安卓逆向分析之酷狗signature案例分享

    public static Map<String, Object> a(Context context, JSONObject jSONObject) {
        HashMap hashMap = new HashMap();
        hashMap.put("dfid", com.kugou.common.q.b.a().dq());
        hashMap.put("appid", com.kugou.android.b.c.d());
        hashMap.put("mid", br.j(context));
        hashMap.put("uuid", com.kugou.common.q.b.a().ak());
        hashMap.put("clientver", Integer.valueOf(d.a(context)));
        hashMap.put("clienttime", Long.valueOf(System.currentTimeMillis() / 1000));
        String a2 = com.kugou.android.ads.feev4.a.a(hashMap);
        StringBuilder sb = new StringBuilder();
        sb.append(a2);
        sb.append(jSONObject == null ? "" : jSONObject.toString());
        hashMap.put("signature", com.kugou.android.ads.feev4.a.a(sb.toString()));
        return hashMap;
    }

  public static String a(Map<String, Object> map) {
        if (map == null || map.isEmpty()) {
            return "";
        }
        ArrayList<String> arrayList = new ArrayList(map.keySet());
        Collections.sort(arrayList);
        StringBuilder sb = new StringBuilder();
        for (String str : arrayList) {
            if (!TextUtils.isEmpty(str)) {
                sb.append(str);
                sb.append(ContainerUtils.KEY_VALUE_DELIMITER);
                sb.append(map.get(str));
            }
        }
        return sb.toString();
    }

import frida, sys
def on_message(message, data):
    if message['type'] == 'send':
        print("[*] {0}".format(message['payload']))
    else:
        print(message)
        
jscode_hook = """
    Java.perform(
        function(){
			var a2_class = Java.use("com.kugou.android.ads.feev4.a")
            a2_class.a.overload('java.util.Map').implementation = function (m) {
			       console.log("参数 --> " m)
			       var result = this.a(m)
			       console.log("参数 --> " result1)
			       return result
			    }
 })
"""
process = frida.get_usb_device().attach('com.kugou.android')
script = process.create_script(jscode_hook)
script.on('message', on_message)
print('[*] Hook Start Running')
script.load()
sys.stdin.read()

import frida, sys
def on_message(message, data):
    if message['type'] == 'send':
        print("[*] {0}".format(message['payload']))
    else:
        print(message)
jscode_hook = """
Java.perform(
    function(){
            var sign_class = Java.use("com.kugou.common.utils.ba");
            console.log(sign_class);
            if (sign_class != undefined) {
                    sign_class.b.overload('java.lang.String').implementation = function (str) {
                    console.log("参数: ==> : "   str);
                    var res = sign_class.b(str);
                    console.log("解密结果: ==> "   res);
                    return res;
                }
            }
    }
)
"""
process = frida.get_usb_device().attach('com.kugou.android')
script = process.create_script(jscode_hook)
script.on('message', on_message)
print('[*] Hook Start Running')
script.load()
sys.stdin.read()