用 burpsuite 抓陌陌 app 出现了出现了未知编码的数据

Question

我在手机上随意乱输一个账户并登录就抓到以下请求： 请问这个 post 数据是什么编码呢？？？

---

`POST /resolve HTTP/1.1
host:httpdns.immomo.com
Accept: /
User-Agent:MomoChat/8.22.4 Android/5485 (unknown; Android 9; Gapps 1; zh_TW; 1; unknown)
Content-Length: 552
Content-Type: application/x-www-form-urlencoded
Connection: close

mzip=suJjy%2Bm5DUIusR7ZLs7a8yLbgalrHtw%2FBSHxDmMQyKB%2Fepgdqf5v5tXTHZmCowQsNwybsor%2F38Wedj%2FmD1ORsQtSCD1ahc%2FR3zLwoeCLBaJGbu2HZqOu3WxXt5DWk6NKdMkmWOZJN1s5zI4gcrijIpmh4Yb9BS4ZZsQQpzum5yDEeeJvZEaCvb2AR4w5QyF3tZhTaR1dbdcZX%2B1WqiXPuzgAcn04vY4Qh4YWsAq9W8kwRwSCgoKTKPaHfZ27VPhCaXGvLkGt%2BbKx%2FoLivuGkoshGcovofMoCxjTx4dzh72O0vXZGivc%2FaqOEnSdBKybz0S28mI2whx6nIsB57j2W0Q%3D%3D&msc=cCCqlFdp6LL7zIdN2Izc4uFGBwjDtpRiW9si2pZ2gM1Y5rxZPrhyI2e0llieVMcuXAfmp7Hbxhs94dwr0j60jh2Yr0Fc15dvlfza5eyYniMXSlxm91HH3uQn35Gb0KAtHhhpbBQZ4DzbraPr3O7brKj7QSBjT6xXMcAJtKHuz7o%3D`

---

我通過classes-dex2jar反編譯並全局搜索“mzip”找到文件“DefaultMMFileUploader.java”源碼如下，有大神幫忙分析一下嗎：

---

`package com.cosmos.mmfile;

import android.text.TextUtils;
import j.aa.a;
import j.ab;
import j.ac;
import j.ad;
import j.e;
import j.v;
import j.w;
import j.w.a;
import j.x;
import j.x.a;
import java.io.File;
import java.util.concurrent.TimeUnit;
import org.json.JSONObject;

public class DefaultMMFileUploader
implements IMMFileUploader
{
private static final int TIMEOUT_READ = 5;
private static final int TIMEOUT_WRITE = 15;
private static final x client = new x.a().c(15L, TimeUnit.SECONDS).b(5L, TimeUnit.SECONDS).a();
private String appId;
private String deviceId;

public DefaultMMFileUploader(String paramString1, String paramString2)
{

this.appId = paramString2;
this.deviceId = paramString1;

}

private boolean uploadLogFile(File paramFile)

throws Exception

{

boolean bool2 = TextUtils.isEmpty(this.deviceId);
boolean bool1 = false;
if (!bool2)
{
  if (TextUtils.isEmpty(this.appId))
    return false;
  Object localObject1 = new JSONObject();
  ((JSONObject)localObject1).put("deviceId", this.deviceId);
  ((JSONObject)localObject1).put("appId", this.appId);
  ((JSONObject)localObject1).put("timestamp", System.currentTimeMillis());
  Object localObject2 = ENCUtils.random(16);
  String str = Base64.encode(ENCUtils.RSAEncode(((String)localObject2).getBytes()));
  localObject1 = ENCUtils.getInstance().encrypt(((JSONObject)localObject1).toString(), (String)localObject2);
  localObject2 = new w.a("---------------------------7da2137580612");
  ((w.a)localObject2).a(w.e);
  v localv = v.b("application/octet-stream");
  paramFile = ((w.a)localObject2).a("msc", str).a("mzip", (String)localObject1).a("logFile", paramFile.getName(), ab.create(localv, paramFile)).a();
  paramFile = new aa.a().a("https://cosmos-api.immomo.com/v2/log/client/upload").a(paramFile).d();
  paramFile = client.a(paramFile).b();
  if (paramFile.d())
  {
    if (new JSONObject(new String(paramFile.h().bytes(), "UTF-8")).optInt("ec", -1) == 0)
      bool1 = true;
    return bool1;
  }
  return false;
}
return false;

}

public boolean upload(String paramString)
{

try
{
  boolean bool = uploadLogFile(new File(paramString));
  return bool;
}
catch (Exception paramString)
{
  paramString.printStackTrace();
}
return false;

}
}
`

Answer 1

从格式上看是对字节流做 Base64 再 URLEncode 的结果。

至于字节流本身显然已经是加密或压缩过的数据了，如果你不知道解密或解压缩的算法，那就没招儿了。

---

【针对补充】

从类名和方法名来看是 ENC 算法和 RSA 算法对 JSON 加密后 Base64 了。那么你想反解已经是不可能了，这是非对称加密，用公钥加密只能用私钥解密了，私钥存储在服务器上。

Answer 2

好像不是常见编码,应该是自己的算法的加密的;强破应该不可能,一般遇到这种app反编译看看是怎么做的