在搜索栏中搜索作品
通过fildder抓包查看请求数据
通过观察可得出client_time和client_sign是不固定的,其中client_time是时间戳,client_sign是签名,所以接下来反编译apk,查看client_sign是如何生成的,现在搜索中搜索关键词client_sign可快速定位
点击进入该处,查看代码
可以发现client_sign的值是aT,而aT是通过一系列字符串生成的
所以进入aT方法中
所以现在可以hook该方法查看传进去的值以及该方法返回的值
jsHook代码:
var aT = Java.use('com.sina.vcomic.b.l');
aT.aT.implementation = function(a){
console.log(a);
console.log(this.aT(a));
return this.aT(a);
}
hook结果:
通过查看可以发现加密字符串的值只有时间戳是变化的。因此可以将加密的参数写出
以下是python代码:
import requests,hashlib,time
url = 'http://api.manhua.weibo.com/client/home/search?word=王牌执行人&page_num=1&row_num=10'
# url = 'http://api.manhua.weibo.com/client/home/search?word=%E7%8E%8B%E7%89%8C%E6%89%A7%E8%A1%8C%E4%BA%BA&page_num=1&row_num=10'
client_time = int(time.time()*1000)
_string = '3.0.1android'+str(client_time)+'e571dd8bd67803995b9bdcfefb58662b24C699621208F2707BD099E04DB8C4890{54563A97-2BBA-7F31-D4C1-8EF72F4A98E6}'
b_string = bytes(_string,encoding='utf-8')
client_sign = hashlib.md5(b_string).hexdigest()
# print(_string)
# print(client_sign)
headers = {
"client-ver": "3.0.1",
"client-type": "android",
"client-time": str(client_time),
"phone-mark": "24C699621208F2707BD099E04DB8C489",
"app-devicetoken": "e571dd8bd67803995b9bdcfefb58662b",
"sina-uid": "0",
"sina-token": "",
"VREADREFER": "vmh_client",
"client-sign": client_sign,
"Cache-Control": "no-cache",
"Content-Type": "application/x-www-form-urlencoded;charset=UTF-8",
"Content-Length": "223",
"Host": "api.manhua.weibo.com",
"Connection": "Keep-Alive",
"Accept-Encoding": "gzip",
"User-Agent": "okhttp/3.8.0"
}
data = {
"client_ver": "3.0.1",
"client_type": "android",
"client_time": str(client_time),
"phone_mark": "24C699621208F2707BD099E04DB8C489",
"app_devicetoken": "e571dd8bd67803995b9bdcfefb58662b",
"sina_uid": "0",
"sina_token": "",
"client_sign": client_sign
}
print(requests.post(url=url, headers=headers, data=data,verify=False).json())