Closed ireun closed 1 year ago
Hi, smells like they are moving from self-hosted server to the alibaba CLOUDS!
Anyway... I see their app creates following request if you click "check updates":
POST https://api.jcidtech.com/api/v1/aixun_config_file_controller/query HTTP/1.1
Host: api.jcidtech.com
Content-Type: application/json;charset=UTF-8
languageType: en
Content-Length: 65
Connection: Keep-Alive
Accept-Encoding: gzip, deflate
Accept-Language: en,*
User-Agent: Mozilla/5.0
{
"fileName": [
"JCID_dev_upgrade_note.zip",
"JCID_config_test.zip"
]
}
Server responded with:
HTTP/1.1 200 OK
Server: nginx/1.21.5
Date: Wed, 26 Jul 2023 06:21:52 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/7.4.3
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 1800
Access-Control-Allow-Methods: GET, POST, PATCH, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: Authorization, Content-Type, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, X-CSRF-TOKEN, X-Requested-With, X-Token, token
Access-Control-Allow-Origin: *
{
"code": 1000,
"data": [
{
"descCn": "P3208更新V2.05",
"descEn": "",
"fileName": "JCID_config_test.zip",
"url": "http://aixun-file.oss-cn-shenzhen.aliyuncs.com/config/20230725141859/JCID_config_test.zip",
"version": "KS3FTCHNU0R8EBBR3E"
},
{
"descCn": "P3208说明文本对齐",
"descEn": "",
"fileName": "JCID_dev_upgrade_note.zip",
"url": "http://aixun-file.oss-cn-shenzhen.aliyuncs.com/config/20230725144943/JCID_dev_upgrade_note.zip",
"version": "RZ7G3F1V5GV3BJHF7W"
}
],
"msg": "success"
}
No authentication/no funny cookies/headers. Looks like open API.
And if I do this by myself:
curl -X POST -H 'Content-Type: application/json' -d '{"fileName": ["JCID_dev_upgrade_note.zip", "JCID_config_test.zip"]}' https://api.jcidtech.com/api/v1/aixun_config_file_controller/query | jq
It works the same:
{
"code": 1000,
"msg": "success",
"data": [
{
"fileName": "JCID_config_test.zip",
"version": "KS3FTCHNU0R8EBBR3E",
"url": "http://aixun-file.oss-cn-shenzhen.aliyuncs.com/config/20230725141859/JCID_config_test.zip",
"descCn": "P3208更新V2.05",
"descEn": ""
},
{
"fileName": "JCID_dev_upgrade_note.zip",
"version": "RZ7G3F1V5GV3BJHF7W",
"url": "http://aixun-file.oss-cn-shenzhen.aliyuncs.com/config/20230725144943/JCID_dev_upgrade_note.zip",
"descCn": "P3208说明文本对齐",
"descEn": ""
}
]
}
I also by mistake tried:
curl -X POST https://api.jcidtech.com/api/v1/aixun_config_file_controller/query | jq
Seems like this api provides files and you can filter these files by using JSON input or not provide any filter and thus get all the files they have.
I will add this as source shortly.
Nice! What have you used to sniff the requests?
I updated both changelog and firmware downloading so now versions should be up to date together with .bin files. Both changelog and firmware storage was changed from custom server to alibabacloud storage. Hopefully they now stop changing and breaking things for no reason 😅.
I was originally using Wireshark but since they are finally using HTTPS this is not easily possible anymore.
Thus now I'm using mitmproxy (https://mitmproxy.org/) instead, I installed root certificate from mitmproxy into OS and then forced AIXUN app to communicate through mitmproxy (via Win2Socks, maybe there is other way, not sure, I used Win2Socks since it's easy and I have it). mitmproxy then automatically generates HTTPS certificates signed by the root certificate so AIXUN app is happy and thinks everything is very secure! Then I can see everything what AIXUN app sends/receives with mitmweb interface.
BTW: Where did you find links to new data sources (posted in your original description)?
BTW: Where did you find links to new data sources (posted in your original description)?
That one https://aixun-file.oss-cn-shenzhen.aliyuncs.com/config/20230725144943/JCID_dev_upgrade_note.zip is accessed without HTTPS, so I could see that in Wireshark, for the rest of the links I used IDA ;)
but the link you've found was split in half, I missed it :)
Cool! Yeah, I guess I'm more high-level than low-level person thus I fallback to analyzing binary code only when there is no other way 😄. Also more conditional/dynamic requests are hard to read from binaries it's so much easier just to see assembled HTTP requests.
https://aixun-file.oss-cn-shenzhen.aliyuncs.com/config/20230725144943/JCID_dev_upgrade_note.zip
Sadly I have not found where does the 'date' come from :/
Maybe from
https://api.jcidtech.com/api/v1/aixun_current_controller/query
but I have not found a way to get response. Also there ishttps://drawing.jcidtech.com/api/v1/auth/login?username=xxx&password=xxx&platform=xxx