通过网络抓包获取题目及答案

[whiteki08]

请求地址

https://xyks.yuanfudao.com/leo-game-pk/iphone/math/pk/match

响应内容如下

{"pkIdStr":"608829268486627373","otherUser":{"userId":245599600,"userName":"厉不厉害你坤哥","avatarUrl":"https://leo-online.fbcontent.cn/leo-gallery/1926fe764a6085f.jpg","userPendantUrl":null},"otherWinCount":1,"selfWinCount":3,"targetCostTime":90000,"examVO":{"pkIdStr":"608829268486627373","pointId":22,"pointName":"两三位数的加减法","ruleType":0,"questionCnt":10,"correctCnt":0,"costTime":0,"questions":[{"id":0,"examId":608829268486627373,"content":"80-50=\\square","answer":"30","userAnswer":null,"answers":["30"],"status":0,"script":null,"wrongScript":null,"ruleType":"ARITHMETIC"},{"id":1,"examId":608829268486627373,"content":"93-13=\\square","answer":"80","userAnswer":null,"answers":["80"],"status":0,"script":null,"wrongScript":null,"ruleType":"ARITHMETIC"},{"id":2,"examId":608829268486627373,"content":"69-47=\\square","answer":"22","userAnswer":null,"answers":["22"],"status":0,"script":null,"wrongScript":null,"ruleType":"ARITHMETIC"},{"id":3,"examId":608829268486627373,"content":"79-11=\\square","answer":"68","userAnswer":null,"answers":["68"],"status":0,"script":null,"wrongScript":null,"ruleType":"ARITHMETIC"},{"id":4,"examId":608829268486627373,"content":"82-72=\\square","answer":"10","userAnswer":null,"answers":["10"],"status":0,"script":null,"wrongScript":null,"ruleType":"ARITHMETIC"},{"id":5,"examId":608829268486627373,"content":"214+310=\\square","answer":"524","userAnswer":null,"answers":["524"],"status":0,"script":null,"wrongScript":null,"ruleType":"ARITHMETIC"},{"id":6,"examId":608829268486627373,"content":"626+123=\\square","answer":"749","userAnswer":null,"answers":["749"],"status":0,"script":null,"wrongScript":null,"ruleType":"ARITHMETIC"},{"id":7,"examId":608829268486627373,"content":"260+608=\\square","answer":"868","userAnswer":null,"answers":["868"],"status":0,"script":null,"wrongScript":null,"ruleType":"ARITHMETIC"},{"id":8,"examId":608829268486627373,"content":"875+101=\\square","answer":"976","userAnswer":null,"answers":["976"],"status":0,"script":null,"wrongScript":null,"ruleType":"ARITHMETIC"},{"id":9,"examId":608829268486627373,"content":"174+813=\\square","answer":"987","userAnswer":null,"answers":["987"],"status":0,"script":null,"wrongScript":null,"ruleType":"ARITHMETIC"}],"updatedTime":0}}

[ChaosJulien]

感谢提供

[WnoteZZ]

优秀

[RWGLQJ]

这样就可以用重写直接吧答案改成1了

[kongbai141]

这样就可以用重写直接吧答案改成1了

这个是post返回的没法重写吧

[wyp010428]

这样就可以用重写直接吧答案改成1了

这个是post返回的没法重写吧

可以重写的，我刚试了一下没问题，稍等发教程

[kongbai141]

这样就可以用重写直接吧答案改成1了

这个是post返回的没法重写吧

可以重写的，我刚试了一下没问题，稍等发教程

草我懂你意思了，直接改response.body把答案全替换，那确实可以

[kongbai141]

这样就可以用重写直接吧答案改成1了

这个是post返回的没法重写吧

可以重写的，我刚试了一下没问题，稍等发教程

但想实现0.0s感觉只能拆math/pk/submit请求体的加密了

[wyp010428]

这样就可以用重写直接吧答案改成1了

这个是post返回的没法重写吧

可以重写的，我刚试了一下没问题，稍等发教程

但想实现0.0s感觉只能拆math/pk/submit请求体的加密了

我把答案库直接改1可行，submit加密了实在懒得搞了

[hhhhhge]

关键是有sign签名，有没有大佬破解签名的

[kongbai141]

关键是有sign签名，有没有大佬破解签名的

只能ida逆so找算法吧，破不动等大佬了

[MamboJiang]

但其实这个pk是假的，刚试了下打开飞行模式都能匹配到然后打完一局...甚至对面的做题数还会自己增加

[hhhhhge]

https://leo.fbcontent.cn/bh5/leo-web-oral-pk/exercise_656db608f6aad6a7.js

[hhhhhge]

应该是来自这个js的加密

[hhhhhge]

https://leo.fbcontent.cn/bh5/leo-web-oral-pk/pk_2afbc56be069f84e.js

[JiuSanBird]

一人一句坤哥牛逼来

[hhhhhge]

[hhhhhge]

export const signUrlIfNeeded = (url: string) => { return new Promise(resolve => { if (isYuanKouSuan() && greaterThanOrEqualTo('3.42.0') && (url.indexOf('{device}') !== -1 || url.indexOf('{client}') !== -1)) { runUniqueApi('requestConfig', { path: url, trigger: (err: any, res: any) => { if (err && err !== 0) { resolve(url) } else { resolve(res.wrappedUrl) } } }, 'LeoSecure') } else { if (url.indexOf('{device}') !== -1 || url.indexOf('{client}') !== -1) { const resultUrl = url.replace('{device}', 'api').replace('{client}', 'api') resolve(resultUrl) } else { resolve(url) } } }) }

[hhhhhge]

不知道这个有没有用

[dfaofeng]

不知道这个有没有用

我刚分析完安卓端的,他是加载libRequestEncoder.so这个文件,调用native String zcvsd1wr2t(String str, String str2, int i11)生成的sign,你那个web链接怎么搞到的

[kongbai141]

不知道这个有没有用

我刚分析完安卓端的,他是加载libRequestEncoder.so这个文件,调用native String zcvsd1wr2t(String str, String str2, int i11)生成的sign,你那个web链接怎么搞到的

webview远程调试