基于xposed Hook框架實現個人免簽支付方案

我的個人網站如何實現支付功能？

　　想必很多程序員都有過想開發一個自己的網站來獲得一些額外的收入，但做這件事會遇到支付這個問題。目前個人網站是無法實現支付功能的。

　　今天我就給大家分享一下我的實現方案：《基于xposed逆向微信、支付寶、云閃付來實現個人免簽支付方案》

測試頁面(點我)

　　接下來給大家簡單分享一下實現過程，這個過程其實是非常復雜的，關鍵點在于如何逆向微信支付寶云閃付這些App，找到核心函數鉤子，然后寫一個hook程序來模擬調用這些方法，來實現根據服務端傳過來的金額，訂單號自動調用微信支付寶生成支付二維碼的函數得到相對應的支付二維碼再傳給服務端，然后監聽微信支付寶的支付成功消息最終回調給服務端實現支付成功通知。這里面用到的核心技術點有：xposed逆向框架、apk反編譯，網絡抓包，apk動態調試等技術。

　　像微信支付寶這些apk反編譯后的代碼基本上都是天書一樣的，嚴重混淆過的代碼。想從中找到核心代碼并非易事，下面我貼一些核心代碼吧。

hook微信二維碼生成函數

private void hookQRCreat(final ClassLoader appClassLoader, final Context context) {
            Class<?> clazz = XposedHelpers.findClass("com.tencent.mm.plugin.collect.b.s", appClassLoader);
        XposedBridge.hookAllMethods(clazz, "a", new XC_MethodHook() {
            @Override
            protected void beforeHookedMethod(MethodHookParam param)
                    throws Throwable {
            }

            @Override
            protected void afterHookedMethod(MethodHookParam param) {
                try {
                    LogUtils.log("hookQRCreat start:");
                    QrBean qrBean = new QrBean();
                    qrBean.setChannel(QrBean.WECHAT);

                    Field moneyField = XposedHelpers.findField(param.thisObject.getClass(), "kcp");
                    Double money = (Double) moneyField.get(param.thisObject);
                    LogUtils.log("hookQRCreat money:"+money.toString());
                    Field markField = XposedHelpers.findField(param.thisObject.getClass(), "desc");
                    String mark = (String) markField.get(param.thisObject);
                    LogUtils.log("hookQRCreat mark:"+mark);
                    Field payurlField = XposedHelpers.findField(param.thisObject.getClass(), "kco");
                    String payurl = (String) payurlField.get(param.thisObject);
                    LogUtils.log("hookQRCreat payurl:"+payurl);

                    qrBean.setMark_sell(mark);
                    qrBean.setUrl(payurl);

                    LogUtils.log( "com.tencent.mm.plugin.collect.b.s qrBean:"+ JSON.toJSONString(qrBean));
                    Intent broadCastIntent = new Intent();
                    broadCastIntent.putExtra("data", qrBean.toString());
                    broadCastIntent.setAction(HookMain.RECEIVE_QR_WECHAT);
//                broadCastIntent.setComponent( new ComponentName( "com.sjk.tpay" ,
//                        "com.sjk.tpay.ReceiverMain") );
                    context.sendBroadcast(broadCastIntent);
                    LogUtils.log("hookQRCreat end:"+JSON.toJSONString(param));
                }catch (Exception e){
                    LogUtils.log("hookQRCreat exception:"+Log.getStackTraceString(e));
                }
            }
        });
    }

hook支付寶二維碼生成函數

private void hookQRCreat(final ClassLoader appClassLoader, final Context context) {
        XposedHelpers.findAndHookMethod("com.alipay.mobile.payee.ui.PayeeQRSetMoneyActivity", appClassLoader, "a",
                XposedHelpers.findClass("com.alipay.transferprod.rpc.result.ConsultSetAmountRes", appClassLoader), new XC_MethodHook() {
                    @Override
                    protected void afterHookedMethod(MethodHookParam param) throws Throwable {

                        Field moneyField = XposedHelpers.findField(param.thisObject.getClass(), "g");
                        String money = (String) moneyField.get(param.thisObject);

                        Field markField = XposedHelpers.findField(param.thisObject.getClass(), "c");
                        Object markObject = markField.get(param.thisObject);
                        String mark = (String) XposedHelpers.callMethod(markObject, "getUbbStr");

                        Object consultSetAmountRes = param.args[0];
                        Field consultField = XposedHelpers.findField(consultSetAmountRes.getClass(), "qrCodeUrl");
                        String payurl = (String) consultField.get(consultSetAmountRes);

                        Field consultField2 = XposedHelpers.findField(consultSetAmountRes
                                .getClass(), "printQrCodeUrl");
                        String payurloffline = (String) consultField2.get(consultSetAmountRes);

                        QrBean qrBean = new QrBean();
                        qrBean.setChannel(QrBean.ALIPAY);
                        qrBean.setMark_sell(mark);
                        qrBean.setUrl(payurl);

                        Intent broadCastIntent = new Intent()
                                .putExtra("data", qrBean.toString())
                                .setAction(RECEIVE_QR_ALIPAY);
                        context.sendBroadcast(broadCastIntent);
                    }
                });
    }

hook云閃付二維碼生成函數

public static void GenQrCode(final String paramString1, final String paramString2, final String bankName, final String bankNo) {
        new Thread(new Runnable() {
            public void run() {
                try {
                    Object obj1 = paramString2;
                    Object obj2 = new BigDecimal(paramString1);
                    obj2 = ((BigDecimal) obj2).setScale(2, RoundingMode.HALF_UP).toPlainString().replace(".", "");
//                    LogUtils.getInstance().saveLog("GenQrCode begin ：" + obj1 + obj2);
                    Object obj3 = new StringBuilder();
                    ((StringBuilder) obj3).append("https://pay.95516.com/pay-web/restlet/qr/p2pPay/applyQrCode?txnAmt=");
                    ((StringBuilder) obj3).append(MainHook.Enc((String) obj2));
                    ((StringBuilder) obj3).append("&cityCode=");
                    ((StringBuilder) obj3).append(MainHook.Enc(MainHook.getcityCd()));
                    ((StringBuilder) obj3).append("&comments=");
                    ((StringBuilder) obj3).append(MainHook.Enc((String) obj1));
                    ((StringBuilder) obj3).append("&virtualCardNo=");
//                    ((StringBuilder) obj3).append(MainHook.encvirtualCardNo);
                    CardInfo cardInfo = getEncvirtualCardNo(bankName, bankNo);
                    if (cardInfo == null) {
                        throw new Exception("找不到對應的下單卡");
                    }
                    cardInfo.setAccount(ysfAccount);
                    ((StringBuilder) obj3).append(Enc(cardInfo.getVirtualCardNo()));
                    obj1 = ((StringBuilder) obj3).toString();
                    obj2 = HttpHelper.getInstance().getOkHttpClient();
                    obj3 = new okhttp3.Request.Builder();
                    Request.Builder localBuilder = ((Request.Builder) obj3).url((String) obj1).header("X-Tingyun-Id", MainHook.getXTid());
//                    LogUtils.getInstance().saveLog("GenQrCode url：" + obj1);
                    obj3 = new StringBuilder();
                    ((StringBuilder) obj3).append("0;");
                    ((StringBuilder) obj3).append(System.currentTimeMillis());

                    obj3 = ((OkHttpClient) obj2).newCall(localBuilder.header("X-Tingyun-Lib-Type-N-ST", ((StringBuilder) obj3).toString())
                            .header("sid", MainHook.getSid()).header("urid", MainHook.geturid()).header("cityCd", MainHook.getcityCd())
                            .header("locale", "zh-CN").header("User-Agent", "Android CHSP").header("dfpSessionId", MainHook.getDfpSessionId())
                            .header("gray", MainHook.getgray()).header("key_session_id", "").header("Host", "pay.95516.com").build()).execute().body().string();
                    obj1 = MainHook.Dec((String) obj3);
                    obj2 = new StringBuilder();
                    ((StringBuilder) obj2).append("GenQrCode RSP=>");
                    ((StringBuilder) obj2).append((String) obj1);
                    MainHook.mlog(obj2.toString());
                    try {
                        obj2 = new JSONObject((String) obj1);
                        String certificate = ((JSONObject) obj2).getJSONObject("params").getString("certificate");
                        QRInfo qrInfo = new QRInfo(certificate, paramString2);
                        qrInfo.setRemark(JSON.toJSONString(cardInfo));
                        String body = JSON.toJSONString(qrInfo);
                        Intent localIntent = new Intent("websocket.sendmsg");
                        localIntent.putExtra("data", "qr:" + body);
                        MainHook.getContext().sendBroadcast(localIntent);
                    } catch (Exception ex) {
                        LogUtils.getInstance().saveLog("二維碼廣播發送異常：" + ex.getMessage());
                    }
                    return;
                } catch (Exception ex) {
                    LogUtils.getInstance().saveLog("GenQrCode異常：" + ex.getMessage());
                }
            }
        }).start();
    }

　　有問題的朋友可以給我留言或者加我Q×××好友