sun博客

记录点滴!

在使用sslunpin时,有的okhttp3被混淆导致无法查看抓包数据。此时可直接搜索okhttp3中的常量字符串,在反编译的代码中直接查找到目标包名

以下是查用常量字符串

must not have a request body.

“unexpected url: “

另外抓到包后,接口地址知道了,但在源码中搜索不到具体调用时,可以直接hook Request$Build中的url来实现,要快速找到url的代码,可直接搜索以下字符串快速定位。

throw new NullPointerException("url == null");

因为源码中url的代码:

 public Builder url(HttpUrl url) {
      if (url == null) throw new NullPointerException("url == null");
      this.url = url;
      return this;
    }

    /**
     * Sets the URL target of this request.
     *
     * @throws IllegalArgumentException if {@code url} is not a valid HTTP or HTTPS URL. Avoid this
     * exception by calling {@link HttpUrl#parse}; it returns null for invalid URLs.
     */
    public Builder url(String url) {
      if (url == null) throw new NullPointerException("url == null");

      // Silently replace web socket URLs with HTTP URLs.
      if (url.regionMatches(true, 0, "ws:", 0, 3)) {
        url = "http:" + url.substring(3);
      } else if (url.regionMatches(true, 0, "wss:", 0, 4)) {
        url = "https:" + url.substring(4);
      }

      HttpUrl parsed = HttpUrl.parse(url);
      if (parsed == null) throw new IllegalArgumentException("unexpected url: " + url);
      return url(parsed);
    }
function klog(data){
    var message={};
    // @ts-ignore
    message["jsname"]="javaEnc";
    // @ts-ignore
    message["data"]=data;
    console.log(JSON.stringify(message));
}
function showStacks(strstr="") {
    console.log("enter...")
    var Exception = Java.use("java.lang.Exception");
    var ins = Exception.$new("Exception");
    var straces = ins.getStackTrace();

    if (undefined == straces || null == straces) {
        return;
    }

    klog(strstr+"============================= Stack strat=======================");
    klog("");

    for (var i = 0; i < straces.length; i++) {
        var str = "   " + straces[i].toString();
        klog(str);
    }
    klog(strstr+"============================= Stack end=======================\r\n");
    Exception.$dispose();
}
function hookOkhttp3Url(url){
    var ok3Request = Java.use('okhttp3.Request$Builder');

    ok3Request.url.overload('java.lang.String').implementation = function(str) {
        console.log("url",str)
        if (str.indexOf(url) >= 0) {
            console.log("HttpClient.getHttpClient:", str)
            showStacks()
        }
        return this.url(str)
    }
}

okhttp3其实挺简单,主要就2个类,一个 OkHttpClient ,一个Request类, OkHttpClient 创建客户端client,client再调用newCall将请求request发出。同步就用execute() 拿到respond,异步就用enqueue。其发送主要还是在Request类中。

另外,接口请求body经常有加密,去拿到接口加密的代码位置也许可以通过hook post试试。

import okhttp3.*;

import java.io.IOException;

public class OkHttpPostExample {
    public static void main(String[] args) {
        OkHttpClient client = new OkHttpClient();

        // 构建请求体
        MediaType mediaType = MediaType.parse("application/json");
        String jsonBody = "{\"key1\": \"value1\", \"key2\": \"value2\"}";
        RequestBody requestBody = RequestBody.create(jsonBody, mediaType);

        // 构建请求
        Request request = new Request.Builder()
                .url("https://api.example.com/postEndpoint")
                .post(requestBody)
                .build();

        // 发送请求
        try {
            Response response = client.newCall(request).execute();
            if (response.isSuccessful()) {
                String responseBody = response.body().string();
                System.out.println("Response body: " + responseBody);
            } else {
                System.out.println("Request failed: " + response.code() + " - " + response.message());
            }
        } catch (IOException e) {
            System.err.println("Error while making the request: " + e.getMessage());
        }
    }
}

发表评论

邮箱地址不会被公开。 必填项已用*标注