您的位置：首页 > 其它

XCodeGhost 笔记

2015-09-22 11:24 246 查看
因为服务已经关掉了，所以要改路由Openwrt

vi /etc/config/dhcp
vi /etc/dnsmasq/dnsmasq.conf
/etc/init.d/dnsmasq restart


dhcp文件在config dnsmasq节点追加：


list addnhosts '/etc/dnsmasq/dnsmasq.conf'


dnsmasq.conf文件追加：


192.168.1.11 icloud-analysis.com
192.168.1.11 init.icloud-analysis.com



nslookup init.icloud-analysis.com
Server:    127.0.0.1
Address 1: 127.0.0.1 localhost

Name:      init.icloud-analysis.com
Address 1: 192.168.1.11 icloud-analysis.com


PC 使用Fiddler抓HTTP包，手机端设置代理PC IP:8888

抓到：


POST http://init.icloud-analysis.com/ HTTP/1.1
Host: init.icloud-analysis.com
Accept: */*
Content-Type: application/x-www-form-urlencoded
Connection: keep-alive
Connection: keep-alive
Cookie: PHPSESSID=bddj900k9lk7esd5stf6ddhbh1
Accept-Language: zh-cn
Content-Length: 320
Accept-Encoding: gzip, deflate
User-Agent: OpenCourse/4.2.8 CFNetwork/758.0.2 Darwin/15.0.0

��@�e�
�:� %Nה^�pY�yi-�[�T����(������P�����*��� ���?����<g�b���*fx;t�&���g ʤZ�d���j��W����K �~�������&�J�
r:p�L������P_��P��(pN�+kF�L���J#gw;�=b��=�_Zb}�����8=�3��ˮ9S9����Ù��撍�>����
�


内容加密，已经解开如下

{
"len": 320,
"cmd": 101,
"ver": 10,
"txt": {
"bundle": "com.netease.videoHD",
"os": "9.0",
"status": "resignActive",
"app": "OpenCourse",
"country": "CN",
"idfv": "60C3FBEE-XXXXXXXXXXXXXXXXXXXXXXXXXXX",
"language": "zh-Hans-CN",
"version": "4.2.8",
"type": "iPhone7,2",
"timestamp": "1442915343",
"name": "my-iPhone"
}
}


尝试返回数据，无效。没环境，不玩了

{
"alertHeader": "我是万恶的弹出框",
"alertBody": "你好我是万恶的弹出框，钱打这个卡上。",
"appID": "0",
"cancelTitle": "确定",
"confirmTitle": "取消",
"scheme": "mqqopensdkapiV2://qzapp"
}
内容来自用户分享和网络整理，不保证内容的准确性，如有侵权内容，可联系管理员处理 点击这里给我发消息
标签： 
相关文章推荐
新的分享
章节导航