优酷app的 x-sign，x-mini-wua， x-sgext，x-umt的 frida hook。
打印出的参数和返回的结果：
- v1: {deviceId=xxx, appKey=xxx, utdid=xxx, x-features=27, ttid=xx, v=1.0, sid=null, t=1634609271, api=“xx”, data={“ms_codes”:“2019061000”,“params”:“xx”,“system_info”:“xx”}, uid=null}
- v2: {pageName=, pageId=}
- v3: 23570660
- v4: null
- v5: false
- res:{x-sign=xx, x-mini-wua=xx, x-sgext=xx, x-umt=xx}
Frida hook代码
import frida, sys
def on_message(message, data):
if message['type'] == 'send':
print("[*] {0}".format(message['payload']))
else:
print(message)
jscode_hook = """
Java.perform(function () {
const u = Java.use("java.net.URL")
u.$init.overload('java.lang.String').implementation = function (v1) {
if (v1.indexOf("mtop.youku.play.ups.appinfo.get") > 0) {
console.log("--------------------------------------------------------------------------")
console.log(v1)
const security = Java.use("mtopsdk.security.c");
security.a.overload('java.util.HashMap', 'java.util.HashMap', 'java.lang.String', 'java.lang.String', 'boolean').implementation = function (v1,v2,v3,v4,v5){
console.log("v1: " + v1);
console.log("v2: " + v2);
console.log("v3: " + v3);
console.log("v4: " + v4);
console.log("v5: " + v5);
const res = this.a(v1,v2,v3,v4,v5);
console.log("res:" + res);
return null;
}
return this.$init(v1);
console.log("--------------------------------------------------------------------------")
}
return this.$init(v1);
}
// const param = Java.use("com.youku.upsplayer.GetUps");
// param.constructParams.implementation = function (v1, v2) {
// const j = Java.use("com.alibaba.fastjson.JSONObject");
// console.log("参数1: " + v1.toJSON())
// console.log("参数2 vid: " + v2.vid.value)
// console.log("参数2 ccode: " + v2.ccode.value)
// console.log("参数2 utid: " + v2.utid.value)
// console.log("参数2 showid: " + v2.showid.value)
// console.log("参数2 show_videoseq: " + v2.show_videoseq.value);
// showStacks();
// // return this.constructParams(v1,v2);
// }
})
"""
process = frida.get_usb_device().attach('com.youku.phone')
script = process.create_script(jscode_hook)
script.on('message', on_message)
print('[*] Hook Start Running')
script.load()
sys.stdin.read()
