近期在使用“实时公交”软件,其有北京大部分公交车的GPS数据,但是软件比较偏国企化,做的并没有那么人性化,大山子路口这里剧堵是远近闻名的,基本上每辆车都要堵一段时间,那么冬天出去等车就会很遭罪,但是晚出去有可能眼睁睁的看着公交到站开走,所以打算逆向分析一下北京实时公交软件,加入对堵车时间的预测。
逆向分析
该软件如其外观一样简单,内部没有做混淆,甚至还有测试信息打印,System.out.println等输出,所以直接dex转jar(https://sourceforge.net/projects/dex2jar/),然后使用jd-gui(http://jd.benow.ca/)进行查看,导出来后放入IDE查看。
代码分析
以下为其主要目录结构
model层应该是可以比较直观的看出其结构(其model层写了一个错别字?)
分析看到需要解密的字段,其使用RC4加解密,一个不是特别常用的对称加解密算法
RC4加解密简介
RC4不是对明文进行分组处理,而是字节流的方式依次加密明文中的每一个字节,解密的时候也是依次对密文中的每一个字节进行解密。
算法简单,运行速度快,而且密钥长度是可变的,可变范围为1-256字节(8-2048比特)
1、密钥流:RC4算法的关键是根据明文和密钥生成相应的密钥流,密钥流的长度和明文的长度是对应的,也就是说明文的长度是500字节,那么密钥流也是500字节。当然,加密生成的密文也是500字节,因为密文第i字节=明文第i字节^密钥流第i字节;
2、状态向量S:长度为256,S[0],S[1]…..S[255]。每个单元都是一个字节,算法运行的任何时候,S都包括0-255的8比特数的排列组合,只不过值的位置发生了变换;
3、临时向量T:长度也为256,每个单元也是一个字节。如果密钥的长度是256字节,就直接把密钥的值赋给T,否则,轮转地将密钥的每个字节赋给T;
4、密钥K:长度为1-256字节,注意密钥的长度keylen与明文长度、密钥流的长度没有必然关系,通常密钥的长度趣味16字节(128比特)。
RC4加解密PHP实现
实现:
1 | 复制代码function rc4($key, $pt) |
测试验证:
1 | 复制代码$str = '{"root":{"status":"200","message":"success","encrypt":"1","num":"6","lid":"949","data":{"bus":[{"gt":"1511789342","id":"75544","t":"0","ns":"MeACxHFmZLhE","nsn":"5kU=","nsd":"1706","nsrt":"197","nst":"1511789539","sd":"+Uc=","srt":"+Uc=","st":"+Uc=","x":"5UewD9XUuDbzQw==","y":"4EaoEdPStDT4","lt":"0","ut":"1511789353"},{"gt":"1511789343","id":"75537","t":"0","ns":"9kh/iiYwnXfFvgPc4r4gjGxZ","nsn":"Ldk=","nsd":"652","nsrt":"79","nst":"1511789422","sd":"MtA=","srt":"MtA=","st":"MtA=","x":"LtDlQqCIRdFZaQ==","y":"K9H9XKaJRtVY","lt":"0","ut":"1511789354"},{"gt":"1511789334","id":"75611","t":"0","ns":"z60iAGP9avHwPh8dLCVw17Rv","nsn":"Gzw=","nsd":"-1","nsrt":"-1","nst":"-1","sd":"Bzg=","srt":"Bzg=","st":"Bzg=","x":"Gzizy+Z0tmpX4g==","y":"GTCr3Op6uW5S","lt":"0","ut":"1511789342"},{"gt":"1511789335","id":"75538","t":"0","ns":"q2CWQiHZ52ohG3yEEOiW","nsn":"fMs=","nsd":"321","nsrt":"52","nst":"1511789387","sd":"YM0=","srt":"YM0=","st":"YM0=","x":"fM07iK9COfuC","y":"fsUjn6JDNvg=","lt":"0","ut":"1511789343"},{"gt":"1511789256","id":"75549","t":"0","ns":"GlwsiqkbEEag","nsn":"wcI=","nsd":"515","nsrt":"71","nst":"1511789327","sd":"3sQ=","srt":"3sQ=","st":"3sQ=","x":"wsS2QRG8zfQcfA==","y":"x8WuXxa/y/kU","lt":"0","ut":"1511789270"},{"gt":"1511789107","id":"75553","t":"0","ns":"ZZQTCHtyjvXT3sBLOCJLdjq3","nsn":"sws=","nsd":"-1","nsrt":"-1","nst":"-1","sd":"rQg=","srt":"rQg=","st":"rQg=","x":"sQi8wPzyX0BIDw==","y":"tAmk3vr4X0NG","lt":"0","ut":"1511789130"}]}}}'; |
RC4加解密Java实现
实现:
1 | 复制代码package testest; |
验证
1 | 复制代码 public static void main(String[] args) throws NoSuchAlgorithmException { |
附Base64实现
1 | 复制代码package testest; |
结果
最终可以看到其站名公交车GPS速度等内容
1 | 复制代码****************************************************** |
相关文章
- 解决Windows磁盘爆满却不知如何清理问题
- 利用ping、nslookup、route、traceroute、mtr等工具排查网络异常
- 针对包含签名加密随机生成特殊请求参数等情况使用JMeter进行压力测试
- CentOS_MINI配置方案3_更换更新源_安装常用软件_创建管理用户_服务启动配置
- CentOS_MINI配置方案2_配置网卡
- CentOS_MINI配置方案1_关闭SELinux
- PHP框架之Yaf框架入门
本文转载自: 掘金