XCodeGhost 筆記

由於服務已經關掉了，因此要改路由Openwrt

vi /etc/config/dhcp 
vi /etc/dnsmasq/dnsmasq.conf
/etc/init.d/dnsmasq restart

dhcp文件在config dnsmasq節點追加：

list addnhosts '/etc/dnsmasq/dnsmasq.conf'

dnsmasq.conf文件追加：

192.168.1.11 icloud-analysis.com
192.168.1.11 init.icloud-analysis.com

nslookup init.icloud-analysis.com
Server:    127.0.0.1
Address 1: 127.0.0.1 localhost

Name:      init.icloud-analysis.com
Address 1: 192.168.1.11 icloud-analysis.com

PC 使用Fiddler抓HTTP包，手機端設置代理PC IP:8888

抓到：

POST http://init.icloud-analysis.com/ HTTP/1.1
Host: init.icloud-analysis.com
Accept: */*
Content-Type: application/x-www-form-urlencoded
Connection: keep-alive
Connection: keep-alive
Cookie: PHPSESSID=bddj900k9lk7esd5stf6ddhbh1
Accept-Language: zh-cn
Content-Length: 320
Accept-Encoding: gzip, deflate
User-Agent: OpenCourse/4.2.8 CFNetwork/758.0.2 Darwin/15.0.0

��
@�e�
�:� %Nה^�pY�yi-�[�T����(������P�����*��� �
��?����<g�b���*fx;t�&���g ʤZ�d���j��W����K �~�������&�J�
r:p�L������P_��P��(pN�+kF�L���J
#gw;�=b��=�_Zb}�����8=�3��ˮ9S9����Ù��撍�>����
�

內容加密，已經解開以下

{
    "len": 320,
    "cmd": 101,
    "ver": 10,
    "txt": {
        "bundle": "com.netease.videoHD",
        "os": "9.0",
        "status": "resignActive",
        "app": "OpenCourse",
        "country": "CN",
        "idfv": "60C3FBEE-XXXXXXXXXXXXXXXXXXXXXXXXXXX",
        "language": "zh-Hans-CN",
        "version": "4.2.8",
        "type": "iPhone7,2",
        "timestamp": "1442915343",
        "name": "my-iPhone"
    }
}

嘗試返回數據，無效。沒環境，不玩了

{
    "alertHeader": "我是萬惡的彈出框",
    "alertBody": "你好我是萬惡的彈出框，錢打這個卡上。",
    "appID": "0",
    "cancelTitle": "肯定",
    "confirmTitle": "取消",
    "scheme": "mqqopensdkapiV2://qzapp"
}