dy设备deviceid iid注册分析

ゞ浴缸里的玫瑰 2023-10-13 23:49 42阅读 0赞

清楚缓存，重新打开app, 点击同意按钮，会触发设备注册；

![在这里插入图片描述][608f9c1a211f42d0b7f6483b7e4a9893.png]  
很明显是一个post包，device\_register  
可以看到请求体加密了 那么 请求体是什么呢？

> 很老版本思路：都是直接明文注册  
> 较老版本思路：在反编译后请求体通过一个bool来判断，是否走，ttencrypt；  
> 这个地方可以hook明文也可以直接修改bool值，让抓包直接抓到明文；
> 
> 正常情况下，是将请求体压缩后，走ttencrypt，进行密文注册；

我们接着往下走，看新版是否有变化；

--------------------

看下params参数：

### cdid: ###

![在这里插入图片描述][49ca0ee6104740a5b7678bf8dea094a2.png]  
![在这里插入图片描述][9f36d2448f5e403791bb5b24b5762cf1.png]

![在这里插入图片描述][5c18a1695d3b46548b31794f45cf9594.png]  
只找到个从SharedPreferences xml拿，没有就uuid;

### openudid: ###

![在这里插入图片描述][553fde6211304f36a7488a596f06729e.png]

--------------------

### x\_ss\_stub： ###

这个值就很普通了，java层，post包的时候会把data转成字符串进行md5的一个值；

![在这里插入图片描述][ef77693c20ba4fd1bc7a37f234e38b50.png]

--------------------

搜出来个这玩意，兄弟们想想这是干啥，注册，激活。。  
![在这里插入图片描述][202cd892501d4753a897a82ae133d316.png]

### ttencrypt： ###

搜一下：/service/2/device\_register/

![在这里插入图片描述][df9bd0b33f7243dd9ebd7e1e312ff2a7.png]

private boolean LIZ(String str, JSONObject jSONObject) {
        
            String[] strArr;
            boolean z;
            Throwable th;
            ChangeQuickRedirect changeQuickRedirect;
            String str2;
            ChangeQuickRedirect changeQuickRedirect2;
            ChangeQuickRedirect changeQuickRedirect3;
            l4Z l4z;
            String C;
            boolean z2;
            ChangeQuickRedirect changeQuickRedirect4 = LIZ;
            if (PatchProxy.isEnable(changeQuickRedirect4)) {
        
                PatchProxyResult proxy = PatchProxy.proxy(new Object[]{
        str, jSONObject}, this, changeQuickRedirect4, false, 5);
                if (proxy.isSupported) {
        
                    return ((Boolean) proxy.result).booleanValue();
                }
            }
            try {
        
                byte[] bytes = str.getBytes("UTF-8");
                System.currentTimeMillis();
                ChangeQuickRedirect changeQuickRedirect5 = l5V.LIZ;
                if (PatchProxy.isEnable(changeQuickRedirect5)) {
        
                    PatchProxyResult proxy2 = PatchProxy.proxy(PatchProxy.getEmptyArgs(), null, changeQuickRedirect5, true, 1);
                    if (proxy2.isSupported) {
        
                        strArr = (String[]) proxy2.result;
                        if (strArr == null) {
        
                            for (String str3 : strArr) {
        
                                byte[] bArr = (byte[]) bytes.clone();
                                if (!StringUtils.isEmpty(str3)) {
        
                                    Logger.debug();
                                    if (TextUtils.isEmpty(jSONObject.optString("device_id")) || TextUtils.isEmpty(jSONObject.optString("install_id"))) {
        
                                        z = true;
                                    } else {
        
                                        z = false;
                                    }
                                    try {
        
                                        ChangeQuickRedirect changeQuickRedirect6 = LIZ;
                                        if (PatchProxy.isEnable(changeQuickRedirect6)) {
        
                                            PatchProxyResult proxy3 = PatchProxy.proxy(PatchProxy.getEmptyArgs(), this, changeQuickRedirect6, false, 7);
                                            if (proxy3.isSupported) {
        
                                                z2 = ((Boolean) proxy3.result).booleanValue();
                                            }
                                        }
                                        ChangeQuickRedirect changeQuickRedirect7 = l5V.LIZ;
                                        if (PatchProxy.isEnable(changeQuickRedirect7)) {
        
                                            PatchProxyResult proxy4 = PatchProxy.proxy(PatchProxy.getEmptyArgs(), null, changeQuickRedirect7, true, 4);
                                            if (proxy4.isSupported) {
        
                                                z2 = ((Boolean) proxy4.result).booleanValue();
                                            }
                                        }
                                        if (l5V.LIZJ != null) {
        
                                            z2 = l5V.LIZJ.LIZ();
                                        }
                                        try {
        
                                            if (str3.indexOf(63) < 0) {
        
                                                new StringBuilder();
                                                C = O.C(str3, "?");
                                            } else {
        
                                                new StringBuilder();
                                                C = O.C(str3, "&");
                                            }
                                            str2 = NetUtil.sendEncryptLog(C, bArr, this.LIZJ.LJIILL, false, (String[]) null, (Map) null, (String) null, z, false);
                                        } catch (RuntimeException unused) {
        
                                            l4Q.LIZ(Monitor.Key.register, Monitor.State.f_to_bytes);
                                            try {
        
                                                str2 = NetUtil.doPost(str3, bytes, true, "application/json; charset=utf-8", false, (Map) null, z, false);
                                                String C2 = O.C("device_register response: ", str2);
                                                changeQuickRedirect2 = l4T.LIZ;
                                                if (PatchProxy.isEnable(changeQuickRedirect2)) {
        
                                                }
                                                changeQuickRedirect3 = l4T.LIZ;
                                                if (PatchProxy.isEnable(changeQuickRedirect3)) {
        
                                                }
                                                l4z = l4T.LIZIZ;
                                                if (l4z != null) {
        
                                                }
                                                if (str2 != null) {
        
                                                }
                                                l4Q.LIZ(Monitor.Key.register, Monitor.State.f_resp_error);
                                            } catch (Throwable th2) {
        
                                                th = th2;
                                                l4Q.LIZ(Monitor.Key.register, Monitor.State.f_net);
                                                l5O l5o = this.LIZJ;
                                                changeQuickRedirect = l5O.LIZIZ;
                                                if (PatchProxy.isEnable(changeQuickRedirect)) {
        
                                                }
                                                if (th instanceof CommonHttpException) {
        
                                                }
                                            }
                                        }
                                        String C22 = O.C("device_register response: ", str2);
                                        changeQuickRedirect2 = l4T.LIZ;
                                        if (PatchProxy.isEnable(changeQuickRedirect2) || !PatchProxy.proxy(new Object[]{
        C22}, null, changeQuickRedirect2, true, 1).isSupported) {
        
                                            changeQuickRedirect3 = l4T.LIZ;
                                            if (PatchProxy.isEnable(changeQuickRedirect3)) {
        
                                                try {
        
                                                } catch (Throwable th3) {
        
                                                    th = th3;
                                                    l4Q.LIZ(Monitor.Key.register, Monitor.State.f_net);
                                                    l5O l5o2 = this.LIZJ;
                                                    changeQuickRedirect = l5O.LIZIZ;
                                                    if (PatchProxy.isEnable(changeQuickRedirect)) {
        
                                                        PatchProxyResult proxy5 = PatchProxy.proxy(new Object[]{
        th}, l5o2, changeQuickRedirect, false, 21);
                                                        if (proxy5.isSupported) {
        
                                                            if (!((Boolean) proxy5.result).booleanValue()) {
        
                                                                throw th;
                                                            }
                                                        }
                                                    }
                                                    if (th instanceof CommonHttpException) {
        
                                                        int responseCode = ((CommonHttpException) th).getResponseCode();
                                                        if (l5o2.LJJIIJ) {
        
                                                            continue;
                                                        } else if (responseCode < 200) {
        
                                                            continue;
                                                        } else if (responseCode == 301) {
        
                                                            continue;
                                                        } else if (responseCode != 302) {
        
                                                            throw th;
                                                        }
                                                    } else {
        
                                                        continue;
                                                    }
                                                }
                                            }
                                            l4z = l4T.LIZIZ;
                                            if (l4z != null) {
        
                                                l4z.LIZ(C22, null);
                                            }
                                        }
                                        if (str2 != null || str2.length() == 0) {
        
                                            l4Q.LIZ(Monitor.Key.register, Monitor.State.f_resp_error);
                                        } else if (LIZ(new JSONObject(str2))) {
        
                                            return true;
                                        }
                                    } catch (Throwable th4) {
        
                                        th = th4;
                                        l4Q.LIZ(Monitor.Key.register, Monitor.State.f_net);
                                        l5O l5o22 = this.LIZJ;
                                        changeQuickRedirect = l5O.LIZIZ;
                                        if (PatchProxy.isEnable(changeQuickRedirect)) {
        
                                        }
                                        if (th instanceof CommonHttpException) {
        
                                        }
                                    }
                                }
                            }
                            return false;
                        }
                        throw new IllegalArgumentException("url is null");
                    }
                }
                strArr = (l5V.LIZIZ == null || l5V.LIZIZ.length <= 0 || StringUtils.isEmpty(l5V.LIZIZ[0])) ? new String[]{
        O.C("https://", l5V.LIZLLL, "/service/2/device_register/"), O.C("https://", l5V.LIZLLL, "/service/2/device_register/")} : l5V.LIZIZ;
                if (strArr == null) {
        
                }
            } catch (Throwable unused2) {
        
                l4Q.LIZ(Monitor.Key.register, Monitor.State.f_exception);
                return false;
            }
        }

可以看到整个注册这个接口的流程；  
![在这里插入图片描述][1af0b224b7fc4940a4a3cb7505092c8d.png]  
这一段代码是核心，看到是发请求去了；

> import com.ss.android.common.applog.NetUtil;

str2 = NetUtil.sendEncryptLog(C, bArr, this.LIZJ.LJIILL, false, (String[]) null, (Map) null, (String) null, z, false);
    
    str2 = NetUtil.doPost(str3, bytes, true, "application/json; charset=utf-8", false, (Map) null, z, false);

**这个时候，我们看出来已经和老版本有区别了，没有一个bool值来控制是否请求加密，而是直接去加密，若报错才会进行明文注册； 这是一点不同的地方；**

doPost： 确实没啥东西；  
![在这里插入图片描述][186b53ca8b7d46e3a24ba2d35c2fdfc4.png]

sendEncryptLog：  
![在这里插入图片描述][ada045c8a9a642fea5bb76181d4d69e7.png]  
![在这里插入图片描述][fce181ea57ba4042b86b1bc1da5afb1f.png]  
如果包含str.contains(“/service/2/app\_log/”）就去走ttEncrypt 加密，目前走else  
![在这里插入图片描述][dd54aea6570f44b98c48c308fdcb83d1.png]  
else: 也是压缩 ttEncrypt 加密  
![在这里插入图片描述][dfb0b44b172846b7b72eec1d41b3abc8.png]

![在这里插入图片描述][a4d52d6ecd054f1e98febc84bb10703b.png]

![在这里插入图片描述][5e5ea24c78244a789cb83015a67f3fb9.png]

ttEncrypt 该加密方式so层，libEncryptor.so

我们在看下，整体接口：  
![在这里插入图片描述][8a28dd9158a54e7ca7f0a32eecf5e116.png]  
看到确实是发了很多接口，注册，激活，日志包等等；而且必须是六神注册，密文注册，这样设备才可用；

很明显的，device\_register，app\_alert ，app\_log等等

为了权重更好，甚至注册完之后还需要发一些日志包，过一些验证码，提高设备权重；

[608f9c1a211f42d0b7f6483b7e4a9893.png]: https://img-blog.csdnimg.cn/608f9c1a211f42d0b7f6483b7e4a9893.png
[49ca0ee6104740a5b7678bf8dea094a2.png]: https://img-blog.csdnimg.cn/49ca0ee6104740a5b7678bf8dea094a2.png
[9f36d2448f5e403791bb5b24b5762cf1.png]: https://img-blog.csdnimg.cn/9f36d2448f5e403791bb5b24b5762cf1.png
[5c18a1695d3b46548b31794f45cf9594.png]: https://img-blog.csdnimg.cn/5c18a1695d3b46548b31794f45cf9594.png
[553fde6211304f36a7488a596f06729e.png]: https://img-blog.csdnimg.cn/553fde6211304f36a7488a596f06729e.png
[ef77693c20ba4fd1bc7a37f234e38b50.png]: https://img-blog.csdnimg.cn/ef77693c20ba4fd1bc7a37f234e38b50.png
[202cd892501d4753a897a82ae133d316.png]: https://img-blog.csdnimg.cn/202cd892501d4753a897a82ae133d316.png
[df9bd0b33f7243dd9ebd7e1e312ff2a7.png]: https://img-blog.csdnimg.cn/df9bd0b33f7243dd9ebd7e1e312ff2a7.png
[1af0b224b7fc4940a4a3cb7505092c8d.png]: https://img-blog.csdnimg.cn/1af0b224b7fc4940a4a3cb7505092c8d.png
[186b53ca8b7d46e3a24ba2d35c2fdfc4.png]: https://img-blog.csdnimg.cn/186b53ca8b7d46e3a24ba2d35c2fdfc4.png
[ada045c8a9a642fea5bb76181d4d69e7.png]: https://img-blog.csdnimg.cn/ada045c8a9a642fea5bb76181d4d69e7.png
[fce181ea57ba4042b86b1bc1da5afb1f.png]: https://img-blog.csdnimg.cn/fce181ea57ba4042b86b1bc1da5afb1f.png
[dd54aea6570f44b98c48c308fdcb83d1.png]: https://img-blog.csdnimg.cn/dd54aea6570f44b98c48c308fdcb83d1.png
[dfb0b44b172846b7b72eec1d41b3abc8.png]: https://img-blog.csdnimg.cn/dfb0b44b172846b7b72eec1d41b3abc8.png
[a4d52d6ecd054f1e98febc84bb10703b.png]: https://img-blog.csdnimg.cn/a4d52d6ecd054f1e98febc84bb10703b.png
[5e5ea24c78244a789cb83015a67f3fb9.png]: https://img-blog.csdnimg.cn/5e5ea24c78244a789cb83015a67f3fb9.png
[8a28dd9158a54e7ca7f0a32eecf5e116.png]: https://img-blog.csdnimg.cn/8a28dd9158a54e7ca7f0a32eecf5e116.png