使用PHP,实现查询天府通余额

成都的巴适公交APP可以查询天府通余额,于是想将其移植到PHP代码上


解压apk,dex2jar反编译classes.dex为jar,用jd-gui.exe打开就可以看见代码了


 

public List getCardRechargeByNum(String paramString)
 {
 ArrayList localArrayList = new ArrayList();
 localArrayList.add(new BasicNameValuePair("mod", "api"));
 localArrayList.add(new BasicNameValuePair("ac", "BusConsumption"));
 localArrayList.add(new BasicNameValuePair("op", "1"));
 localArrayList.add(new BasicNameValuePair("cardno", "0001" + paramString));
 StringBuffer localStringBuffer = new StringBuffer();
 localStringBuffer.append(Config.BASE_URL);
 localStringBuffer.append("Bus/QueryTopUp/");
 localStringBuffer.append("?cardno=0001" + paramString);
 localObject1 = new ArrayList();
 for (;;)
 {
 try
 {
 String str = request(getHttpClient(), ParamUtils.generateSignature(localStringBuffer.toString()), null);
 localJSONObject = new JSONObject(str.toLowerCase());
 if (localJSONObject.getInt("status") == 101)
 {
 localType = new TypeToken() {}.getType();
 System.out.println(">>>sss:" + str);
 }
 }
 catch (Exception localException)
 {
 JSONObject localJSONObject;
 Type localType;
 localException.printStackTrace();
 if ((localException instanceof InterruptedException)) {
 continue;
 }
 (localException instanceof ConnectException);
 if (localObject1 != null) {
 continue;
 }
 return new ArrayList();
 }
 finally
 {
 if (localObject1 != null) {
 continue;
 }
 new ArrayList();
 }
 try
 {
 localObject1 = (List)gson.fromJson(localJSONObject.getString("listdata"), localType);
 if (localObject1 == null) {
 localObject1 = new ArrayList();
 }
 return localObject1;
 }
 finally {}
 }
 }


[/java]


[java collapse="true" title="com.guoke.chengdu.bashi.tools.util.ParamUtils"]
public static final String generateSignature(String paramString)
 {
 if ((paramString != null) && (paramString.contains("http://www.basiapp.com")))
 {
 String[] arrayOfString = paramString.split("[?]");
 if (arrayOfString != null) {}
 try
 {
 if (arrayOfString.length > 1)
 {
 LogUtils.d(LogUtils.LogAuthor.AUTHOR, "before : " + arrayOfString[1] + "&time=" + getNowTime());
 LogUtils.d(LogUtils.LogAuthor.AUTHOR, "after : " + AESUtil.encrypt(new StringBuilder(String.valueOf(arrayOfString[1])).append("&time=").append(getNowTime()).toString()));
 String str2 = arrayOfString[0] + "?signature=" + AESUtil.encrypt(new StringBuilder(String.valueOf(arrayOfString[1])).append("&time=").append(getNowTime()).toString());
 LogUtils.d(LogUtils.LogAuthor.AUTHOR, "split : " + str2);
 return str2;
 }
 String str1 = paramString + "?signature=" + AESUtil.encrypt(new StringBuilder("time=").append(getNowTime()).toString());
 LogUtils.d(LogUtils.LogAuthor.AUTHOR, "split : " + str1);
 return str1;
 }
 catch (Exception localException)
 {
 localException.printStackTrace();
 }
 }
 return paramString;
 }
 public static final String getNowTime()
 {
 return new SimpleDateFormat("yyyy-MM-dd HH:mm:ss").format(new Date());
 }

 

public static String keyValue = "666AA4DF3533497D973D852004B975BC";
public static String encrypt(String paramString)
 throws Exception
 {
 SecretKeySpec localSecretKeySpec = new SecretKeySpec(shortmd5(keyValue), "AES");
 Cipher localCipher = Cipher.getInstance("AES");
 localCipher.init(1, localSecretKeySpec);
 return byte2hex(localCipher.doFinal(paramString.getBytes())).toLowerCase();
 }

原理就是向http://www.basiapp.com/Bus/BusCardBalance/请求数据
参数为signature,ASC加密数据为cardno=0001XXXXXXXX&time=Y-m-d H:i:s
加密秘钥为666AA4DF3533497D973D852004B975BC的MD5的特殊形式

private static byte[] shortmd5(String paramString)
    throws Exception
  {
    MessageDigest localMessageDigest = MessageDigest.getInstance("MD5");
    localMessageDigest.update(paramString.getBytes("UTF-8"));
    return localMessageDigest.digest();
  }

与

md5('',true)

等同


接下来是获得URL地址,从而获得所需数据(8位卡号前面补0001)


 

class Security {
public static function encrypt($input, $key) {
$size = mcrypt_get_block_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_ECB);
$input = Security::pkcs5_pad($input, $size);
$td = mcrypt_module_open(MCRYPT_RIJNDAEL_128, '', MCRYPT_MODE_ECB, '');
$iv = mcrypt_create_iv (mcrypt_enc_get_iv_size($td), MCRYPT_RAND);
mcrypt_generic_init($td, $key, $iv);
$data = mcrypt_generic($td, $input);
mcrypt_generic_deinit($td);
mcrypt_module_close($td);
$data = bin2hex($data);
return $data;
}
 
private static function pkcs5_pad ($text, $blocksize) {
$pad = $blocksize - (strlen($text) % $blocksize);
return $text . str_repeat(chr($pad), $pad);
}
 
public static function decrypt($sStr, $sKey) {
$decrypted= mcrypt_decrypt(
MCRYPT_RIJNDAEL_128,
$sKey,
base64_decode($sStr),
MCRYPT_MODE_ECB
);
 
$dec_s = strlen($decrypted);
$padding = ord($decrypted[$dec_s-1]);
$decrypted = substr($decrypted, 0, -$padding);
return $decrypted;
} 
}

获得卡片余额
 

echo "http://www.basiapp.com/Bus/BusCardBalance/?signature=".Security::encrypt("cardno=0001{$CARD_NO}&time=". date('Y-m-d H:i:s',time()) ,  md5('666AA4DF3533497D973D852004B975BC',true));

BusCardBalance:卡片余额
QueryConsumption:消费记录
QueryTopUp:充值记录