHnB_QQx7EhGYzt0aRv0%2BjcjSfSTdMh9NXopIhtlxCcIGWkyEPONy4fMU296Q4NG4PEFmdynoG21RVXefkf%2Ff8G%2Fqlkl8cahX%2BEk3JT5GB2Uh4TNEqzzblgemWV%2Bitf42AKL%2FrWZLKkzalExnviNeICDt5A%3D%3D
content-type: application/x-www-form-urlencoded;charset=UTF-8
Content-Length: 630
x-t: 1672056548
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
x-bx-version: 6.5.56
f-refer: mtop
x-extdata: openappkey%3DDEFAULT_AUTH
x-ttid: 231200%40fleamarket_android_7.4.70
x-app-ver: 7.4.70
x-c-traceid: Y6mM0d1XDnwDAAZc4d8Tk60B16720565484910160126869
x-location: 0%2C0
x-umt: 2QMB7AlLPMcI7wKFTpWcJNO9Tq3ykFES
a-orange-q: appKey=21407387&appVersion=7.4.70&clientAppIndexVersion=1120221225203700833&clientVersionIndexVersion=0
x-utdid: Y6mM0d1XDnwDAAZc4d8Tk60B
x-appkey: 21407387
x-devid: AnlVbDHuTb2u0LWMPSEZxO4CdI4PNLcEAjN85BBOipB9
user-agent: MTOPSDK%2F3.1.1.7+%28Android%3B11%3BXiaomi%3BM2012K11AC%29
Host: g-acs.m.goofish.com
Accept-Encoding: gzip
Connection: Keep-Alive
data=%7B%22activeSearch%22%3Afalse%2C%22bizFrom%22%3A%22home%22%2C%22disableHierarchicalSort%22%3A0%2C%22forceUseInputKeyword%22%3Afalse%2C%22forceUseTppRepair%22%3Afalse%2C%22fromFilter%22%3Afalse%2C%22fromKits%22%3Afalse%2C%22fromLeaf%22%3Afalse%2C%22fromShade%22%3Afalse%2C%22fromSuggest%22%3Afalse%2C%22keyword%22%3A%22%E4%B8%9D%E8%A2%9C%22%2C%22pageNumber%22%3A1%2C%22resultListLastIndex%22%3A0%2C%22rowsPerPage%22%3A10%2C%22searchReqFromActivatePagePart%22%3A%22historyItem%22%2C%22searchReqFromPage%22%3A%22xyHome%22%2C%22searchTabType%22%3A%22SEARCH_TAB_MAIN%22%2C%22shadeBucketNum%22%3A-1%2C%22suggestBucketNum%22%3A27%7D

多次抓包，发现变化的字段有：

x-sgext、x-sign、x-mini-wua、x-c-traceid、x-t、Content-Length                                    

参数分析

先从 x-sign 值入手， apk 包拖入 jadx 搜索，得到以下结果：

一个个点进去查看，发现并没有有价值的东西，仅仅只是构建字段名等操作，并且我尝试 hook 这些点，并没有得到有用的信息，换 JEB 看看，反复搜索观察，最终定位到 getUnifiedSign 这个函数：

跟进