特来电 APP AVER X-Token分析

声明
本文章中所有内容仅供学习交流使用，不用于其他任何目的，抓包内容、敏感网址、数据接口等均已做脱敏处理，严禁用于商业用途和非法用途，否则由此产生的一切后果均与作者无关！

使用的老版本hook show方法去除强制更新。

部分python代码

result = json.loads(decrypt(Data, UTS, UVER))
AccessToken = result['AccessToken']
print(AccessToken)
headers = {
    "a_c": "20000",
    "a_r": "20000",
    "TELDAppID": "",
    "Device": "",
    "AppOS": "Android",
    "AppVersion": "6.7.0",
    "ACOL": "",
    "ARS": "app",
    "X-Token": AccessToken,
    "ATS": ATS,
    "AVER": AVER,
    "DeviceTime": str(int(time.time())),
    "Teld-RequestID": f"_{int(time.time()*1000)}_Android",
    "Teld-RpcID": "0.4",
    "Host": "sg.teld.cn"
}
cookies = {
    "domain": ".teld.cn",
    "path": "/"
}
url = "api/invoke"
params = {
    "SID": ""
}
data = {
    "filter": "{\"MallType\":\"2\",\"Keywords\":\"广州\",\"CityID\":\"4401\",\"Sort\":\"1\",\"Page\":\"1\",\"SearchType\":\"1\",\"ShopID\":\"\",\"Rows\":\"3\"}"
}
response = requests.post(url, headers=headers, cookies=cookies, params=params, data=data)

print(response.text)
print(response)

result = json.loads(decrypt(Data, UTS, UVER))
AccessToken = result['AccessToken']
print(AccessToken)
headers = {
    "a_c": "20000",
    "a_r": "20000",
    "TELDAppID": "",
    "Device": "",
    "AppOS": "Android",
    "AppVersion": "6.7.0",
    "ACOL": "",
    "ARS": "app",
    "X-Token": AccessToken,
    "ATS": ATS,
    "AVER": AVER,
    "DeviceTime": str(int(time.time())),
    "Teld-RequestID": f"_{int(time.time()*1000)}_Android",
    "Teld-RpcID": "0.4",
    "Host": "sg.teld.cn"
}
cookies = {
    "domain": ".teld.cn",
    "path": "/"
}
url = "api/invoke"
params = {
    "SID": ""
}
data = {
    "filter": "{\"MallType\":\"2\",\"Keywords\":\"广州\",\"CityID\":\"4401\",\"Sort\":\"1\",\"Page\":\"1\",\"SearchType\":\"1\",\"ShopID\":\"\",\"Rows\":\"3\"}"
}
response = requests.post(url, headers=headers, cookies=cookies, params=params, data=data)

print(response.text)
print(response)

结果

总结

1.出于安全考虑,本章未提供完整流程,调试环节省略较多,只提供大致思路,具体细节要你自己还原,相信你也能调试出来。