安卓逆向：抖⾳protobuf数据解析⽂章⽬录前⾔免责声明：请勿商⽤！请勿⼤量抓取！若因使⽤本服务与抖⾳官⽅造成不必要的纠纷，本⼈盖不负责！本⼈纯粹技术爱好，若侵犯抖⾳贵公司的权益，请告知,速删除！什么是protobuf,csdn很多相关的⽂章介绍,总体来说就是更⼩，更快，可读性差！转载本⽂，请注明本⽂链接，谢谢！⼀、protobuf正向流程1.创建proto⽂件⽣成对应的py⽂件pycharm有编辑proto的插件，写代码有提⽰很⽅便,创建protobuf⽂件包，创建addressbook.proto⽂件syntax = \"proto3\";message AddressBook { repeated Person people = 1;}message Person { string name = 1; int32 id = 2; string email = 3; float money = 4; bool work_status = 5; repeated PhoneNumber phones = 6; MyMessage maps = 7;}message PhoneNumber { string number = 1; PhoneType type = 2;}message MyMessage { map
mapfield = 1;}进⼊这个⽂件的⽬录protoc ./addressbook.proto --python_out=./进⼊这个⽂件的⽬录，这时候就创建了⼀个对应的py⽂件创建add_person.py# 环境python3.8from protobuf import addressbook_pb2from google.protobuf import json_format# 添加数据信息address_book = addressbook_pb2.AddressBook()person = address_book.people.add()person.id = 1person.name = \"safly\"person.email = \"safly@qq.com\"person.money = 1000.11person.work_status = Truephone_number = person.phones.add()phone_number.number = \"123456\"phone_number.type = addressbook_pb2.HOMEmaps = person.mapsmaps.mapfield[1] = 1maps.mapfield[2] = 2# 转成字符串serializeToString = address_book.SerializeToString()print(serializeToString)# a = address_book.ParseFromString(serializeToString)# print(type(address_book.people))# 转成jsonb = json_format.MessageToJson(address_book)print(b)⼆、protobuf逆向流程1.抓包确定位置通过charles抓包那就已经接⼝是aweme/v2/feed,打开jadx打开app全局搜索关键词，按住ctrl点击这个类点进去就找对应的字段和编号啦2.根据代码编写相应的proto⽂件syntax = \"proto3\";// 这⾥还需要其他的proto⽂件，数据很多，jadx代码上都有，安装ctrl点进去就是，以此类推import 'myAwemeStructV2.proto';import 'myExtraStructV2.proto';import 'myLogPbStructV2.proto';import 'myGuideWordV2.proto';message AwemeV2FeedResponse { int32 status_code = 1; int64 min_cursor = 2; int64 max_cursor = 3; int32 has_more = 4; repeated my_aweme_struct_v2.AwemeStructV2 aweme_list = 5; string rid = 6; int32 home_model = 7; int32 refresh_clear = 8; repeated my_extra_struct_v2.ExtraStructV2 extra = 9; repeated my_log_pb_structV2.LogPbStructV2 log_pb = 10; string DebugInfo = 11; repeated my_guide_word_v2.GuideWordV2 guide_word = 12; repeated my_aweme_struct_v2.AwemeStructV2 preload_ads = 13; string status_msg = 14; int32 block_code = 15; repeated my_aweme_struct_v2.AwemeStructV2 preload_awemes = 16; bool enable_re_rank = 17; bool disable_adjust_for_cache = 18;}3.结果⽣成相应的py⽂件，最后结合抓取的信息转换成json格式⽰例代码# 环境python2.7info = DouyinAwemeFeed_pb2.AwemeV2FeedResponse()info.ParseFromString(\"你的请求proto数据\")print json.dumps(MessageToDict(info, preserving_proto_field_name=True), ensure_ascii=False)结果展⽰: