安卓逆向:抖音protobuf数据解析

---

前言

免责声明：
请勿商用！
请勿大量抓取！
若因使用本服务与抖音官方造成不必要的纠纷，本人盖不负责！
本人纯粹技术爱好，若侵犯抖音贵公司的权益，请告知,速删除！

---

什么是protobuf,csdn很多相关的文章介绍,总体来说就是更小，更快，可读性差！

---

转载本文，请注明本文链接，谢谢！

一、protobuf正向流程

1.创建proto文件生成对应的py文件

pycharm有编辑proto的插件，写代码有提示很方便,创建protobuf文件包，创建addressbook.proto文件

syntax = "proto3";


message AddressBook {
  repeated Person people = 1;
}

message Person {
  string name = 1;
  int32 id = 2;
  string email = 3;
  float money = 4;
  bool work_status = 5;

  repeated PhoneNumber phones = 6;
  MyMessage maps = 7;

}

message PhoneNumber {
    string number = 1;
    PhoneType type = 2;
}

message MyMessage {
  map<int32, int32> mapfield = 1;
}

---

进入这个文件的目录

protoc ./addressbook.proto  --python_out=./

进入这个文件的目录，这时候就创建了一个对应的py文件

---

创建add_person.py

# 环境python3.8
from protobuf import addressbook_pb2
from google.protobuf import json_format

# 添加数据信息
address_book = addressbook_pb2.AddressBook()
person = address_book.people.add()

person.id = 1
person.name = "safly"
person.email = "safly@qq.com"
person.money = 1000.11
person.work_status = True

phone_number = person.phones.add()
phone_number.number = "123456"
phone_number.type = addressbook_pb2.HOME

maps = person.maps
maps.mapfield[1] = 1
maps.mapfield[2] = 2

# 转成字符串
serializeToString = address_book.SerializeToString()
print(serializeToString)

# a = address_book.ParseFromString(serializeToString)
# print(type(address_book.people))

# 转成json
b = json_format.MessageToJson(address_book)
print(b)

二、protobuf逆向流程

1.抓包确定位置

通过charles抓包

---

那就已经接口是aweme/v2/feed,打开jadx打开app全局搜索关键词，按住ctrl点击这个类

点进去就找对应的字段和编号啦

2.根据代码编写相应的proto文件

syntax = "proto3";
// 这里还需要其他的proto文件，数据很多，jadx代码上都有，安装ctrl点进去就是，以此类推
import 'myAwemeStructV2.proto';
import 'myExtraStructV2.proto';
import 'myLogPbStructV2.proto';
import 'myGuideWordV2.proto';

message AwemeV2FeedResponse {
    int32 status_code = 1;
    int64 min_cursor = 2;
    int64 max_cursor = 3;
    int32 has_more = 4;
    repeated my_aweme_struct_v2.AwemeStructV2 aweme_list = 5;
    string rid = 6;
    int32 home_model = 7;
    int32 refresh_clear = 8;
    repeated my_extra_struct_v2.ExtraStructV2 extra = 9;
    repeated my_log_pb_structV2.LogPbStructV2 log_pb = 10;
    string DebugInfo = 11;
    repeated my_guide_word_v2.GuideWordV2 guide_word = 12;
    repeated my_aweme_struct_v2.AwemeStructV2 preload_ads = 13;
    string status_msg = 14;
    int32 block_code = 15;
    repeated my_aweme_struct_v2.AwemeStructV2 preload_awemes = 16;
    bool enable_re_rank = 17;
    bool disable_adjust_for_cache = 18;
}

3.结果

生成相应的py文件，最后结合抓取的信息转换成json格式示例代码

# 环境python2.7
info = DouyinAwemeFeed_pb2.AwemeV2FeedResponse()
info.ParseFromString("你的请求proto数据")
print json.dumps(MessageToDict(info, preserving_proto_field_name=True), ensure_ascii=False)

结果展示: