先分析一下考蟲的課程觀看流程, 無論是免費的課程還是付費課程, 都需要購買添加, 課程都有時間有效期, 購買後課程會添加到個人中心-我的訂單列表, 因此從這入手.

以下分析基於安卓考虫V3.7.1, 百度市場版, 之所以強調應用市場, 是因為一個應用市場下載的APP, 購買課程後其他市場APP觀看會提示無網絡, 逆向分析不同市場也有區別.

進入我的訂單,先抓一下包:

{
        "code": 1, 
        "msg": "成功", 
        "data": {
                "historyContent": "点击查看更早的订单", 
                "historyUrl": "/api/newOrder/r/orderHistoryList", 
                "page": {
                        "totalCount": 5, 
                        "pageSize": 12, 
                        "pageCount": 1, 
                        "currentPage": 1, 
                        "nextPage": 1, 
                        "previousPage": 1, 
                        "hasNext": false, 
                        "hasPrevious": false, 
                        "startIndex": 0
                }, 
                "list": [
                        {
                                "isRmb": true,     
                                "needRemain": 0, 
                                "orderType": 0, 
                                "tradeNo": "", 
                                "orderId": "1001918726644",         
                                "payTime": 1588312139138,         
                                "type": 2, 
                                "cutOffTime": 1588355339000,     
                                "goodsIds": "14762",            
                                "activityId": 0, 
                                "totalAmount": 0, 
                                "uid": 7379744, 
                                "couponAmount": 0, 
                                "goodsCount": 1, 
                                "payAmount": 0, 
                                "payType": 2, 
                                "payFailedReason": "", 
                                "closeTime": 1588313939000, 
                                "ctime": 1588312139000, 
                                "details": [
                                        {
                                                "totalAmount": 0, 
                                                "goodsId": 14762, 
                                                "goodsPrice": 0, 
                                                "sellCount": 1, 
                                                "type": 0, 
                                                "goodsName": "【微信群】为什么你需要一份雅思成绩？", 
                                                "status": 0
                                        }
                                ], 
                                "refundable": false, 
                                "optAttribute": -1, 
                                "needAddress": false, 
                                "status": 3
                        }, 
                        {
                                "isRmb": true, 
                                "needRemain": 0, 
                                "orderType": 0, 
                                "tradeNo": "", 
                                "orderId": "1001602521944", 
                                "payTime": 1582872436000, 
                                "type": 2, 
                                "cutOffTime": 1582915636000, 
                                "goodsIds": "14400", 
                                "activityId": 0, 
                                "totalAmount": 0, 
                                "uid": 7379744, 
                                "couponAmount": 0, 
                                "goodsCount": 1, 
                                "payAmount": 0, 
                                "payType": 2, 
                                "payFailedReason": "", 
                                "closeTime": 1582874236000, 
                                "ctime": 1582872436000, 
                                "details": [
                                        {
                                                "totalAmount": 0, 
                                                "goodsId": 14400, 
                                                "goodsPrice": 0, 
                                                "sellCount": 1, 
                                                "type": 0, 
                                                "goodsName": "21考研数学新手3周刷题营01期", 
                                                "status": 0
                                        }
                                ], 
                                "refundable": false, 
                                "optAttribute": -1, 
                                "needAddress": false, 
                                "status": 3
                        }, 
                ]
        }, 
        "stime": 1592399316738, 
        "traceId": "b801d249d5854789a15638fdf7aed14e"
}

請求接口參數:

https://mobile.kaochong.com/api/mcore/order/r/getOrderList
    ?pageSize=12
    &pageNum=1
    &showAddress=0
    &androidId=xxx        // 安卓ID
    &apiVer=3
    &appId=1001
    &ca=%E6%9C%AA%E7%9F%A5%E8%BF%90%E8%90%A5%E5%95%86        // 網絡運營商 : "未知运营商"
    &channel=baidu        // 應用市場
    &cl=baidu            // 應用市場
    &duid=xxx            // ID
    &dv=ONEPLUS%20A5010    // 設備型號: 一加5T
    &imei=
    &nt=wifi
    &ov=9                // 安卓版本
    &rosType=android
    &sh=2046
    &sw=1080            // 屏幕分辨率
    &token=xxx            // token
    &ver=3.7.1            // 版本

然後反編譯搜尋相關信息, 定位到請求位置MyOrderRepository: // com.xuanke.kaochong.l0.a.a

    @NotNull
    /* renamed from: a */
    public final LiveData<DataWrap<CommonListEntity<OrderItem>>> mo45860a(@NotNull Map<String, String> map) {
        C10434e0.m48756f(map, "params");                // 請求參數
        MutableLiveData pVar = new MutableLiveData();
        C3047z<BaseApi<CommonListEntity<OrderItem>>> F = KcNet.m16387a().mo42972F(map);        // 接口
        KCSuperRetrofit.C6862a aVar = KCSuperRetrofit.f25847b;
        C10434e0.m48731a((Object) F, "observable");
        aVar.mo42930a(F, new C7619b(map, pVar));        // C7619b 回調
        return pVar;
    }

請求完成C7619b回調, 到 C7619b 看看

    /* renamed from: com.xuanke.kaochong.l0.a.a$b */
    /* compiled from: MyOrderRepository.kt */
    public static final class C7619b implements C6893p<CommonListEntity<OrderItem>> {

        /* renamed from: a */
        final /* synthetic */ Map f28267a;

        /* renamed from: b */
        final /* synthetic */ MutableLiveData f28268b;

        C7619b(Map map, MutableLiveData pVar) {
            this.f28267a = map;
            this.f28268b = pVar;
        }

        /* renamed from: a */
        public void onSuccess(@Nullable CommonListEntity<OrderItem> commonListEntity) {        // onSuccess 請求成功返回
            if (commonListEntity != null) {
                int i = 1;
                if (commonListEntity.isListNotEmpty()) {
                    String str = (String) this.f28267a.get("pageNum");
                    if (str != null) {
                        i = Integer.parseInt(str);
                    }
                    commonListEntity.setCurrentPageNumber(i);
                    this.f28268b.mo6430b(DataWrap.f15077d.mo28227c(commonListEntity));
                    return;
                }
                this.f28268b.mo6430b(DataWrap.C3777a.m20280b(DataWrap.f15077d, (Object) null, 1, (Object) null));
            }
        }

        public void onFail(int i, @Nullable String str) {        // 請求失敗
            this.f28268b.mo6430b(DataWrap.C3777a.m20279a(DataWrap.f15077d, (Object) null, (Throwable) null, 3, (Object) null));
        }
    }

可用Xposed hook onSuccess 請求結果獲取信息, 以下相同思路

關鍵參數是上一步獲取的 "orderId": "1001602521944",

https://mobile.kaochong.com/api/mcore/order/r/detail
    ?orderId=1001602521944
    &androidId=xxx
    &apiVer=3
    &appId=1001
    &ca=%E6%9C%AA%E7%9F%A5%E8%BF%90%E8%90%A5%E5%95%86
    &channel=baidu
    &cl=baidu
    &duid=xxx
    &dv=ONEPLUS%20A5010
    &imei=
    &nt=wifi
    &ov=9
    &rosType=android
    &sh=2046
    &sw=1080
    &token=xxx
    &ver=3.7.1

{
        "code": 1, 
        "msg": "成功", 
        "data": {
                "orderId": "1001602521944", 
                "uid": 7379744, 
                "status": 3, 
                "payFailedReason": "", 
                "payType": 2, 
                "type": 2, 
                "goodsCount": 1, 
                "totalAmount": 0, 
                "couponAmount": 0, 
                "payAmount": 0, 
                "payTime": 1582872436000, 
                "tradeNo": "", 
                "ctime": 1582872436000, 
                "closeTime": 1582874236000, 
                "cutOffTime": 1582915636000, 
                "needAddress": false, 
                "needRemain": 0, 
                "refundable": false, 
                "details": [
                        {
                                "goodsId": 14400,         
                                "goodsName": "21考研数学新手3周刷题营01期", 
                                "sellCount": 1, 
                                "goodsPrice": 0, 
                                "totalAmount": 0, 
                                "status": 0, 
                                "type": 0, 
                                "exchangedGoods": null
                        }
                ], 
                "optAttribute": -1, 
                "goodsIds": "14400", 
                "activityId": 0, 
                "plusUrl": null, 
                "orderType": 0, 
                "isRmb": true, 
                "payTypeDesc": "免费", 
                "typeDesc": "免费", 
                "refundTime": null, 
                "cancelReason": null, 
                "couponList": [ ], 
                "discountList": [ ], 
                "changeHistory": [ ], 
                "courseChangeHistory": [ ]
        }, 
        "stime": 1592399498624, 
        "traceId": "0168ff887c5e4c8fa7100d1147a66bc2"
}

[公告]看雪论坛2020激励机制上线了！发帖不减雪币了！如何获得积分快速升级？

最后于 4天前 被KwaiChing编辑 ，原因： 後半部分不顯示?