脱敏说明：目标站点域名、接口密钥与邀请码已脱敏，仅保留分析方法与流程。
邀请人
注册
设备注册，拿到临时账号，得到邀请码
解密密钥算法
aes cbc pkcs7padding
头条
密钥为REDACTED
偏移为NTobdLvTqyEhNV46
硬编码
U蓝
密钥为REDACTED
偏移为S87Iwwp7wJl0d8W1
被邀请人
下载
扫描二维码得到下载链接，浏览器会添加到剪贴板，下载完成并打开软件会进行识别，上传
相关接口
响应包含vno，分类，公告等信息，第一次打开获取的
curl --http2 -X GET -H "Host:api-target-01.example.com" -H "equip:PD2324" -H "sysinfo:ANDROID" -H "sysver:10" -H "vos:ANDROID" -H "vcode:" -H "vsk:7ac4cdb251fe73c7dc024ec575dfb2a058ff424a31c05061179f00d671080a00" -H "content-type:application/json" -H "vmid:REDACTED" -H "app-version:2.8.3" -H "version-code:1" -H "app-name:GGT" -H "device-modal:vivo" -H "vke:REDACTED" -H "vsd:1" -H "vtoken:9j4al/9/qEItiukFSAICEEuTj0HdPqb4YHdXRDIFQDQps8JqSVwwjv5PW7vayURc" -H "vtime:1714278807578" -H "vversion:283" -H "device-uniq:REDACTED" -H "os:android" -H "package-name:com.play.app" -H "os-version:10" -H "client-time:1714278807578" -H "rand-str:REDACTED1714278807578829980317" -H "accept-encoding:gzip" -H "user-agent:okhttp/4.9.0" "https://api-target-01.example.com/app/run/info"
注册，获取nickname和其他信息
curl --http2 -X GET -H "Host:api-target-01.example.com" -H "content-type:application/json" -H "vmid:REDACTED" -H "app-version:2.8.3" -H "version-code:1" -H "app-name:GGT" -H "device-modal:vivo" -H "vke:REDACTED" -H "vsd:1" -H "vtoken:9j4al/9/qEItiukFSAICEEuTj0HdPqb4YHdXRDIFQDR+HWQlumW1cMsc6Kr8LfCNKPPLgcA7l+/tRdJ7A6meW4/nfZxG4uhzphWd1yiFNYQ1IZBVfs29WiobzfBke8JC" -H "vtime:1714278808245" -H "vversion:283" -H "device-uniq:REDACTED" -H "os:android" -H "package-name:com.play.app" -H "os-version:10" -H "client-time:1714278808245" -H "rand-str:REDACTED17142788082455337748369" -H "vno:g662dd198e4b0a6ab82029477i3y2rqlq" -H "accept-encoding:gzip" -H "user-agent:okhttp/4.9.0" "https://api-target-01.example.com/member/home/info"
重点，这个是invite接口，用于记录邀请
code为1，密文为success，邀请成功
curl --http2 -X GET -H "Host:api-target-01.example.com" -H "content-type:application/json" -H "vmid:REDACTED" -H "app-version:2.8.3" -H "version-code:1" -H "app-name:GGT" -H "device-modal:vivo" -H "vke:REDACTED" -H "vsd:1" -H "vtoken:9j4al/9/qEItiukFSAICEEuTj0HdPqb4YHdXRDIFQDR+HWQlumW1cMsc6Kr8LfCNKPPLgcA7l+/tRdJ7A6meW4/nfZxG4uhzphWd1yiFNYQ1IZBVfs29WiobzfBke8JC" -H "vtime:1714278808606" -H "vversion:283" -H "device-uniq:REDACTED" -H "os:android" -H "package-name:com.play.app" -H "os-version:10" -H "client-time:1714278808606" -H "rand-str:REDACTED17142788086066009619712" -H "vno:g662dd198e4b0a6ab82029477i3y2rqlq" -H "accept-encoding:gzip" -H "user-agent:okhttp/4.9.0" "https://api-target-01.example.com/app/invite/bind?code=REDACTED"
主页信息的
curl --http2 -X GET -H "Host:api-target-01.example.com" -H "content-type:application/json" -H "vmid:REDACTED" -H "app-version:2.8.3" -H "version-code:1" -H "app-name:GGT" -H "device-modal:vivo" -H "vke:REDACTED" -H "vsd:1" -H "vtoken:9j4al/9/qEItiukFSAICEEuTj0HdPqb4YHdXRDIFQDR+HWQlumW1cMsc6Kr8LfCNKPPLgcA7l+/tRdJ7A6meW4/nfZxG4uhzphWd1yiFNYQ1IZBVfs29WiobzfBke8JC" -H "vtime:1714278812429" -H "vversion:283" -H "device-uniq:REDACTED" -H "os:android" -H "package-name:com.play.app" -H "os-version:10" -H "client-time:1714278812429" -H "rand-str:REDACTED17142788124296749412666" -H "vno:g662dd198e4b0a6ab82029477i3y2rqlq" -H "accept-encoding:gzip" -H "user-agent:okhttp/4.9.0" "https://api-target-01.example.com/consumer/advice/perfect"
视频播放链接
curl -X GET -H "User-Agent:ExoSourceManager/2.8.3 (Linux;Android 10) ExoPlayerLib/2.16.1" -H "Accept-Encoding:gzip" -H "Host:cdn-target-01.example.com" -H "Connection:Keep-Alive" "https://cdn-target-01.example.com/files/few/f662ca2fee4b020aab27c3b24/662ca2e0e4b020aab27c3b1e.m3u8"
付费的是/few/，免费能看的是/view/
搜索接口，post
此处的content加密，解密后还有一个json
curl --http2 -X POST -H "Host:api-target-02.example.com" -H "page:1" -H "size:15" -H "vmid:REDACTED" -H "app-version:2.8.3" -H "version-code:1" -H "app-name:GGT" -H "device-modal:vivo" -H "vke:REDACTED" -H "vsd:1" -H "vtoken:9j4al/9/qEItiukFSAICEEuTj0HdPqb4YHdXRDIFQDR+HWQlumW1cMsc6Kr8LfCNKPPLgcA7l+/tRdJ7A6meW4/nfZxG4uhzphWd1yiFNYQ1IZBVfs29WiobzfBke8JC" -H "vtime:1714279531986" -H "vversion:283" -H "device-uniq:REDACTED" -H "os:android" -H "package-name:com.play.app" -H "os-version:10" -H "client-time:1714279531986" -H "rand-str:REDACTED17142795319869932043913" -H "vno:g662dd198e4b0a6ab82029477i3y2rqlq" -H "content-type:application/json;charset=UTF-8" -H "content-length:58" -H "accept-encoding:gzip" -H "user-agent:okhttp/4.9.0" -d "{"content":"MFfFAVe+HDlfFlVpi8fXu3XppmBpAviNB19IXtMIzYc="}" "https://api-target-02.example.com/player/search/video"
通过id获取视频详情，包括视频文件链接
curl --http2 -X GET -H "Host:api-target-02.example.com" -H "content-type:application/json" -H "vmid:REDACTED" -H "app-version:2.8.3" -H "version-code:1" -H "app-name:GGT" -H "device-modal:vivo" -H "vke:REDACTED" -H "vsd:1" -H "vtoken:9j4al/9/qEItiukFSAICEEuTj0HdPqb4YHdXRDIFQDR+HWQlumW1cMsc6Kr8LfCNKPPLgcA7l+/tRdJ7A6meW4/nfZxG4uhzphWd1yiFNYQ1IZBVfs29WiobzfBke8JC" -H "vtime:1714279614579" -H "vversion:283" -H "device-uniq:REDACTED" -H "os:android" -H "package-name:com.play.app" -H "os-version:10" -H "client-time:1714279614579" -H "rand-str:REDACTED17142796145794886612972" -H "vno:g662dd198e4b0a6ab82029477i3y2rqlq" -H "accept-encoding:gzip" -H "user-agent:okhttp/4.9.0" "https://api-target-02.example.com/player/video/info?id=s65f84e19e4b04cade3e822d0"
参数
- vmid 设备id，固定不变
- vtoken 设备id加密 格式{"vmid":"REDACTED"}
- 请求接口的vmid {"vmid":"REDACTED","vno":"g662dd198e4b0a6ab82029477i3y2rqlq"}
- device-uniq 设备id