Skip to content

R
ratel-demo
Commit 96e8b40e authored by Tsaiilin's avatar Tsaiilin
Browse files
Options

查询到下单完成

parent 55821cd2
Hide whitespace changes
Inline Side-by-side
Showing with 252 additions and 92 deletions
crack-tianjingairlines/src/main/java/ratel/crack/com/TianjinAirlines/androidApp/AirItineraryReservationHandler.java 0 → 100644
View file @ 96e8b40e
package ratel.crack.com.TianjinAirlines.androidApp;
import com.virjar.ratel.api.rposed.RposedHelpers;
import com.virjar.sekiro.business.api.interfaze.Action;
import com.virjar.sekiro.business.api.interfaze.AutoBind;
import com.virjar.sekiro.business.api.interfaze.RequestHandler;
import com.virjar.sekiro.business.api.interfaze.SekiroRequest;
import com.virjar.sekiro.business.api.interfaze.SekiroResponse;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Method;
import java.lang.reflect.Proxy;
import external.com.alibaba.fastjson.JSONObject;
@Action("AirItineraryReservation")
public class AirItineraryReservationHandler implements RequestHandler {
@AutoBind(require = true)
private String itineraryPriceIds;
private Object _rInstance;
private Class<?> itineraryPriceReqClazz;
private Class<?> callbackClazz;
public AirItineraryReservationHandler(Object _rInstance, Class<?> itineraryPriceReqClazz, Class<?> callbackClzaa) {
this._rInstance = _rInstance;
this.itineraryPriceReqClazz = itineraryPriceReqClazz;
this.callbackClazz = callbackClzaa;
}
@Override
public void handleRequest(SekiroRequest sekiroRequest, final SekiroResponse sekiroResponse) {
Object o = Proxy.newProxyInstance(callbackClazz.getClassLoader(), new Class[]{callbackClazz}, new InvocationHandler() {
@Override
public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
if (method.getName().equals("onRequestSuccess")) {
String result = RposedHelpers.getObjectField(args[0], "result");
sekiroResponse.success(JSONObject.parse(result));
} else if (method.getName().equals("onRequestError")) {
sekiroResponse.failed(args[0].toString());
}
return null;
}
});
Object itineraryPriceReq = RposedHelpers.newInstance(this.itineraryPriceReqClazz, itineraryPriceIds);
RposedHelpers.callMethod(this._rInstance, "getAirItineraryReservation", itineraryPriceReq, o);
}
}
crack-tianjingairlines/src/main/java/ratel/crack/com/TianjinAirlines/androidApp/AirLowSearchHandler.java
View file @ 96e8b40e
......@@ -19,8 +19,9 @@ import external.com.alibaba.fastjson.JSONObject;
@Action("AirLowSearch")
public class AirLowSearchHandler implements RequestHandler {
private final Object rs;
private final Class<?> u;
private final Object rsInstance;
private final Class<?> callBackClazz;
private final Class<?> getDescClazz;
@AutoBind(require = true)
private String origin;
......@@ -34,17 +35,17 @@ public class AirLowSearchHandler implements RequestHandler {
@AutoBind
private String backDate;
public AirLowSearchHandler(Object rs, Class<?> u) {
this.rs = rs;
this.u = u;
public AirLowSearchHandler(Object rsInstance, Class<?> getDescClazz, Class<?> callBackClazz) {
this.rsInstance = rsInstance;
this.callBackClazz = callBackClazz;
this.getDescClazz = getDescClazz;
}
@Override
public void handleRequest(SekiroRequest sekiroRequest, final SekiroResponse sekiroResponse) {
Class<?> aClass = RposedHelpers.findClass("com.eking.sdk.c", RatelToolKit.hostClassLoader);
String desc = (String) RposedHelpers.callStaticMethod(aClass, "getImei", RatelToolKit.sContext);
String desc = (String) RposedHelpers.callStaticMethod(getDescClazz, "getImei", RatelToolKit.sContext);
Log.i(HookEntry.TAG, "handleRequest desc: " + desc);
Object o = Proxy.newProxyInstance(u.getClassLoader(), new Class[]{u}, new InvocationHandler() {
Object o = Proxy.newProxyInstance(callBackClazz.getClassLoader(), new Class[]{callBackClazz}, new InvocationHandler() {
@Override
public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
if (method.getName().equals("onRequestSuccess")) {
......@@ -56,7 +57,7 @@ public class AirLowSearchHandler implements RequestHandler {
return null;
}
});
RposedHelpers.callMethod(rs, "getAirLowSearch", origin, destination, departureDate, backDate, desc, null, o);
RposedHelpers.callMethod(rsInstance, "getAirLowSearch", origin, destination, departureDate, backDate, desc, null, o);
Log.i(HookEntry.TAG, "handleRequest: call success");
}
}
crack-tianjingairlines/src/main/java/ratel/crack/com/TianjinAirlines/androidApp/CreateReservationHandler.java 0 → 100644
View file @ 96e8b40e
package ratel.crack.com.TianjinAirlines.androidApp;
import android.util.Log;
import com.virjar.ratel.api.RatelToolKit;
import com.virjar.ratel.api.rposed.RposedHelpers;
import com.virjar.sekiro.business.api.interfaze.Action;
import com.virjar.sekiro.business.api.interfaze.AutoBind;
import com.virjar.sekiro.business.api.interfaze.RequestHandler;
import com.virjar.sekiro.business.api.interfaze.SekiroRequest;
import com.virjar.sekiro.business.api.interfaze.SekiroResponse;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Method;
import java.lang.reflect.Proxy;
import java.util.ArrayList;
import java.util.List;
import external.com.alibaba.fastjson.JSONObject;
@Action("CreateReservation")
public class CreateReservationHandler implements RequestHandler {
private Object _rInstance;
private Class<?> createReservationReqClazz;
private Class<?> callbackClazz;
private final Class<?> getDescClazz;
private Class<?> customerBeanClazz;
private Class<?> passengerListBeanClazz;
@AutoBind(require = true)
private String shoppingCartId;
@AutoBind(require = true)
private String customerEmail;
@AutoBind(require = true)
private String customerFirstName;
@AutoBind(require = true)
private String customerLastName;
@AutoBind(defaultValue = "")
private String customerId;
@AutoBind(require = true)
private String customerMobile;
@AutoBind(require = true)
private String passengerBirthday;
@AutoBind(defaultValue = "")
private String passengerCardIssueCountry;
@AutoBind(defaultValue = "")
private String passengerCardValidDate;
@AutoBind(defaultValue = "")
private String passengerCountry;
@AutoBind(defaultValue = "")
private String passengerEmail;
@AutoBind(require = true)
private String passengerFirstName;
@AutoBind(require = true)
private String passengerIdNo;
@AutoBind(defaultValue = "1")
private String passengerIdType;
@AutoBind(require = true)
private String passengerLastName;
@AutoBind(require = true)
private String passengerMobile;
@AutoBind(defaultValue = "ADT")
private String passengerPassType;
@AutoBind(require = true)
private String passengerSex;
public CreateReservationHandler(Object _rInstance, Class<?> createReservationReqClazz, Class<?> getDescClazz, Class<?> customerBeanClazz, Class<?> passengerListBeanClazz, Class<?> callbackClazz) {
this._rInstance = _rInstance;
this.createReservationReqClazz = createReservationReqClazz;
this.getDescClazz = getDescClazz;
this.callbackClazz = callbackClazz;
this.customerBeanClazz = customerBeanClazz;
this.passengerListBeanClazz = passengerListBeanClazz;
}
@Override
public void handleRequest(SekiroRequest sekiroRequest, final SekiroResponse sekiroResponse) {
try {
Object customer = RposedHelpers.newInstance(this.customerBeanClazz);
RposedHelpers.callMethod(customer, "setEmail", customerEmail);
RposedHelpers.callMethod(customer, "setFirstName", customerFirstName);
RposedHelpers.callMethod(customer, "setLastName", customerLastName);
RposedHelpers.callMethod(customer, "setMobile", customerMobile);
RposedHelpers.callMethod(customer, "setId", customerId);
Object passenger = RposedHelpers.newInstance(this.passengerListBeanClazz);
RposedHelpers.callMethod(passenger, "setBirthday", passengerBirthday);
RposedHelpers.callMethod(passenger, "setCardIssueCountry", passengerCardIssueCountry);
RposedHelpers.callMethod(passenger, "setCardValidDate", passengerCardValidDate);
RposedHelpers.callMethod(passenger, "setCountry", passengerCountry);
RposedHelpers.callMethod(passenger, "setEmail", passengerEmail);
RposedHelpers.callMethod(passenger, "setFirstName", passengerFirstName);
RposedHelpers.callMethod(passenger, "setIdNo", passengerIdNo);
RposedHelpers.callMethod(passenger, "setIdType", passengerIdType);
RposedHelpers.callMethod(passenger, "setLastName", passengerLastName);
RposedHelpers.callMethod(passenger, "setMobile", passengerMobile);
RposedHelpers.callMethod(passenger, "setPassType", passengerPassType);
RposedHelpers.callMethod(passenger, "setSex", passengerSex);
String desc = (String) RposedHelpers.callStaticMethod(getDescClazz, "getImei", RatelToolKit.sContext);
Log.i(HookEntry.TAG, "handleRequest desc: " + desc);
Object createReservationReq = RposedHelpers.newInstance(this.createReservationReqClazz);
RposedHelpers.callMethod(createReservationReq, "setShoppingCartId", shoppingCartId);
RposedHelpers.callMethod(createReservationReq, "setDesc", desc);
RposedHelpers.callMethod(createReservationReq, "setCustomer", customer);
List<Object> passengerList = new ArrayList<>();
passengerList.add(passenger);
RposedHelpers.callMethod(createReservationReq, "setPassengerList", passengerList);
Log.i(HookEntry.TAG, "handleRequest: " + JSONObject.toJSONString(createReservationReq));
Object o = Proxy.newProxyInstance(callbackClazz.getClassLoader(), new Class[]{callbackClazz}, new InvocationHandler() {
@Override
public Object invoke(Object proxy, Method method, Object[] args) throws Throwable {
if (method.getName().equals("onRequestSuccess")) {
String result = RposedHelpers.getObjectField(args[0], "result");
sekiroResponse.success(result);
} else if (method.getName().equals("onRequestError")) {
sekiroResponse.failed(args[0].toString());
}
return null;
}
});
RposedHelpers.callMethod(this._rInstance, "getCreateReservation", createReservationReq, o);
} catch (Throwable throwable) {
Log.e(HookEntry.TAG, "handleRequest: ", throwable);
}
}
}
crack-tianjingairlines/src/main/java/ratel/crack/com/TianjinAirlines/androidApp/HookEntry.java
View file @ 96e8b40e
......@@ -10,7 +10,6 @@ import android.view.LayoutInflater;
import android.widget.FrameLayout;
import com.virjar.ratel.api.RatelToolKit;
import com.virjar.ratel.api.inspect.ClassLoadMonitor;
import com.virjar.ratel.api.rposed.IRposedHookLoadPackage;
import com.virjar.ratel.api.rposed.RC_MethodHook;
import com.virjar.ratel.api.rposed.RposedHelpers;
......@@ -20,9 +19,7 @@ import com.virjar.sekiro.business.api.interfaze.HandlerRegistry;
import com.virjar.sekiro.business.api.interfaze.SekiroRequest;
import com.virjar.sekiro.business.api.interfaze.SekiroRequestInitializer;
import java.lang.reflect.InvocationHandler;
import java.lang.reflect.Method;
import java.lang.reflect.Proxy;
import java.util.UUID;
/**
......@@ -36,25 +33,55 @@ public class HookEntry implements IRposedHookLoadPackage {
@Override
public void handleLoadPackage(final RC_LoadPackage.LoadPackageParam lpparam) {
if (lpparam.processName.equals(lpparam.packageName)) {
final Class<?> aClass = RposedHelpers.findClass("com.xc.tjhk.base.base.u", RatelToolKit.hostClassLoader);
Class<?> rs = RposedHelpers.findClass("rs", RatelToolKit.hostClassLoader);
final Object o = RposedHelpers.newInstance(rs);
// u 为响应回调接口
final Class<?> callbackClazz = RposedHelpers.findClass("com.xc.tjhk.base.base.u", RatelToolKit.hostClassLoader);
// rs 类有查询航班的方法，该对象没有复杂构建过程，可以直接反射创建
Class<?> rsClazz = RposedHelpers.findClass("rs", RatelToolKit.hostClassLoader);
final Object rsInstance = RposedHelpers.newInstance(rsClazz);
// _r 类中有查询下单 id 及创建最终订单的接口，同样 u 为回调接口
Class<?> _rClazz = RposedHelpers.findClass("_r", RatelToolKit.hostClassLoader);
final Object _rInstance = RposedHelpers.newInstance(_rClazz);
final Class<?> itineraryPriceReqClazz = RposedHelpers.findClass("com.xc.tjhk.ui.home.entity.ItineraryPriceReq", RatelToolKit.hostClassLoader);
final Class<?> createReservationReqClazz = RposedHelpers.findClass("com.xc.tjhk.ui.home.entity.CreateReservationReq", RatelToolKit.hostClassLoader);
final Class<?> customerBeanClazz = RposedHelpers.findClass("com.xc.tjhk.ui.home.entity.CreateReservationReq$CustomerBean", RatelToolKit.hostClassLoader);
final Class<?> passengerListBeanClazz = RposedHelpers.findClass("com.xc.tjhk.ui.home.entity.CreateReservationReq$PassengerListBean", RatelToolKit.hostClassLoader);
final Class<?> getDescClazz = RposedHelpers.findClass("com.eking.sdk.c", RatelToolKit.hostClassLoader);
new ClusterSekiroClient("TianJinAirLines", UUID.randomUUID().toString())
.setupSekiroRequestInitializer(new SekiroRequestInitializer() {
@Override
public void onSekiroRequest(SekiroRequest sekiroRequest, HandlerRegistry handlerRegistry) {
handlerRegistry.registerSekiroHandler(new AirLowSearchHandler(o, aClass));
handlerRegistry.registerSekiroHandler(new AirLowSearchHandler(rsInstance, getDescClazz, callbackClazz));
handlerRegistry.registerSekiroHandler(new AirItineraryReservationHandler(_rInstance, itineraryPriceReqClazz, callbackClazz));
handlerRegistry.registerSekiroHandler(new CreateReservationHandler(_rInstance,
createReservationReqClazz, getDescClazz, customerBeanClazz,
passengerListBeanClazz, callbackClazz));
}
})
.start();
Log.i(TAG, "handleLoadPackage: start sekiro");
}
backup();
Log.i(TAG, "hook end");
}
private void backup() {
RposedHelpers.findAndHookMethod("com.xc.tjhk.base.utils.a", RatelToolKit.hostClassLoader,
"decryptAES", String.class, new RC_MethodHook() {
@Override
protected void afterHookedMethod(MethodHookParam param) throws Throwable {
super.afterHookedMethod(param);
Log.i(TAG, "decryptAES param: " + param.args[0]);
Log.i(TAG, "decryptAES result: " + param.getResult());
}
});
// RposedHelpers.findAndHookConstructor("ci", RatelToolKit.hostClassLoader, new RC_MethodHook() {
// @Override
// protected void afterHookedMethod(MethodHookParam param) throws Throwable {
......@@ -75,81 +102,6 @@ public class HookEntry implements IRposedHookLoadPackage {
// }
// });
// ClassLoadMonitor.addClassLoadMonitor("ci", new ClassLoadMonitor.OnClassLoader() {
// @Override
// public void onClassLoad(Class<?> aClass) {
// Log.i(TAG, "onClassLoad: " + aClass.getName());
// try {
// RposedHelpers.findAndHookMethod("com.xc.tjhk.base.base.u.rs", aClass.getClassLoader(),
// "getAirLowSearch",
// String.class,
// String.class,
// String.class,
// String.class,
// String.class,
// String.class,
// "com.xc.tjhk.base.base.u",
// new RC_MethodHook() {
// @Override
// protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
// super.beforeHookedMethod(param);
// Log.i(TAG, "param0: " + param.args[0]);
// Log.i(TAG, "param1: " + param.args[1]);
// Log.i(TAG, "param2: " + param.args[2]);
// Log.i(TAG, "param3: " + param.args[3]);
// Log.i(TAG, "param4: " + param.args[4]);
// }
// });
//
// } catch (Throwable throwable) {
// Log.e(TAG, "handleLoadPackage: ", throwable);
// }
// RposedHelpers.findAndHookMethod(aClass, "getAirLowSearch",
// boolean.class,
// String.class,
// String.class,
// String.class,
// String.class,
// new RC_MethodHook() {
// @Override
// protected void beforeHookedMethod(MethodHookParam param) throws Throwable {
// super.beforeHookedMethod(param);
// Log.i(TAG, "param0: " + param.args[0]);
// Log.i(TAG, "param1: " + param.args[1]);
// Log.i(TAG, "param2: " + param.args[2]);
// Log.i(TAG, "param3: " + param.args[3]);
// Log.i(TAG, "param4: " + param.args[4]);
// }
// });
// }
// });
// try {
// Class<?> aClass = RposedHelpers.findClass("com.xc.tjhk.base.base.u", RatelToolKit.hostClassLoader);
// RposedHelpers.findAndHookMethod("rs", RatelToolKit.hostClassLoader, "getAirLowSearch",
// String.class,
// String.class,
// String.class,
// String.class,
// String.class,
// String.class,
// aClass,
// new RC_MethodHook() {
// @Override
// protected void afterHookedMethod(MethodHookParam param) throws Throwable {
// super.beforeHookedMethod(param);
// Log.i(TAG, "getAirLowSearch param0: " + param.args[0]);
// Log.i(TAG, "getAirLowSearch param1: " + param.args[1]);
// Log.i(TAG, "getAirLowSearch param2: " + param.args[2]);
// Log.i(TAG, "getAirLowSearch param3: " + param.args[3]);
// Log.i(TAG, "getAirLowSearch param4: " + param.args[4]);
// Log.i(TAG, "getAirLowSearch param5: " + param.args[5]);
//
// }
// }
// );
// } catch (Throwable t) {
// Log.e(TAG, "handleLoadPackage: ", t);
// }
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment