Thor|小米运动逆向步数分析与过滤器制作

确实是个孩子谥

0x0 前言
                之前写的乐心的过滤器总是被删贴，在此注明  此绝对原创

               仅供学习交流，请勿恶意利用去牟利。

0x1 逆向开始
               拿起我在小米官方线下店里买的小米4nfc版手环，在小区里溜达几圈看了看步数4624步，还真是不算少哈，废话不多说，开始逆向分析接口编写过滤器。
               抓包，关键字   
[Asm] 纯文本检察 复制代码data/band_data
   可以看到很多的加密代码毕竟是小米嘛            [Asm] 纯文本检察 复制代码%22%3A113%2C%5C%22dt%5C%22%3A0%2C%5C%22st%5C%22%3A1589556420%2C%5C%22lb%5C%22%3A0%2C%5C%22dp%5C%22%3A107%2C%5C%22is%5C%22%3A77%2C%5C%22rhr%5C%22%3A0%2C%5C%22stage%5C%22%3A%5B%7B%5C%22start%5C%22%3A-33%2C%5C%22stop%5C%22%3A15%2C%5C%22mode%5C%22%3A2%7D%2C%7B%5C%22start%5C%22%3A16%2C%5C%22stop%5C%22%3A85%2C%5C%22mode%5C%22%3A3%7D%2C%7B%5C%22start%5C%22%3A86%2C%5C%22stop%5C%22%3A108%2C%5C%22mode%5C%22%3A2%7D%2C%7B%5C%22start%5C%22%3A109%2C%5C%22stop%5C%22%3A122%2C%5C%22mode%5C%22%3A3%7D%2C%7B%5C%22start%5C%22%3A123%2C%5C%22stop%5C%22%3A146%2C%5C%22mode%5C%22%3A2%7D%2C%7B%5C%22start%5C%22%3A147%2C%5C%22stop%5C%22%3A169%2C%5C%22mode%5C%22%3A3%7D%2C%7B%5C%22start%5C%22%3A170%2C%5C%22stop%5C%22%3A187%2C%5C%22mode%5C%22%3A2%7D%5D%2C%5C%22ed%5C%22%3A1589569620%2C%5C%22wk%5C%22%3A0%2C%5C%22wc%5C%22%3A0%7D%2C%5C%22tz%5C%22%3A%5C%2228800%5C%22%2C%5C%22stp%5C%22%3A%7B%5C%22runCal%5C%22%3A1%2C%5C%22cal%5C%22%3A2%2C%5C%22conAct%5C%22%3A0%2C%5C%22stage%5C%22%3A%5B%7B%5C%22stop%5C%22%3A819%2C%5C%22mode%5C%22%3A7%2C%5C%22dis%5C%22%3A40%2C%5C%22step%5C%22%3A63%2C%5C%22cal%5C%22%3A2%2C%5C%22start%5C%22%3A813%7D%5D%2C%5C%22ttl%5C%22%3A63%2C%5C%22dis%5C%22%3A40%2C%5C%22rn%5C%22%3A1%2C%5C%22wk%5C%22%3A0%2C%5C%22runDist%5C%22%3A0%2C%5C%22ncal%5C%22%3A0%7D%2C%5C%22v%5C%22%3A5%2C%5C%22goal%5C%22%3A8000%7D%22%2C%22data%22%3A%5B%7B%22stop%22%3A1439%2C%22value%22%3A%22eQAAcA0AcAAAcAAAegAAegAAegAAegAAegAAegAAcAgAcAAAcAAAegAAegAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAegAAegAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAegAAegAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAkAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAwAcBEAcAkAcAAAcAsAcAAAcBMAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcA4AcAAAcAkAcAwAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcBkAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAEAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAeRAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcBIAcAYAegAAegAAcAAAcAAAcAAAcAAAegAAcAAAcAAAcAAAcAcAcwAAcwAAcwAAcwAAfAAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcAcAcAUAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcAAAcwAAcwAAcwAAcwAAcAwAcA8AcAAAcAAAcAAAcAAAcAYAcAAAcAAAcAAAcAAAcAAAewAAcAAAcAAAcAAAcA4AegAAegAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcBEAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcBQAcAUAcBIAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAcAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcA4AcAAAcAAAcA8AcAAAcAAAcAAAcAAAcAwAcAoAcwAAcwAAcwAAcwAAfAAAcwAAcwAAcwAAcAMAcAAAcAgAcwAAcAMAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcwAAcAsAcwAAcA4AcwAAcwAAcwAAcwAAcwAAcBAAcBAAcAAAcBEAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAEAcAoAewAAcAAAcAAAcAUAcAAAcAAAcAAAegAAcAAAcAAAcAEAcAAAcAAAcA0AcAcAcBUAcAQAeRAAcAAAcAsAegAAegAAegAAcAAAcAMAcAgAcAAAcAUAcAsAcAMAegAAegAAegAAcAIAegAAegAAcAAAegAAcAAAegAAcwAAcwAAeRIAcAAAcAAAcAAAcAsAcAIAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAcAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAsAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcAAAcA8AcAAAcAAAcAAAcAsAcAAAcAAAcAAAcAAAcAAAcAAAcAAAAWQSfGYVEAQAYB0AYCMAYBcAAY0YfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgAAfgA


0x3 逆向分析
           代码大部分都可以看出采用的是url编码，这就降低了难度。开始解码分析
[Asm] 纯文本检察 复制代码tage\":[{\"stop\":819,\"mode\":7,\"dis\":40,\"step\":63,\"cal\":2,\"start\":813}],\"ttl\":63,\"dis\":40,\"rn\":1,\"wk\":0,\"runDist\":0,\"ncal\":0},\"v\":5,\"goal\":8000}"
           关键字step，到这里我们就可以进行正则表达匹配修改上传，优先在Abubis上面哀求一下，乐成刷到。
    接口可用，大功告成。


0x4 Thor过滤器编写
                    鉴于论坛上面很多的编写方法，在此不再编写，自行学习编写。
                    留下成品如下：https://yzy6699.lanzous.com/icpevtg
                     注：步数的修改在变量绑定当中的当前值修改



来源：http://www.12558.net
免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！