* WeChat;
* , , ;
* ( );
* ;
* ;
* -;
* .
WeChat Tencent
WeChat . , .
800 , 90% .
WeChat ( -Weixin), , , , , - . . .
CRM , , WeChat. WeChat , API. - , , , . , API, CRM WeChat ( , ) , .
, 32- iOS. , , iPhone 4S iOS 7.2.1.
MITM
Burp Suite Free Edition.
dumpdecrypted .
- WeChat 6.3.13.
, IDA, .
.
.
MITM HTTP-
http:// hkshort.weixin.qq.com/bindopmobileforreg.
:
( );
( ).
, .
Protocol Buffers.
:
;
;
ID ;
;
( 16 );
( ).
RSA. AES-, . , , .
. , , ticket. , ticket, . .
- secp224r1. ,
hkshort.weixin.qq.com/newreg. , CryptUin ServerID, . .
, , . - AES 128 .
, . , . , . :
bfa65f16050520252cb6b770021001754cc8fd5e57e085457800fb0242420001aeb890f40b010a0080.
:
1. . .
2. . SrvID, .
0b10, , 0b01.
3. . .
4. CryptUin. .
5. SrvID. ID . .
6. uiCgi. . uiCgi url. bindopmobileforreg, uiCgi 0x91, newreg 0x7e. , :
private static void Write7BitEncodedInt(BinaryWriter store, int value)
{
Debug.Assert(store != null);
// Write out an int 7 bits at a time. The high bit of the byte,
// when on, tells reader to continue reading more bytes.
uint v = (uint)value; // support negative numbers
while (v >= 0x80)
{
store.Write((byte)(v | 0x80));
v >>= 7;
}
store.Write((byte)v);
}
uiCgi 0x17b, fb02.
7. . . , 0x80, .
8. . , .
9. .
10. .
:
hash1 = md5(cryptUin.shareKey);
hash2 = md5( strlen(data).shareKey.hash1.data)
resultHash = adler32(hash2)
sharedKey , .
.
11.. , , .
, . . MmtlsCtrlFlag.
.
, . , . .
. . , - . , . .
. . , (, , , ). , Too many attempts. Try again later . , , , , Too many attempts. Try again later - , . , . , WeChat, , , . , , , .
20 000 WeChat , .
, End-to-End . ,
.
, WeChat, WeChat (, ) .
Sqwony
12:44
