\u521d\u6b65\u9759\u6001\u5206\u6790<\/h2>\n
\u5f00\u542f\u6293\u5305\u8f6f\u4ef6\uff0c\u6253\u5f00\u4e00\u4e2a\u89c6\u9891\u8fdb\u884c\u6293\u5305 \u521d\u6b65\u641c\u7d22\uff0c\u63a8\u6d4b\u662f\u8fd9\u4e2a\u7c7b \u8fdb\u4e00\u6b65\u67e5\u770b<\/p>\n \u5f97\u5230\u5982\u4e0b\u7ed3\u679c<\/p>\n \u770b\u8d77\u6765\u6ca1\u6709\u7ecf\u8fc7\u671f\u671b\u7684\u5730\u65b9 \u53ef\u4ee5\u786e\u5b9a\u548c\u94fe\u63a5\u4e2d\u7684sign\u4e00\u81f4\uff08\u6ca1\u9519\u662f\u94fe\u63a5\u4e2d\u7684\uff0c\u524d\u9762\u6ca1\u6709\u6ce8\u610f\u5230 \u7528IDA\u7b80\u5355\u770b\u4e00\u4e0b\uff0c\u53d1\u73b0\u6574\u4f53\u4ee3\u7801\u8f83\u5c11\uff0c\u4e0b\u56fe\u4f9d\u6b21\u662f\u51fd\u6570\u3001\u5b57\u7b26\u3001\u5bfc\u5165 \u7136\u540e\u8fd0\u884c\u5f97\u5230\u4e0b\u9762\u7684\u65e5\u5fd7<\/p>\n \u53ef\u4ee5\u770b\u5230 \u62a5\u9519\uff0c\u8865\u5145\u5bf9\u5e94\u7684jni\u8c03\u7528<\/p>\n \u6700\u7ec8\u8fd4\u56de\u7ed3\u679c\u7684\u7b2c\u4e00\u4e2a\u5b57\u7b26\u4e32\u7684\u6784\u6210<\/p>\n \u597d\u5728\u8fd9\u79cd\u60c5\u51b5\u662f\u6709\u89e3\u7684\uff0c\u53c2\u8003 <\/p>\n \u5c06\u4ece\u51fd\u6570\u8d77\u59cb\u4f4d\u7f6e\u5230\u62a5\u9519\u4f4d\u7f6e\u4e4b\u524d\u7684\u90e8\u5206\u9009\u4e2d\uff0c\u6309P\u521b\u5efa\u51fd\u6570 \u4f20\u5165\u53c2\u6570\u4e5f\u662f\u4e00\u4e2amd5\uff0c\u6839\u636e\u8c03\u7528\u6808\uff0c\u4e0a\u4e00\u7ea7\u662f \u4e0d\u8fc7dump\u4e0b\u6765\u7684dex\u6ca1\u6709\u627e\u5230\u8fd9\u4e2a\u7c7b\uff0c\u6709\u53ef\u80fd\u662f\u524d\u9762\u53bb\u9664\u4e0d\u80fd\u6253\u5f00\u7684\u7c7b\u7684\u65f6\u5019\u53bb\u6389\u4e86 \u5f97\u5230\u7684\u4f20\u5165\u53c2\u6570\u662f\u7c7b\u4f3c\u8fd9\u6837\u7684<\/p>\n \u6784\u6210\u5982\u4e0b<\/p>\n \u8bf7\u6c42\u5934\u4e2d\u7684\u5269\u4f59\u6821\u9a8c\u53c2\u6570\u540e\u9762\u518d\u5206\u6790… \u53d1\u73b0\u786e\u5b9e\u6709 \u6839\u636e\u7ecf\u9a8chook\u4e00\u4e0b \u7ed3\u679c\u5982\u4e0b<\/p>\n \u4f46\u662f\u8fd9\u4e2a\u8c03\u7528\u6808\u603b\u662f\u597d\u51e0\u4e2a\u8bf7\u6c42\u90fd\u91cd\u590d\u51fa\u73b0\u4e86 \u8fd9\u4e2a\u7c7b\u53c8\u51fa\u73b0\u4e86 \u82e6\u4e8e\u4e0d\u80fd\u6307\u4ee4\u88ab\u62bd\u53d6… \u6700\u7ec8\u7ecf\u8fc7\u6d4b\u8bd5\u786e\u5b9a\u53ea\u8981\u8bf7\u6c42\u5934\u6709 \u76ee\u6807apk\u4e0emd5 \u8131\u51fa\u6765\u7684dex\u53ef\u80fd\u6709\u4e0d\u80fd\u76f4\u63a5\u7528jadx-gui\u76f4\u63a5\u6253\u5f00\u7684\uff0c\u4e0d\u6253\u5f00\u5b83\u4fbf\u662f![\"\u54aa\u5495\u89c6\u9891APP\u89e3\u6790\u63a5\u53e3\u5206\u6790\"](\"https:\/\/cdn.jsdelivr.net\/gh\/lwx7832\/pic-yyob@4c084aea177255e3de0faf4e5233767e1cc85a75\/2021\/08\/30\/45280af4a720b2ace1511ecd8c99e02a.png\")
<\/a>
\u4e0d\u597d\uff0c\u6709\u58f3\uff0c\u90a3\u4e48\u5148\u8131\u58f3\u4e00\u6ce2\u518d\u8bf4https:\/\/github.com\/hluwa\/FRIDA-DEXDump
![\"\u54aa\u5495\u89c6\u9891APP\u89e3\u6790\u63a5\u53e3\u5206\u6790\"](\"https:\/\/cdn.jsdelivr.net\/gh\/lwx7832\/pic-yyob@bf7951cbb7720688738b54a05116c3c46acbaed1\/2021\/08\/30\/7642524475a54cb034d71bfe3a0b5eca.png\")
<\/a>
\u8131\u51fa\u6765\u7684dex\u53ef\u80fd\u6709\u4e0d\u80fd\u76f4\u63a5\u7528jadx-gui\u76f4\u63a5\u6253\u5f00\u7684\uff0c\u4e0d\u6253\u5f00\u5b83\u4fbf\u662f
\u6700\u7ec8\u7559\u4e0b\u8fd9\u4e9b
![\"\u54aa\u5495\u89c6\u9891APP\u89e3\u6790\u63a5\u53e3\u5206\u6790\"](\"https:\/\/cdn.jsdelivr.net\/gh\/lwx7832\/pic-yyob@5bf9755d051a8da20884bf479ef8003ff7fb13c2\/2021\/08\/30\/824b9ff8d8f1caf8281175147eb2be96.png\")
<\/a><\/p>\n\u6293\u5305\u89c6\u9891\u63a5\u53e3<\/h2>\n
https:\/\/cdn.jsdelivr.net\/gh\/lwx7832\/pic-yyob@9eac965bda9297e6da6252b0eca9c2b4a87591ba\/2021\/08\/30\/1f29078551886eeadc01a3cb996d75fc.png
\u663e\u7136\u6bd4\u8f83\u91cd\u8981\u7684\u53c2\u6570\u5e94\u8be5\u662f\u8fd9\u51e0\u4e2a<\/p>\n\n
com.cmvideo.capability.mgplayercore.net.VideoDetailsRequestHelper<\/code>
https:\/\/cdn.jsdelivr.net\/gh\/lwx7832\/pic-yyob@aeef9d53791d19f8f3ce3e5069ac66402a8536a2\/2021\/08\/30\/7eeb071f311df205b0eca8b2ba4935fd.png
\u7528objection\u8f85\u52a9\u5206\u6790<\/p>\nobjection -g com.cmcc.cmvideo explore -P ~\/.objection\/plugins\/ android hooking watch class com.cmvideo.capability.mgplayercore.net.VideoDetailsRequestHelper <\/pre>\n
android hooking watch class_method com.cmvideo.capability.mgplayercore.net.VideoDetailsRequestHelper.updateVideoInfo --dump-args --dump-backtrace --dump-return <\/pre>\n
(agent) [693091] Called com.cmvideo.capability.mgplayercore.net.VideoDetailsRequestHelper.updateVideoInfo(com.cmvideo.foundation.bean.player.VideoBean, com.cmvideo.foundation.bean.player.VideoInfoBean) (agent) [693091] Backtrace: com.cmvideo.capability.mgplayercore.net.VideoDetailsRequestHelper.updateVideoInfo(Native Method) com.cmcc.cmvideo.player.PlayHelper$2.onVideoInfoCallback(PlayHelper.java:282) com.cmvideo.foundation.videocache.chain.VideoInfoInvocationChain$3$1.run(VideoInfoInvocationChain.java:213) android.os.Handler.handleCallback(Handler.java:938) android.os.Handler.dispatchMessage(Handler.java:99) android.os.Looper.loop(Looper.java:223) android.app.ActivityThread.main(ActivityThread.java:7664) java.lang.reflect.Method.invoke(Native Method) com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:592) com.android.internal.os.ZygoteInit.main(ZygoteInit.java:947) (agent) [693091] Arguments com.cmvideo.capability.mgplayercore.net.VideoDetailsRequestHelper.updateVideoInfo(VideoBean{mgdbId='null', id='714007259', type='null', contId='null', contName='null', epsAssetID='null', prdPackageId='null', needAuth=false, titleValue=0, endValue=0, duration=0, sTime=0, eTime=0, mediaSize=0, level='null', playName='null', urlType='null', url='null', tmpUrl='null', assertId='null', imgUrl='null', videoCoding='null', isLive=false, isStreaming=false, needClothHat=false, shareUrl='null', shareTitle='null', shareSubTitle='null', nodeId='null', goodsId='null', payType='null', payName='null', cpName='null', actor='null', programType='null', vId='null', isAdvert='null', toast='null', playLengths='null', isReserved=false, isCanReserve=false, suitMultiView=false, suitMultiViewDesc='null', suitAvs2Desc='null', suitAvs2=false, shareSwitch=false, commentSwitch=false, copyrightType=0, totalCount='null', subtitleTrackInfos=null, currentMediaFile=null, mediaFiles=null, contents=null, previewPicture=null, auth=null, star=null, urlInfos=null, keywords='null', resourceType='null', pricingStage='null', hasAudio=false, thumbViewer='null', thumbViewerPath='null', thumbViewerName='null', thumbViewerIndex=null, shieldStrategy=null, preRecord='null', albumId='null', isDirectlyRunMeWithoutByHomePage=false, index=0, copyRightObjectId='null', cutVideo='null', free=false, rid='null', code=0, reason='null', hdToast='null', hdReason='null', defaultMgdbId='null', trySeeDuration='null', totalPage='null', audioTrackInfos=null, mediaFiles4K=null, mWonderfulMomentsBeans=null, mLookTaStarsBeans=null, isLightSpot=false, shellPayType='null', shellPayContent='null', selectItemPosition=0, mDolbyUrl='null', mDolbyUrlType='null'}, com.cmvideo.foundation.bean.player.VideoInfoBean@22b3bf9) (agent) [693091] Return Value: VideoBean{mgdbId='null', id='714007259', type='null', contId='null', contName='\u300a\u6211\u5728\u4ed6\u4e61\u633a\u597d\u7684DVD\u7248\u300b\u7b2c02\u96c6', epsAssetID='null', prdPackageId='1002581', needAuth=true, titleValue=104, endValue=4375, duration=4524, sTime=0, eTime=0, mediaSize=871268892, level='', playName='null', urlType='normal', url='http:\/\/gslbmgspvod.miguvideo.com\/depository_yqv\/asset\/zhengshi\/5103\/448\/823\/5103448823\/media\/5103448823_5010320108_95.mg001.mp4.m3u8?xxx...', tmpUrl='null', assertId='5103448823', imgUrl='null', videoCoding='h265', isLive=false, isStreaming=false, needClothHat=true, shareUrl='null', shareTitle='null', shareSubTitle='null', nodeId='null', goodsId='null', payType='FREE_LIMIT', payName='\u9650\u514d', cpName='\u8292\u679c\u65e0\u7ebf\u589e\u503c', actor='null', programType='null', vId='null', isAdvert='2', toast='null', playLengths='5', isReserved=false, isCanReserve=false, suitMultiView=false, suitMultiViewDesc='null', suitAvs2Desc='null', suitAvs2=false, shareSwitch=false, commentSwitch=false, copyrightType=0, totalCount='null', subtitleTrackInfos=null, currentMediaFile=com.cmvideo.foundation.bean.player.VideoInfoBean$BodyBean$MediaFilesBean@444973e, mediaFiles=[com.cmvideo.foundation.bean.player.VideoInfoBean$BodyBean$MediaFilesBean@f3d799f, com.cmvideo.foundation.bean.player.VideoInfoBean$BodyBean$MediaFilesBean@8356aec, com.cmvideo.foundation.bean.player.VideoInfoBean$BodyBean$MediaFilesBean@3da9eb5], contents=null, previewPicture=null, auth=com.cmvideo.foundation.bean.player.VideoInfoBean$BodyBean$AuthBean@56ee94a, star=null, urlInfos=[com.cmvideo.foundation.bean.player.VideoInfoBean$BodyBean$UrlInfoBean@48a10bb], keywords='null', resourceType='null', pricingStage='null', hasAudio=true, thumbViewer='1', thumbViewerPath='http:\/\/img.cmvideo.cn:8080\/publish\/slt', thumbViewerName='thumbnail\/asset\/zhengshi\/5103\/448\/823\/5103448823\/snapshot', thumbViewerIndex=null, shieldStrategy=null, preRecord='null', albumId='null', isDirectlyRunMeWithoutByHomePage=false, index=0, copyRightObjectId='null', cutVideo='0', free=false, rid='SUCCESS', code=200, reason='ad-skip-5-seconds', hdToast='\u5c0a\u656c\u7684\u4f1a\u5458\u4e3a\u60a8\u5207\u6362\u81f3\u84dd\u51491080p\u6e05\u6670\u5ea6', hdReason='null', defaultMgdbId='null', trySeeDuration='0', totalPage='null', audioTrackInfos=null, mediaFiles4K=null, mWonderfulMomentsBeans=null, mLookTaStarsBeans=null, isLightSpot=false, shellPayType='null', shellPayContent='null', selectItemPosition=0, mDolbyUrl='null', mDolbyUrlType='null'} <\/pre>\n
\u90a3\u770b\u770b\u6ca1\u6709\u88ab\u8c03\u7528\u7684\u5730\u65b9\u7684sign\u662f\u600e\u4e48\u8ba1\u7b97\u7684\u5427
<\/a><\/p>\nandroid hooking watch class_method com.cmcc.migutv.encryptor.MGEncryptor.getMiGuSign --dump-args --dump-backtrace --dump-return <\/pre>\n
(agent) [104147] Called com.cmcc.migutv.encryptor.MGEncryptor.getMiGuSign(android.content.Context, java.lang.String) (agent) [104147] Backtrace: com.cmcc.migutv.encryptor.MGEncryptor.getMiGuSign(Native Method) com.cmvideo.foundation.videocache.processor.VideoInfoProcessor.getVideoInfoParams(VideoInfoProcessor.java:205) com.cmvideo.foundation.videocache.processor.VideoInfoProcessor.getVideoInfo(VideoInfoProcessor.java:102) com.cmvideo.foundation.videocache.processor.VideoInfoProcessor.run(VideoInfoProcessor.java:65) com.cmvideo.foundation.videocache.chain.VideoInfoInvocationChain.getVideoInfo(VideoInfoInvocationChain.java:58) com.cmvideo.foundation.videocache.CacheController.getVideoInfo(CacheController.java:138) com.cmcc.cmvideo.player.PlayHelper.getVideoInfo(PlayHelper.java:984) com.cmcc.cmvideo.player.PlayHelper.preparePlayData(PlayHelper.java:776) com.cmcc.cmvideo.player.PlayHelper.preparePlayData(PlayHelper.java:725) com.cmcc.cmvideo.playdetail.widget.MgPlayPageFragment.getPlayUrl(MgPlayPageFragment.java:3481) com.cmcc.cmvideo.playdetail.widget.MgPlayPageFragment.onResume(MgPlayPageFragment.java:2290) android.support.v4.app.Fragment.performResume(Fragment.java:2498) android.support.v4.app.FragmentManagerImpl.moveToState(FragmentManager.java:1501) android.support.v4.app.FragmentManagerImpl.moveFragmentToExpectedState(FragmentManager.java:1784) android.support.v4.app.FragmentManagerImpl.moveToState(FragmentManager.java:1852) android.support.v4.app.FragmentManagerImpl.dispatchStateChange(FragmentManager.java:3269) android.support.v4.app.FragmentManagerImpl.dispatchResume(FragmentManager.java:3241) android.support.v4.app.FragmentController.dispatchResume(FragmentController.java:223) android.support.v4.app.FragmentActivity.onResumeFragments(FragmentActivity.java:538) android.support.v4.app.FragmentActivity.onPostResume(FragmentActivity.java:527) android.support.v7.app.AppCompatActivity.onPostResume(AppCompatActivity.java:172) android.app.Activity.performResume(Activity.java:8154) android.app.ActivityThread.performResumeActivity(ActivityThread.java:4428) android.app.ActivityThread.handleResumeActivity(ActivityThread.java:4470) android.app.servertransaction.ResumeActivityItem.execute(ResumeActivityItem.java:52) android.app.servertransaction.TransactionExecutor.executeLifecycleState(TransactionExecutor.java:176) android.app.servertransaction.TransactionExecutor.execute(TransactionExecutor.java:97) android.app.ActivityThread$H.handleMessage(ActivityThread.java:2066) android.os.Handler.dispatchMessage(Handler.java:106) android.os.Looper.loop(Looper.java:223) android.app.ActivityThread.main(ActivityThread.java:7664) java.lang.reflect.Method.invoke(Native Method) com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:592) com.android.internal.os.ZygoteInit.main(ZygoteInit.java:947) (agent) [104147] Arguments com.cmcc.migutv.encryptor.MGEncryptor.getMiGuSign(com.cmcc.cmvideo.application.MGApplication@a9d9282, a42002edf5fdf989cb63a07327eb804c) (agent) [104147] Return Value: 22441061,d9e1f6772cfb42705b6a9563ec7830c8 <\/pre>\n
<\/a>
\u76f4\u63a5\u8bbf\u95ee\u94fe\u63a5\u7ed3\u679c\u662f\u8bf7\u6c42\u6821\u9a8c\u5931\u8d25\uff0c\u8bf4\u660e\u8bf7\u6c42\u5934\u8fd8\u662f\u4e0d\u80fd\u7f3a\u5c11\u7684
<\/a>
MGEncryptor\u7684\u53cd\u7f16\u8bd1\u4ee3\u7801<\/p>\npackage com.cmcc.migutv.encryptor; import android.content.Context; import android.text.TextUtils; import com.meituan.robust.ChangeQuickRedirect; import com.meituan.robust.PatchProxy; import com.meituan.robust.PatchProxyResult; public class MGEncryptor { public static ChangeQuickRedirect changeQuickRedirect; public native String[] getSignFromNative(Context context, String str); static { System.loadLibrary(\"mgencryptor\"); } public String[] getMiGuSign(Context context, String str) { PatchProxyResult proxy = PatchProxy.proxy(new Object[]{context, str}, this, changeQuickRedirect, false, 30812, new Class[]{Context.class, String.class}, String[].class); if (proxy.isSupported) { return (String[]) proxy.result; } if (context == null || TextUtils.isEmpty(str)) { return new String[]{\"0000\", \"input error\"}; } try { return getSignFromNative(context, str); } catch (Exception e) { e.printStackTrace(); return new String[]{\"0000\", \"jni error\"}; } } } <\/pre>\n
<\/a>
\u4e0d\u8fc7\u4eca\u5929\u5e76\u4e0d\u6253\u7b97\u8fd8\u539f\u7b97\u6cd5\uff0c\u76f4\u63a5unidbg\u8c03\u7528
\u62c9\u4e00\u4e0b\u6700\u65b0\u7248\u672c\u7684unidbg\uff0c\u7136\u540e\u505a\u7b80\u5355\u7684so\u521d\u59cb\u5316\u8f7d\u5165
\u6839\u636eIDA\u76f4\u63a5\u770b\u5230\u7684\u4fe1\u606f
\u53ef\u4ee5\u770b\u5230\u6709\u4e00\u4e2a\/proc\/self\/maps<\/code>\u5b57\u7b26\u4e32\uff0c\u4e8e\u662f\u5b9e\u73b0IOResolver<\/code>
\u6587\u4ef6\u5185\u5bb9\u53ef\u4ee5\u4ece\u5185\u5b58\u4e2d\u76f4\u63a5dump\u4e0b\u6765\u4e00\u4efd
\u540c\u65f6\u5f88\u53ef\u80fd\u6709jni\u4ea4\u4e92\uff0c\u4e8e\u662f\u7ee7\u627fAbstractJni<\/code>
\u540c\u65f6\u5bfc\u5165\u91cc\u9762\u6709\u968f\u673a\u51fd\u6570\uff0c\u4e8e\u662f\u7528HookZz<\/code>\u56fa\u5b9alrand48<\/code>\uff0c\u53ea\u56fa\u5b9a\u8fd9\u4e00\u4e2a\u662f\u56e0\u4e3a\u5b83\u7528\u5f97\u6700\u591a
\u4ee3\u7801\u5982\u4e0b<\/p>\npackage com.cmcc.migutv.encryptor; import com.github.unidbg.AndroidEmulator; import com.github.unidbg.Emulator; import com.github.unidbg.Module; import com.github.unidbg.Symbol; import com.github.unidbg.arm.context.EditableArm32RegisterContext; import com.github.unidbg.file.FileResult; import com.github.unidbg.file.IOResolver; import com.github.unidbg.hook.HookContext; import com.github.unidbg.hook.ReplaceCallback; import com.github.unidbg.hook.hookzz.HookZz; import com.github.unidbg.hook.hookzz.IHookZz; import com.github.unidbg.linux.android.AndroidEmulatorBuilder; import com.github.unidbg.linux.android.AndroidResolver; import com.github.unidbg.linux.android.dvm.*; import com.github.unidbg.linux.file.SimpleFileIO; import com.github.unidbg.memory.Memory; import java.io.File; import java.util.ArrayList; import java.util.List; public class MGEncryptor extends AbstractJni implements IOResolver { private final AndroidEmulator emulator; private final VM vm; private final Module module; MGEncryptor() { emulator = AndroidEmulatorBuilder .for32Bit() .setProcessName(\"com.cmcc.cmvideo\") .build(); System.out.println(\"\u5f53\u524d\u8fdb\u7a0bPID -> \" + emulator.getPid()); final Memory memory = emulator.getMemory(); \/\/ \u6a21\u62df\u5668\u7684\u5185\u5b58\u64cd\u4f5c\u63a5\u53e3 memory.setLibraryResolver(new AndroidResolver(23)); \/\/ \u8bbe\u7f6e\u7cfb\u7edf\u7c7b\u5e93\u89e3\u6790 emulator.getSyscallHandler().addIOResolver(this); \/\/ \u7ed1\u5b9aIO\u91cd\u5b9a\u5411\u63a5\u53e3 vm = emulator.createDalvikVM(); vm.setVerbose(true); \/\/ \u8bbe\u7f6e\u662f\u5426\u6253\u5370Jni\u8c03\u7528\u7ec6\u8282 DalvikModule dm = vm.loadLibrary(new File(\"unidbg-android\/src\/test\/java\/com\/cmcc\/migutv\/encryptor\/libmgencryptor.so\"), true); module = dm.getModule(); vm.setJni(this); IHookZz hookZz = HookZz.getInstance(emulator); Symbol lrand48 = module.findSymbolByName(\"lrand48\"); hookZz.replace(lrand48, new ReplaceCallback() { @Override public void postCall(Emulator<?> emulator, HookContext context) { EditableArm32RegisterContext ctx = emulator.getContext(); System.out.println(\"lrand48 origin return ->\" + ctx.getR0Int()); } }, true); dm.callJNI_OnLoad(emulator); } @Override public FileResult resolve(Emulator emulator, String pathname, int oflags) { System.out.println(\"\u8bbf\u95ee -> \" + pathname); if ((\"\/proc\/self\/maps\").equals(pathname)) { return FileResult.success(new SimpleFileIO(oflags, new File(\"unidbg-android\/src\/test\/java\/com\/cmcc\/migutv\/encryptor\/maps\"), pathname)); } return null; } public static void main(String[] args) { MGEncryptor mMGEncryptor = new MGEncryptor(); } } <\/pre>\n\u5f53\u524d\u8fdb\u7a0bPID -> 10097 \u8bbf\u95ee -> \/dev\/__properties__ \u8bbf\u95ee -> \/proc\/stat \u8bbf\u95ee -> \/proc\/self\/maps JNIEnv->FindClass(com\/cmcc\/migutv\/encryptor\/MGEncryptor) was called from RX@0x400052ef[libmgencryptor.so]0x52ef JNIEnv->RegisterNatives(com\/cmcc\/migutv\/encryptor\/MGEncryptor, RW@0x4000f004[libmgencryptor.so]0xf004, 1) was called from RX@0x40005305[libmgencryptor.so]0x5305 RegisterNative(com\/cmcc\/migutv\/encryptor\/MGEncryptor, getSignFromNative(Landroid\/content\/Context;Ljava\/lang\/String;)[Ljava\/lang\/String;, RX@0x4000a731[libmgencryptor.so]0xa731) <\/pre>\n
getSignFromNative<\/code>\u52a8\u6001\u6ce8\u518c\u4e8e0xa731<\/code>\uff0c\u73b0\u5728\u8865\u5145getSignFromNative<\/code>\u7684\u8c03\u7528<\/p>\npublic void getSignFromNative(){ \/\/ args list List<Object> args = new ArrayList<>(4); \/\/ arg1 env args.add(vm.getJNIEnv()); \/\/ arg2 jobject\/jclazz \u4e00\u822c\u7528\u4e0d\u5230\uff0c\u76f4\u63a5\u586b0 args.add(0); \/\/ arg3 context DvmObject context = vm.resolveClass(\"com\/cmcc\/cmvideo\/application\/MGApplication\").newObject(null); args.add(vm.addLocalObject(context)); \/\/ arg4 md5string StringObject md5string = new StringObject(vm, \"a42002edf5fdf989cb63a07327eb804c\"); args.add(vm.addLocalObject(md5string)); \/\/ call function Number number = module.callFunction(emulator, 0xa731, args.toArray())[0]; System.out.println(\"number ->\" + number); Object result = vm.getObject(number.intValue()).getValue(); DvmObject[] strarr = (DvmObject[]) result; System.out.println(\"result ->\" + strarr[0]); System.out.println(\"result ->\" + strarr[1]); };<\/pre>\ncom\/cmcc\/cmvideo\/application\/MGApplication->getPackageManager()Landroid\/content\/pm\/PackageManager;<\/pre>\n
<\/a><\/p>\ncom\/cmcc\/cmvideo\/application\/MGApplication->getPackageName()Ljava\/lang\/String;<\/pre>\n
<\/a>
\u6210\u529f\u8fd4\u56de\u7ed3\u679c\uff0c\u4e0d\u8fc7\u7ed3\u679c\u548chook\u7684\u4e0d\u4e00\u81f4
<\/a>
\u53ef\u4ee5\u53d1\u73b0\u8c03\u7528\u4e86lrand48<\/code>\uff0c\u6240\u4ee5\u6bcf\u6b21\u7ed3\u679c\u4e0d\u4e00\u6837
\u6700\u7ec8\u8fd4\u56de\u7ed3\u679c\u524d\u6709\u5f88\u957f\u7684\u4e00\u4e32\u5b57\u7b26\u4e32
\u7b80\u5355\u6d4b\u8bd5\u53d1\u73b0\u6700\u7ec8\u7ed3\u679c\u5c31\u662f\u8fd9\u4e32\u5b57\u7b26\u4e32\u7684md5
<\/a>
\u591a\u6b21\u8fd0\u884c\u53ef\u4ee5\u53d1\u73b0\u6700\u7ec8\u5b57\u7b26\u4e32\u6784\u6210\u5982\u4e0b<\/p>\n\n
\n
<\/a>
\u90a3\u4e48\u8fd9\u4e2a\u672a\u77e532\u4f4d\u5b57\u7b26\u4e32\u662f\u4ec0\u4e48\u5462
\u6839\u636e\u65e5\u5fd7\u53ef\u4ee5\u77e5\u9053\u6700\u7ec8\u8fdb\u884cmd5\u7684\u957f\u5b57\u7b26\u4e32\u57280xa9fb<\/code>\u4ea7\u751f
\u800c\u5f88\u53ef\u60dc\u8fd9\u4e2a\u5730\u65b9\u539fso\u6ca1\u6709\u5185\u5bb9
<\/a>
\u7528elf-dump-fix\u4ece\u5185\u5b58\u4e2ddump\u5e76\u4fee\u590d
\u73b0\u5728\u8fd9\u4e2a\u4f4d\u7f6e\u6709\u4ee3\u7801\u4e86\uff0c\u4f46\u662f\u4e0d\u80fdF5\u770b\u4f2a\u4ee3\u7801
<\/a>
\u53e6\u5916\u901a\u8fc7\u8fd9\u91cc\u7684%s%s%s%s<\/code>\u53ef\u4ee5\u63a8\u6d4b\u5e94\u8be5\u662f\u8fdb\u884c\u4e86\u5b57\u7b26\u4e32\u683c\u5f0f\u5316\uff0c\u8fd9\u91cc\u662f4\u4e2a\u5b57\u7b26\u4e32
\u8fd9\u548c\u524d\u9762\u901a\u8fc7\u91cd\u590d\u6267\u884c\u63a8\u6d4b\u7684\u7ed3\u8bba\u662f\u4e00\u81f4\u7684
\u5982\u679c\u5c1d\u8bd5\u5728\u51fd\u6570\u5f00\u59cb\u7684\u4f4d\u7f6e\u521b\u5efa\u51fd\u6570\uff0c\u5219\u4f1a\u51fa\u73b0\u8fd9\u6837\u7684\u9519\u8bef
<\/a><\/p>\n.text:0000AA5C: The function has undefined instruction\/data at the specified address.<\/pre>\n
<\/a> <\/span><\/p>\n<\/a> <\/div>\nIDA sp-analysis failed\u4e0d\u80fdF5\u7684\u89e3\u51b3\u65b9\u6848<\/h2>\n
<\/a>\u5929\u8d50<\/div>\n\n
<\/a>
<\/a>
\u73b0\u5728\u5f88\u5bb9\u6613\u770b\u51fa\u6765\u672a\u77e5\u7684\u5b57\u7b26\u4e32\u662f\u600e\u4e48\u6765\u7684\u4e86
<\/a>
\u76f4\u63a5\u67e5\u770boff_E440<\/code>\u7684\u6570\u636e\uff0c\u53ef\u4ee5\u53d1\u73b0\u539f\u6765\u662f\u4e00\u4e2a\u56fa\u5b9a\u7684\u5b57\u7b26\u4e32\u6570\u7ec4
<\/a>
\u800c\u7d22\u5f15\u503c\u7684\u8ba1\u7b97\u662f\u67d0\u4e2a\u6570\u5bf9100\u53d6\u4f59\u6570
<\/a>
\u53ef\u4ee5\u786e\u5b9a\u4e4b\u524d\u7684\u8ba1\u7b97\u4e2d\u7684\u5b57\u7b26\u4e32\u6240\u5728\u7d22\u5f15\u662f74\uff0c\u6b63\u597d\u662f\u7b2c\u4e00\u4e2a\u968f\u673a\u6570\u5bf9100\u53d6\u4f59
<\/a>
\u7efc\u4e0a\u5206\u6790\uff0c\u53ef\u4ee5\u5f97\u51fa\u94fe\u63a5\u4e2d\u7684sign\u53c2\u6570\u7b97\u6cd5\u5982\u4e0b
\u53ea\u662f\u8ba1\u5212\u7528unidbg\u8c03\u7528\uff0c\u6ca1\u60f3\u5230\u591a\u770b\u4e86\u4e24\u773c\u76f4\u63a5\u8fd8\u539f\u4e86<\/del><\/p>\nimport time import hashlib from random import randint SALT_TABLE = [ '9b49eed02d9240aeabeb782860cc6be2', 'd34d010b674341b0b31d60118370e3e7', '551c102e19a74dbbbaadf82e0f603725', 'a49d1441c2ef4ec3881ee03975ed9e64', 'f9580a84a68b4ff9aface3fac135203a', 'afef8c8c9ccf47bd9ff5abddffbfab06', '49d91578d4cb48a89c91a8f29648d884', '41df4cf1d6194f38ae6f8901326f27ea', 'dd3c4050bba845acbd40d4ebd59f60f9', '20d530788ec54dfaa998f564fa0eed54', '2dd7693907354fa49e271eeba79a3c3d', '7ca04529cd1445e2b8b4df2edf982944', '8a8631b96f394283b65c8acc7b118ef6', '9730e9e2521d42829fcce6c47ee6e714', '0062ddbfd9994cdea21bcfbe8822469b', '-', 'af10e55f740549e293a9d8793094557e', '325e13e4d0b6424a9041ce9a6e2a0936', '9fb2c2e3d05d4ad8855dd057111a0372', '9955c67d6039457e897db4fbb0e4213e', '383f42c488e2446c8a209826c21e07a4', 'ac7e796c016d437e95c4904edecb5706', '08509a488f674143a3a565e3672cc1f3', '56c8088875ac4d3981021f28795ee7cb', '87ff10e325e44ef5a865af4a9948d0cd', '3503b2aaa8a849d2a2c2a157594922d9', '62657b2522be4905b6396f6d4a45e42d', '6ef4148deffd487f887ad5e77eb8b639', '294146dd81e04d65bb3499dc2c531227', '778a2ea5e7254351aa3d7b0a6ee7a6a4', '7ab16383308f4aef80bb91816aaa1571', '9ecbdf2d1fdc43b1a9ebb7b703681d1b', '364ba40d5cd24cb9be9df68087b9ba50', '20c7028e5460482987821c8c8bd44d11', '1053bab67a544877a6124b13a1aafd6c', '9b8a02b7c3c044a8bae0d22e15296088', 'cc97fc32d3234500beea4f2a866a5788', 'a19ef2dee5db46a18e510770002b4108', '992e27034ca84cfb82cdaa43e1c1e739', '7c228f634ce94bdbbb11c89758f60c00', '8c8c596dee1247d09b4d4317af1ef731', '1a8957f176bc4739b34d0d3331cda8f5', '2f6c2be2e48f49f78decf349e63265de', '72f1e5f5cb004912a7557d72e0f7f652', 'fe15dabd9d984bd489c1478fd18ffe6c', '2b8972952cfc497d8826e8021a7d8d92', 'bf987c51ea5c4ce78ec811d9288481d3', 'd7b9fbea37954e329ee8608004d2da05', '87e9e9a543f9438490c1e59a63926f07', '6b558f2e86ad4696a3001ecf9fe4b21d', '9aeed1e21fbf4158b908aec943087eb0', 'ac89a5dda0e143e894d435ac8995d24d', '2a15df822c0a4eb8a788e572afa4742c', '4c2c0ef25e234098bfb5f18c732a28a9', '1cbd413b3a61499bb810f2883303cb6a', '969298f797cc4265a3f2e87e4dfdc518', 'ddac82a533ed48e98fa6b4de3a06feee', '3e2e6df232094bb9886b7595096e3e6b', '59ded02ca64c4c0ab3d5ede710371123', '40661ccbe2e644bc8172922b124a1710', 'a3fa8d41ab654d56af396a54db24f7b5', 'f92214baa3db40fabcfdb175a04ade66', 'db8627874e774b539389f143ab1e0f8c', '0d6952220feb4a13a0f93e205b8d62cb', '5c3dd326f2da4057aa952256f45305ab', '750a698c5ad846f88f87aae00540505f', 'cf73a3dd6d0c41fc9d9dbda95a4cf536', '008128a294ce42afa12f0ef90591aa7b', '729157e0c72a4f2087223661836d948f', 'f8bbac1ddf5c4efb85cec18546a8088a', '173b8aa9dd664a33917e04adeff44684', '554ab71d3c0a41b1ab60ee7b1b758fae', '04a6af281972401d96674bff6fe767bb', 'c3cb3544785f4a61a5fdf3ab78306561', '98a87ce236174e7ab69034aa38f659ba', '7f1654c5efa24dadba3703d82f97c45f', '5034a1b0f66a4094aabaa2a0d3bdc3b4', '9ff967e2f9ec40aab85a6501e8ce4d60', 'bf0cc5b403c241c8b9323ddb2489a76e', '69e96fc4cf254c88a0cc92e7842ed4c8', '5f0920c74fef413c9a04aea044b93d7e', '4f6ebdd6a504445b9a38020f5a0e7aa7', 'e00862ac9dc44ee8b3bb1e2c02162fb9', '9eec67c764014c139a392175e17a9998', '2ff76133ce0047a18219f072ab3adb09', '61cadeae84d449f197fad9736bf7921d', 'f2238ccf20c84cd99336c165e8b40115', '25953a714f064300ae9d9d3c684dc6ae', '17bd953399894c17a7f96a7d9a14af9f', 'f9098752968f478491a6d5d0dad456b9', '651bf4d967544a08994d1f17fd52bea8', '581ddc7f75be466ab3fbcc51d4ee0ffb', 'bb9007a6f55a4a6daa5271418f0c16e5', '0696c78302d34b8cb9122e91c80fd935', 'fe6afa3b778243548a36e7df3d8e7f68', 'f5f121881568425d80b6cf2fe3f09e0d', '9100fcd3470f4c0f88b403f12eaaf65a', '3e1c91e67ff54838b28566f72478e3c6', '70689f17ac39440c91b4b0a82e77c58c', 'd5deac6df499466680d6b6e74d86734c', ] def get_sign_config(contId: str, appVersion: str = '2500090310'): tm = f'{time.time() * 1000 - 1000 * 1000:.0f}' md5string = hashlib.new('md5', f'{tm}{contId}{appVersion[:8]}'.encode('utf-8')).hexdigest() return tm, url_sign(md5string) def url_sign(md5string: str): ''' \u539f\u7b97\u6cd5\u4e24\u6b21\u968f\u673a\u6570\u5408\u5e76\u4e3a\u4e00\u6b21 \u6240\u4ee5\u8fd9\u91cc\u9650\u5b9a\u4e86\u4e0b\u8303\u56f4 ''' salt = f'{randint(10000000, 99999999)}' text = f'{md5string}{SALT_TABLE[int(salt[6:]) % 100]}migu{salt[:4]}' sign = hashlib.new('md5', text.encode('utf-8')).hexdigest() return [salt, sign] if __name__ == '__main__': print(get_sign_config('714725402')) # print(url_sign('a42002edf5fdf989cb63a07327eb804c')) <\/pre>\ngetVideoInfoParams<\/code><\/p>\ncom.cmvideo.foundation.videocache.processor.VideoInfoProcessor.getVideoInfoParams(VideoInfoProcessor.java:205)<\/pre>\n
\u597d\u5728\u5728com.cmvideo.capability.mgplayercore.net.VideoDetailsRequestHelper<\/code>\u91cc\u9762\u6709\u540c\u6837\u7684\u65b9\u6cd5
\u8fd9\u4e2a\u4f4d\u7f6e\u662f\u4f20\u5165\u5b57\u7b26\u4e32\u4e0e\u65f6\u95f4\u6233\u4e0e\u67d0\u4e2aid\u76f8\u62fc\u63a5
<\/a>
\u90a3\u4e48\u76f4\u63a5hook\u8fd9\u4e2a\u65b9\u6cd5<\/p>\nandroid hooking watch class_method com.cmvideo.capability.mgkit.util.MD5Util.getStringMD5 --dump-args --dump-backtrace --dump-return<\/pre>\n
com.cmvideo.capability.mgkit.util.MD5Util.getStringMD5(162962756341271472540225000903)<\/pre>\n
\n
\u5269\u4e0b\u7684\u51e0\u4e2a\u53c2\u6570\u90fd\u662f\u8bf7\u6c42\u5934\u91cc\u9762\u7684\uff0c\u6784\u9020\u94fe\u63a5\u5f88\u6709\u53ef\u80fd\u4f1a\u7528java.net.URI<\/code>\uff0c\u90a3\u4e48\u8ffd\u8e2a\u4e00\u6ce2<\/p>\nandroid hooking watch class_method java.net.URI.$init --dump-args --dump-return --dump-backtrace<\/pre>\n
https:\/\/play.miguvideo.com\/<\/code><\/p>\n(agent) [227076] Called java.net.URI.URI(java.lang.String) (agent) [227076] Backtrace: java.net.URI.(Native Method) okhttp3.HttpUrl.uri(HttpUrl.java:379) okhttp3.internal.connection.RouteSelector.resetNextProxy(RouteSelector.java:129) okhttp3.internal.connection.RouteSelector.(RouteSelector.java:63) okhttp3.internal.connection.StreamAllocation.(StreamAllocation.java:101) okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(RetryAndFollowUpInterceptor.java:113) okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:147) okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:121) com.cmvideo.capability.networkimpl.HttpLoggingInterceptor.intercept(HttpLoggingInterceptor.java:68) okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:147) okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:121) okhttp3.RealCall.getResponseWithInterceptorChain(RealCall.java:257) okhttp3.RealCall$AsyncCall.execute(RealCall.java:201) okhttp3.internal.NamedRunnable.run(NamedRunnable.java:32) java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167) java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641) java.lang.Thread.run(Thread.java:923) (agent) [227076] Arguments java.net.URI.URI(https:\/\/play.miguvideo.com\/) <\/pre>\n
okhttp3.Request$Builder.build<\/code><\/p>\nandroid hooking watch class_method okhttp3.Request$Builder.build --dump-backtrace --dump-return<\/pre>\n
(agent) [925216] Called okhttp3.Request$Builder.build() (agent) [925216] Backtrace: okhttp3.Request$Builder.build(Native Method) okhttp3.internal.http.BridgeInterceptor.intercept(BridgeInterceptor.java:93) okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:147) okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(RetryAndFollowUpInterceptor.java:127) okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:147) okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:121) com.cmvideo.capability.networkimpl.HttpLoggingInterceptor.intercept(HttpLoggingInterceptor.java:68) okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:147) okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:121) okhttp3.RealCall.getResponseWithInterceptorChain(RealCall.java:257) okhttp3.RealCall$AsyncCall.execute(RealCall.java:201) okhttp3.internal.NamedRunnable.run(NamedRunnable.java:32) java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1167) java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:641) java.lang.Thread.run(Thread.java:923) (agent) [925216] Return Value: Request{method=GET, url=https:\/\/play.miguvideo.com\/playurl\/v1\/play\/playurl?chip=msmnile&salt=44076543&os=11&xavs2=true&startPlay=true&nt=4&sign=a1845b27294d7461b801286b47d37fbd&xh265=true&sessionId=************&ua=Pixel%204&dolby=false&gpu=&ott=false&hdrversion=7474174&rateType=4&isRaming=0&contId=714725402&isMultiView=true&vr=true&drm=true×tamp=1629634666853&hdrmode=Pixel%204, tags={}} <\/pre>\n
\u7ecf\u8fc7\u6d4b\u8bd5\uff0c\u6700\u7ec8\u6709\u4e00\u4e2a\u66f4\u4e3a\u660e\u786e\u7684\u8c03\u7528\u6808<\/p>\n(agent) [009406] Called okhttp3.Request$Builder.build() (agent) [009406] Backtrace: okhttp3.Request$Builder.build(Native Method) com.cmvideo.capability.networkimpl.OkhttpNetworkManager.get(OkhttpNetworkManager.java:739) com.cmvideo.capability.network.NetworkManager2.get(NetworkManager2.java:164) com.cmcc.cmvideo.content.network.BaseResponseRequest.loadData(BaseResponseRequest.java:44) com.cmcc.cmvideo.content.network.BaseResponseObject.subscribe(BaseResponseObject.java:35) com.cmcc.cmvideo.content.ContentServiceImpl.getVideoInfo(ContentServiceImpl.java:157) com.cmvideo.foundation.videocache.processor.VideoInfoProcessor.getVideoInfo(VideoInfoProcessor.java:104) com.cmvideo.foundation.videocache.processor.VideoInfoProcessor.run(VideoInfoProcessor.java:65) com.cmvideo.foundation.videocache.chain.VideoInfoInvocationChain.getVideoInfo(VideoInfoInvocationChain.java:58) com.cmvideo.foundation.videocache.CacheController.getVideoInfo(CacheController.java:138) com.cmcc.cmvideo.player.PlayHelper.getVideoInfo(PlayHelper.java:984) com.cmcc.cmvideo.player.PlayHelper.preparePlayData(PlayHelper.java:776) com.cmcc.cmvideo.player.PlayHelper.preparePlayData(PlayHelper.java:725) com.cmcc.cmvideo.playdetail.widget.MgPlayPageFragment.getPlayUrl(MgPlayPageFragment.java:3481) com.cmcc.cmvideo.playdetail.widget.MgPlayPageFragment.onResume(MgPlayPageFragment.java:2290) android.support.v4.app.Fragment.performResume(Fragment.java:2498) android.support.v4.app.FragmentManagerImpl.moveToState(FragmentManager.java:1501) android.support.v4.app.FragmentManagerImpl.moveFragmentToExpectedState(FragmentManager.java:1784) android.support.v4.app.FragmentManagerImpl.moveToState(FragmentManager.java:1852) android.support.v4.app.FragmentManagerImpl.dispatchStateChange(FragmentManager.java:3269) android.support.v4.app.FragmentManagerImpl.dispatchResume(FragmentManager.java:3241) android.support.v4.app.FragmentController.dispatchResume(FragmentController.java:223) android.support.v4.app.FragmentActivity.onResumeFragments(FragmentActivity.java:538) android.support.v4.app.FragmentActivity.onPostResume(FragmentActivity.java:527) android.support.v7.app.AppCompatActivity.onPostResume(AppCompatActivity.java:172) android.app.Activity.performResume(Activity.java:8154) android.app.ActivityThread.performResumeActivity(ActivityThread.java:4428) android.app.ActivityThread.handleResumeActivity(ActivityThread.java:4470) android.app.servertransaction.ResumeActivityItem.execute(ResumeActivityItem.java:52) android.app.servertransaction.TransactionExecutor.executeLifecycleState(TransactionExecutor.java:176) android.app.servertransaction.TransactionExecutor.execute(TransactionExecutor.java:97) android.app.ActivityThread$H.handleMessage(ActivityThread.java:2066) android.os.Handler.dispatchMessage(Handler.java:106) android.os.Looper.loop(Looper.java:223) android.app.ActivityThread.main(ActivityThread.java:7664) java.lang.reflect.Method.invoke(Native Method) com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:592) com.android.internal.os.ZygoteInit.main(ZygoteInit.java:947) (agent) [009406] Return Value: Request{method=GET, url=https:\/\/play.miguvideo.com\/playurl\/v1\/play\/playurl?chip=msmnile&salt=42709724&os=11&xavs2=true&startPlay=true&nt=4&sign=ee4249aba30ebb0c6191d13e85a68d8a&xh265=true&sessionId=************&ua=Pixel%204&dolby=false&gpu=&ott=false&hdrversion=7474174&rateType=4&isRaming=0&contId=714725402&isMultiView=true&vr=true&drm=true×tamp=1629635337448&hdrmode=Pixel%204, tags={}} <\/pre>\ncom.cmvideo.foundation.videocache.processor.VideoInfoProcessor<\/code>
\u770b\u6765\u5f97\u62ff\u5230\u8fd9\u4e2a\u7c7b\u7684\u4ee3\u7801\u624d\u884c\uff0c\u53c8\u8bd5\u4e86\u51e0\u6b21\uff0c\u8fd8\u662f\u6ca1\u6709dump\u4e0b\u6765
\u8bd5\u4e00\u8bd5BlackDex
\u7136\u800c\u5931\u8d25\u4e86
<\/a>
\u4e0d\u8981\u7d27\uff0c\u638f\u51fa\u4e13\u7528\u8131\u58f3\u673a
\u556a\u7684\u4e00\u4e0b\uff0c\u5f88\u5feb\u554a\u5c31\u8131\u5b8c\u4e86
<\/a>
\u4e0d\u5e78\u7684\u662f\u51fd\u6570\u4f53\u88ab\u62bd\u53d6\u4e86\uff0c\u800c\u4e14\u662f\u5e26\u504f\u79fb\u7684\u62bd\u53d6TAT
\u597d\u5728\u8fd8\u6709\u4e00\u4e9b\u662f\u6ca1\u6709\u88ab\u62bd\u53d6\u7684\uff0c\u63a5\u7740\u53c8\u518d\u6b21\u641c\u7d22sign\u5173\u952e\u5b57
\u7136\u540e\u5b9a\u4f4d\u5230com.cmcc.cmvideo.layout.livefragment.network.RetrofitNetworkManagerEx<\/code>\u7c7b
<\/a>
\u8fd8\u662f\u6709\u6536\u83b7\u7684\uff0c\u6bd4\u5982SDKCEId<\/code>\u662f\u56fa\u5b9a\u503c
\u53e6\u5916\u518d\u770b\u770b\u8bf7\u6c42\u5934sign<\/code>\u7684\u6765\u6e90
<\/a>
\u53e6\u5916\u7ecf\u8fc7\u5bf9\u6bd4\u53d1\u73b0\u4e0b\u9762\u8bf7\u6c42\u5934l_c<\/code>\u4e5f\u662f\u56fa\u5b9a\u7684
<\/a>
\u5176\u4e2dsign<\/code>\u53ef\u4ee5\u5728APP\u76ee\u5f55\u4e0b\u7684app_webview\/Default\/Cookie<\/a>s<\/code>\u627e\u5230
l_c<\/code>\u5219\u53ef\u4ee5\u5728APP\u76ee\u5f55\u4e0b\u7684files\/mmkv\/mmkv.default<\/code>\u627e\u5230\uff08sign<\/code>\u540c\u65f6\u4e5f\u5728\u8fd9\u4e2a\u6587\u4ef6\uff09
\u8fd9\u4e9b\u8bf7\u6c42\u5934\uff0c\u53ef\u4ee5\u77e5\u9053\u662fcom.cmcc.cmvideo.foundation.network.NetworkManager.addCommonHeader<\/code>\u6dfb\u52a0\u5904\u7406\u7684
\u4e0d\u8fc7hook\u8fd9\u4e2a\u65b9\u6cd5\u6ca1\u6709\u770b\u5230l_s<\/code>\uff0c\u8bf4\u660e\u5e94\u8be5\u662f\u76f4\u63a5\u64cd\u4f5c\u7684\u5b58\u653e\u8bf7\u6c42\u5934\u7684\u5bf9\u8c61\u505a\u7684\u6dfb\u52a0
<\/a>
\u53ef\u4ee5\u770b\u5230\u8bf7\u6c42\u5934\u653e\u5728HashMap<\/code>\u4e2d\uff0c\u90a3\u4e48\u63a8\u6d4bl_s<\/code>\u53ef\u80fd\u5c31\u662f\u53d6\u4e86\u8fd9\u4e9b\u503c\u7136\u540e\u8ba1\u7b97\u51fa\u6765\u7684<\/p>\n(agent) [391494] Called com.cmcc.cmvideo.content.network.BaseResponseRequest.getCustomHeaders() (agent) [391494] Backtrace: com.cmcc.cmvideo.content.network.BaseResponseRequest.getCustomHeaders(Native Method) com.cmcc.cmvideo.content.network.BaseResponseRequest.loadData(BaseResponseRequest.java:44) com.cmcc.cmvideo.content.network.BaseResponseRequest.loadData(Native Method) com.cmcc.cmvideo.content.network.BaseResponseObject.subscribe(BaseResponseObject.java:35) com.cmcc.cmvideo.content.ContentServiceImpl.getVideoInfo(ContentServiceImpl.java:157) com.cmvideo.foundation.videocache.processor.VideoInfoProcessor.getVideoInfo(VideoInfoProcessor.java:104) com.cmvideo.foundation.videocache.processor.VideoInfoProcessor.run(VideoInfoProcessor.java:65) com.cmvideo.foundation.videocache.chain.VideoInfoInvocationChain.getVideoInfo(VideoInfoInvocationChain.java:58) com.cmvideo.foundation.videocache.CacheController.getVideoInfo(CacheController.java:138) com.cmcc.cmvideo.player.PlayHelper.getVideoInfo(PlayHelper.java:984) com.cmcc.cmvideo.player.PlayHelper.preparePlayData(PlayHelper.java:776) com.cmcc.cmvideo.player.PlayHelper.preparePlayData(PlayHelper.java:725) com.cmcc.cmvideo.playdetail.widget.MgPlayPageFragment.getPlayUrl(MgPlayPageFragment.java:3481) com.cmcc.cmvideo.playdetail.widget.MgPlayPageFragment.onResume(MgPlayPageFragment.java:2290) android.support.v4.app.Fragment.performResume(Fragment.java:2498) android.support.v4.app.FragmentManagerImpl.moveToState(FragmentManager.java:1501) android.support.v4.app.FragmentManagerImpl.moveFragmentToExpectedState(FragmentManager.java:1784) android.support.v4.app.FragmentManagerImpl.moveToState(FragmentManager.java:1852) android.support.v4.app.FragmentManagerImpl.dispatchStateChange(FragmentManager.java:3269) android.support.v4.app.FragmentManagerImpl.dispatchResume(FragmentManager.java:3241) android.support.v4.app.FragmentController.dispatchResume(FragmentController.java:223) android.support.v4.app.FragmentActivity.onResumeFragments(FragmentActivity.java:538) android.support.v4.app.FragmentActivity.onPostResume(FragmentActivity.java:527) android.support.v7.app.AppCompatActivity.onPostResume(AppCompatActivity.java:172) android.app.Activity.performResume(Activity.java:8154) android.app.ActivityThread.performResumeActivity(ActivityThread.java:4428) android.app.ActivityThread.handleResumeActivity(ActivityThread.java:4470) android.app.servertransaction.ResumeActivityItem.execute(ResumeActivityItem.java:52) android.app.servertransaction.TransactionExecutor.executeLifecycleState(TransactionExecutor.java:176) android.app.servertransaction.TransactionExecutor.execute(TransactionExecutor.java:97) android.app.ActivityThread$H.handleMessage(ActivityThread.java:2066) android.os.Handler.dispatchMessage(Handler.java:106) android.os.Looper.loop(Looper.java:223) android.app.ActivityThread.main(ActivityThread.java:7664) java.lang.reflect.Method.invoke(Native Method) com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:592) com.android.internal.os.ZygoteInit.main(ZygoteInit.java:947) <\/pre>\n
\u4f55\u4e0d\u5927\u80c6\u731c\u6d4b\u8fd9\u4e2a\u503c\u662fnative\u8ba1\u7b97\u51fa\u6765\u7684\uff0c\u76f4\u63a5\u770bjni\u597d\u4e86
\u4f46\u662f\u8fd8\u662f\u6ca1\u6709\u53d1\u73b0
\u90a3\u4e48\u8003\u8651\u6dfb\u52a0\u8bf7\u6c42\u5934\u53ef\u80fd\u7684\u5730\u65b9\uff0cokhttp3.Request$Builder.headers<\/code>\u65b9\u6cd5\u521a\u597d\u548c\u524d\u9762VideoInfoProcessor.getVideoInfo<\/code>\u5bf9\u5e94\u4e0a\u4e86<\/p>\n(agent) [989471] Called okhttp3.Request$Builder.headers(okhttp3.Headers) (agent) [989471] Backtrace: okhttp3.Request$Builder.headers(Native Method) com.cmvideo.capability.networkimpl.OkhttpNetworkManager.get(OkhttpNetworkManager.java:738) com.cmvideo.capability.network.NetworkManager2.get(NetworkManager2.java:164) com.cmcc.cmvideo.content.network.BaseResponseRequest.loadData(BaseResponseRequest.java:44) com.cmcc.cmvideo.content.network.BaseResponseObject.subscribe(BaseResponseObject.java:35) com.cmcc.cmvideo.content.ContentServiceImpl.getVideoInfo(ContentServiceImpl.java:157) com.cmvideo.foundation.videocache.processor.VideoInfoProcessor.getVideoInfo(VideoInfoProcessor.java:104) com.cmvideo.foundation.videocache.processor.VideoInfoProcessor.run(VideoInfoProcessor.java:65) com.cmvideo.foundation.videocache.chain.VideoInfoInvocationChain.getVideoInfo(VideoInfoInvocationChain.java:58) com.cmvideo.foundation.videocache.CacheController.getVideoInfo(CacheController.java:138) com.cmcc.cmvideo.player.PlayHelper.getVideoInfo(PlayHelper.java:984) com.cmcc.cmvideo.player.PlayHelper.preparePlayData(PlayHelper.java:776) com.cmcc.cmvideo.player.PlayHelper.preparePlayData(PlayHelper.java:725) com.cmcc.cmvideo.playdetail.widget.MgPlayPageFragment.getPlayUrl(MgPlayPageFragment.java:3481) com.cmcc.cmvideo.playdetail.widget.MgPlayPageFragment.onResume(MgPlayPageFragment.java:2290) android.support.v4.app.Fragment.performResume(Fragment.java:2498) android.support.v4.app.FragmentManagerImpl.moveToState(FragmentManager.java:1501) android.support.v4.app.FragmentManagerImpl.moveFragmentToExpectedState(FragmentManager.java:1784) android.support.v4.app.FragmentManagerImpl.moveToState(FragmentManager.java:1852) android.support.v4.app.FragmentManagerImpl.dispatchStateChange(FragmentManager.java:3269) android.support.v4.app.FragmentManagerImpl.dispatchResume(FragmentManager.java:3241) android.support.v4.app.FragmentController.dispatchResume(FragmentController.java:223) android.support.v4.app.FragmentActivity.onResumeFragments(FragmentActivity.java:538) android.support.v4.app.FragmentActivity.onPostResume(FragmentActivity.java:527) android.support.v7.app.AppCompatActivity.onPostResume(AppCompatActivity.java:172) android.app.Activity.performResume(Activity.java:8154) android.app.ActivityThread.performResumeActivity(ActivityThread.java:4428) android.app.ActivityThread.handleResumeActivity(ActivityThread.java:4470) android.app.servertransaction.ResumeActivityItem.execute(ResumeActivityItem.java:52) android.app.servertransaction.TransactionExecutor.executeLifecycleState(TransactionExecutor.java:176) android.app.servertransaction.TransactionExecutor.execute(TransactionExecutor.java:97) android.app.ActivityThread$H.handleMessage(ActivityThread.java:2066) android.os.Handler.dispatchMessage(Handler.java:106) android.os.Looper.loop(Looper.java:223) android.app.ActivityThread.main(ActivityThread.java:7664) java.lang.reflect.Method.invoke(Native Method) com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:592) com.android.internal.os.ZygoteInit.main(ZygoteInit.java:947) (agent) [989471] Return Value: okhttp3.Request$Builder@30d2e1e <\/pre>\n
appVersion<\/code>\u5373\u53ef\uff0c\u8fd9\u91cc\u662f2500090310<\/code>
\u90a3\u4e48…l_s<\/code>\u6682\u65f6\u5c31\u4e0d\u7814\u7a76\u4e86\u5427…<\/p>\n","protected":false},"excerpt":{"rendered":"
\n \u4e0d\u597d\uff0c\u6709\u58f3\uff0c\u90a3\u4e48\u5148\u8131\u58f3\u4e00\u6ce2\u518d\u8bf4https:\/\/github.com\/hluwa\/FRIDA-DEXDump<\/p>\n
\n \u6700\u7ec8\u7559\u4e0b\u8fd9\u4e9b<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[10379,10325,10175],"class_list":["post-101371","post","type-post","status-publish","format-standard","hentry","tag-ookie","tag-ap","tag-pve"],"_links":{"self":[{"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/posts\/101371","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/comments?post=101371"}],"version-history":[{"count":0,"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/posts\/101371\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/media?parent=101371"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/categories?post=101371"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dongwubaike.cn\/fanhao\/wp-json\/wp\/v2\/tags?post=101371"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}