折腾:
【已解决】尝试破解小花生app安卓apk希望看到api返回的json中的J的解密算法得到明文
期间,现在已经有了:
- apk改名zip后解压得到的:xiaohuashengv3.6.9 – unzipped
- apktool反编译得到的:xiaohuashengv3.6.9 – apktool decoded
- jd-gui查看到的jar包的源码:jar sourcecode
- jar包是dex2jar从dex破解得到的
现在只能是尝试利用手上的资源,去找找,能否发现点返回的json中J的加密逻辑和其他有用的线索。
参考:
“AndroidManifest.xml:这东西大家肯定非常熟悉,是一个存了一大堆程序配置信息的清单文件,当然也是二进制的。”
去看看:AndroidManifest.xml
- jar改名zip解压后的:是二进制乱码
- apktool反编译得到的:是xml源码
- 其中有我要的很多的:
- com.huili.readingclub.xxx
/Users/crifan/dev/dev_tool/android/reverse engineering/apk/xiaohuashengv3.6.9 – apktool decoded/AndroidManifest.xml
<uses-permission android:name="com.huili.readingclub.permission.JPUSH_MESSAGE"/> <meta-data android:name="TxAppEntry" android:value="com.huili.readingclub.MyApplication"/> <provider android:authorities="com.huili.readingclub.provider" android:exported="false" android:grantUriPermissions="true" android:name="android.support.v4.content.FileProvider"> <activity android:label="@string/app_name" android:name="com.huili.readingclub.activity.LauncherActivity"> <activity android:name="com.huili.readingclub.activity.note.WebWriteArticleFinishActivity" android:screenOrientation="portrait" android:windowSoftInputMode="adjustPan"/> <activity android:name="com.huili.readingclub.activity.note.ExperienceVoteUsersActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.LoginActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.LoginPasswordActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.LoginBindPhoneActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.RegisterActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.VerificationCodeLoginActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.GuidePageActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.base.WebViewActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.YouzanH5Activity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.base.ChoosePictureActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.booklist.ViewActivityBooklistActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.booklist.AddBookWithChildrenBooklistActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.booklist.AgeRankingActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.booklist.BookCommentsAndBookAppraisesActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.booklist.ActivityBooklistActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.booklist.CreateActivityBooklistActivity" android:screenOrientation="portrait" android:windowSoftInputMode="adjustResize"/> <activity android:name="com.huili.readingclub.activity.booklist.UserAndRecommendBooklistsActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.booklist.BooklistsAndHotBooksActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.bookcase.SearchMyBookWithSelectedBookActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.book.ShareBookCardActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.booklist.UBLSelectBookWithWriteActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.tabreading.ReadingCalendarActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.tabreading.ReadingRankingListActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.tabreading.SingleMonthlyBookListActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.tabreading.SingleDarenActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.tabreading.ShareReadingActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.tabreading.ReadedActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.tabreading.ReadedMoreActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.english.BookCommentsWithSingleGroupActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.englishresource.SingleCategoryActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.englishresource.SearchSeriesActivity" android:screenOrientation="portrait" android:windowSoftInputMode="adjustResize"/> <activity android:name="com.huili.readingclub.activity.englishresource.AudioPlayViewActivity" android:screenOrientation="portrait" android:windowSoftInputMode="adjustResize"/> <activity android:name="com.huili.readingclub.activity.english.AddNoteTagActivity" android:screenOrientation="portrait" android:windowSoftInputMode="adjustResize"/> <activity android:name="com.huili.readingclub.activity.english.AddQuestionActivity" android:screenOrientation="portrait" android:windowSoftInputMode="adjustResize"/> <activity android:name="com.huili.readingclub.activity.english.ModifyQuestionActivity" android:screenOrientation="portrait" android:windowSoftInputMode="adjustResize"/> <activity android:name="com.huili.readingclub.activity.english.SingleQuestionTagActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.english.SingleEnglishAnswerBooksActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.english.AddBooksForAnswerActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.english.AnswerReplyActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.english.HistoryQuestionActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.englishresource.RelationAudioActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.englishresource.SingleAudioPackageActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.classroom.SelfReadingCategoryActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.classroom.ParentChildReadingActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.classroom.SelfReadingActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.classroom.WhitePaperActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.classroom.EnglishGradeActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.classroom.ShareInviteActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.classroom.ShareInviteCardActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.classroom.InviteAwardActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.classroom.ExchangeCouponActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.classroom.ExchangeCoupon1Activity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.classroom.GetTestAccountActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.classroom.SelectedGradeWithScreenActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.classroom.SearchEnglishLevelActivity" android:screenOrientation="portrait" android:windowSoftInputMode="adjustResize"/> <activity android:name="com.huili.readingclub.activity.classroom.SelectedChildSituationWithScreenActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.classroom.SelectedTestProjectWithScreenActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.classroom.TestHomeActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.classroom.XueLeTestActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.classroom.LanceTestWithScreenActivity" android:screenOrientation="portrait" android:windowSoftInputMode="adjustResize"/> <activity android:name="com.huili.readingclub.activity.classroom.ARTestWithScreenActivity" android:screenOrientation="portrait" android:windowSoftInputMode="adjustResize"/> <activity android:name="com.huili.readingclub.activity.classroom.LevelBuyListActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.classroom.NoTestWithScreenActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.classroom.RelatedExperiencesActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.classroom.TestResultWithScreenActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.classroom.LatelyNewSeriesActivity" android:screenOrientation="portrait"/> <activity android:name="com.huili.readingclub.activity.classroom.SellBooklistActivity" android:screenOrientation="portrait"> <intent-filter> ...
其中可见:
- com.huili.readingclub:下面有很多文件夹和类
- activity
- note
- WebWriteArticleFinishActivity
- ExperienceVoteUsersActivity
- LoginActivity
- LoginPasswordActivity
- LoginBindPhoneActivity
- RegisterActivity
- VerificationCodeLoginActivity
- GuidePageActivity
- base
- WebViewActivity
- ChoosePictureActivity
- YouzanH5Activity
- booklist
- ViewActivityBooklistActivity
- AddBookWithChildrenBooklistActivity
- AgeRankingActivity
- BookCommentsAndBookAppraisesActivity
- ActivityBooklistActivity
- CreateActivityBooklistActivity
- UserAndRecommendBooklistsActivity
- BooklistsAndHotBooksActivity
- UBLSelectBookWithWriteActivity
- bookcase
- SearchMyBookWithSelectedBookActivity
- book
- ShareBookCardActivity
- tabreading
- ReadingCalendarActivity
- ReadingRankingListActivity
- SingleMonthlyBookListActivity
- SingleDarenActivity
- ShareReadingActivity
- ReadedActivity
- ReadedMoreActivity
- english
- BookCommentsWithSingleGroupActivity
- AddNoteTagActivity
- AddQuestionActivity
- ModifyQuestionActivity
- SingleQuestionTagActivity
- SingleEnglishAnswerBooksActivity
- AddBooksForAnswerActivity
- AnswerReplyActivity
- HistoryQuestionActivity
- TopicsWithSingleGroupActivity
- SingleEnglishQuestionActivity
- AddAndModifyEnglishAnswerActivity
- AddAndModifyEnglishAnswerBooksActivity
- SingleEnglishAnswerActivity
- englishresource
- SingleCategoryActivity
- SearchSeriesActivity
- AudioPlayViewActivity
- RelationAudioActivity
- SingleAudioPackageActivity
- classroom
- SelfReadingCategoryActivity
- ParentChildReadingActivity
- SelfReadingActivity
- WhitePaperActivity
- EnglishGradeActivity
- ShareInviteActivity
- ShareInviteCardActivity
- InviteAwardActivity
- ExchangeCouponActivity
- ExchangeCoupon1Activity
- GetTestAccountActivity
- SelectedGradeWithScreenActivity
- SearchEnglishLevelActivity
- SelectedChildSituationWithScreenActivity
- SelectedTestProjectWithScreenActivity
- TestHomeActivity
- XueLeTestActivity
- LanceTestWithScreenActivity
- ARTestWithScreenActivity
- LevelBuyListActivity
- NoTestWithScreenActivity
- RelatedExperiencesActivity
- TestResultWithScreenActivity
- LatelyNewSeriesActivity
- SellBooklistActivity
- TestResultNotificationActivity
- AllSellBooklistActivity
- AllSellPosterActivity
- SingleWhitePaperActivity
- LexileARFindBookActivity
- 。。。
- 。。。
还有很多,就不继续列举了。
其中的:
- classroom
- SelfReadingCategoryActivity
- ParentChildReadingActivity
像是我此处希望找的:

- 花生团-》教师,房间
- 自主阅读馆
- 亲子阅读馆
搜:
com.huili.readingclub
搜:
C,J,M,ST
中的ST,找不到:

搜:

GET /Reading.svc/queryRecentPopularBook/1134781/1 HTTP/1.1 Content-Type application/json Authorization NSTp9~)NwSfrXp@\ Content-Length 2 Host www.xiaohuasheng.cn:83 User-Agent Mozilla/5.0 (Linux; U; Android 4.4.2; zh-cn; A0001 Build/KOT49H) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1 Cookie ASP.NET_SessionId=b25ctv2hir0gibk4aaxj5aix Cookie2 $Version=1 Accept-Encoding gzip Connection keep-alive { "C": 2, "J": "H4sIAAAAAAAEAKVXXU8bVxD9K5afEok29\/vu5aU。。。9fYLgHH\/g\/\/AoBWrGdtEAAA", "M": "1001", "ST": null }
中的
1001
是能搜到的:

-》那这部分代码,可能就是有关系的。
-》针对于返回的json去解析的代码。
所以去研究看看
com/tencent/bugly/legu/crashreport/crash/BuglyBroadcastRecevier.java
public class BuglyBroadcastRecevier extends BroadcastReceiver { public static String ACTION_PROCESS_CRASHED = "com.tencent.feedback.A02"; public static String ACTION_PROCESS_LAUNCHED = "com.tencent.feedback.A01"; public static final long UPLOADLIMITED = 60000L; private static BuglyBroadcastRecevier d = null; private IntentFilter a = new IntentFilter(); private Context b; private String c; private boolean a(Context paramContext, Intent paramIntent) { boolean bool1 = true; if ((paramContext != null) && (paramIntent != null)) {} for (;;) { boolean bool2; Object localObject1; try { bool2 = paramIntent.getAction().equals("android.net.conn.CONNECTIVITY_CHANGE"); if (!bool2) { bool2 = false; return bool2; } paramIntent = com.tencent.bugly.legu.proguard.a.e(this.b); localObject1 = new java/lang/StringBuilder; ((StringBuilder)localObject1).<init>("is Connect BC "); w.c(paramIntent, new Object[0]); localObject1 = new java/lang/StringBuilder; ((StringBuilder)localObject1).<init>(); localObject2 = this.c; localObject1 = new java/lang/StringBuilder; ((StringBuilder)localObject1).<init>(); w.a("network %s changed to %s", new Object[] { localObject2, paramIntent }); if (paramIntent == null) { this.c = null; bool2 = bool1; continue; } localObject1 = this.c; } finally {} this.c = paramIntent; long l = System.currentTimeMillis(); Object localObject2 = com.tencent.bugly.legu.crashreport.common.strategy.a.a(); t localt = t.a(); paramContext = com.tencent.bugly.legu.crashreport.common.info.a.a(paramContext); if ((localObject2 == null) || (localt == null) || (paramContext == null)) { w.d("not inited BC not work", new Object[0]); bool2 = bool1; } else { bool2 = bool1; if (!paramIntent.equals(localObject1)) { if (l - localt.a(c.a) > 60000L) { w.a("try to upload crash on network changed.", new Object[0]); c.a().a(0L); } bool2 = bool1; if (l - localt.a(1001) > 60000L) { w.a("try to upload userinfo on network changed.", new Object[0]); paramIntent = v.a(); paramContext = new com/tencent/bugly/legu/crashreport/crash/BuglyBroadcastRecevier$1; paramContext.<init>(this); paramIntent.b(paramContext); bool2 = bool1; } } } } }
可以看懂,基本上是网络相关,上传文件或数据超过一定大小了,然后会报错之类的。
-》不是我们要找的。
com/tencent/bugly/legu/crashreport/biz/b.java
private static void c(Context paramContext, BuglyStrategy paramBuglyStrategy) { boolean bool1; boolean bool2; if (paramBuglyStrategy != null) { bool1 = paramBuglyStrategy.recordUserInfoOnceADay(); bool2 = paramBuglyStrategy.isEnableUserInfo(); } for (;;) { int m; Object localObject2; if (bool1) { paramBuglyStrategy = com.tencent.bugly.legu.crashreport.common.info.a.a(paramContext); localObject1 = paramBuglyStrategy.d; localObject1 = a.a((String)localObject1); if (localObject1 != null) { m = 0; if (m < ((List)localObject1).size()) { localObject2 = (UserInfoBean)((List)localObject1).get(m); if ((((UserInfoBean)localObject2).n.equals(paramBuglyStrategy.i)) && (((UserInfoBean)localObject2).b == 1)) { long l1 = com.tencent.bugly.legu.proguard.a.o(); if (l1 <= 0L) { break label151; } if (((UserInfoBean)localObject2).e >= l1) { if (((UserInfoBean)localObject2).f <= 0L) { a.b(); } } } } } label151: for (m = 0;; m = 1) { if (m != 0) { break label157; } return; m++; break; } label157: bool2 = false; } Object localObject1 = com.tencent.bugly.legu.crashreport.common.info.a.a(); if (localObject1 != null) { int n = 0; localObject2 = Thread.currentThread().getStackTrace(); int i1 = localObject2.length; paramBuglyStrategy = null; for (m = 0; m < i1; m++) { Object localObject3 = localObject2[m]; if (((StackTraceElement)localObject3).getMethodName().equals("onCreate")) { paramBuglyStrategy = ((StackTraceElement)localObject3).getClassName(); } if (((StackTraceElement)localObject3).getClassName().equals("android.app.Activity")) { n = 1; } } if (paramBuglyStrategy == null) { break label403; } if (n == 0) { break label397; } ((com.tencent.bugly.legu.crashreport.common.info.a)localObject1).n = true; } for (;;) { ((com.tencent.bugly.legu.crashreport.common.info.a)localObject1).o = paramBuglyStrategy; if (bool2) { paramBuglyStrategy = null; if (Build.VERSION.SDK_INT >= 14) { if ((paramContext.getApplicationContext() instanceof Application)) { paramBuglyStrategy = (Application)paramContext.getApplicationContext(); } if (paramBuglyStrategy == null) {} } } try { if (k == null) { paramContext = new com/tencent/bugly/legu/crashreport/biz/b$2; paramContext.<init>(); k = paramContext; } paramBuglyStrategy.registerActivityLifecycleCallbacks(k); } catch (Exception paramContext) { for (;;) {} } i = System.currentTimeMillis(); a.a(1, true, 0L); t.a().a(1001, System.currentTimeMillis()); w.a("[session] launch app, new start", new Object[0]); a.a(); paramContext = a; v.a().a(new a.a(paramContext, null, true), 21600000L); break; label397: paramBuglyStrategy = "background"; continue; label403: paramBuglyStrategy = "unknown"; } bool2 = true; bool1 = false; }
以及:
com/tencent/bugly/legu/crashreport/biz/a.java
都不是我们要的业务逻辑,而是bugly相关的,bug report相关的代码。
后来继续去:
【已解决】从不同版本的小花生apk中反编译出包含业务逻辑代码的dex和jar包源码