turingfd tdid 分析

import hashlib
import zlib

import xxtea
from jce import loads

key = hashlib.md5(bytes.fromhex('4446472324255e2325245247485228262a4d3c3e3c')).hexdigest()
print(key)
print()


def de_packet(input_bytes):
    zlib_bytes = xxtea.decrypt(
        input_bytes,
        bytes.fromhex(key)
    )
    print(zlib_bytes.hex())
    jce_bytes = zlib.decompress(zlib_bytes)
    print(jce_bytes.hex())
    jce_data = loads(jce_bytes[4:])
    print(jce_data)
    return jce_data


resp = bytes.fromhex(
    'HEX_STRING1'
)
resp_data = de_packet(resp)

手撕 JCE

// tag: 7, type: SIMPLE_LIST; size: 1; length: 0x00e7
7d 0001 00e7
    // tag: 0, type: MAP; size: 1
    08 0001 
        // tag: 6, type: STRING1; length: 1; value: "req"
        06 03 726571
        // tag: 1, type: SIMPLE_LIST; size: 1; length: 0x00da
        1d 0001 00da
            // tag: 0, type: STRUCT_BEGIN
            0a
                // tag: 0, type: LONG; value: 0x0000019c08bb02f9
                03 0000019c08bb02f9
                // tag: 1, type: MAP; size: 0x09
                18 0009
                    // tag: 0, type: STRING1; length: 8; value: "platform"
                    06 08 706c6174666f726d
                    // tag: 1, type: STRING1; length: 1; value: "2"
                    16 01 32
                    // tag: 0, type: STRING1; length: 7; value: "version"
                    06 07 76657273696f6e
                    // tag: 1, type: STRING1; length: 2; value: "69"
                    16 02 3639
                    // tag: 0, type: STRING1; length: 2; value: "lc"
                    06 02 6c63
                    // tag: 1, type: STRING1; length: 16; value: "704117AC825FFC52"
                    16 10 37303431313741433832354646434532
                    // tag: 0, type: STRING1; length: 7; value: "channel"
                    06 07 6368616e6e656c
                    // tag: 1, type: STRING1; length: 6; value: "105678"
                    16 06 313035363738
                    // tag: 0, type: STRING1; length: 3; value: "pkg"
                    06 03 706b67
                    // tag: 1, type: STRING1; length: 17; value: "com.tencent.token"
                    16 11 636f6d2e74656e63656e742e746f6b656e
                    // tag: 0, type: STRING1; length: 10; value: "pkgVerInfo"
                    06 0a 706b67566572496e666f
                    // tag: 1, type: STRING1; length: 9; value: "7.3.6,134"
                    16 09 372e332e362c313334
                    // tag: 0, type: STRING1; length: 8; value: "apiLevel"
                    06 08 6170694c6576656c
                    // tag: 1, type: STRING1; length: 3; value: "31"
                    16 02 3331
                    // tag: 0, type: STRING1; length: 5; value: "brand"
                    06 05 6272616e64
                    // tag: 1, type: STRING1; length: 7; value: "samsung"
                    16 07 73616d73756e67
                    // tag: 0, type: STRING1; length: 5; value: "model"
                    06 05 6d6f64656c
                    // tag: 1, type: STRING1; length: 8; value: "SM-N9700"
                    16 08 534d2d4e39373030
                // tag: 2, type: STRUCT_BEGIN
                2a
                    // tag: 0, type: ZERO_TAG
                    0c
                    // tag: 1, type: Byte; value: 0x01
                    10 01
                    // tag: 2, type: ZERO_TAG
                    2c
                    // tag: 3, type: MAP; size: 0
                    38 0c
                    // tag: 4, type: MAP; size: 0
                    48 0c
                    // tag: 5, type: ZERO_TAG
                    5c
                // tag: 0, type: STRUCT_END
                0b
                // tag: 3, type: STRING1; length: 32; value: "0e14eea98b144d9d9783c07c3f1f179e"
                36 20 3065313465656139386231343464396439373833633037633366316631373965
            // tag: 0, type: STRUCT_END
            0b

r1q_data = {
            1: 3,
            2: 0,
            3: 0,
            4: 3,
            5: "getTFConfig",
            6: "getTFConfig",
            7: dumps({
                "req": dumps(JceDict({
                    0: JceDict({
                        0: 1769672999673,
                        1: {
                            "platform": "2",
                            "version": f"{self.app_info['turing_version']}",
                            "lc": self.app_info['turing_lc'],
                            "channel": f"{self.app_info['turing_channel']}",
                            "pkg": self.app_info['package_name'],
                            "pkgVerInfo": f"{self.app_info['version_name']},{self.app_info['version_code']}",
                            "apiLevel": f"{self.device_info['build_version_sdk']}",
                            "brand": f"{self.device_info['build_manufacturer'].lower()}",
                            "model": f"{self.device_info['build_model']}",
                        },
                        2: {
                            0: 0,
                            1: 1,
                            2: 0,
                            3: {},
                            4: {},
                            5: 0
                        },
                        3: hashlib.md5(str(time.time()).encode()).hexdigest(),
                    })
                }))
            }),
            8: 0,
            9: {},
            10: {}
        }
        r1q_body = dumps(JceDict(r1q_data))
        print(loads(r1q_body))
        r1q_head = hex(len(r1q_body) + 4)[2:].rjust(8, '0')
        b = r1q_head + r1q_body.hex()
        print(b)