登录时提交本机MAC地址

[ClumsyLee]

可以简化自动断网的逻辑

[ClumsyLee]

从 TUNet 安卓版反编译的结果来看，几个关键点：

Web 登录方式

public static String m3477a(Map<String, String> map, Map<String, String> map2, String str) {
    try {
        Object obj;
        StringBuilder stringBuilder = new StringBuilder();
        Object obj2 = 1;
        if (map != null) {
            for (Entry entry : map.entrySet()) {
                if (obj2 != null) {
                    obj = null;
                } else {
                    stringBuilder.append(MtopRequestHelper.f3036a);
                    obj = obj2;
                }
                stringBuilder.append(URLEncoder.encode((String) entry.getKey(), str));
                stringBuilder.append("=");
                stringBuilder.append(URLEncoder.encode((String) entry.getValue(), str));
                obj2 = obj;
            }
        }
        if (map2 != null) {
            for (Entry entry2 : map2.entrySet()) {
                if (obj2 != null) {
                    obj = null;
                } else {
                    stringBuilder.append(MtopRequestHelper.f3036a);
                    obj = obj2;
                }
                stringBuilder.append(URLEncoder.encode((String) entry2.getKey(), str));
                stringBuilder.append("=");
                stringBuilder.append((String) entry2.getValue());
                obj2 = obj;
            }
        }
        return stringBuilder.toString();
    } catch (Throwable e) {
        throw new MissingPlatformFeatureError(e);
    }
}

似乎是 MAC 地址直接post，不要URLEncode。尝试该方法不成功。

SRun protocol

public static String m3326a(String str, String str2, String str3, long j) {
    try {
        InetAddress byName = InetAddress.getByName("166.111.204.120");
        TUNet.m2665b(NetUtilities.LogTag, "SRun Login: start making UDP request.");
        ChallengeResponse challengeResponse = new ChallengeResponse(UDPUtilities.m3480a(byName, 3335, new ChallengeRequest(str).m3325a(), 56, 64, j));
        TUNet.m2665b(NetUtilities.LogTag, "SRun Login: UDP request finished.");
        if (challengeResponse.type == -101) {
            byte[] bArr = new byte[49];
            bArr[0] = (byte) ((int) (challengeResponse.user_id & 255));
            for (int i = 0; i < 32; i++) {
                bArr[i + 1] = (byte) str2.charAt(i);
            }
            System.arraycopy(challengeResponse.challenge, 0, bArr, 33, challengeResponse.challenge.length);
            Map hashMap = new HashMap();
            hashMap.put("action", "login");
            hashMap.put("username", str);
            hashMap.put("password", Utilities.m3487a(bArr));
            hashMap.put("chap", bP.f1548b);
            hashMap.put("mac", str3);
            hashMap.put("drop", bP.f1547a);
            hashMap.put(BaseConstants.MESSAGE_TYPE, bk.f1633h);
            hashMap.put("n", "120");
            hashMap.put("ac_id", bP.f1548b);
            String a = HTTPUtilities.m3476a(hashMap, com.umeng.message.proguard.TUNet.f1909a);
            TUNet.m2665b(NetUtilities.LogTag, "SRun Login: start making HTTP request.");
            a = HTTPUtilities.m3473a("http://166.111.204.120:69/cgi-bin/srun_portal", j, a, com.umeng.message.proguard.TUNet.f1909a);
            TUNet.m2665b(NetUtilities.LogTag, "SRun Login: HTTP request finished: " + a);
            return a;
        }
        TUNet.m2665b(NetUtilities.LogTag, "SRun Login failed with code: " + challengeResponse.type);
        throw new UnexpectedResponseError("SRun Login to 166.111.204.120:3335 with challenge request failed.", "type:" + challengeResponse.type + " user_id:" + challengeResponse.user_id);
    } catch (UnknownHostException e) {
        throw new NetworkError();
    }
}

和之前抓包的分析一样，先发UDP包，再登录。找机会看看。

[lizy14]

其实吧，直接去问 labμ 的同学就行了呗…… 好像他们的 SRun 协议是从官方 windows 客户端反向出来的

[ClumsyLee]

主要是他们的TUNet桌面版已经进入内测阶段了似乎，感觉现在去问不太妥_(:3」∠)_