美和易思app协议分析及反编译思路解析

获取apk文件

点击下载

反编译apk

1. apktool.bat；apktool.jar
   作用：最大程度的还原apk中的manifest文件和资源文件 。使用apktool工具反编译apk文件比直接解压同一个apk文件大；还可以将反编译之后的apk重新打包成apk文件，但需要重新签名，才能安装使用。 
2. classes-dex2.jar
   作用：将APK直接解压后，目录下包含的一个classes.dex文件反编译为
3. dex2jar
   作用：直接查看classes-dex2jar.jar文件

分析反编译后的包体

查看包体，会得到assets目录,如图

apps目录则是app的核心代码，这里没有经过原生安卓的方法，因为经过分析，此app是使用MUI，用js编写的app，为webview，所有核心代码都在此目录！我们使用HbuilderX打开此目录，则app的工程文件自动显示，接下来，我们可以随意查看代码

分析代码业务逻辑

查看代码后，我们会得到如下信息:
1. app接口: http://api.51moot.cn/api/

2. 静态资源网址: https://mootimg.oss-cn-beijing.aliyuncs.com/Moot/ 
3. 核心sign获取接口:http://api.51moot.cn/api/v1/sign

所有请求都会验证sign的正确性，不过可笑的是这个sign是固定的！

分析播放业务逻辑

通过查阅代码，我们可以找到视频播放页面是course_vedio.html，核心代码course_vedio.js文件，以下是播放器初始化代码，可以看出只需要传入我们的用户ID就可以统计时长

通过百度查找polyvObject方法，我们可以得到这是保利威公司的播放器sdk，核心依赖sdk文档->点击查看
至此，我们只需要拼接所需信息即可完成模拟播放，以下是我封装过的接口，使用php语言编写，通过此接口我们可以得到任何想要的信息

更新日志:

2021-01-07：
(1.)支持学生账户提取试卷及一键答题
2020-10-28:
(1.)修复APP外部与内部进度不同步的问题
2020-09-02:
(1.)修复节点失效
2020-08-17:
(1.)增加一键秒刷
2020-06-03:
(1.)增加pc协议支持
(2.)增加pc cookie提取
(3.)增加pc协议的视频加密信息获取
(4.)网站同时支持falsh和h5内核，播放更加流畅
(5.)优化答题业务逻辑

1. <?php
3. namespace SinKingCloud;
5. class Mstanford
6. {
7. private $ApiUrl = array(‘pc’ => ‘https://www.51moot.net/’, ‘mobile’ => ‘http://112.126.118.66/’);
8. private $sign; //签名
9. private $UserInfo; //账户信息
10. public $cookies = null; //pc cookie
11. /**
12. *构造参数
13. */
14. function __construct($ApiUrl = false, $sign = false)
15. {
16. if ($ApiUrl) {
17. $this->ApiUrl = $ApiUrl;
18. }
19. if ($sign) {
20. $this->sign = $sign;
21. } else {
22. $this->sign = $this->get_sign();
23. }
24. }
25. /**
26. * 获取sign
27. * @return String 签名
28. */
29. private function get_sign()
30. {
31. $res = $this->get_curl($this->ApiUrl[‘mobile’] . “/api/v1/sign”);
32. $arr = json_decode($res, true);
33. if (!array_key_exists(‘code’, $arr)) {
34. return false;
35. }
36. if ($arr[‘code’] == 0) {
37. return $arr[‘data’];
38. } else {
39. return false;
40. }
41. }
42. /**
43. * 账户登陆(app协议)
44. * @param String $user 账户
45. * @param String $pwd 密码
46. * @return Array 数据集
47. */
48. public function UserLogin($user, $pwd)
49. {
50. if (!empty($user) && !empty($pwd)) {
51. if (empty($this->sign)) {
52. $this->get_sign();
53. }
54. $res = $this->get_curl($this->ApiUrl[‘mobile’] . “/api/v1/web_user?login_name=” . $user . “&login_pass=” . $pwd . “&sign=” . $this->sign);
55. $arr = json_decode($res, true);
56. if (!array_key_exists(‘code’, $arr)) {
57. return false;
58. }
59. if ($arr[‘code’] == 0) {
60. $this->UserInfo = $arr[‘data’];
61. return $arr[‘data’];
62. } else {
63. return false;
64. }
65. } else {
66. return false;
67. }
68. }
69. /**
70. * 账户登陆(pc协议)
71. * @param String $user 账户
72. * @param String $pwd 密码
73. * @return Array 数据集
74. */
75. public function UserPcLogin($user, $pwd)
76. {
77. if (!empty($user) && !empty($pwd)) {
78. if (empty($this->sign)) {
79. $this->get_sign();
80. }
81. $res = $this->get_curl($this->ApiUrl[‘pc’] . “/main/login_validate”, “login_name=” . $user . “&login_pass=” . $pwd . “&auto_login=true”, 0, 0, 1);
82. $arr = explode(“n”, $res);
83. $data = json_decode(end($arr), true);
84. if ($data[‘code’] == ‘success’) {
85. //取cookie
86. preg_match_all(‘/Set-Cookie: (.*?);/’, $res, $arr);
87. $this->cookies = implode(“;”, $arr[1]);
88. //二次登陆获取用户信息
89. return $this->UserLogin($user, $pwd);
90. } else {
91. return false;
92. }
93. } else {
94. return false;
95. }
96. }
97. /**
98. * 账户信息查询(app协议)
99. * @param Int $uid 账户ID
100. * @return Array 数据集
101. */
102. public function UserQuery($uid)
103. {
104. if (!empty($uid)) {
105. if (empty($this->sign)) {
106. $this->get_sign();
107. }
108. $res = $this->get_curl($this->ApiUrl[‘mobile’] . ‘/api/v1/web_user?id=’ . $uid . ‘&sign=’ . $this->sign);
109. $arr = json_decode($res, true);
110. if (!array_key_exists(‘code’, $arr)) {
111. return false;
112. }
113. if ($arr[‘code’] == 0) {
114. $this->UserInfo = $arr[‘data’];
115. return $arr[‘data’];
116. } else {
117. return false;
118. }
119. } else {
120. return false;
121. }
122. }
123. /**
124. * 课程信息查询(app协议)
125. * @param Array $id 课程ID
126. * @return Array 数据集
127. */
128. public function CourseQuery($id = array(), $uid = 6518)
129. {
130. if (empty($id) || !is_array($id) || empty($this->sign)) {
131. return false;
132. } else {
133. $list = implode(‘,’, $id);
134. $data = array();
135. for ($i = 1; $i <= 5; $i++) {
136. $res = $this->get_curl($this->ApiUrl[‘mobile’] . “/api/v1/course_info?page_index=0&page_size=9999&id_list=” . $list . “&type=1&is_progress=true&user_id=” . $uid . “&assort_id=3&sign=” . $this->sign);
137. $arr = json_decode($res, true);
138. if (!array_key_exists(‘code’, $arr)) {
139. continue;
140. }
141. if ($arr[‘code’] == 0) {
142. foreach ($arr[‘data’][‘rows’] as $key) {
143. $data[] = $key;
144. }
145. } else {
146. continue;
147. }
148. }
149. return $data;
150. }
151. }
152. /**
153. * 课程详情(app协议)
154. * @param Int $id 课程ID
155. * @return Array
156. */
157. public function CourseInfo($id)
158. {
159. if (empty($id)) {
160. return false;
161. }
162. if (empty($this->sign)) {
163. $this->get_sign();
164. }
165. $res = $this->get_curl($this->ApiUrl[‘mobile’] . “/api//v1/course_dirctory?course_id=” . $id . “&sign=” . $this->sign);
166. $arr = json_decode($res, true);
167. if (!array_key_exists(‘code’, $arr)) {
168. return false;
169. }
170. if ($arr[‘code’] == 0) {
171. return $arr[‘data’];
172. } else {
173. return false;
174. }
175. }
176. /**
177. * 视频详情(app协议)
178. * @param Array $id 课程ID
179. * @return Array 数据集
180. */
181. public function DirctoryInfo($id)
182. {
183. if (empty($id)) {
184. return false;
185. } else {
186. if (empty($this->sign)) {
187. $this->get_sign();
188. }
189. $res = $this->get_curl($this->ApiUrl[‘mobile’] . “/api/v1/course_dirctory?id=” . $id . “&is_dirctory=true&sign=” . $this->sign);
190. $arr = json_decode($res, true);
191. if (!array_key_exists(‘code’, $arr)) {
192. return false;
193. }
194. if ($arr[‘code’] == 0) {
195. return $arr[‘data’];
196. } else {
197. return false;
198. }
199. }
200. }
201. /**
202. * 视频详情(pc协议)
203. * @param Array $id 课程ID
204. * @return Array 数据集
205. */
206. public function DirctoryPcInfo($id)
207. {
208. if (empty($id)) {
209. return false;
210. } else {
211. if (empty($this->cookies)) {
212. return false;
213. }
214. $res = $this->get_curl($this->ApiUrl[‘pc’] . “/server_hall_2/server_hall_2/video_play?dir_id=” . $id . “&do=_do”, 0, 0, $this->cookies);
215. //取视频加密信息
216. preg_match_all(‘/polyvPlayer([sS]*?);/i’, $res, $arr);
217. if (isset($arr[0][0])) {
218. $res = substr(substr($arr[0][0], 12), 0, -2);
219. $arr = json_decode(str_replace(array(“n”, “t”, “wrap”, “false”, “‘”), array(“”, “”, “‘wrap'”, “‘false'”, ‘”‘), $res), true);
220. return array(
221. ‘vid’ => $arr[‘vid’],
222. ‘ts’ => $arr[‘ts’],
223. ‘sign’ => $arr[‘sign’],
224. ‘session_id’ => $arr[‘session_id’],
225. ‘playsafe’ => $arr[‘playsafe’]
226. );
227. } else {
228. return false;
229. }
230. }
231. }
232. /**
233. * 试卷评测(app协议)
234. * @param Int $id 试卷ID
235. * @param Int $uid 用户ID
236. * @param Int $num 错误的个数
237. * @return Array 数据集
238. */
239. public function CourseTest($id, $uid, $num = 0)
240. {
241. if (empty($id) || empty($uid)) {
242. return false;
243. }
244. if (empty($this->sign)) {
245. $this->get_sign();
246. }
247. $arr = $this->GetTestInfo($id);
248. if ($arr) {
249. $data1 = “api_action=evaluating_check&example_id=” . $id . “&user_id=” . $uid . “&sign=” . $this->sign;
250. $ids = array();
251. $ids2 = array();
252. $errors = array();
253. for ($i = 0; $i < $num; $i++) {
254. $errors[] = rand(0, count($arr));
255. }
256. $i = 0;
257. foreach ($arr as $value) {
258. $ids[] = $value[‘id’];
259. if (in_array($i, $errors)) {
260. $value[‘answer_list’] = rand(0, 3);
261. }
262. $ids2[] = ‘&answer_list’ . $value[‘id’] . ‘=’ . $value[‘answer_list’];
263. $i++;
264. }
265. $data2 = “&subject_id_list=” . implode(“[{@}]”, $ids);
266. $data3 = implode(“”, $ids2);
267. $data = $data1 . $data2 . $data3;
268. $res2 = $this->put_curl($this->ApiUrl[‘mobile’] . “/api/v1/example_subject”, $data);
269. $arr2 = json_decode($res2, true);
270. if ($arr2[‘code’] == 0) {
271. return $arr2[‘data’];
272. } else {
273. return false;
274. }
275. } else {
276. return false;
277. }
278. }
279. /**
280. * 试卷评测结果(app协议)
281. * @param Int $id 试卷ID
282. * @param Int $uid 用户ID
283. * @return Array 数据集
284. */
285. public function GetTestResault($id, $uid)
286. {
287. if (empty($id) || empty($uid)) {
288. return false;
289. }
290. if (empty($this->sign)) {
291. $this->get_sign();
292. }
293. $res = $this->get_curl($this->ApiUrl[‘mobile’] . “/api/v1/example_result?example_id=” . $id . “&user_id=” . $uid . “&is_ext=true&sign=” . $this->sign);
294. $arr = json_decode($res, true);
295. if (!array_key_exists(‘code’, $arr)) {
296. return false;
297. }
298. return $arr[‘data’];
299. }
300. /**
301. * 试卷详情(app协议)
302. * @param Int $id 试卷ID
303. * @return Array 数据集
304. */
305. public function GetTestInfo($id)
306. {
307. if (empty($this->sign)) {
308. $this->get_sign();
309. }
310. $res = $this->get_curl($this->ApiUrl[‘mobile’] . “/api/v1/example_subject?example_id=” . $id . “&is_random=false&sign=” . $this->sign);
311. $arr = json_decode($res, true);
312. if (!array_key_exists(‘code’, $arr)) {
313. return false;
314. }
315. if ($arr[‘code’] == 0) {
316. return $arr[‘data’];
317. }
318. return false;
319. }
320. /**
321. * 用户试卷列表(pc协议)
322. * @param Boolean 是否为老师
323. * @return Array 数据集
324. */
325. public function GetTestList($admin = false)
326. {
327. if (empty($this->cookies)) {
328. return false;
329. }
330. $type = $admin ? “tea” : “stu”;
331. $res = $this->get_curl($this->ApiUrl[‘pc’] . “/server_hall_2/” . $type . “/examine”, 0, 0, $this->cookies);
332. preg_match_all(‘/JSON.parse[sS]*?}/i’, $res, $arr);
333. if ($arr[0]) {
334. $new = array();
335. foreach ($arr[0] as $key) {
336. $txt = htmlspecialchars_decode(str_replace(“JSON.parse(‘”, “”, $key));
337. $arr2 = json_decode($txt, true);
338. if (empty($arr2[‘id’]) || empty($arr2[‘title’])) continue;
339. $new[] = array(
340. ‘id’ => $arr2[‘id’],
341. ‘title’ => $arr2[‘title’]
342. );
343. }
344. $tmp_arr = array();
345. foreach ($new as $k => $v) {
346. if (in_array($v[‘id’], $tmp_arr)) {
347. unset($new[$k]);
348. } else {
349. $tmp_arr[$k] = $v[‘id’];
350. }
351. }
352. return $new;
353. } else {
354. return false;
355. }
356. }
358. /**
359. * 观看视频
360. * @param Int $user_id 用户id
361. * @param String $video_id 视频id值
362. * @param Int $times 观看秒数
363. * @param Int $id 视频id
364. * @return Boolean 执行结果
365. */
366. public function LookVideo($user_id, $video_id, $times, $id)
367. {
368. $pid = time() . rand(100, 999) . ‘X’ . rand(100000, 999999);
369. $vid = $video_id;
370. $uid = substr($vid, 0, 10);
371. $flow = 0;
372. $ts = time() . “886”;
373. $href = ‘https://www.51moot.net/server_hall_2/server_hall_2/video_play?dir_id=’ . $id . ‘&do=_do’;
374. $duration = $times;
375. $cts = $times;
376. $pd = $times;
377. $sd = 10;
378. $param2 = base64_encode($user_id);
379. $pn = ‘HTML5’;
380. $pv = ‘v1.15.1’;
381. $cataid = “1480326650851”;
382. $sign = md5(“rtas.net” . $pid . $vid . ‘0’ . $pd . $cts);
383. $url = ‘https://prtas.videocc.net/v2/view?pid=’ . $pid . ‘&vid=’ . $vid . ‘&uid=’ . $uid . ‘&flow=’ . $flow . ‘&ts=’ . $ts . ‘&href=’ . base64_encode($href) . ‘&duration=’ . $duration . ‘&cts=’ . $cts . ‘&sign=’ . $sign . ‘&sd=’ . $sd . ‘&pd=’ . $pd . ‘&pn=’ . $pn . ‘&pv=’ . $pv . ‘&param2=’ . $param2 . ‘&cataid=’ . $cataid . ‘&ute=bop’;
384. return $this->get_curl($url) == “1”;
385. }
387. /**
388. * Curl get post请求
389. * @param String $url 网址
390. * @param String $post POST参数
391. * @param String $referer refer地址
392. * @param String $cookie 携带COOKIE
393. * @param String $header 请求头
394. * @param String $ua User-agent
395. * @param String $nobaody 重定向
396. * @return String 数据
397. */
398. private function get_curl($url, $post = 0, $referer = 0, $cookie = 0, $header = 0, $ua = 0, $nobaody = 0)
399. {
400. $ch = curl_init();
401. curl_setopt($ch, CURLOPT_URL, $url);
402. curl_setopt($ch, CURLOPT_TIMEOUT, 60);
403. curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
404. curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
405. $clwl[] = “Accept:*/*”;
406. $clwl[] = “Accept-Encoding:gzip,deflate,sdch”;
407. $clwl[] = “Accept-Language:zh-CN,zh;q=0.8”;
408. curl_setopt($ch, CURLOPT_HTTPHEADER, $clwl);
409. if ($post) {
410. curl_setopt($ch, CURLOPT_POST, 1);
411. curl_setopt($ch, CURLOPT_POSTFIELDS, $post);
412. }
413. if ($header) {
414. curl_setopt($ch, CURLOPT_HEADER, TRUE);
415. }
416. if ($cookie) {
417. curl_setopt($ch, CURLOPT_COOKIE, $cookie);
418. }
419. if ($referer) {
420. if ($referer == 1) {
421. curl_setopt($ch, CURLOPT_REFERER, $this->ApiUrl . $url);
422. } else {
423. curl_setopt($ch, CURLOPT_REFERER, $referer);
424. }
425. }
426. if ($ua) {
427. curl_setopt($ch, CURLOPT_USERAGENT, $ua);
428. } else {
429. curl_setopt($ch, CURLOPT_USERAGENT, ‘Mozilla/5.0 (Linux; U; Android 4.0.4; es-mx; HTC_One_X Build/IMM76D) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0’);
430. }
431. if ($nobaody) {
432. curl_setopt($ch, CURLOPT_NOBODY, 1);
433. //主要头部
434. curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); //跟随重定向
435. }
436. curl_setopt($ch, CURLOPT_ENCODING, “gzip”);
437. curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
438. $ret = curl_exec($ch);
439. curl_close($ch);
440. return $ret;
441. }
442. /**
443. * Curl PUT请求
444. * @param String $url 网址
445. * @param String $data 参数
446. * @param Array $header 请求头
447. * @return String 数据
448. */
449. private function put_curl($url, $data = “”, $header = array())
450. {
451. $ch = curl_init();
452. $header[] = “Content-type:application/x-www-form-urlencoded”;
453. curl_setopt($ch, CURLOPT_URL, $url);
454. curl_setopt($ch, CURLOPT_CUSTOMREQUEST, “PUT”);
455. curl_setopt($ch, CURLOPT_HEADER, 0);
456. curl_setopt($ch, CURLOPT_HTTPHEADER, $header);
457. curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
458. curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
459. $res = curl_exec($ch);
460. curl_close($ch);
461. return $res;
462. }
463. }
     

     总体功能实现

     封装完接口，我们可以得到想要功能，我们可以实现多视频同时播放来实现，以下是实现效果