使用PHP,实现查询天府通余额

成都的巴适公交APP可以查询天府通余额,于是想将其移植到PHP代码上

解压apk,dex2jar反编译classes.dex为jar,用jd-gui.exe打开就可以看见代码了

 

public List<CardRechargeBean> getCardRechargeByNum(String paramString)
{
ArrayList localArrayList = new ArrayList();
localArrayList.add(new BasicNameValuePair("mod", "api"));
localArrayList.add(new BasicNameValuePair("ac", "BusConsumption"));
localArrayList.add(new BasicNameValuePair("op", "1"));
localArrayList.add(new BasicNameValuePair("cardno", "0001" + paramString));
StringBuffer localStringBuffer = new StringBuffer();
localStringBuffer.append(Config.BASE_URL);
localStringBuffer.append("Bus/QueryTopUp/");
localStringBuffer.append("?cardno=0001" + paramString);
localObject1 = new ArrayList();
for (;;)
{
try
{
String str = request(getHttpClient(), ParamUtils.generateSignature(localStringBuffer.toString()), null);
localJSONObject = new JSONObject(str.toLowerCase());
if (localJSONObject.getInt("status") == 101)
{
localType = new TypeToken() {}.getType();
System.out.println(">>>sss:" + str);
}
}
catch (Exception localException)
{
JSONObject localJSONObject;
Type localType;
localException.printStackTrace();
if ((localException instanceof InterruptedException)) {
continue;
}
(localException instanceof ConnectException);
if (localObject1 != null) {
continue;
}
return new ArrayList();
}
finally
{
if (localObject1 != null) {
continue;
}
new ArrayList();
}
try
{
localObject1 = (List)gson.fromJson(localJSONObject.getString("listdata"), localType);
if (localObject1 == null) {
localObject1 = new ArrayList();
}
return localObject1;
}
finally {}
}
}

[/java]

[java collapse="true" title="com.guoke.chengdu.bashi.tools.util.ParamUtils"]
public static final String generateSignature(String paramString)
{
if ((paramString != null) && (paramString.contains("http://www.basiapp.com")))
{
String[] arrayOfString = paramString.split("[?]");
if (arrayOfString != null) {}
try
{
if (arrayOfString.length > 1)
{
LogUtils.d(LogUtils.LogAuthor.AUTHOR, "before : " + arrayOfString[1] + "&time=" + getNowTime());
LogUtils.d(LogUtils.LogAuthor.AUTHOR, "after : " + AESUtil.encrypt(new StringBuilder(String.valueOf(arrayOfString[1])).append("&time=").append(getNowTime()).toString()));
String str2 = arrayOfString[0] + "?signature=" + AESUtil.encrypt(new StringBuilder(String.valueOf(arrayOfString[1])).append("&time=").append(getNowTime()).toString());
LogUtils.d(LogUtils.LogAuthor.AUTHOR, "split : " + str2);
return str2;
}
String str1 = paramString + "?signature=" + AESUtil.encrypt(new StringBuilder("time=").append(getNowTime()).toString());
LogUtils.d(LogUtils.LogAuthor.AUTHOR, "split : " + str1);
return str1;
}
catch (Exception localException)
{
localException.printStackTrace();
}
}
return paramString;
}
public static final String getNowTime()
{
return new SimpleDateFormat("yyyy-MM-dd HH:mm:ss").format(new Date());
}

 

public static String keyValue = "666AA4DF3533497D973D852004B975BC";
public static String encrypt(String paramString)
throws Exception
{
SecretKeySpec localSecretKeySpec = new SecretKeySpec(shortmd5(keyValue), "AES");
Cipher localCipher = Cipher.getInstance("AES");
localCipher.init(1, localSecretKeySpec);
return byte2hex(localCipher.doFinal(paramString.getBytes())).toLowerCase();
}

原理就是向http://www.basiapp.com/Bus/BusCardBalance/请求数据

参数为signature,ASC加密数据为cardno=0001XXXXXXXX&time=Y-m-d H:i:s

加密秘钥为666AA4DF3533497D973D852004B975BC的MD5的特殊形式

private static byte[] shortmd5(String paramString)
throws Exception
{
MessageDigest localMessageDigest = MessageDigest.getInstance("MD5");
localMessageDigest.update(paramString.getBytes("UTF-8"));
return localMessageDigest.digest();
}

与

md5('',true)

等同

接下来是获得URL地址,从而获得所需数据(8位卡号前面补0001)

 

class Security {
public static function encrypt($input, $key) {
$size = mcrypt_get_block_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_ECB);
$input = Security::pkcs5_pad($input, $size);
$td = mcrypt_module_open(MCRYPT_RIJNDAEL_128, '', MCRYPT_MODE_ECB, '');
$iv = mcrypt_create_iv (mcrypt_enc_get_iv_size($td), MCRYPT_RAND);
mcrypt_generic_init($td, $key, $iv);
$data = mcrypt_generic($td, $input);
mcrypt_generic_deinit($td);
mcrypt_module_close($td);
$data = bin2hex($data);
return $data;
}

private static function pkcs5_pad ($text, $blocksize) {
$pad = $blocksize - (strlen($text) % $blocksize);
return $text . str_repeat(chr($pad), $pad);
}

public static function decrypt($sStr, $sKey) {
$decrypted= mcrypt_decrypt(
MCRYPT_RIJNDAEL_128,
$sKey,
base64_decode($sStr),
MCRYPT_MODE_ECB
);

$dec_s = strlen($decrypted);
$padding = ord($decrypted[$dec_s-1]);
$decrypted = substr($decrypted, 0, -$padding);
return $decrypted;
}
}

获得卡片余额

 

echo "http://www.basiapp.com/Bus/BusCardBalance/?signature=".Security::encrypt("cardno=0001{$CARD_NO}&time=". date('Y-m-d H:i:s',time()) ,  md5('666AA4DF3533497D973D852004B975BC',true));

BusCardBalance:卡片余额

QueryConsumption:消费记录

QueryTopUp:充值记录