夜雨聆风先看看有没有加壳
发现是爱加密企业版的壳，去网站上脱壳，https://56.al/
先抓个包看看
在源码里面查找相关的数据加密，搜索base或者init或者encrypt
找到key的初始化分支控制，重点看看EncryptUtils
这应该是构造请求体的部分，看得出是aes的加密，继续跟
这是生成token的部分，是aes+rsa加密的
感觉像用在解密什么东西，丢给ai看看
基本的加密就已经明了了
直接hook一下，脚本如下
// aes_hook_decoded.jsJava.perform(function() {var Cipher = Java.use("javax.crypto.Cipher");var SecretKeySpec = Java.use("javax.crypto.spec.SecretKeySpec");Cipher.init.overload("int", "java.security.Key").implementation = function(opmode, key) {console.log("\n========== AES Cipher.init ==========");console.log("OpMode: " + (opmode == 1 ? "ENCRYPT" : "DECRYPT"));console.log("Algorithm: " + this.getAlgorithm());console.log("Key (hex): " + bytesToHex(key.getEncoded()));console.log("Key (base64): " + bytesToBase64(key.getEncoded()));return this.init(opmode, key);};Cipher.doFinal.overload("[B").implementation = function(data) {console.log("\n========== AES doFinal ==========");console.log("Input (hex): " + bytesToHex(data));console.log("Input (base64): " + bytesToBase64(data));var result = this.doFinal(data);console.log("Output (hex): " + bytesToHex(result));console.log("Output (base64): " + bytesToBase64(result));console.log("Output (明文): " + bytesToString(result));return result;};// 同时 Hook SecretKeySpecSecretKeySpec.$init.overload("[B", "java.lang.String").implementation = function(keyBytes, algorithm) {console.log("\n========== SecretKeySpec ==========");console.log("Algorithm: " + algorithm);console.log("Key (hex): " + bytesToHex(keyBytes));console.log("Key (base64): " + bytesToBase64(keyBytes));console.log("Key (明文): " + bytesToString(keyBytes));return this.$init(keyBytes, algorithm);};function bytesToHex(bytes) {var hex = "";for (var i = 0; i < bytes.length; i++) {hex += ("0" + (bytes[i] & 0xff).toString(16)).slice(-2);}return hex;}function bytesToBase64(bytes) {var base64 = "";var chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";for (var i = 0; i < bytes.length; i += 3) {var b1 = bytes[i] & 0xff;var b2 = (i + 1 < bytes.length) ? bytes[i + 1] & 0xff : 0;var b3 = (i + 2 < bytes.length) ? bytes[i + 2] & 0xff : 0;base64 += chars[b1 >> 2];base64 += chars[((b1 & 0x03) << 4) | (b2 >> 4)];base64 += (i + 1 < bytes.length) ? chars[((b2 & 0x0f) << 2) | (b3 >> 6)] : "=";base64 += (i + 2 < bytes.length) ? chars[b3 & 0x3f] : "=";}return base64;}function bytesToString(bytes) {var str = "";for (var i = 0; i < bytes.length; i++) {var c = bytes[i] & 0xff;if (c >= 32 && c <= 126) {str += String.fromCharCode(c);} else if (c < 32) {str += "\\x" + ("0" + c.toString(16)).slice(-2);} else {str += "\\x" + c.toString(16);}}return str;}});
