原改分代码为Python代码,
import requests
import json
import time
from Crypto.Cipher import AES
import base64
action_data = {
"score": 10086,
"times": 666,
"game_data": "{}"
}
session_id = "5TrXoE7IXtM/Nr7vITnbU9bmR53VH0u8RkVnm6m/Fezg=="
aes_key = session_id[0:16]
aes_iv = aes_key
cryptor = AES.new(aes_key, AES.MODE_CBC, aes_iv)
str_action_data = json.dumps(action_data).encode("utf-8")
print("json_str_action_data ", str_action_data)
#Pkcs7
length = 16 - (len(str_action_data) % 16)
str_action_data += bytes([length])*length
cipher_action_data = base64.b64encode(cryptor.encrypt(str_action_data)).decode("utf-8")
print("action_data ", cipher_action_data)
post_data = {
"base_req": {
"session_id": session_id,
"fast": 1,
},
"action_data": cipher_action_data
}
headers = {
"charset": "utf-8",
"Accept-Encoding": "gzip",
"referer": "https://servicewechat.com/wx7c8d593b2c3a7703/3/page-frame.html",
"content-type": "application/json",
"User-Agent": "MicroMessenger/6.6.1.1200(0x26060130) NetType/WIFI Language/zh_CN",
"Content-Length": "0",
"Host": "mp.weixin.qq.com",
"Connection": "Keep-Alive"
}
url = "https://mp.weixin.qq.com/wxagame/wxagame_settlement"
response = requests.post(url, json=post_data, headers=headers)
print(json.loads(response.text))
以上代码来自:知乎-发现更大的世界! 考虑到很多同学没有Python环境,用起来并不是很方便,故参考此代码改写成Java版本。
GitHub链接:走你!
另外简单写了个Web版提交工具走你!(2018年1月3日 14:30分,测试可用。) 但是不管哪种方法,都需要手动抓取微信跳一跳小游戏的session_id,抓包方法请自行搜索。
安卓抓包参考:知乎-发现更大的世界! iOS抓包参考: Fiddler 怎么对 IPhone 手机的数据进行抓包分析
这里写了两个类,一个PKCS7加密的单独类,(参考自 WindCoder)
package com;
import javax.crypto.Cipher;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.util.Arrays;
import javax.crypto.NoSuchPaddingException;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import java.security.Key;
import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import java.security.Security;
public class Pkcs7Encoder {
// 算法名称
static final String KEY_ALGORITHM = "AES";
// 加解密算法/模式/填充方式
static final String algorithmStr = "AES/CBC/PKCS7Padding";
private static Key key;
private static Cipher cipher;
boolean isInited = false;
//默认对称解密算法初始向量 iv
static byte[] iv = { 0x30, 0x31, 0x30, 0x32, 0x30, 0x33, 0x30, 0x34, 0x30, 0x35, 0x30, 0x36, 0x30, 0x37, 0x30, 0x38 };
public static void init(byte[] keyBytes) {
// 如果密钥不足16位,那么就补足. 这个if 中的内容很重要
int base = 16;
if (keyBytes.length % base != 0) {
int groups = keyBytes.length / base + (keyBytes.length % base != 0 ? 1 : 0);
byte[] temp = new byte[groups * base];
Arrays.fill(temp, (byte) 0);
System.arraycopy(keyBytes, 0, temp, 0, keyBytes.length);
keyBytes = temp;
}
// 初始化
Security.addProvider(new BouncyCastleProvider());
// 转化成JAVA的密钥格式
key = new SecretKeySpec(keyBytes, KEY_ALGORITHM);
try {
// 初始化cipher
cipher = Cipher.getInstance(algorithmStr, "BC");
} catch (NoSuchAlgorithmException e) {
// TODO Auto-generated catch block
e.printStackTrace();
} catch (NoSuchPaddingException e) {
// TODO Auto-generated catch block
e.printStackTrace();
} catch (NoSuchProviderException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
/**
* 加密方法
* --使用默认iv时
* @param content
* 要加密的字符串
* @param keyBytes
* 加密密钥
* @return
*/
public static byte[] encrypt(byte[] content, byte[] keyBytes) {
byte[] encryptedText = encryptOfDiyIV(content,keyBytes,iv);
return encryptedText;
}
/**
* 解密方法
* --使用默认iv时
* @param encryptedData
* 要解密的字符串
* @param keyBytes
* 解密密钥
* @return
*/
public static byte[] decrypt(byte[] encryptedData, byte[] keyBytes) {
byte[] encryptedText = decryptOfDiyIV(encryptedData,keyBytes,iv);
return encryptedText;
}
/**
* 加密方法
* ---自定义对称解密算法初始向量 iv
* @param content
* 要加密的字符串
* @param keyBytes
* 加密密钥
* @param ivs
* 自定义对称解密算法初始向量 iv
* @return 加密的结果
*/
public static byte[] encryptOfDiyIV(byte[] content, byte[] keyBytes, byte[] ivs) {
byte[] encryptedText = null;
init(keyBytes);
try {
cipher.init(Cipher.ENCRYPT_MODE, key, new IvParameterSpec(ivs));
encryptedText = cipher.doFinal(content);
} catch (Exception e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
return encryptedText;
}
/**
* 解密方法
*
* @param encryptedData
* 要解密的字符串
* @param keyBytes
* 解密密钥
* @param ivs
* 自定义对称解密算法初始向量 iv
* @return
*/
public static byte[] decryptOfDiyIV(byte[] encryptedData, byte[] keyBytes,byte[] ivs) {
byte[] encryptedText = null;
init(keyBytes);
try {
cipher.init(Cipher.DECRYPT_MODE, key, new IvParameterSpec(ivs));
encryptedText = cipher.doFinal(encryptedData);
} catch (Exception e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
return encryptedText;
}
}
执行请求的工具类
package com;
import okhttp3.*;
import org.bouncycastle.util.encoders.Base64;
import org.json.JSONObject;
import java.io.IOException;
import java.io.UnsupportedEncodingException;
/**
* @author: Seayon
* @date: 2017/12/31
* @time: 21:11
*/
public class Util {
private static final MediaType JSON = MediaType.parse("application/json;charset=utf-8");
private static final String WXGAME_URL = "https://mp.weixin.qq.com/wxagame/wxagame_settlement";
public static final String SESSIONID_ERROR = "SESSIONID有误,请检查";
private static String getActionData(String sessionKey, String encryptedData, String iv) {
byte[] sessionKeyBy = sessionKey.getBytes();
byte[] en = new byte[0];
try {
en = encryptedData.getBytes("UTF-8");
} catch (UnsupportedEncodingException e) {
e.printStackTrace();
}
byte[] ivBy = iv.getBytes();
byte[] enc = Pkcs7Encoder.encryptOfDiyIV(en, sessionKeyBy, ivBy);
return new String(Base64.toBase64String(enc));
}
public static String postData(String score, String times, String session_id) {
String result = null;
String content = "{\"score\": " + score + ", \"times\": " + times + "}";
String AES_KEY = null;
try {
AES_KEY = session_id.substring(0, 16);
} catch (Exception e) {
return SESSIONID_ERROR;
}
String AES_IV = AES_KEY;
OkHttpClient okHttpClient = new OkHttpClient();
String actionData = Util.getActionData(AES_KEY, content, AES_IV);
String json = "{\"base_req\":{\"session_id\":\"" + session_id + "\",\"fast\":1},\"action_data\":\"" + actionData + "\"}";
RequestBody requestBody = RequestBody.create(JSON, json);
Request request = new Request.Builder()
.url(WXGAME_URL)
.header("Accept","*/*")
.header("Accept-Language","zh-cn")
.header("User-Agent","Mozilla/5.0 (iPhone; CPU iPhone OS 10_3_1 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Mobile/14E304 MicroMessenger/6.6.1 NetType/WIFI Language/zh_CN")
.header("Content-Length","680")
.header("Content-Type","application/json")
.header("Referer","https://servicewechat.com/wx7c8d593b2c3a7703/5/page-frame.html")
.header("Host","mp.weixin.qq.com")
.header("Connection","keep-alive")
.post(requestBody)
.build();
ResponseBody responseBody = null;
try {
responseBody = okHttpClient.newCall(request).execute().body();
result = responseBody.string();
} catch (IOException e) {
e.printStackTrace();
} finally {
if (responseBody != null) {
responseBody.close();
}
}
return result;
}
}
执行测试
public class Main {
public static void main(String[] args) {
String sessionid = "zS719dyi83wQIJmpDKX5qWcumYPUx1f8KNkxk1LG8e8CIcZ8emXs2cx0XFslY1q8k1WctCLXCXGUrdk4wgC3VuQf1qsvIUH0LzxnB2zAmLZH3I2Kt4gVSLOrMcTp8xwBFNNfl9fNXrd4gq8qBy73w==";
String score = "100";
String times = "700";
String result = Util.postData(score, times, sessionid);
System.out.println(result);
}
目前观察当执行errcode为0时代表成功,此时可以关闭微信,重新打开,打开跳一跳小游戏,可以查看自己的分数,分数千万不要太高,我目前设置过的最高分是1024分,没有被封。
代码中使用到的依赖,Maven :
<dependency>
<groupId>commons-codec</groupId>
<artifactId>commons-codec</artifactId>
<version>1.11</version>
</dependency>
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcprov-debug-jdk15on</artifactId>
<version>1.55</version>
</dependency>
<dependency>
<groupId>org.json</groupId>
<artifactId>json</artifactId>
<version>20171018</version>
</dependency>
<dependency>
<groupId>com.squareup.okhttp3</groupId>
<artifactId>okhttp</artifactId>
<version>3.9.1</version>
</dependency>
转载至:青枫浦上