hmac-sha1 + Base64结果不对

巨龙

各位大佬请教一下（在学逆）
下面是抓包来的，这个app带有Authorization。
id="APID8jN115a8pHemP3wdo8d65su943JGe5vl68r4"  ‘===这个玩意是固定的
signature="ZVMVz3RCngEOBrAmfQd23+si49w=" ‘===这里是密文
.我弄的都稀里糊涂了，我搞到的是明文为x-date: Sat, 11 Feb 2023 06:13:53 GMT /n GET     密匙是：Ke2TkUq2Jh3Ev16MQL1W3BxOPCW9fBlmAomvkZvG
.但是通过hmac-sha1 + Base64编码后出现的密文和下面signature的不一样，我头两天弄好像记得要拼接POST /v2/ticket/amount HTTP/1.1 但是我今晚试了也不行
有没有大佬给点思路。

  

POST /v2/ticket/amount HTTP/1.1
lat: 28.999495
lng: 114.526601
language: ch
deviceid: 03fc2b6313872152b7348243701bca7167f6
IsInPark: 0
OS: Android
PreSaleSign: 0
appVersion: 2.4.1
versionCode: 12
ISDARK: 0
APPToken: eyJlIjoxNjc4Njg1ODk0LCJkIjoiMzg4Mjk5OTUyYjJhYjlkNmI0NDZlMmY1ZTc0NjM0NTgiLCJ1IjoiNWI5ZWU1YjhmNDE3YzE3ZTYwMGRiZWU0ZGMzNGZhMDE5NGYzODA2ZmI1YzU5NzAxOTNlNDFhYjBjYzNhOTdiNCIsInAiOjB9.aca74c3e9129200e6a366d3c84d70fbc326c76b83e5d26ac3a7c507072113bb8
USERAREA: other
x-date: Sat, 11 Feb 2023 06:13:53 GMT
Authorization: hmac id="APID8jN115a8pHemP3wdo8d65su943JGe5vl68r4", algorithm="hmac-sha1", headers="x-date", signature="ZVMVz3RCngEOBrAmfQd23+si49w="
Content-Type: application/json; charset=UTF-8
Content-Length: 86
Host: gw.app.universalbeijingresort.com
Connection: Keep-Alive
Accept-Encoding: gzip
User-Agent: okhttp/3.12.1

POST /v2/ticket/amount HTTP/1.1<br /> lat: 28.999495<br /> lng: 114.526601<br /> language: ch<br /> deviceid: 03fc2b6313872152b7348243701bca7167f6<br /> IsInPark: 0<br /> OS: Android<br /> PreSaleSign: 0<br /> appVersion: 2.4.1<br /> versionCode: 12<br /> ISDARK: 0<br /> APPToken: eyJlIjoxNjc4Njg1ODk0LCJkIjoiMzg4Mjk5OTUyYjJhYjlkNmI0NDZlMmY1ZTc0NjM0NTgiLCJ1IjoiNWI5ZWU1YjhmNDE3YzE3ZTYwMGRiZWU0ZGMzNGZhMDE5NGYzODA2ZmI1YzU5NzAxOTNlNDFhYjBjYzNhOTdiNCIsInAiOjB9.aca74c3e9129200e6a366d3c84d70fbc326c76b83e5d26ac3a7c507072113bb8<br /> USERAREA: other<br /> x-date: Sat, 11 Feb 2023 06:13:53 GMT<br /> Authorization: hmac id="APID8jN115a8pHemP3wdo8d65su943JGe5vl68r4", algorithm="hmac-sha1", headers="x-date", signature="ZVMVz3RCngEOBrAmfQd23+si49w="<br /> Content-Type: application/json; charset=UTF-8<br /> Content-Length: 86<br /> Host: gw.app.universalbeijingresort.com<br /> Connection: Keep-Alive<br /> Accept-Encoding: gzip<br /> User-Agent: okhttp/3.12.1

XZ6

明文错了，或者秘钥错了

kic1234

这得分析具体的生成过程！！！或者找到那个方法之后，直接调用js

都由我来赎

发下网址

巨龙

都由我来赎 发表于 2023-2-17 13:00
发下网址

https://www.universalbeijingresort.com/zh_CN/app-miniprogram-download

巨龙

巨龙 发表于 2023-2-17 15:50
https://www.universalbeijingresort.com/zh_CN/app-miniprogram-download

下载地址