优酷app参数分析

优酷app的 x-sign，x-mini-wua， x-sgext，x-umt的 frida hook。

打印出的参数和返回的结果：

• v1: {deviceId=xxx, appKey=xxx, utdid=xxx, x-features=27, ttid=xx, v=1.0, sid=null, t=1634609271, api="xx", data={"ms_codes":"2019061000","params":"xx","system_info":"xx"}, uid=null}
• v2: {pageName=, pageId=}
• v3: 23570660
• v4: null
• v5: false
• res:{x-sign=xx, x-mini-wua=xx, x-sgext=xx, x-umt=xx}

Frida hook代码

import frida, sys

def on_message(message, data):
    if message['type'] == 'send':
        print("[*] {0}".format(message['payload']))
    else:
        print(message)

jscode_hook = """
Java.perform(function () {
    /**
     * hook url构造函数， 得到调用位置打印堆栈信息
     */
    const u = Java.use("java.net.URL")
    u.$init.overload('java.lang.String').implementation = function (v1) {
        if (v1.indexOf("mtop.youku.play.ups.appinfo.get") > 0) {
            console.log("--------------------------------------------------------------------------")
            console.log(v1)
            const security = Java.use("mtopsdk.security.c");
            security.a.overload('java.util.HashMap', 'java.util.HashMap', 'java.lang.String', 'java.lang.String', 'boolean').implementation = function (v1,v2,v3,v4,v5){
                console.log("v1: " + v1);
                console.log("v2: " + v2);
                console.log("v3: " + v3);
                console.log("v4: " + v4);
                console.log("v5: " + v5);
                const res  = this.a(v1,v2,v3,v4,v5);
                console.log("res:" + res);
                return null;
            }
            return this.$init(v1);
            console.log("--------------------------------------------------------------------------")
        }
        return this.$init(v1);
    }

    /**
     * hook 验证视频播放信息数据
     * @type {Java.Wrapper<{}>}
     */
    // const param = Java.use("com.youku.upsplayer.GetUps");
    // param.constructParams.implementation = function (v1, v2) {
    //     const j = Java.use("com.alibaba.fastjson.JSONObject");
    //     console.log("参数1: " + v1.toJSON())
    //     console.log("参数2 vid: " + v2.vid.value)
    //     console.log("参数2 ccode: " + v2.ccode.value)
    //     console.log("参数2 utid: " + v2.utid.value)
    //     console.log("参数2 showid: " + v2.showid.value)
    //     console.log("参数2 show_videoseq: " + v2.show_videoseq.value);
    //     showStacks();
    //     // return this.constructParams(v1,v2);
    // }

})
"""

process = frida.get_usb_device().attach('com.youku.phone')
script = process.create_script(jscode_hook)
script.on('message', on_message)
print('[*] Hook Start Running')
script.load()
sys.stdin.read()