welove农场签到更新了sig

[zixing131]

新的sig好像是md5形式的，不是之前的base64了

[Bpazy]

这两天试验了下，确实更新了sig，简单试了下几种组合后的md5都不对，可能需要反编译下apk或找到动态加载下来的农场的代码。
我最近比较忙可能没空去看这个问题，希望大家能一起来研究下。

[HikaruChang]

另外，这个版本似乎可以重放攻击，sig没有时间戳，尝试抓包获取sig后，写死在程序内，依旧可以获取数据。

[zixing131]

另外，这个版本似乎可以重放攻击，sig没有时间戳，尝试抓包获取sig后，写死在程序内，依旧可以获取数据。

我刚才试了一下，浇花是可以的，https://blog.csdn.net/hanziyuan08/article/details/52606908

[zixing131]

这是我之前写的代码
#encoding:utf-8
"""
@author:zixing
@email:zixing131@qq.com
@Date:2017-10-26 02:46
"""
from hashlib import sha1
import hmac
import base64
import urllib
import hashlib
import requests
import collections

def cn(x):
return x.decode("u8").encode("gbk")

class WeLove:
def init(self,token,appkey):
self.urlhead = "http://sweet.api.welove520.com" # http://api.welove520.com
self.access_token = token
self.app_key = appkey

def md5(self,v):
	m2 = hashlib.md5()   
	m2.update(v)   
	return m2.hexdigest()  
def signpass(self,pas):
	pas = pas + "8eb4afa4"
	return self.md5(pas)
	
def hmacsha1(self,key,value):
	my_sign = hmac.new(key, value, sha1).digest() 
	my_sign = base64.b64encode(my_sign)
	return my_sign

def getsig(self,url,data,method="POST"):
	key = "8b5b6eca8a9d1d1f"
	value = "%s&%s&%s"%(method,urllib.quote_plus(url),urllib.quote_plus(urllib.urlencode(data)))
	result = self.hmacsha1(key,value)
	return result
	
def post_post(self,url,data):
	url = self.urlhead + url
	data2 = sorted(data.items(), key=lambda d:d[0], reverse = False)
	sig = self.getsig(url,data2) 
	data2.append(("sig",sig))
	result = requests.post(url,data2)
	return cn(result.content)
	
def post_get(self,url,data):
	url = self.urlhead + url
	data2 = sorted(data.items(), key=lambda d:d[0], reverse = False)
	sig = self.getsig(url,data2) 
	data2.append(("sig",sig))
	url = url +"?"+ urllib.urlencode(data2)
	result = requests.post(url)
	return cn(result.content)
	
#打卡,成功返回 {"result":1} 
# 其他返回值 
# {"result":2205,"error_msg":"已经打过卡了"}
# {"result":2204,"error_msg":"没有找到对应打卡"}
def punch(self,user_card): 
	if(user_card["is_punched"] == 1):
		return cn("%s 已经打卡了，共打卡次数：%d，持续天数：%d") %(user_card["text"],user_card["punch_sum"],user_card["duration_num"])

	user_card_id = user_card["user_card_id"] 
	
	url = "/v5/punch/punch" 
	data = {
		"access_token" : self.access_token,
		"app_key" : self.app_key ,
		"user_card_id" : user_card_id
	} 
	result = eval(self.post_get(url,data))
	if(result["result"] == 1):
		return cn("%s 打卡成功，共打卡次数：%d，持续天数：%d") %(user_card["text"],user_card["punch_sum"],user_card["duration_num"])
	else:
		return cn("%s %s，共打卡次数：%d，持续天数：%d") %(user_card["text"],result["error_msg"],user_card["punch_sum"],user_card["duration_num"])

#获取打卡列表，返回 user_cards 
def getPunchIndex(self): 
	url = "/v5/punch/index" 
	data = {
		"access_token" : self.access_token,
		"app_key" : self.app_key
	} 
	result = eval(self.post_get(url,data))
	if(result["result"]!=1):
		print result["error_msg"]
		return []
	result = result["user_cards"]
	print cn("共获取到 %d条 打卡操作"%(len(result)))
	return result
	
#给小树浇水，晒太阳，op=1时为浇树，op=2为晒阳光
def treeOp(self,op):
	url = "/v1/game/tree/op"
	data = {
		"access_token" : self.access_token,
		"app_key" : self.app_key,
		"op" : op
	} 
	result = eval(self.post_post(url,data))
	if(result["result"]!=1):
		return result["error_msg"]
	return cn("%s成功，我已连续浇树%d天，对方连续浇树%d天，小树等级：%d级，当前成长值:%d，升级还需要成长值：%d，小树留言板：'%s'")%(
			op==1 and cn("浇水") or cn("晒阳光"),
			result["lasting_days"],
			result["lover_lasting_days"],
			result["level"],
			result["level_growth"],
			result["next_stage_growth"],
			result["name"]
			)
			
#农场签到
def signin(self):
	url = "/v1/game/farm/signin"
	data = {
		"access_token" : self.access_token,
		"app_key" : self.app_key,
		"ph" : "farm"
	} 
	result = eval(self.post_post(url,data))
	if(result["result"]!=1):
		return result["error_msg"]
		
	messages = result["messages"][0]
	lasting_days = messages["lasting_days"] #连续经营时间 
	return cn("签到完成，连续经营时间：%d ") %(lasting_days)
	
#开宝箱
def openGiftBox(self):
	url = "/v1/game/farm/giftbox/open"
	data = {
		"access_token" : self.access_token,
		"app_key" : self.app_key,
		"rainbow_coin" : 0 ,
		"ph" : "farm"
	} 
	result = eval(self.post_post(url,data))
	if(result["result"]!=1):
		print result
		return result["error_msg"]
	print result

if(name == "main"):
print(cn("-->执行微爱签到打卡任务..."))
print(cn("\n-->执行打卡任务"))
welove = WeLove("","ac5f34563a4344c4")
punchList = welove.getPunchIndex()
for i in punchList:
print welove.punch(i)
print(cn("\n-->执行浇树任务"))
print welove.treeOp(1)
print welove.treeOp(2)
print(cn("\n-->执行农场签到"))
print welove.signin()

[zixing131]

另外，看了下md5的那个算法，可能是这个

public static C9409d m46162a() {
    String c = UserSpaceData.m42989a().mo55128c();
    String digest = MD5Utils.digest(c + WeloveK.SIG_SECRET);
    String deviceId = DeviceInfoUtil.getDeviceId(WeloveAppContext.m41093b().mo53325c());
    String macAddr = DeviceInfoUtil.getMacAddr(WeloveAppContext.m41093b().mo53325c());
    C9409d dVar = new C9409d();
    dVar.mo59935a(c);
    dVar.mo59936b(digest);
    dVar.mo59937c(UserAgentInfo.m45422g().mo59396a() + ResourceUtil.getAppVersionName());
    dVar.mo59938d(deviceId);
    dVar.mo59939e(macAddr);
    dVar.mo59940f(null);
    return dVar;
}

[zixing131]

accesstoken+“8b5b6eca8a9d1d1f”
然后求md5

[HikaruChang]

accesstoken+“8b5b6eca8a9d1d1f”
然后求md5

你看一下我上传的这个版本。
private boolean a(String paramString, byte[] paramArrayOfbyte1, byte[] paramArrayOfbyte2) {
if (TextUtils.isEmpty(paramString))
return false;
if (paramArrayOfbyte1 != null) {
if (paramArrayOfbyte1.length <= 0)
return false;
if (paramArrayOfbyte2 != null) {
if (paramArrayOfbyte2.length <= 0)
return false;
try {
X509EncodedKeySpec x509EncodedKeySpec = new X509EncodedKeySpec(Base64.decode(paramString, 0));
PublicKey publicKey = KeyFactory.getInstance("RSA").generatePublic(x509EncodedKeySpec);
Signature signature = Signature.getInstance("SHA256withRSA");
signature.initVerify(publicKey);
signature.update(paramArrayOfbyte1);
return signature.verify(paramArrayOfbyte2);
} catch (Exception exception) {
exception.printStackTrace();
}
}
}
return false;
}

似乎是这一段？

[zixing131]

accesstoken+“8b5b6eca8a9d1d1f”
然后求md5

你看一下我上传的这个版本。
private boolean a(String paramString, byte[] paramArrayOfbyte1, byte[] paramArrayOfbyte2) {
if (TextUtils.isEmpty(paramString))
return false;
if (paramArrayOfbyte1 != null) {
if (paramArrayOfbyte1.length <= 0)
return false;
if (paramArrayOfbyte2 != null) {
if (paramArrayOfbyte2.length <= 0)
return false;
try {
X509EncodedKeySpec x509EncodedKeySpec = new X509EncodedKeySpec(Base64.decode(paramString, 0));
PublicKey publicKey = KeyFactory.getInstance("RSA").generatePublic(x509EncodedKeySpec);
Signature signature = Signature.getInstance("SHA256withRSA");
signature.initVerify(publicKey);
signature.update(paramArrayOfbyte1);
return signature.verify(paramArrayOfbyte2);
} catch (Exception exception) {
exception.printStackTrace();
}
}
}
return false;
}

似乎是这一段？

也可能是这个RSA签名，不过我已经分手好多年了，很久没看过这个了

[HikaruChang]

accesstoken+“8b5b6eca8a9d1d1f”
然后求md5

你看一下我上传的这个版本。
private boolean a(String paramString, byte[] paramArrayOfbyte1, byte[] paramArrayOfbyte2) {
if (TextUtils.isEmpty(paramString))
return false;
if (paramArrayOfbyte1 != null) {
if (paramArrayOfbyte1.length <= 0)
return false;
if (paramArrayOfbyte2 != null) {
if (paramArrayOfbyte2.length <= 0)
return false;
try {
X509EncodedKeySpec x509EncodedKeySpec = new X509EncodedKeySpec(Base64.decode(paramString, 0));
PublicKey publicKey = KeyFactory.getInstance("RSA").generatePublic(x509EncodedKeySpec);
Signature signature = Signature.getInstance("SHA256withRSA");
signature.initVerify(publicKey);
signature.update(paramArrayOfbyte1);
return signature.verify(paramArrayOfbyte2);
} catch (Exception exception) {
exception.printStackTrace();
}
}
}
return false;
}
似乎是这一段？

也可能是这个RSA签名，不过我已经分手好多年了，很久没看过这个了

ORZ，我只是想研究研究TX的算法

[HikaruChang]

尴尬，我下错包了，因为没有Android手机，没法测apk包，结果看了一晚上发现，这玩意是应用宝（
以下为新版加密：

package com.welove520.welove.tools;

import java.io.UnsupportedEncodingException;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import javax.crypto.BadPaddingException;
import javax.crypto.Cipher;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.NoSuchPaddingException;
import javax.crypto.spec.SecretKeySpec;

public class EncryUtils {
private static final byte[] AES_KEY = new byte[] {
61, -3, 17, 56, -75, 118, -73, 41, 47, 73,
-55, -21, 35, -54, Byte.MIN_VALUE, -92 };

public static byte[] decrypt(byte[] paramArrayOfbyte) {
if (paramArrayOfbyte == null)
return null;
try {
SecretKeySpec secretKeySpec = new SecretKeySpec(AES_KEY, "AES");
Cipher cipher = Cipher.getInstance("AES");
cipher.init(2, secretKeySpec);
return cipher.doFinal(paramArrayOfbyte);
} catch (NoSuchAlgorithmException noSuchAlgorithmException) {
noSuchAlgorithmException.printStackTrace();
return null;
} catch (NoSuchPaddingException noSuchPaddingException) {
noSuchPaddingException.printStackTrace();
return null;
} catch (InvalidKeyException invalidKeyException) {
invalidKeyException.printStackTrace();
return null;
} catch (IllegalBlockSizeException illegalBlockSizeException) {
illegalBlockSizeException.printStackTrace();
return null;
} catch (BadPaddingException badPaddingException) {
badPaddingException.printStackTrace();
return null;
} catch (Exception exception) {
exception.printStackTrace();
return null;
}
}

public static byte[] encrypt(String paramString) {
if (paramString == null)
return null;
try {
SecretKeySpec secretKeySpec = new SecretKeySpec(AES_KEY, "AES");
Cipher cipher = Cipher.getInstance("AES");
null = paramString.getBytes("utf-8");
cipher.init(1, secretKeySpec);
return cipher.doFinal(null);
} catch (NoSuchAlgorithmException noSuchAlgorithmException) {
noSuchAlgorithmException.printStackTrace();
return null;
} catch (NoSuchPaddingException noSuchPaddingException) {
noSuchPaddingException.printStackTrace();
return null;
} catch (InvalidKeyException invalidKeyException) {
invalidKeyException.printStackTrace();
return null;
} catch (UnsupportedEncodingException unsupportedEncodingException) {
unsupportedEncodingException.printStackTrace();
return null;
} catch (IllegalBlockSizeException illegalBlockSizeException) {
illegalBlockSizeException.printStackTrace();
return null;
} catch (BadPaddingException badPaddingException) {
badPaddingException.printStackTrace();
return null;
} catch (Exception exception) {
exception.printStackTrace();
return null;
}
}

public static String parseByte2HexStr(byte[] paramArrayOfbyte) {
if (paramArrayOfbyte == null)
return null;
StringBuffer stringBuffer = new StringBuffer();
for (int i = 0; i < paramArrayOfbyte.length; i++) {
String str2 = Integer.toHexString(paramArrayOfbyte[i] & 0xFF);
String str1 = str2;
if (str2.length() == 1) {
StringBuilder stringBuilder = new StringBuilder();
stringBuilder.append('0');
stringBuilder.append(str2);
str1 = stringBuilder.toString();
}
stringBuffer.append(str1.toUpperCase());
}
return stringBuffer.toString();
}

public static byte[] parseHexStr2Byte(String paramString) {
if (paramString == null)
return null;
if (paramString.length() < 1)
return null;
byte[] arrayOfByte = new byte[paramString.length() / 2];
for (int i = 0; i < paramString.length() / 2; i++) {
int j = i * 2;
int k = j + 1;
arrayOfByte[i] = (byte)(Integer.parseInt(paramString.substring(j, k), 16) * 16 + Integer.parseInt(paramString.substring(k, j + 2), 16));
}
return arrayOfByte;
}
}

[zixing131]

尴尬，我下错包了，因为没有Android手机，没法测apk包，结果看了一晚上发现，这玩意是应用宝（
以下为新版加密：

package com.welove520.welove.tools;

import java.io.UnsupportedEncodingException;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import javax.crypto.BadPaddingException;
import javax.crypto.Cipher;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.NoSuchPaddingException;
import javax.crypto.spec.SecretKeySpec;

public class EncryUtils {
private static final byte[] AES_KEY = new byte[] {
61, -3, 17, 56, -75, 118, -73, 41, 47, 73,
-55, -21, 35, -54, Byte.MIN_VALUE, -92 };

public static byte[] decrypt(byte[] paramArrayOfbyte) {
if (paramArrayOfbyte == null)
return null;
try {
SecretKeySpec secretKeySpec = new SecretKeySpec(AES_KEY, "AES");
Cipher cipher = Cipher.getInstance("AES");
cipher.init(2, secretKeySpec);
return cipher.doFinal(paramArrayOfbyte);
} catch (NoSuchAlgorithmException noSuchAlgorithmException) {
noSuchAlgorithmException.printStackTrace();
return null;
} catch (NoSuchPaddingException noSuchPaddingException) {
noSuchPaddingException.printStackTrace();
return null;
} catch (InvalidKeyException invalidKeyException) {
invalidKeyException.printStackTrace();
return null;
} catch (IllegalBlockSizeException illegalBlockSizeException) {
illegalBlockSizeException.printStackTrace();
return null;
} catch (BadPaddingException badPaddingException) {
badPaddingException.printStackTrace();
return null;
} catch (Exception exception) {
exception.printStackTrace();
return null;
}
}

public static byte[] encrypt(String paramString) {
if (paramString == null)
return null;
try {
SecretKeySpec secretKeySpec = new SecretKeySpec(AES_KEY, "AES");
Cipher cipher = Cipher.getInstance("AES");
null = paramString.getBytes("utf-8");
cipher.init(1, secretKeySpec);
return cipher.doFinal(null);
} catch (NoSuchAlgorithmException noSuchAlgorithmException) {
noSuchAlgorithmException.printStackTrace();
return null;
} catch (NoSuchPaddingException noSuchPaddingException) {
noSuchPaddingException.printStackTrace();
return null;
} catch (InvalidKeyException invalidKeyException) {
invalidKeyException.printStackTrace();
return null;
} catch (UnsupportedEncodingException unsupportedEncodingException) {
unsupportedEncodingException.printStackTrace();
return null;
} catch (IllegalBlockSizeException illegalBlockSizeException) {
illegalBlockSizeException.printStackTrace();
return null;
} catch (BadPaddingException badPaddingException) {
badPaddingException.printStackTrace();
return null;
} catch (Exception exception) {
exception.printStackTrace();
return null;
}
}

public static String parseByte2HexStr(byte[] paramArrayOfbyte) {
if (paramArrayOfbyte == null)
return null;
StringBuffer stringBuffer = new StringBuffer();
for (int i = 0; i < paramArrayOfbyte.length; i++) {
String str2 = Integer.toHexString(paramArrayOfbyte[i] & 0xFF);
String str1 = str2;
if (str2.length() == 1) {
StringBuilder stringBuilder = new StringBuilder();
stringBuilder.append('0');
stringBuilder.append(str2);
str1 = stringBuilder.toString();
}
stringBuffer.append(str1.toUpperCase());
}
return stringBuffer.toString();
}

public static byte[] parseHexStr2Byte(String paramString) {
if (paramString == null)
return null;
if (paramString.length() < 1)
return null;
byte[] arrayOfByte = new byte[paramString.length() / 2];
for (int i = 0; i < paramString.length() / 2; i++) {
int j = i * 2;
int k = j + 1;
arrayOfByte[i] = (byte)(Integer.parseInt(paramString.substring(j, k), 16) * 16 + Integer.parseInt(paramString.substring(k, j + 2), 16));
}
return arrayOfByte;
}
}

这只是一个aes加密啊

[HikaruChang]

  public static byte[] getHMAC(String paramString1, String paramString2) {
    try {
      SecretKeySpec secretKeySpec = new SecretKeySpec(paramString1.getBytes(), "hmacmd5");
      Mac mac = Mac.getInstance("HmacSHA1");
      mac.init(secretKeySpec);
      mac.update(paramString2.getBytes());
      return mac.doFinal();
    } catch (Exception exception) {
      a.b(exception);
      return null;
    } 
  }