{ "version": "https://jsonfeed.org/version/1", "title": "做个俗人 贪财好色", "subtitle": null, "icon": "https://winston950213.github.io/images/favicon.ico", "description": "终是庄周梦了蝶 亦是情缘亦是劫", "home_page_url": "https://winston950213.github.io", "items": [ { "id": "https://winston950213.github.io/2022/11/04/%E6%AD%A3%E5%88%99%E8%A1%A8%E8%BE%BE%E5%BC%8F%E5%8F%8D%E9%80%89/", "url": "https://winston950213.github.io/2022/11/04/%E6%AD%A3%E5%88%99%E8%A1%A8%E8%BE%BE%E5%BC%8F%E5%8F%8D%E9%80%89/", "title": "正则表达式反选", "date_published": "2022-11-04T06:49:43.000Z", "content_html": "

正则表达式骚操作之反选

\n

\n

# search 函数判断是否为 None

\n\n
bool(re.search(\"hi\", \"abcdefghijkl\"))
True
bool(re.search(\"hi\", \"abcdefgijkl\"))
False
# 正则表达式反选
\n
示例：
\n
需要匹配出来 h1 标签 ps: 在实际开发中使用 h1 直接匹配太繁琐 so: 使用？！进行反选
\n <(?!div).\\*?text-align: center.\\*?/(?!div).\\*?>
\n",
            "tags": [
                "操作备忘",
                "tips",
                "正则"
            ]
        },
        {
            "id": "https://winston950213.github.io/2022/11/04/git%E6%8A%A5%E9%94%99%EF%BC%9A-fatal-remote-origin-already-exists/",
            "url": "https://winston950213.github.io/2022/11/04/git%E6%8A%A5%E9%94%99%EF%BC%9A-fatal-remote-origin-already-exists/",
            "title": "git报错：'fatal:remote origin already exists'",
            "date_published": "2022-11-04T06:47:04.000Z",
            "content_html": "
只要两步，解决  fatal:remote origin already exists
\n
\n
    \n
  1. 先删除
    \n $ git remote rm origin
    2. \n
  2. 重新添加
    \n git remote add origin git@github.com:username/repostery.git //关联本地仓库，远程库的名字为origin
    3. \n
\n",
            "tags": [
                "操作备忘",
                "bug",
                "git"
            ]
        },
        {
            "id": "https://winston950213.github.io/2022/11/04/win10%E5%AE%89%E8%A3%85mitmproxy%E6%8A%A5%E9%94%99-Failed-building-wheel-for-brotlipy/",
            "url": "https://winston950213.github.io/2022/11/04/win10%E5%AE%89%E8%A3%85mitmproxy%E6%8A%A5%E9%94%99-Failed-building-wheel-for-brotlipy/",
            "title": "win10安装mitmproxy报错'Failed building wheel for brotlipy'",
            "date_published": "2022-11-04T06:43:19.000Z",
            "content_html": "
缺什么装什么
\n
\n
到这个网址下载 whl 文件，带路径安装
\n
Unofficial Windows Binaries for Python Extension Packages
\n
pip install xxx.whl
\n",
            "tags": [
                "操作备忘",
                "bug",
                "mitmproxy"
            ]
        },
        {
            "id": "https://winston950213.github.io/2022/11/04/win10%E5%AE%89%E8%A3%85mitmproxy%EF%BC%8C%E6%88%90%E5%8A%9F%E4%B9%8B%E5%90%8E%E8%AE%BF%E9%97%AEmitm-it%E5%87%BA%E7%8E%B0%E4%B8%8D%E4%BA%86%E4%B8%8B%E8%BD%BD%E8%AF%81%E4%B9%A6%E9%A1%B5%E9%9D%A2/",
            "url": "https://winston950213.github.io/2022/11/04/win10%E5%AE%89%E8%A3%85mitmproxy%EF%BC%8C%E6%88%90%E5%8A%9F%E4%B9%8B%E5%90%8E%E8%AE%BF%E9%97%AEmitm-it%E5%87%BA%E7%8E%B0%E4%B8%8D%E4%BA%86%E4%B8%8B%E8%BD%BD%E8%AF%81%E4%B9%A6%E9%A1%B5%E9%9D%A2/",
            "title": "win10安装mitmproxy，成功之后访问mitm.it出现不了下载证书页面",
            "date_published": "2022-11-04T06:41:09.000Z",
            "content_html": "
浏览器代理老问题
\n
\n
# 错误重现
\n
所有都安装好之后，各种检测都通过时候依旧出现不了证书下载页面。
\n
此时检测一下浏览器或者计算机是否使用了代理【我就是因为使用了谷歌上网助手而导致不成功的 =-=】
\n
# 解决方法
\n
关闭所有代理工具，使用系统代理
\n
# 插件推荐
\n
使用 SwitchyOmega 是所有流量切换到固定端口，监听此端口
\n
SwitchyOmega: 一个强大的代理切换工具 (官方自述)
\n",
            "tags": [
                "操作备忘",
                "bug",
                "mitmproxy",
                "代理",
                "证书"
            ]
        },
        {
            "id": "https://winston950213.github.io/2022/11/04/Ubuntu%E5%AE%89%E8%A3%85curl%E6%8A%A5%E9%94%99%EF%BC%9A%E8%BD%AF%E4%BB%B6%E5%8C%85%E6%9C%89%E6%9C%AA%E6%BB%A1%E8%B6%B3%E7%9A%84%E4%BE%9D%E8%B5%96%E5%85%B3%E7%B3%BB%EF%BC%9A-curl-%E4%BE%9D%E8%B5%96-libcurl4-7-58-0-2ubuntu3-10/",
            "url": "https://winston950213.github.io/2022/11/04/Ubuntu%E5%AE%89%E8%A3%85curl%E6%8A%A5%E9%94%99%EF%BC%9A%E8%BD%AF%E4%BB%B6%E5%8C%85%E6%9C%89%E6%9C%AA%E6%BB%A1%E8%B6%B3%E7%9A%84%E4%BE%9D%E8%B5%96%E5%85%B3%E7%B3%BB%EF%BC%9A-curl-%E4%BE%9D%E8%B5%96-libcurl4-7-58-0-2ubuntu3-10/",
            "title": "Ubuntu安装curl报错：软件包有未满足的依赖关系： curl : 依赖: libcurl4 (= 7.58.0-2ubuntu3.10)",
            "date_published": "2022-11-04T06:39:03.000Z",
            "content_html": "
依赖关系错误的老问题了
\n
\n
# 错误重现
\n
执行  sudo apt install curl 
\n 下列软件包有未满足的依赖关系：
\ncurl : 依赖: libcurl4 (= 7.58.0-2ubuntu3.10) 但是 7.68.0-1ubuntu2.1 正要被安装
\n E: 无法修正错误，因为您要求某些软件包保持现状，就是它们破坏了软件包间的依赖关系。
\n
# 解决方法
\n
依次执行:
\n
    \n
  1. apt-get purge libcurl4
    2. \n
  2. apt-get install curl
    3. \n
\n",
            "tags": [
                "操作备忘",
                "bug",
                "ubuntu"
            ]
        },
        {
            "id": "https://winston950213.github.io/2022/11/04/linux-ubuntu-pip3-list-%E5%87%BA%E7%8E%B0%E8%AD%A6%E5%91%8A/",
            "url": "https://winston950213.github.io/2022/11/04/linux-ubuntu-pip3-list-%E5%87%BA%E7%8E%B0%E8%AD%A6%E5%91%8A/",
            "title": "linux ubuntu pip3 list 出现警告",
            "date_published": "2022-11-04T06:37:05.000Z",
            "content_html": "
# 错误重现
\n
\n
 执行pip3 list后出现\n
\n
DEPRECATION: The default format will switch to columns in the future. You can use --format=(legacy|columns) (or define a format=(legacy|columns) in your pip.conf under the [list] section) to disable this warning.
\n
# 解决方法
\n
    \n
  1. 在  /etc  下新建  pip.conf  :
    \n sudo nano /etc/pip.conf
    2. \n
  2. 写入
    \n [list] format=columns 
    \n ctrl x  Y 保存
    3. \n
  3. 再次执行  pip3 lsit
    4. \n
\n",
            "tags": [
                "操作备忘",
                "bug",
                "ubuntu"
            ]
        },
        {
            "id": "https://winston950213.github.io/2022/11/04/Command-python-setup-py-egg-info-failed-with-error-code-1-in-tmp-pip-build-thtq7d55-frida/",
            "url": "https://winston950213.github.io/2022/11/04/Command-python-setup-py-egg-info-failed-with-error-code-1-in-tmp-pip-build-thtq7d55-frida/",
            "title": "Command 'python setup.py egg_info' failed with error code 1 in /tmp/pip-build-thtq7d55/frida/",
            "date_published": "2022-11-04T06:33:38.000Z",
            "content_html": "
另一种方法解决 Command "python setup.py egg_info" failed with error code 1 in /tmp/pip-build-thtq7d55/frida/
\n
\n
# 错误重现
\n\n
# 解决方法
\n\n",
            "tags": [
                "操作备忘",
                "python",
                "bug"
            ]
        },
        {
            "id": "https://winston950213.github.io/2022/11/04/Ubuntu%E6%8D%A2%E6%BA%90/",
            "url": "https://winston950213.github.io/2022/11/04/Ubuntu%E6%8D%A2%E6%BA%90/",
            "title": "Ubuntu换源",
            "date_published": "2022-11-04T06:26:26.000Z",
            "content_html": "
在使用 ububtu 的时候免不了切换安装源，网上其他的文本复制总会出现一些或大或小的问题，这里我以清华源为例
\n
\n
    \n
  1. 进入官方帮助 https://mirror.tuna.tsinghua.edu.cn/help/ubuntu/
    2. \n
  2. 选择你想要的版本
    3. \n
  3. 复制粘贴，解决问题
    4. \n
\n",
            "tags": [
                "操作备忘",
                "tips"
            ]
        },
        {
            "id": "https://winston950213.github.io/2022/11/04/Kali-Linux-Failed-to-launch-preferred-application-for-category-TerminalEmulator-and-all-files-missing/",
            "url": "https://winston950213.github.io/2022/11/04/Kali-Linux-Failed-to-launch-preferred-application-for-category-TerminalEmulator-and-all-files-missing/",
            "title": "Kali Linux Failed to launch preferred application for category 'TerminalEmulator' and all files missing",
            "date_published": "2022-11-04T06:23:46.000Z",
            "content_html": "
I had a similar problem today. Installed Kali 2020.4 64-bit and ran sudo apt update && sudo apt upgrade as you described. Rebooted the system and was unable to open terminal or browse files (I only tried via the "Home" folder on the desktop).
\n
\n
I was still able to open QTerminal directly from the application menu to run commands. I was able to fix this by running the following. Hopefully this works for you.
\n
sudo apt update
sudo apt upgrade
This returned a list of packages that "were automatically installed and are no longer required:" Remove these packages with the below command.
\n
sudo apt autoremove 
\nReboot. Then run  sudo apt update && sudo apt upgrade  again. The following packages were required. Reboot again and terminal/file browsing should be working as expected.
\n
I suspect one specific package "xfce4-helpers" is causing the issue. I'm new to Linux so not sure of the cause (hopefully someone can elaborate).
\n
After completing the above steps, run  sudo apt-get install xfce4-helpers  .
\n
After doing the above
\n\n",
            "tags": [
                "操作备忘",
                "bug",
                "kali"
            ]
        },
        {
            "id": "https://winston950213.github.io/2022/11/04/E-Unable-to-locate-package-neofetch/",
            "url": "https://winston950213.github.io/2022/11/04/E-Unable-to-locate-package-neofetch/",
            "title": "E: Unable to locate package neofetch",
            "date_published": "2022-11-04T06:15:26.000Z",
            "content_html": "
ubuntu16.04 在安装  neofetch  的时候会遇到  E: Unable to locate package neofetch  , 这里提供一种解决方式
\n
\n\n
\n
来自一篇 16 年的文章:
\n 原文指路 ==> https://my.oschina.net/liuyuantao/blog/800375
\n
\n",
            "tags": [
                "操作备忘",
                "bug",
                "ubuntu"
            ]
        },
        {
            "id": "https://winston950213.github.io/2022/11/02/%E7%BD%91%E5%9D%80%E5%A4%87%E5%BF%98/",
            "url": "https://winston950213.github.io/2022/11/02/%E7%BD%91%E5%9D%80%E5%A4%87%E5%BF%98/",
            "title": "网址备忘",
            "date_published": "2022-11-02T06:07:40.000Z",
            "content_html": "
常用的网址备忘
\n
\n\n",
            "tags": [
                "操作备忘",
                "工具",
                "网址",
                "备忘"
            ]
        },
        {
            "id": "https://winston950213.github.io/2022/11/01/python%E5%A4%9A%E7%BA%BF%E7%A8%8B%E5%AD%A6%E4%B9%A0/",
            "url": "https://winston950213.github.io/2022/11/01/python%E5%A4%9A%E7%BA%BF%E7%A8%8B%E5%AD%A6%E4%B9%A0/",
            "title": "python多线程学习",
            "date_published": "2022-10-31T08:53:01.000Z",
            "content_html": "
python 多线程一点研究，有待深入
\n
\n
# 线程模块
\n
在 Python3 通过两个标准库 _thread 和 threading 提供对线程的支持。
\n\n
# 创建线程
\n
    \n
  1. 方法一:
    2. \n
\n
# 使用函数的方式创建
 import threading
 import time
 def func(arg):
     time.sleep(1)
     print('thread '+str(arg)+\" running....\")
 if __name__ == '__main__':
     for i in range(10):
         t = threading.Thread(target=func, args=(i,))
         t.start()
    \n
  1. 方法二:
    2. \n
\n
# 使用继承 Thread 类的方式创建
import threading
class MyThread(threading.Thread):
    def __init__(self, thread_name):
        # 注意：一定要显式的调用父类的初始化函数。
        super(MyThread, self).__init__(name=thread_name)
    def run(self):
        print(\"%s正在运行中......\" % self.name)
if __name__ == '__main__':
    for i in range(10):
        MyThread(\"thread-\" + str(i)).start() #此行代码也可分开写，先创建 MyThread 对象，在调用 start 方法
# 疑惑
\n
    \n
  1. \n
    start  和  join  干了什么？
    \n
    ctrl  + 左键点击进去 start 源码看到注释:
    \n
    2. \n
\n
\"\"\"Start the thread's activity.
    It must be called at most once per thread object. It arranges for the
    object's run() method to be invoked in a separate thread of control.
    This method will raise a RuntimeError if called more than once on the
    same thread object.
\"\"\"
简单来说就是激活一个线程，在 run () 方法之后被独立调用，重复调用会抛出  RuntimeError
\n
\"\"\"Wait until the thread terminates.
    This blocks the calling thread until the thread whose join() method is
    called terminates -- either normally or through an unhandled exception
    or until the optional timeout occurs.
    When the timeout argument is present and not None, it should be a
    floating point number specifying a timeout for the operation in seconds
    (or fractions thereof). As join() always returns None, you must call
    is_alive() after join() to decide whether a timeout happened -- if the
    thread is still alive, the join() call timed out.
    When the timeout argument is not present or None, the operation will
    block until the thread terminates.
    A thread can be join()ed many times.
    join() raises a RuntimeError if an attempt is made to join the current
    thread as that would cause a deadlock. It is also an error to join() a
    thread before it has been started and attempts to do so raises the same
    exception.
    \"\"\"
join () 会一直等待知道所有线程结束
\n就方法一中的代码如果直接在 for 循环中加入 join 的话会导致执行时间为 10s
\n
正确做法:
\n
import threading
import time
def func(arg):
    time.sleep(1)
    print('thread '+str(arg)+\" running....\")
if __name__ == '__main__':
    start = time.time()
    threads = []
    for i in range(10):
        t = threading.Thread(target=func, args=(i,))
        threads.append(t)
    for t in threads:
        t.start()
    for t in threads:
        t.join()
    print(time.time() - start)
    \n
  1. 同时写入多个文件
    2. \n
\n
import threading
import time
def func_fs(name):
    with open(f\"{name}.txt\", \"w\") as target:
        time.sleep(5) # 假装写入很久
        target.write(\"这是一段很长的文本\")
if __name__ == \"__main__\":
    start = time.time()
    l_thread = []
    for i in range(2):
        t = threading.Thread(target=func_fs, args=(i,))
        l_thread.append(t)
    for t in l_thread:
        t.start()
    for t in l_thread:
        t.join()
    print(time.time() - start)
# Todo
\n\n
# 参考链接:
\n
threading
\n
_thread
\n",
            "tags": [
                "编程语言",
                "python",
                "多线程"
            ]
        },
        {
            "id": "https://winston950213.github.io/2022/11/01/python%E4%B8%BA%E8%A7%86%E9%A2%91%E6%B7%BB%E5%8A%A0%E6%B0%B4%E5%8D%B0/",
            "url": "https://winston950213.github.io/2022/11/01/python%E4%B8%BA%E8%A7%86%E9%A2%91%E6%B7%BB%E5%8A%A0%E6%B0%B4%E5%8D%B0/",
            "title": "python为视频添加水印",
            "date_published": "2022-10-31T08:50:08.000Z",
            "content_html": "
python 去水印
\n
\n
# 环境配置
\n
笔者环境：win10 专业版， python3.8.0
\n\n
    \n
  1. pip install ez_setup
    2. \n
  2. pip install moviepy
    3. \n
\n
# 添加图片水印
\n
import moviepy.editor as mp
#本地视频位置
video = mp.VideoFileClip(r\"D:\\resource\\myresource\\4393644710024974337.mp4\")
#准备log图片
logo = (mp.ImageClip(r\"C:\\Users\\zrail\\Downloads\\touxiang.jpeg\")
        .set_duration(video.duration) # 水印持续时间
        .resize(height=100) # 水印的高度，会等比缩放
        .margin(right=8, top=8, opacity=1) # 水印边距和透明度
        .set_pos((\"left\",\"center\"))) # 水印的位置
final = mp.CompositeVideoClip([video, logo])
# mp4文件默认用libx264编码， 比特率单位bps
final.write_videofile(\"test.mp4\", codec=\"libx264\", bitrate=\"10000000\")
# 报错
\n
    \n
  1. RuntimeError: The current Numpy installation ('C:\\\\Users\\\\zrail\\\\.conda\\\\envs\\\\py380\\\\lib\\\\site-packages\\\\numpy\\\\__init__.py') fails to pass a sanity check due to a bug in the windows runtime. See this issue for more information: https://tinyurl.com/y3dm3h86
    2. \n
\n\n
# 添加文字水印
\n
# -*- coding: utf-8 -*-
from moviepy.editor import VideoFileClip,CompositeVideoClip
#本地视频位置
from moviepy.video.VideoClip import TextClip
#subclip视频截取开始时间和结束时间
video = VideoFileClip(r\"D:\\resource\\myresource\\4393644710024974337.mp4\").subclip(0,1)
#制作文字，指定文字大小和颜色
txt_clip = ( TextClip(\"zxl shuiyin\",fontsize=30,color='red')
             .set_position('center')#水印内容居中
             .set_duration(1) )#水印持续时间
result = CompositeVideoClip([video, txt_clip]) #在视频上覆盖文本
result.write_videofile(\"tttttest.mp4\",fps=25)#fps:视频文件中每秒的帧数
# 报错
\n
    \n
  1. `OSError: MoviePy Error: creation of None failed because of the following error:
    2. \n
\n
[WinError 2] 系统找不到指定的文件。.
\n
.This error can be due to the fact that ImageMagick is not installed on your computer, or (for Windows users) that you didn't specify the path to the ImageMagick binary in file conf.py, or that the path you specified is incorrect`
\n\n
\n
具体没有仔细研究，水印的各种细节有待处理，这里只是抛砖引玉。剩下的靠大家了
\n
\n",
            "tags": [
                "操作备忘",
                "python",
                "水印"
            ]
        },
        {
            "id": "https://winston950213.github.io/2021/05/23/%E6%8A%93%E5%8C%85%E6%80%BB%E7%BB%93%E8%AE%B0%E5%BD%95/",
            "url": "https://winston950213.github.io/2021/05/23/%E6%8A%93%E5%8C%85%E6%80%BB%E7%BB%93%E8%AE%B0%E5%BD%95/",
            "title": "抓包总结记录",
            "date_published": "2021-05-23T04:50:13.000Z",
            "content_html": "
逆向学习中抓包的一点总结记录
\n
\n
# 计算机网络基础
\n
\n
互联网所有的数据都是基于网络传输，所以懂点网络在逆向过程中也是必不可少的
\n
\n\n
\n
OSI 网络模型 和 TCP/IP 模型的对比
\n
\n
\"文章插图\"
\n
\n
读完 图解 HTTP 的一点碎碎念
\n
\n\n
# 基于工具的抓包
\n
# charles + 系统代理
\n
\n
很早期的做法，但是随着 android7 以上不信任系统证书和检测手段增多现在不推荐这种抓包方式
\n
从 OSI 模型理解，修改系统代理的抓包方式，代理存在于应用层，而使用 VPN 转发的方式抓包在网络层。代理的位置更加底层，更难防护
\n
\n
# charles + VPN 代理工具
\n
\n
VPN 代理工具有很多，比如 Brook, postern, proxyDaivd, drony
\n
笔者使用的是 postern, 觉得不怎么好，但是其他的用的也不怎么样好，相对之下选了一个相对好的就一直用了
\n
\n
# 抓包环境搭建
\n
    \n
  1. \n
    charles 安装与配置 [破解可耻，支持正版]
    \n
      \n
    1. 官网下载最新版:https://www.charlesproxy.com/assets/release/4.6.1/charles-proxy-4.6.1_amd64.tar.gz 解压即可使用
      2. \n
    2. 破解 (行为可耻，请勿模仿):\n
        \n
      • 在 https://www.charles.ren/ 填写 Registered Name, 并生成授权码
        • \n
      • \"文章插图\"
        • \n
      • \"文章插图\"
        • \n
      \n
      3. \n
    \n
    2. \n
  2. \n
    postern 安装与配置
    \n
      \n
    1. 谷歌下载 postern
      2. \n
    2. \"文章插图\"
      3. \n
    3. \"文章插图\"
      4. \n
    4. \"文章插图\"
      5. \n
    \n
    3. \n
  3. \n
    证书安装
    \n
      \n
    1. charles 将证书导出到 PC, 导出为 pem 格式
      2. \n
    2. 计算文件名，文件名是一个 Hash 值，而后缀是一个数字。后缀名的数字是为了防止文件名冲突的，比如如果两个证书算出的 Hash 值是一样的话，那么一个证书的后缀名数字可以设置成 0，而另一个证书的后缀名数字可以设置成 1
      3. \n
    \n
    4. \n
\n
openssl x509 -subject_hash_old -in <Certificate_File>
    \n
  1. \n
    修改证书名称
    \n
    2. \n
  2. \n
    复制证书到设备上
    \n
    \n
    复制到系统目录并修改权限（安卓 8.1.0 Magisk Root）
    \n
    \n
    3. \n
\n
adb push xxxxxxx.0 /sdcard/
mount -o rw,remount /system 【不修改 没法写入】
mount -o rw,remount /
mv /sdcard/xxxxxxx.0 /etc/security/cacerts/ 移动文件到系统
chown root:root /etc/security/cacerts/xxxxxx.0 修改用户组
chmod 644 /system/etc/security/cacerts/xxxxxxx.0 修改权限
    \n
  1. \n
    重启手机验证
    \n
    reboot
    \n
    —by:r0syue
    \n
    2. \n
\n
\n
由于证书先安装到用户目录再移动到系统目录这样的操作会被 app 将此证书拉黑，如果曾经有过此操作最好先刷机在移动证书.
\n
\n
\n
openssl x509 -subject_hash_old -in  <Certificate_File>报错 ：PEM routines:get_name:no start line:crypto\\pem\\pem_lib.c:745:Expecting: TRUSTED CERTIFICATE
\n
解决办法：使用这个命令  openssl x509 -subject_hash_old -in <Certificate_File> -inform der  by: 嘴强王者
\n系统证书目录：  /system/etc/security/cacerts/
\n
\n
# HttpCany/Packet Capture
\n
\n
基于安卓手机。优点的话那就是省事。缺点的话可能是屏幕小
\n
\n
# Wireshark
\n
\n
https://book.douban.com/subject/21691692/
\n
\n
# tcpdump
\n
\n
https://juejin.cn/post/6844904084168769549
\n
\n
# 对抗
\n
# 证书
\n
# 证书锁定
\n
\n
在代码中指定证书 hash 值
\n
\n
# 反证书锁定
\n
    \n
  1. \n
    服务端校验客户端证书
    \n
      \n
    1. \n
      使用 objection 自带命令
      \n
      android sslpinning disable
      \n
      \"文章插图\"
      \n
      2. \n
    2. \n
      使用瘦蛟舞大佬的 DroidSSLUnpinning
      \nhttps://github.com/WooyunDota/DroidSSLUnpinning
      \n
      3. \n
    3. \n
      使用  JustTrustMe  , 当然了珍惜大佬的升级版本也可以
      \n
        \n
      • 原版: https://github.com/Fuzion24/JustTrustMe
        • \n
      • 升级版: https://github.com/w296488320/XposedOkHttpCat/tree/master/justTrustMePlush
        • \n
      • 分析文章: https://bbs.pediy.com/thread-254114.htm
        • \n
      \n
      4. \n
    4. \n
      自己分析 hook 点，去过掉证书锁定
      \n
        \n
      1. java.io.File
        2. \n
      2. java.security.KeyStore
        3. \n
      3. ...
        4. \n
      \n
      5. \n
    \n
    2. \n
  2. \n
    客户端校验服务端
    \n
    未完待续...
    \n
    3. \n
  3. \n
    双向验证
    \n
    \n
    典型的双向验证 Soul 分析，===> soul 双向证书破解
    \n
    \n
    未完待续...
    \n
    4. \n
\n
# 检测系统代理
\n
System.getProperty(“http.proxyHost”);
System.getProperty(“http.proxyPort”);
# 反系统代理检测
\n
\n
不使用系统代理的方式抓包，使用 VPN 代理方式
\n
\n
# 检测 VPN
\n
java.net.NetworkInterface.getName()
android.net.ConnectivityManager.getNetworkCapabilities()
# 反 VPN 检测
\n
\n
分析 app,hook 掉检测
\n
\n
\n
实战秀动 APP
\n
https://mp.weixin.qq.com/s/UixExZkPWHJAT3jAD2sJJg
\n
\n
\n\n
Java.perform(
    function () {
        var ConnectivityManager = Java.use(\"android.net.ConnectivityManager\");
        ConnectivityManager.getActiveNetwork.implementation = function () {
            var Integer = Java.use(\"android.net.Network\")
            var r1 = Integer.$new(100)
            var result = this.getActiveNetwork();
            console.log(\"result is => \", result);
            return r1;
        }
    }
)
\"文章插图\"
\n
# 文章收藏
\n
https://www.anquanke.com/post/id/197657
\n
https://mp.weixin.qq.com/s/UixExZkPWHJAT3jAD2sJJg
\n
https://www.jianshu.com/p/2476c8858daf
\n
https://api-caller.com/2019/11/05/capture-note/
\n
# hook 抓包
\n
\n
这个仁者见仁智者见智，方法不尽相同，记录几个小工具，方便抄袭
\n
\n\n
# 对抗
\n\n
# 抓包骚操作
\n\n",
            "tags": [
                "逆向学习",
                "逆向",
                "安卓",
                "Frida",
                "抓包"
            ]
        },
        {
            "id": "https://winston950213.github.io/2021/05/19/%E5%86%8D%E8%AF%BB-%E5%9B%BE%E8%A7%A3HTTP/",
            "url": "https://winston950213.github.io/2021/05/19/%E5%86%8D%E8%AF%BB-%E5%9B%BE%E8%A7%A3HTTP/",
            "title": "再读[图解HTTP]",
            "date_published": "2021-05-18T15:27:53.000Z",
            "content_html": "
总的来说，这本书就好像是一本介绍 http 协议的发展史和一些基本的概念，基本没有很晦涩的概念
\n
\n
# 网络基础
\n
# TCP/IP 协议簇
\n\n
\"文章插图\"
\n\n
\"文章插图\"
\n
\n
TCP/IP 的模型是分为四层，OSI 网络模型是七层，不过有的人也分为五层
\n
\n
\"文章插图\"
\n\n
\n
在第三次握手的时候是可以传输数据的
\n
\n
\"文章插图\"
\n
# HTTP 协议
\n\n
# HTTP 报文信息
\n
\n
这章感觉没什么实质的东西，主要就是编码，压缩和报文字段的解释
\n
\n
http 报文头各字段详细含义
\n
# HTTP 状态码
\n
\n
约定俗成的规矩，不遵守也没事.
\n
\n
\"文章插图\"
\n
# HTTP 协议与 WEB 服务器
\n\n
# HTTP 首部
\n
\n
都是一些常见的首部，不常见的用的也不多
\n
\n
# HTTPS
\n
\n
HTTPS  就是 披着 SSL 外壳的 HTTP
\n
\n\n
# 通信中用户身份的认证
\n
\n
感觉现在大多是表单认证了，其他不是很多
\n
\n\n
# 基于 HTTP 协议的追加协议
\n
\n
随着时代的发展，人们对网络传输的要求越来越高，于是诞生了许多解决 HTTP 协议痛点的追加协议
\n
\n\n
# 构建 WEB 内容技术
\n\n
# WEB 攻击技术
\n
\n
参考资料
\n
\n
    \n
  1. <<图解 HTTP>>
    2. \n
  2. OSI 七层模型和 TCP/IP 四层模型以及五层模型
    3. \n
  3. 看懂 HTTPS、证书机构（CA）、证书、数字签名、私钥、公钥
    4. \n
  4. “三次握手，四次挥手” 你真的懂吗？
    5. \n
\n",
            "tags": [
                "读书笔记",
                "网络",
                "基础"
            ]
        },
        {
            "id": "https://winston950213.github.io/2021/05/10/%E6%A8%B1%E8%8A%B1/",
            "url": "https://winston950213.github.io/2021/05/10/%E6%A8%B1%E8%8A%B1/",
            "title": "樱花",
            "date_published": "2021-05-10T01:12:53.000Z",
            "content_html": "
实战樱花 app, 难度：有手就行，参数：请求  req
\n
\n
# 抓包
\n
安装好之后先抓包，这次使用的是小黄鸟 + pixel
\n
\n
由于之前在 N5x 上面小黄鸟打开抓包之后 VPN 图标并不能正常出现，这次换了一个版本好了，就可以用了 (孕气好)
\n
\n
\"文章插图\"
\n
通过抓包可以看到服务器地址为:  http://vip.yinlu.online/v1/svc/sms
\n
参数:  req=5rbFBgelHwvqcXtwsVAfWiMkqJ1cXwuEGEZmyEgOFjrmxVGEMK5jsTYpH1MHbo3yiPMCrO4J8OFeEw7HJyIH0qewUwcbSbH9fJ4N+Yz5ihb9cfCfFT8wnD+GOVy6x6ltWOVHjBNwwOqEzMTbDIFG0rD6CSwwwQBgteVJGiu7iRimwhkILBODqrqqgmmBTrKp0TxdgiLSwRbB6mXJhFItE1VXLhNlhZgbIz1L3DyN4gSmfPjXi79RkZTEqm8wE/wgZ0V4OVElEPWb7B6AA5MrVYWlbjse9Ht85SuLnUFYU1EqAPDq8/T52y6q5rtem1fP3n6Nq/HIU80z52ift5bibQdHDm/Vb3P0wm0hKnFk4UP5/dCZmUPbbSKKbQJQLslRL5vwjYEf7My2QDYysyeidd/ZlfsoF1K3ryB3jv/fg+3J+2XURyyB2eh9WbouB9T0kwYzvXts/jJmlH8HE5ZVCA==
\n
# 参数分析
\n
使用 jadx 打开 apk, 可以看到只是混淆了并没有加壳，搜索  v1/svc/sms  可知:
\n
\"文章插图\"
\n
点进去可以看到下面有个 code get , 然后右键  Find usage  , 只有两个结果看看就看到结果了
\n
\"文章插图\"
\n
使用 objection 快速验证  e.h.a.f.h.e  为收集参数值，在查看  com.dasc.base_self_innovate.base_network.NetWorkStringUtil  为调用加解密.
\n
\"文章插图\"
\n
\"文章插图\"
\n
不继续分析了，其中有个  sign  , 其实静态分析一下就行.
\n",
            "tags": [
                "逆向学习",
                "逆向",
                "安卓",
                "Frida",
                "抓包"
            ]
        },
        {
            "id": "https://winston950213.github.io/2021/05/07/%E7%A7%BB%E5%8A%A8TV/",
            "url": "https://winston950213.github.io/2021/05/07/%E7%A7%BB%E5%8A%A8TV/",
            "title": "移动TV",
            "date_published": "2021-05-06T20:22:10.000Z",
            "content_html": "
实战移动 TV, 只分析了登录注册
\n
\n
\n
更多详细内容可以参考指纹大佬的文章 ===> https://bbs.pediy.com/thread-258776.htm
\n
\n
# 抓包
\n
指纹大佬文章说的抓不到包于是就上了 hook 抓包，hook 抓包是可以的，但是也可以使用  postern + charles  , 在抓包这里没必要纠结太久 (-- 珍惜大佬), 使用 httpcanary 也行.
\n 登录:
\n\"文章插图\"
\n注册:
\n\"文章插图\"
\n
可以看到校验还是比较少的，需要分析参数也就  memi1  ,  key  ,  rightkey  .
\n
# 脱壳
\n
脱壳工具现在有很多了，我这里使用的是 youpk, 使用方法很简单，只需要配置一下就可以，前提是有一台 pixel1
\n
作者文章 ===> https://bbs.pediy.com/thread-259854.htm
\n
# 参数分析
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
参数值处理
name1111111传入
pass123123传入
memi1afb9d9b6577c0397android id 写死
key3820....dd72包签名，写死
rightkey376035775包签名，写死
registerregisterregister 字符串，login 同理
\n
\n
apk 签名是不变的，android id 如果是要大批量生成，hook  android.os.Build  应该可以，没测试
\n
\n
#内部类处理方法
android hooking search classes android.provider.Settings
android hooking watch class_method android.provider.Settings$Secure.getString --dump-args --dump-backtrace --dump-return
\n
从哪里看出来，meli1 是 Android id?
\n
\n
这个 app 做了一定的混淆，把关键逻辑放到线程中去执行，这样打出来的调用栈就只有 Thread.run. 但是看到 onclick 方法:  v()  返回的就是  android id
\n
\"文章插图\"
\n
# 尾声
\n
至于基于协议的登录注册，有手就行。我就不贴了
\n
基本 objection 可以一把梭分析
\n",
            "tags": [
                "逆向学习",
                "逆向",
                "安卓",
                "Frida",
                "抓包"
            ]
        },
        {
            "id": "https://winston950213.github.io/2021/04/22/%E7%BA%A6%E5%8D%95/",
            "url": "https://winston950213.github.io/2021/04/22/%E7%BA%A6%E5%8D%95/",
            "title": "约单",
            "date_published": "2021-04-21T16:13:06.000Z",
            "content_html": "
约单 app 导游模块分析
\n
\n
# 抓包
\n
\n
这里使用 postern + charles 抓包
\n
\n
\"文章插图\"
\n
# 静态分析
\n
\n
通过抓包结果可知响应是加密的，请求参数也需要看一下。经过 jadx 静态反编译可以得知:
\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
参数分析结果
GET请求方式
/api3.0/user/boxapi{https://and.iyuedan.com/api3.0/user/box}
?tdid=388b6b40d00b627ce448595e2910f28d6
&time=1618816116054时间戳
&oaid=null写死
&token=1650097369I622d07d4e9IW66029678deviceId 写死
&role=1写死
&version=6.1.6写死
&sversion=1写死
&client=android写死
&device=Nexus 5X写死
&appname=yuedan写死
&market=xiaomi写死
&os_version=27写死
&new_work=27写死
&lang=cn写死
&ydmd=tmBmKE!VuK>H>E!_^K>H>母鸡，写死
&and_class_name=Activity_UserInfo_V2写死
&user_id=53745578用户 id 写死
&position=2写死
&ydtoken=6f9e3deb3afa8e2ccd4f015ca06fcef9
HTTP/1.1http 协议
\n
经过分析，tdid 是不变化的，也有可能是登陆时候生成的 (没有分析), 接下来搜索  ydtoken
\n
\"文章插图\"
\n
进过分析这里最为可疑，然后点进去看一下
\n
\"文章插图\"
\n
可以看到这里是 MD5 加密，但是还是需要开启 objection 看一下.
\n
\"文章插图\"
\n
但是在网页端使用 MD5 加密将原本的字符串加密之后结果并不一样，怀疑加盐了或者是自写的 MD5 加密，（但是一般不会是自写算法）. 我第一次在找盐的时候想错了。简单方法可以直接 hook 这个 md5 算法这样就会知道了
\n
\n
接着分析响应加密
\n
\n
具体怎么找到的我也忘记了，只记得先找到了这个 decrypt 函数
\n
\"文章插图\"
\n
然后写 frida 脚本测试一下是可以调用成功的，但是在把算法抠出来写入却始终报错，然后再试了试 hook  convert  .
\n
\"文章插图\"
\n
将这里的  sohoKeyMap  和  devKeyMap  重写，这样解密算法就完成了
\n
至于如何做成接口调用这不是有手就行？
\n
\n
使用 springboot (不得不说 java 的代码是真的繁琐)
\n
\n
# tips
\n
    \n
  1. \n
    脱壳
    \n
    我使用的是 yang 神的脱壳工具 https://github.com/lasting-yang/frida_dump
    \n
    2. \n
  2. \n
    合并 dex
    \n
    合并 dex 的方法有多种方法，我使用的是
    \n
    \n
    https://github.com/Simp1er/AndroidSec/blob/master/dex2apk.py
    \n
    \n
    3. \n
\n
import os
import zipfile
import argparse
def rename_class(path):
    files = os.listdir(path)
    dex_index = 0
    if path.endswith('/'):
        path = path[:-1]
        print(path)
    for i in range(len(files)):
        if files[i].endswith('.dex'):
            old_name = path + '/' + files[i]
            if dex_index == 0:
                new_name = path + '/' + 'classes.dex'
            else:
                new_name = path + '/' + 'classes%d.dex' % dex_index
            dex_index += 1
            if os.path.exists(new_name):
                continue
            os.rename(old_name, new_name)
    print('[*] 重命名完毕')
def extract_META_INF_from_apk(apk_path, target_path):
    r = zipfile.is_zipfile(apk_path)
    if r:
        fz = zipfile.ZipFile(apk_path, 'r')
        for file in fz.namelist():
            if file.startswith('META-INF'):
                fz.extract(file, target_path)
    else:
        print('[-] %s 不是一个APK文件' % apk_path)
def zip_dir(dirname, zipfilename):
    filelist = []
    if os.path.isfile(dirname):
        if dirname.endswith('.dex'):
            filelist.append(dirname)
    else:
        for root, dirs, files in os.walk(dirname):
            for dir in dirs:
                # if dir == 'META-INF':
                # print('dir:', os.path.join(root, dir))
                filelist.append(os.path.join(root, dir))
            for name in files:
                # print('file:', os.path.join(root, name))
                filelist.append(os.path.join(root, name))
    z = zipfile.ZipFile(zipfilename, 'w', zipfile.ZIP_DEFLATED)
    for tar in filelist:
        arcname = tar[len(dirname):]
        if ('META-INF' in arcname or arcname.endswith('.dex')) and '.DS_Store' not in arcname:
            # print(tar + \" -->rar: \" + arcname)
            z.write(tar, arcname)
    print('[*] APK打包成功，你可以拖入APK进行分析啦！'  )
    z.close()
def parse_args():
    parser = argparse.ArgumentParser(description='repackage dumped dex to apk for jeb/jadx analysis.')
    parser.add_argument('-a', '--apk_path', required=True, type=str,
                        help='apk for extracting META-INF')
    parser.add_argument('-i', '--dex_path', required=True, type=str,
                        help='path of dumped dex')
    parser.add_argument('-o', '--output', type=str, default=\"repacked.apk\",
                        help='apk path after zip')
    args = parser.parse_args()
    #print(args.apk_path)
    return args
if __name__ == '__main__':
    args = parse_args()
    rename_class(args.dex_path)
    extract_META_INF_from_apk(args.apk_path, args.dex_path)
    # zip_file(args.dex_path)
    zip_dir(args.dex_path, args.output)
​ 但是有时候我们也许不要合并，使用  ls -Sr  将 dex 按照大小排列，1.2.0 版本的 jadx 可以使用  add files  将 dex 添加到项目中但是我添加了 6 个之后就崩了，但是不影响分析.
\n",
            "tags": [
                "逆向学习",
                "逆向",
                "安卓",
                "Frida",
                "实战"
            ]
        },
        {
            "id": "https://winston950213.github.io/2021/03/26/frida-rpc-%E5%AD%A6%E4%B9%A0/",
            "url": "https://winston950213.github.io/2021/03/26/frida-rpc-%E5%AD%A6%E4%B9%A0/",
            "title": "frida rpc 学习",
            "date_published": "2021-03-25T23:55:06.000Z",
            "content_html": "
Frida RPC 学习记录
\n
\n
# RPC 开发环境搭建
\n
\n
抄代码的地方 ===> https://github.com/frida/frida-python
\n
\n
由于我们使用的是 frida-rpc,RPC 环境其实就是 frida 环境，只是多了一个内网穿透的搭建，这里使用的是 NPS, 具体可以详见内网穿透
\n
# Java 层主动调用
\n
\n
先写 hook
\n
再写主动调用
\n
\n
在拿到一个 apk 时，首先要找一下 MainActivity,  grep -ril "MainActivty" *  尤其是脱壳之后的 dex, 但是这里我们的 apk 比较简单，用 jadx 静态分析一下就可以.
\n
\n
objection 试试
\n
\n
    \n
  1. \n
    搜索
    \n android hooking search classes MainActivity
    \n
    2. \n
  2. \n
    hook 打参数及调用栈
    \n
    android hooking watch class com.example.demoso1.MainActivity --dump-args --dump-backtrace --dump-return
    \n
    3. \n
  3. \n
    写 frida 脚本
    \n
    4. \n
\n
function hook(){
   Java.perform(function(){
       var MainActivity = Java.use(\"com.example.demoso1.MainActivity\");
       MainActivity.method01.implementation = function(str){
           var s1 = \"123123\"
           var result = this.method01(s1)
           console.log(\"str ===> \", str);
           console.log(\"s1 ===> \", s1);
           console.log(\"result ===> \", result);
           return result
       }
   })
}
    \n
  1. 写主动调用脚本
    2. \n
\n
function fridamethod01(plaintext){
    var result;
    Java.perform(function(){
        var MainActivity = Java.use(\"com.example.demoso1.MainActivity\");
        var JavaString = Java.use(\"java.lang.String\");
        result = MainActivity.method01(JavaString.$new(plaintext));
    })
    return result;
}
function fridamethod02(ciphertext){
    var result;
    Java.perform(function(){
        var JavaString = Java.use(\"java.lang.String\");
        Java.choose(\"com.example.demoso1.MainActivity\",{
            onMatch: function(instanca){
                result = instanca.method02(JavaString.$new(ciphertext));
            },onComplete(){}
        })
    })
    return result;
}
    \n
  1. 制作 RPC
    2. \n
\n
rpc.exports = {
    fridamethod01:fridamethod01,
    fridamethod02:fridamethod02,
}
    \n
  1. \n
    暴露接口到公网
    \n
    详见内网穿透
    \n
    2. \n
  2. \n
    优化
    \n
    \n
    由于  fridamethod02  方法中需要使用到  Java.choose()  , 这个操作非常耗时，我们为了节省时间将这部分代码抽出，但是这种操作非常危险，万一获取不到 handle 会造成严重后果，由于 MainActivity 一定存在就这样干了，但是其他类也许可以也许不可以.
    \n
    \n
    3. \n
\n
var MainActivityHandle;
Java.perform(function(){
    // var JavaString = Java.use(\"java.lang.String\");
    // result = MainActivity.method02(JavaString.$new(ciphertext));
    Java.choose(\"com.example.demoso1.MainActivity\",{
        onMatch: function(instanca){
            MainActivityHandle = instanca;
            // result = instanca.method02(JavaString.$new(ciphertext));
        },onComplete(){}
    })
})
# So 层主动调用
\n
\n
普通 hook
\n
replace hook
\n
env, jclass,jobject,jsring 构造
\n
启动 rpc 服务并测试
\n部署到公网
\n
\n
    \n
  1. 普通 hook
    2. \n
\n
function hook_method(addr){
    Interceptor.attach(addr, {
        onEnter:function(args){
            console.log(\"args[0] ===> \", args[0]);
            console.log(\"args[1] ===> \", args[1]);
            console.log(\"args[2] ===> \", Java.vm.getEnv().getStringUtfChars(args[2], null).readCString());
        },onLeave:function(retvel){
            console.log(\"retvel is ===> \",Java.vm.getEnv().getStringUtfChars(retvel, null).readCString());
        }
    })
}
    \n
  1. replace hook
    2. \n
\n
function replacehook(addr){
    var addrfunc =new NativeFunction(addr, \"pointer\", [\"pointer\",\"pointer\",\"pointer\"]);
    Interceptor.replace(addr, new NativeCallback(function(arg1, arg2, arg3){
        console.log(\"args[2] ===> \", Java.vm.getEnv().getStringUtfChars(arg3, null).readCString());
        var result = addrfunc(arg1, arg2, arg3);
        console.log(\"retvel is ===> \",Java.vm.getEnv().getStringUtfChars(result, null).readCString());
        return result;
    },\"pointer\", [\"pointer\",\"pointer\",\"pointer\"]))
}
    \n
  1. \n
    env, jclass,jobject,jsring 构造
    \n
    \n
    由于肉丝姐在上课时的案例中没有用到  jobject  和  jclass  , 所以只要传个指针过去就行，  jstring  也是个指针，在实际情况中不建议这么做，构造代码初次骨头大佬
    \n
    \n
    2. \n
\n
var javaClass = Java.use(\"com.example.demoso1.MainActivity\")
var JCLASS = javaClass.$getClassHandle(Java.vm.tryGetEnv());
var JOBJECT = javaClass.$getClassHandle(Java.vm.tryGetEnv());
    \n
  1. 启动 rpc 服务并测试
    2. \n
\n
function invokemethod01(text){
    console.log(\"ENV is ===> \", ENV)
    // console.log(\"method01 is ===> \", method01addr);
    var method01 =new NativeFunction(method01addr, \"pointer\", [\"pointer\",\"pointer\",\"pointer\"]);
    var NewStringUTF = new NativeFunction(addrNewStringUTF,'pointer',['pointer','pointer'])
    var result;
    // var result = method01(env, jclass, jstring);
    Java.perform(function(){
        var javaClass = Java.use(\"com.example.demoso1.MainActivity\")
        // var JSTRING =Java.vm.getEnv().newStringUtf(Java.vm.getEnv(), Memory.allocUtf8String(\"123123123123\"))
        var JSTRING = NewStringUTF(Java.vm.getEnv(),Memory.allocUtf8String(text))
        var JCLASS = javaClass.$getClassHandle(Java.vm.tryGetEnv());
        // var result = method01(env, jclass, jstring);
        result = method01(Java.vm.getEnv(), JCLASS, JSTRING);
        // console.log(\"result is ===> \", result)
        // console.log(\"readCString result is ===> \", Java.vm.getEnv().getStringUtfChars(result, null).readCString())
        // console.log(\"Memory.readCString result is ===> \", Memory.readCString(Java.vm.getEnv().getStringUtfChars(result, null)))
        result = Java.vm.getEnv().getStringUtfChars(result, null).readCString();
        console.log(result);
    })
    return result
}
function invokemethod02(textenc){
    console.log(\"ENV is ===> \", ENV)
    // console.log(\"method02 is ===> \", method02addr);
    var method02 =new NativeFunction(method02addr, \"pointer\", [\"pointer\",\"pointer\",\"pointer\"]);
    var NewStringUTF = new NativeFunction(addrNewStringUTF,'pointer',['pointer','pointer'])
    var result;
    // var result = method02(env, jobject, jstring);
    Java.perform(function(){
        // var JSTRING =Java.vm.getEnv().newStringUtf(Java.vm.getEnv(), Memory.allocUtf8String(\"123123123123\"))
        var javaClass = Java.use(\"com.example.demoso1.MainActivity\")
        var JSTRING = NewStringUTF(Java.vm.getEnv(),Memory.allocUtf8String(textenc))
        var JOBJECT = javaClass.$getClassHandle(Java.vm.tryGetEnv());
        // var result = method02(env, jobject, jstring);
        result = method02(Java.vm.getEnv(), JOBJECT, JSTRING);
        // console.log(\"result is ===> \", result)
        // console.log(\"readCString result is ===> \", Java.vm.getEnv().getStringUtfChars(result, null).readCString())
        // console.log(\"Memory.readCString result is ===> \", Memory.readCString(Java.vm.getEnv().getStringUtfChars(result, null)))
        result = Java.vm.getEnv().getStringUtfChars(result, null).readCString();
    })
    return  result;
}
// RPC invoke SO step 4:
// make exports
rpc.exports = {
    invoke1:invokemethod01,
    invoke2:invokemethod02,
}
\n
测试详见测试
\n
\n
    \n
  1. \n
    暴露到公网
    \n
    详见内网穿透
    \n
    2. \n
\n
# 测试
\n
\n
curl/postman
\n
sige
\n
\n
# 连通性测试
\n
# curl
\n
\n
在开启服务之后简单测试接口是否通，可以用 curl, 更多操作可以参考:https://curl.se/docs/manpage.html
\n
\n
笔者只会一条命令还是刚学会:
\n
curl -X POST -H \"Content-Type: application/json\"     -d '{\"data\": \"zrail\"}'  http://127.0.0.1:5000/encrypt
curl -X POST -H \"Content-Type: application/json\"     -d '{\"data\": \"4a61203f8a1b640818230269bd1059ea\"}'  http://127.0.0.1:5000/decrypt
# postman
\n
\n
由于开发在虚拟机，postman 测试需要 :
\n
\n
app.run(host=\"0.0.0.0\", port=50000, threaded=True, debug=False)
\n
至于传参使用  formdata  还是  raw  , 这就要看服务端怎么写了
\n
\n
import json
from flask import Flask, request
app = Flask(__name__)
@app.route('/encrypt', methods=['POST'])#url 加密
def encrypt_class():
    data = request.get_data()
    json_data = json.loads(data.decode(\"utf-8\"))
    postdata = json_data.get(\"data\")
    # print(\"data ===> \",postdata)
    res = script.exports.invoke1(postdata)
    # print(\"res ===> \", res)
    return res
@app.route('/decrypt', methods=['POST'])#data 解密
def decrypt_class():
    data = request.get_data()
    json_data = json.loads(data.decode(\"utf-8\"))
    postdata = json_data.get(\"data\")
    res = script.exports.invoke2(postdata)
    return res
if __name__ == '__main__':
    # app.run(host=\"0.0.0.0\", port=50000, threaded=True, debug=False)
    app.run()
# 压力测试
\n
# siege
\n
\n
其他系统可能需要编译，但是 kali 自带，直接安装
\n
\n
\n
具体操作参考: https://www.cnblogs.com/chenxiaomeng/p/13130526.html
\n
\n
\n
siege 默认只支持 255 个并发数，可以自己自定义，修改 /root/.siege/siege.conf 下的 limit 数值。
\n
\n
命令:
\n
siege -c200 -r10 \"http://127.0.0.1:5000/decrypt POST <./textenc.json\"
siege -c200 -r10 \"http://127.0.0.1:5000/decrypt POST <./text.json\"
# text.json
{
        \"data\":\"123123123123123123\"
}
# textenc.json
{
        \"data\":\"53c6a31a21192365943a4f672fc97c7d\"
}
\n
据说 Jmeter 也挺好用，没试过
\n
\n
# 内网穿透
\n
\n
将接口暴露至公网需要用到内网穿透工具，这里使用 NPS.github 地址:https://github.com/ehang-io/nps
\n
\n
# Tips
\n
\n
安装比较简单，文档也够详细，有手就行 (😿我手呢？😿). 这里记录几个坑点
\n
\n
    \n
  1. 端口一定要开放，我就是一开始端口开少了.
    2. \n
  2. 服务器开完端口之后需要等一会儿，这个时间长短不确定.
    3. \n
\n
# 主动调用，内网穿透的两种方式
\n
# 将 http server 暴露至公网
\n
\"文章插图\"
\n
\n
如果是此种方式，NPC 就是 linux 或者 windows 的版本
\n
\n
# 将 frida server 暴露至公网
\n
\"文章插图\"
\n
\n
此种方式 NPC 为 arm64 (手机). 模拟器应该是 x86 (没试过)
\n
\n
# Tips
\n
    \n
  1. 暴露 frida server 比暴露 http server 快，但是也没快多少
    2. \n
  2. 感觉手机和网络是瓶颈，选什么框架并无关系
    3. \n
\n
Todo
\n\n",
            "tags": [
                "逆向学习",
                "逆向",
                "安卓",
                "Frida"
            ]
        },
        {
            "id": "https://winston950213.github.io/2021/03/23/%E9%80%86%E5%90%91%E7%8E%AF%E5%A2%83%E6%90%AD%E5%BB%BA/",
            "url": "https://winston950213.github.io/2021/03/23/%E9%80%86%E5%90%91%E7%8E%AF%E5%A2%83%E6%90%AD%E5%BB%BA/",
            "title": "逆向环境搭建",
            "date_published": "2021-03-22T23:55:29.000Z",
            "content_html": "
基于 kali linux 2019 的逆向环境搭建
\n
\n
\n
本文基于 kali 2021.1, 种子地址:https://www.offensive-security.com/kali-linux-vm-vmware-virtualbox-image-download/
\n
\n
# 基本配置
\n
# 修改用户及密码
\n
\n
kali 开机默认账号  kali  , 密码  kali  , 一般在 root 用户下工作 (切勿用于生产环境)
\n
\n
sudo passwd root
New password:toor
Retype new password:toor
# 同步时区
\n
\n
新版本可能会自动修改时区，如为自动修改则使用以下方法:
\n
\n
dpkg-reconfigure tzdata
然后选择  Asia→Shanghai
\n
# 安装中文字体
\n
\n
有些网页中文显示为乱码，许安装中文字体。新版本可能已经安装，如未自动安装则使用以下方法:
\n
\n
apt install xfonts-intl-chinese
apt install ttf-wqy-microhei
# 安装中文输入法
\n
\n
一般不建议安装
\n
https://blog.csdn.net/qq_42333641/article/details/89325576
\n
\n
apt-get update
apt-get install ibus ibus-pinyin
\n
配置如文中图
\n
\n
\"文章插图\"
\n
# 修改电源设置
\n
\n
更改电源设置，防止息屏
\n
\n
\"文章插图\"
\n
\"文章插图\"
\n
# 切换到 bash
\n
\n
kali 2021.1 默认使用 zsh, 在某些时候会出现问题，所以切换到 bash
\n
\n
zsh  切换到  bash
\n
chsh -s /bin/bash
bash  切换到  zsh
\n
chsh -s /bin/zsh
\n
为防止重启终端不彻底直接  reboot  或者重启虚拟机使其生效
\n
\n
\n
检查当前使用的 shell
\n
\n
echo $SHELL
echo $0
两个任选其一
\n
# 增大历史缓存
\n
\n
有时候 app 数据太多，防止丢失
\n
\n
nano ~/.bashrc
\"文章插图\"
\n
在其后面增加三个 0,  Ctrl  +  x  +  Y  +  Enter  保存退出.
\n
source ~/.bashrc  , 如果出现乱码，不要慌，  reooot
\n
# 工具安装
\n
# htop , jnettop, tree
\n
更新源
\n
apt update
\n
安装
\n
apt install htop jnettop tree
\n
# 安装 Android Studio
\n
\n
建议在真机复制链接到虚拟机使用  wget   下载
\n
\n
# 下载
\n
wget //redirector.gvt1.com/edgedl/android/studio/ide-zips/4.1.2.0/android-studio-ide-201.7042882-linux.tar.gz
\n
# 解压
\n
使用  tar zxvf FileName.tar.gz  解压
\n
# 配置 adb
\n
\n
如果默认安装 Android Studio 的话，adb 位置为  PATH=/root/Android/Sdk/platform-tools
\n
\n
    \n
  1. 执行在  nano ~/.bashrc  在 bashrc 中增加  export PATH=/root/Android/Sdk/platform-tools:$PATH
    2. \n
  2. source 刷新
    3. \n
  3. 输入 adb 不出现  command not found  则成功
    4. \n
\n
# 启动
\n
    \n
  1. 进入 /root/android-studio/bin
    2. \n
  2. ./studio.sh
    3. \n
\n
# 初始化第一个 Android 项目
\n
\n
empty app 相信大家都会
\n
静静等待初始化完成
\n
\n
问题:
\n
\n
在初始化 NDK 环境的时候会出现一个玄学问题
\n
\n
\"文章插图\"
\n
介绍几种解决方法:
\n\n
\n
由于 NDK 已经安装过，就不需要再安装，只安装 CMake, 此时也不需要特定版本 [毕竟不是专业开发者]
\n
\n
# 科学配置
\n
# 命令行科学
\n
# proxychains
\n\n
\"文章插图\"
\n
\n
打开主机 VPN  Allow LAN  即 允许局域网连接
\n
\n\n
\n
输出不是自己 ip 即成功
\n
\n
# redsocks
\n
\n
kali linux 自带，其他系统可能需要编译安装
\n
遗留问题：浏览器访问 google 有问题，但是其他正常
\n
\n
    \n
  1. 修改配置文件
    \n\"文章插图\"
    2. \n
\n
\n
前面的 log 开关可改可不改
\n local_ip 与 local_port 可改可不改
\n
\n
    \n
  1. 修改 iptables.sh
    2. \n
\n
\"文章插图\"
\n
\n
框中为你的主机地址
\n
\n
    \n
  1. 启动
    2. \n
\n
redsocks
# 使用 `iptables.sh` 进行流量转发
sh iptables.sh
    \n
  1. \n
    验证
    \n\n
    2. \n
  2. \n
    其他操作系统参照
    \n
    \n
    https://blog.csdn.net/zdy0_2004/article/details/48474721
    \n
    https://www.cnblogs.com/shaohef/p/4477862.html
    \n
    \n
    笔者未实验
    \n
    \n
    \n
    3. \n
\n
# 安装 jadx
\n\n
# 安装 pyenv
\n
\n
安装尽量参照官方 README, 一般不会出现问题
\n
以下实验均在 kali linux bash 下运行
\n
官方地址 ==> https://github.com/pyenv/pyenv
\n
\n
    \n
  1. 下载
    2. \n
\n
git clone https://github.com/pyenv/pyenv.git ~/.pyenv
    \n
  1. 写入环境变量
    2. \n
\n
echo 'export PYENV_ROOT=\"$HOME/.pyenv\"' >> ~/.bashrc
echo 'export PATH=\"$PYENV_ROOT/bin:$PATH\"' >> ~/.bashrc
    \n
  1. 初始化
    2. \n
\n
echo -e 'if command -v pyenv 1>/dev/null 2>&1; then\\n  eval \"$(pyenv init -)\"\\nfi' >> ~/.bashrc'
    \n
  1. 刷新
    2. \n
\n
exec \"$SHELL\"
    \n
  1. 安装编译依赖
    2. \n
\n
sudo apt-get update; sudo apt-get install --no-install-recommends make build-essential libssl-dev zlib1g-dev libbz2-dev libreadline-dev libsqlite3-dev wget curl llvm libncurses5-dev xz-utils tk-dev libxml2-dev libxmlsec1-dev libffi-dev liblzma-dev
\n
https://github.com/pyenv/pyenv/wiki#suggested-build-environment
\n
\n
    \n
  1. \n
    常用命令
    \n\n
    2. \n
\n
# 安装 Miniconda
\n\n
proxychains pip install frida==12.8.0
proxychains pip install frida-tools==5.3.0
proxychains pip install objection==1.8.4
\n
\n
环境隔离 Miniconda 和 pyenv 二选一 (建议选择 conda)
\n
\n
# 安装 010editer
\n
# 安装
\n\n
# 破解
\n
\n
破解可耻，请支持正版
\n
无限试用法
\n
\n
root 用户下删除  /root/.local/share/SweetScape/010 Editor  和  /root/.config/SweetScape
\n
rm -rf /root/.config/SweetScape
rm -rf /root/.local/share/SweetScape/010 Editor
又来三十天
\n
\n
分析文章 ==> https://blog.csdn.net/k7arm/article/details/108914024
\n
\n
# 安装 Vscode
\n\n
# 安装 jeb
\n
\n
https://bbs.pediy.com/thread-259895-1.htm
\n
\n
\n
破解可耻，请支持正版
\n
\n
# 下载
\n
​ https://mega.nz/file/OEJwWa7J#amoAEa0GGnWpWXaPYvGBC3E5FjciGYRXZpYiUTFDE8I
\n​ or
\n​ https://mir.cr/09UHCATD
\n
# 安装
\n
​ 解压运行  ./jeb_linux.sh
\n
# 运行
\n
​ 输入密码  ilbtcdnwiuypbzeo  -->  Accept  -->  manual  激活 (用户名自己定义)---> 拷贝  License Data  ---> 使用 Python2 执行  jebKeygen.py  ---> 粘贴  License Data  ---> 拷贝 key---> 粘贴到 jeb---> 完成
\n
# 安装 scrcpy
\n
\n
在 kali 中使用无线投屏，结合 WiFiadb
\n
\n
apt search scrcpy
\n
apt install scrcpy
\n
    \n
  1. 使用 adb connect 连接手机
    2. \n
  2. scrcpy 启动
    3. \n
\n
# 安装 tmux
\n
\n
遇事不决，翻译提示
\n
第一次启动出现一个让你执行  touch ~/.hushlogin  的提示，执行就完了
\n
\n
# 安装
\n
apt install tmux
\n
# 运行
\n
tmux
\n
\n
tmux 默认  Ctrl  +  B  为命令前缀
\n
\n
更多操作命令
\n
\n
可以参考阮一峰大佬的文章 ==>https://www.ruanyifeng.com/blog/2019/10/tmux.html
\n
\n
# 踩坑及备忘
\n
# VM
\n\n",
            "tags": [
                "逆向学习",
                "逆向",
                "安卓"
            ]
        }
    ]
}