技術宅打造全能美劇播放器

1:前言

看到有同仁發《權力的游戲》自動追劇腳本,老衲也來湊個熱鬧…

移動端最好的播放器非云播君莫屬了,極速而方便,高清而無碼,可惜最近資源被和諧,每次有美劇更新需要用瀏覽器手工添加播放源或者pc端添加,很是麻煩的說。于是就簡單diy了下云播1.9 for Android ,使其支持自定義搜索引擎(比如人人影視,xxx資源站等),并且修復了原來搜索結果列表頁標題的bug,為了迎接Game of Thrones Season 4 的回歸,特記錄下修改過程。

2:添加yyets.com搜索引擎

反編譯搜索引擎代碼

comxunleicloudactionsearchAdviseEngine.java 89 行

try    {      str = SearchAdviceEngineListResp.getDomainName(paramString);      if (str.equalsIgnoreCase("btdigg.org"))      {        localAdviseEngine.url_pattern = "http://btdigg.org/search?q={searchTerms}&p={page}";        localAdviseEngine.multi_page = true;        localAdviseEngine.page_start_point = 0;        return localAdviseEngine;      }      if (str.equalsIgnoreCase("so.com"))      {        localAdviseEngine.url_pattern = "http://www.so.com/s?q={searchTerms}+site%3Abtdigg.org&pn={page}";        localAdviseEngine.multi_page = true;        localAdviseEngine.page_start_point = 1;        return localAdviseEngine;      }    }    catch (URISyntaxException localURISyntaxException)    {      localURISyntaxException.printStackTrace();      return localAdviseEngine;    }    if (str.equalsIgnoreCase("torrentkitty.com"))    {      localAdviseEngine.url_pattern = "http://www.torrentkitty.com/search/{searchTerms}/{page}";      localAdviseEngine.multi_page = true;      localAdviseEngine.page_start_point = 1;      return localAdviseEngine;    }    if (str.equalsIgnoreCase("kuaichuanmirror.com"))    {      localAdviseEngine.url_pattern = "http://www.kuaichuanmirror.com/search/{searchTerms}/";      localAdviseEngine.multi_page = false;      localAdviseEngine.page_start_point = 1;    }

挖槽 竟然內置四大毛片搜索引擎 !!!

隨便改掉一個即可

由于內置引擎只識別磁力鏈接 需要一個腳本文件來做中轉(代碼見最后鏈接)

輸出格式為

magnet:?xt=urn:btih:hash1&title1</br>magnet:?xt=urn:btih:hash2&title2</br>

修改 smalicomxunleicloudactionsearchAdviseEngine.smali 239 行

.line 127 :cond_1 const-string v2, "yyets.com" invoke-virtual {v0, v2}, Ljava/lang/String;->equalsIgnoreCase(Ljava/lang/String;)Z move-result v2 if-eqz v2, :cond_2 .line 128 const-string v0, "http://www.ttst.com/y2c.php?keyword={searchTerms}&page={page}" iput-object v0, v1, Lcom/xunlei/cloud/action/search/AdviseEngine;->url_pattern:Ljava/lang/String;.line 129 const/4 v0, 0x1

3:修正標題bug

云播在使用第三方搜索引擎時,發現結果列表頁面的標題全部是隨機的字符串

查看對應的dalvik代碼

smalicomxunleicloudactionsearchAdviseEngine.smali 990行

const-string v0, "magnet:\?xt=urn:btih:([A-Za-z\d]{32,})&?"      //批量正則   遍歷結果數組  ..... invoke-static {v0, v1}, Ljava/util/regex/Pattern;->//compile(Ljava/lang/String;I)Ljava/util/regex/Pattern; ..... invoke-virtual {v5}, //Ljava/util/regex/Matcher;->find()Zmove-result-object v0 .line 88 invoke-virtual {v0}, Ljava/lang/String;->length()Imove-result v1add-int/lit8 v1, v1, -0x1 invoke-virtual {v0, v1}, Ljava/lang/String;->charAt(I)C move-result v1.line 89const/16 v6, 0x26if-ne v1, v6, :cond_4.line 90invoke-virtual {v0}, Ljava/lang/String;->length()Imove-result v1add-int/lit8 v1, v1, -0x1invoke-virtual {v0, v3, v1}, Ljava/lang/String;->substring(II)Ljava/lang/String; move-result-object v0    move-object v1, v0    .line 92    :goto_1    const/16 v0, 0x14    invoke-virtual {v1}, Ljava/lang/String;->length()I    move-result v6    invoke-virtual {v1, v0, v6}, Ljava/lang/String;->substring(II)Ljava/lang/String;    move-result-object v0    .line 93    invoke-static {v0, v2}, Lcom/xunlei/cloud/action/search/g;->a(Ljava/lang/String;I)Ljava/lang/String;     // str2.substring(20, str2.length())    move-result-object v6 .......line 105 iput-object v6, v0, Lcom/xunlei/cloud/action/search/SnifferData;->title:Ljava/lang/String;.line 106  iput-object v1, v0, Lcom/xunlei/cloud/action/search/SnifferData;->url:Ljava/lang/String;.line 107  iput-object v6, v0, Lcom/xunlei/cloud/action/search/SnifferData;->hash:Ljava/lang/String;

可以看到,標題被直接賦值給 magnet 的 hash 了 …..

修改為

ArrayList localArrayList = new ArrayList();  Matcher localMatcher = pattern.compile(".*?</br>", 2).matcher(   //中轉腳本每行用</br> 分割    paramString);  if (!localMatcher.find()) {   return;  }  String str1;  str1 = localMatcher.group();  for (String str2 = str1.substring(0, 60);; str2 = str1) {   String str3 = str2.substring(20, 60);   String str4 = str1.substring(61, str1.length() - 5);   SnifferData localSnifferData = new SnifferData();   localSnifferData.title = str4;   localSnifferData.url = str2;   localSnifferData.hash = str3;   localArrayList.add(localSnifferData);   break;  }

對應的dalvik 代碼(具體見后面鏈接)

locals 15 //15個寄存器const-string v0, ".*?</br>"const/4 v10, 0x0const/16 v11, 0x3c // 60const/16 v12, 0x3d //61const/4 v1, 0x2invoke-static {v0, v1}, Ljava/util/regex/Pattern;->compile(Ljava/lang/String;I)Ljava/util/regex/Pattern;move-result-object v0invoke-virtual {v0, v10, v11}, Ljava/lang/String;->substring(II)Ljava/lang/String;                                                                                                              move-result-object v8move-object v1, v8                                                                                                              .line 92:goto_1move-object v9, v0     // copy 一份v0   magnet:?xt=urn:btih:hash&titleconst/16 v0, 0x14                                                                                                              invoke-virtual {v1}, Ljava/lang/String;->length()I                                                                                                              ........new-instance v0, Lcom/xunlei/cloud/action/search/SnifferData;invoke-direct {v0}, Lcom/xunlei/cloud/action/search/SnifferData;-><init>()Vinvoke-virtual {v9}, Ljava/lang/String;->length()Imove-result v13add-int/lit8 v13, v13, -0x5invoke-virtual {v9, v12, v13}, Ljava/lang/String;->substring(II)Ljava/lang/String;move-result-object v14.line 105iput-object v14, v0, Lcom/xunlei/cloud/action/search/SnifferData;->title:Ljava/lang/String;                                                                                                              .line 106iput-object v1, v0, Lcom/xunlei/cloud/action/search/SnifferData;->url:Ljava/lang/String;                                                                                                              .line 107iput-object v6, v0, Lcom/xunlei/cloud/action/search/SnifferData;->hash:Ljava/lang/String;

4:編譯錯誤處理

java -jar apktool.jar b CloudPlay_ybappgw c1.apklibpng error: Not a PNG fileERROR: Failure processing PNG image F:PentestYa Toolspendroidapktool1.5.2CloudPlay_ybappgwresdrawable-hdpilocal_list_view_item_color.png

不是真正的png文件 看了下文件頭 bmp… 改過來 繼續

ERROR: 9-patch image F:PentestYa Toolspendroidapktool1.5.2CloudPlay_ybappgwresdrawable-hdpiprogressbar_local_item.9.pngmalformed.

把三個文件全部改成普通 png格式 progressbar_local_item.9.png => progressbar_local_item.png

apktool b CloudPlay_ybappgw c1.apkI: Checking whether sources has changed...I: Smaling...I: Checking whether resources has changed...I: Building apk file...

成功編譯成apk 文件

5:測試結果

簽名 安裝到手機

java -jar signapk.jar testkey.x509.pem testkey.pk8 c1.apk c1_s.apkadb install -r c1_s.apk

6:鏈接

中轉腳本: https://github.com/yaseng/pentest/blob/master/project/diy_cloudplay/y2c.phpg.smali : https://github.com/yaseng/pentest/blob/master/project/diy_cloudplay/g.smalismali 語法 : https://code.google.com/p/smali/w/listAv Top 10: http://movie.douban.com/doulist/3822549