A, goals,

Boss Li: Fenfei, the latest updates are all small apps. Do you want to analyze a bigger one?

Fenfei: You are the boss, so you have the final say.

Big company really atmosphere, somebody else signature is a field, he direct a pile of fields.

Mtgsig is our goal today

Second, the steps

Jadx search “mtgsig”

The results of

public static final String MTG_SIG_HEADER = "mtgsig";
Copy the code

Continue to Jadx MTG_SIG_HEADER

The makeHeader function is found

The Hook

var signCls = Java.use("com.mxx.android.common.mtguard.wtscore.plugin.sign.core.WTSign");
signCls.makeHeader.implementation = function(a,b){
        var rc = this.makeHeader(a,b);

        console.log(">>> rc=" + rc);
        return rc;
}
Copy the code

run

>>> Rc = {" a0 ":" 1.5 ", "a1" : "9 b69f861 - bc4 e054-4-9 daf - d36ae205ed3e", "a2" : "73 a251e151ab949912ab68226ab96799b478eb2a" and "a3" : 2, "a4" : 1 619572653,"a5":"OgkiOY9ddFObzxjxdyEibG6zSvjMTm+1miRg447HjfNOCqFrudZ/vrOpk6hai/+TacmmG83UPjqoWk1mQlHcIxCSzerxptOiGEaOt25z jBGPhjHt1sg9bhqg/mnWDTYUNA25WxMDtFxX9r8OZFJjH/cU3MhTSEkgTmw+pYDawdJbPF4CwrO99app5xY82x/4nZD/1CHYcggE1gkepGw5LF2gaJsDHqtL VNHb/DKL8UWdMNohVPYTXIX5Q2oPvxqVyQefBBat15vf9levYWKLfMVQ4xCfCfbbCBzixUb8VKw7JM9tzArMqpkbM+lM","a6":0,"d1":"9f3b94a2f89b7 830da8c16ed73e7419e83870877"}Copy the code

No problem. That’s him. Call it a day

Preparations for RPC calls

Boss Li: Fenfei, you si already 996, 007, we can not at least 6:00 on time? I’ll be laughed at this afternoon when I brag about X to other bosses.

Fenfei: Well, you are the boss, so you have the final say. Let’s knock off at 6:01. Set the watch one minute back outside the office. You’re gonna be the new Lee Skin. That’s a blast.

Let’s look at the makeHeader function. The first argument is a byte[] type and the second argument is an enumeration type. Let’s use our bytestString function to print this

console.log("a=" + bytesToString(a));
console.log("b=" + b);
console.log(">>> rc=" + rc);
Copy the code

Ok, no problem, the input is clear.

a=GET /mop/entry/guideLayerEntry __reqTraceID=bf7c285b-f476-425d-805f-2c33abd974cb&ci=10&latlng=&model=MI%20NOTE%20Pro&msid=8673020214763141619572366484& userid=-1&utm_campaign=AgroupBgroupC0E0Ghomepage&utm_content=867302021476314&utm_medium=android&utm_source=wandoujia&utm _term = 1100080206 & 00000000000002 ee5c4acb0554dce9fff3ab6ea7aa1740000000000000108337 uuid = & version_name = 11.8.206 b = FAST > > > Rc = {" a0 ":" 1.5 ", "a1" : "9 b69f861 - bc4 e054-4-9 daf - d36ae205ed3e", "a2" : "fc568f7eff071afdc5d12aaf0eeb9dc734fbed7a" and "a3" : 2, "a4" : 1 619572653,"a5":"OgkiOY9ddFObzxjxdyEibG6zSvjMTm+1miRg447HjfNOCqFrudZ/vrOpk6hai/+TacmmG83UPjqoWk1mQlHcIxCSzerxptOiGEaOt25z jBGPhjHt1sg9bhqg/mnWDTYUNA25WxMDtFxX9r8OZFJjH/cU3MhTSEkgTmw+pYDawdJbPF4CwrO99app5xY82x/4nZD/1CHYcggE1gkepGw5LF2gaJsDHqtL VNHb/DKL8UWdMNohVPYTXIX5Q2oPvxqVyQefBBat15vf9levYWKLfMVQ4xCfCfbbCBzixUb8VKw7JM9tzArMqpkbM+lM","a6":0,"d1":"2d1d2f72034de 8360ee6e21f29837e94d5254857"}Copy the code

So the next step is to construct a string, turn it into a byte[], and call makeHeader to make it OK.

I feel a little trouble, boss Li is so bad, we have to touch the fish, a few days ago in tsinghua open class to learn the fish to use the introduction, we pay attention to the use of learning.

var signCls = Java.use("com.meituan.android.common.mtguard.wtscore.plugin.sign.core.WTSign"); signCls.makeHeader.implementation = function(a,b){ var rc = this.makeHeader(a,b); var StrCls = Java.use('java.lang.String'); var OutStr = StrCls.$new("GET /mop/entry/guideLayerEntry __reqTraceID=bf7c285b-f476-425d-805f-2c33abd974cb&ci=10&latlng=&model=MI%20NOTE%20Pro&msid=8673020214763141619572366484& userid=-1&utm_campaign=AgroupBgroupC0E0Ghomepage&utm_content=867302021476314&utm_medium=android&utm_source=wandoujia&utm _term = 1100080206 & 00000000000002 ee5c4acb0554dce9fff3ab6ea7aa1740000000000000108337 uuid = & version_name = 11.8.206 "); var myRc = this.makeHeader(OutStr.getBytes(),b); console.log("#### myRc=" + myRc); console.log("a=" + bytesToString(a)); console.log("b=" + b); console.log(">>> rc=" + rc); return rc; }Copy the code

GetBytes [] = getBytes [];

# # # # MyRc = {" a0 ":" 1.5 ", "a1" : "9 b69f861 - bc4 e054-4-9 daf - d36ae205ed3e", "a2" : "fc568f7eff071afdc5d12aaf0eeb9dc734fbed7a" and "a3" : 2, "a4" :1619574692,"a5":"g/pDS/G/6rmL0K1YP94jPk7oWNSpEp+MuACRTKqTgl+oUG/rIn7XPv/bvLjNRK80rtInhRbJGKfrpXXqw3CLreUr7q0fGBQfrcGL15 kJQ66OaVBkvlt3fH2WsqpgTanIKvGNmTtT4hfJfIe0y1JcbGA0xW0V69I6L3jBaCiE6E54HsNtGSaCAnBBn5jzRpe88vtx+MTB3FGdme/cLlHcDGTyBNP4tb KXseHLT2wvUrlLDYiWxAHYNkoREwtpKZns1xUyJRSl1EfvPE3R2Jo4/8OtEYlu9NiS6BJ9VRrH+nwKzW5VSDrXZmXXk55E","a6":0,"d1":"c5a9bf4c610 171f14c20559dd34154ecb35ccfb3"}Copy the code

The results proved:

  • If the parameters are the same, a0, A1, a2, a3 looks like a timestamp, and a5 and d1 have different values.

Then we’ll know whether we’re actually doing RPC calls or running with unidbg.

Third, summary

Big companies still have the characteristics of big companies, people pay high, long working hours, must be complicated.

Then is the analysis of the time or to master a few more skills, first simple and clear verification, and then proceed to the next step. Don’t rush into writing a bunch of code. Code is so expensive these days. Wouldn’t it be nice to write a draft first?

I don’t think there’s much point in lamenting about the state of the world unless you can think of ways to improve it. Otherwise, either move bricks or find a park and lie in the sun. —- Haidian Wild Rinpoche

TIP: The purpose of this article is only one is learning more backward techniques and train of thought, if anyone use this technology to get illegal commercial interests the legal liabilities are their operators, and the author and it doesn’t matter, this paper involves the knowledge of code project can go to my friends to fly star come undone, welcome to join star learn together to explore technology knowledge. Questions can be added to me WX: Fenfei331 discussion.

Wechat public account fenfei security, the latest technology dry goods real-time push