|
火山小视频抖音 as cp mas X-Gorgon 算法源码
火山小视频 抖音 as cp mas X-Gorgon 的调用算法~  
- //v2=Url/POST 中的ts参数 v0_2 = 是Url v3_3是数组，Get/Post，格式为{"a","1","b","2"} V1_2=Url/POST中的device_id参数
复制代码 - v1_2 = UserInfo.getUserInfo(v2, URLDecoder.decode(((String)v0_2)), v3_3, v1_2);
复制代码 - v6_1 = v1_2;
- String[] v5_3 = v3_3;
- if(!TextUtils.isEmpty(((CharSequence)v6_1))) {
- int v1_3 = v6_1.length();
- if(v1_3 % 2 == 0) {
- v2 = v1_3 >> 1;
- v3_2 = v6_1.substring(0, v2);
- com.ss.sys.ces.g.a v4_2 = com.ss.sys.ces.g.b.a(GlobalContext.getContext(), ((long)AwemeApplication.z().m()));
- v4_2.a(o.a());
- String v4_3 = com.ss.android.common.applog.l.a(v4_2.a(v3_2.getBytes()));
- v0 = (((String)v0_2)) + "&as=" + v3_2 + "&cp=" + v6_1.substring(v2, v1_3);
- return v0 + "&mas=" + v4_3;
- }
- v0 = (((String)v0_2)) + "&as=a1qwert123&cp=cbfhckdckkde1";
- f.a(v0, v5_3, v6_1, com.ss.android.common.applog.d.l(), ((long)v2));
- return v0;
- }
复制代码
根据上面代码知道 加密代码是再 UserInfo.getUserInfo(int,String,String[],String）
getUserInfo 是一个 Native 方法 这个方法再Libcms.so中（别问我怎么知道的，过程有点长）
将这个UserInfo类全部复制到 Android Studio （注意路径，类名 得一致）
在 吧cms.so 复制到 Android Studio 写以下代码
UserInfo.setAppId(1128);
UserInfo.initUser("a3668f0afac72ca3f6c1697d29e0e1bb1fef4ab0285319b95ac39fa42c38d05f"); String Url = "https://iu-hl.snssdk.com/passport/auth/login/?retry_type=no_retry&mcc_mnc=46000&iid=65890761809&device_id=50321920862&ac=wifi&channel=update&aid=1128&app_name=aweme&version_code=530&version_name=5.3.0&device_platform=android&ssmix=a&device_type=mx5&device_brand=meizu&language=zh&os_api=22&os_version=5.1.1&uuid=865166026749633&openudid=d240410dcc715514&manifest_version_code=530&resolution=720*1280&dpi=240&update_version_code=5302&_rticket=1552476032695&ts=1552476031";
String[] arr2 = {"os_api","22","device_type","mx5","device_platform","android","ssmix","a","iid","65890761809","manifest_version_code","530","dpi","240","uuid","865166026749633","version_code","530","app_name","aweme","version_name","5.3.0","openudid","d240410dcc715514","device_id","50321920862","resolution","720*1280","os_version","5.1.1","language","zh","device_brand","meizu","ac","wifi","update_version_code","5302","aid","1128","channel","update","mcc_mnc","46000"};
String v0_4 = UserInfo.getUserInfo(1552476031, Url, arr2, "50321920862"); int v1_2 = v0_4.length();
if (v1_2 % 2 == 0) {
String v2_2 = v0_4.substring(0, v1_2 >> 1);
v0_4 = "as=" + v2_2 + "&cp=" + URLEncoder.encode(v0_4.substring(v1_2 >> 1, v1_2)) + "&mas=" + bytesToHex(com.ss.sys.ces.a.e(v2_2.getBytes()));
}
Log.e(Tag, v0_4);
cms.so，不光只注册了一个叫UserInfo的类，还有[com.ss.sys.ces.a][com.ss.sys.secuni.b.c]在 Android Studio 中创建这个路径以及类 将反编译之后的代码复制进来就可以了。
执行代码发现就得到了v0_4的值了。 把v0_4添加到Url后面即可
抖音的最新版 协议头多了[X-Gorgon][X-Khronos]这两个，缺一不可
X-Khronos = 十位的 时间戳
Url = 到大写 (MD5( Url)) // Url为有 as cp mas 的Url 也就是你即将提交的 URL
X-SS-STUB = "00000000000000000000000000000000" // 协议头中的 X-SS-STUB 如果为空 用32个0表示
Cookie = 到大写 (MD5（Cookies）) // Cookies为你即将提交的Cookies
未知参数="00000000000000000000000000000000" // 固定即可
X-Gorgon = Url ＋ X-SS-STUB ＋ Cookies ＋ 未知参数
X-Gorgon = com.ss.sys.ces.a.leviathan( X-Khronos , X-Gorgon )//加密
将得到的 X-Khronos X-Gorgon 放在协议头就OK了
有一些请求 返回值是乱码的，比如 (https://xlog.snssdk.com/v2/r?os=0&ver=0.5.10.28&m=1&app_ver=.......)
将返回值到HEX 发现 只要是 01 开头的 都可以用 com.ss.sys.ces.a.d 解密 包括mas
提交数据到HEX 如果有 01 开头的 都可以用 com.ss.sys.ces.a.e 加密 包括mas
现在你可以用 Android Studio 写个服务端。根据实际情况来调用加密了；
|
(需注册本站用户)
