Как я расковырял антифрод маркетплейса

# 1. достать библиотеку из APK
unzip ozon_bank.apk lib/arm64-v8a/libozon-id-sdk.so -d out

# 2. сверить хеш
sha256sum out/lib/arm64-v8a/libozon-id-sdk.so
# c0fa6b288669572c5dff5fe86766b6005c32a0bd6c9fc1122a7e404700929646

# 3. посмотреть экспорты
nm -D --defined-only out/lib/arm64-v8a/libozon-id-sdk.so | grep Java_
# 0x62d08 ... getValue1
# 0x63880 ... getValue2
# 0x63894 ... Amf_getValueNative

# 4. вытащить блоб 84 байта (скрипт из раздела с кодом)
python3 extract_blob.py
# 5d3a9d92... / AESAES/CFB/NoPadding

import struct

P = 'libozon-id-sdk.so'
f = open(P, 'rb').read()

e_phoff = struct.unpack_from('<Q', f, 0x20)[0]
e_phentsize = struct.unpack_from('<H', f, 0x36)[0]
e_phnum = struct.unpack_from('<H', f, 0x38)[0]

segs = []
for i in range(e_phnum):
    b = e_phoff + i * e_phentsize
    if struct.unpack_from('<I', f, b)[0] == 1:          # PT_LOAD
        segs.append((struct.unpack_from('<Q', f, b + 0x10)[0],
                     struct.unpack_from('<Q', f, b + 0x08)[0],
                     struct.unpack_from('<Q', f, b + 0x20)[0]))

def off(v):
    for va, o, fs in segs:
        if va <= v < va + fs:
            return o + (v - va)

blob = f[off(0xe2da8):off(0xe2da8) + 84]
print('key    :', blob[0:32].hex())
print('algo   :', blob[64:67])
print('cipher :', blob[67:84])

$ nm -D --defined-only libozon-id-sdk.so | grep Java_
Java_ru_ozon_id_ad_AdManager_getValue1
Java_ru_ozon_id_ad_AdManager_getValue2
Java_ru_ozon_id_amf_Amf_getValueNative

import base64
from Crypto.Cipher import AES

KEY = bytes.fromhex('5d3a9d9237450777b3028be69a06bd1376ccc0d2f73748bedfc28909a551d789')

def decode(payload: str) -> str:
    raw = base64.b64decode(payload)
    iv, ct = raw[:16], raw[16:]
    cipher = AES.new(KEY, AES.MODE_CFB, iv=iv, segment_size=128)
    return cipher.decrypt(ct).decode()

print(decode('<payload из логов>'))

import base64
sig = base64.b64decode(x_ad_id)
print(len(sig), sig[:9], sig[9:11])   # [9 случ.] [1.] [hex millis]...

{"vendor":"Google","device":"Pixel 7",
 "raw_ids":{"a_build_fingerprint":"google/panther/panther:14/UP1A.231005.007/10754064:user/release-keys"},
 "found_apps":[],"is_root":false,"emulator":false,
 "debug":{"usb_debug_enabled":false,"wifi_debug_enabled":false,"is_debugging":false},
 "cert_hash":null,"carrier":"YOTA"}

import struct

P = 'libozon-id-sdk.so'
f = open(P, 'rb').read()

# разбираем program headers, чтобы получить файловые смещения
e_phoff = struct.unpack_from('<Q', f, 0x20)[0]
e_phentsize = struct.unpack_from('<H', f, 0x36)[0]
e_phnum = struct.unpack_from('<H', f, 0x38)[0]

segs = []
for i in range(e_phnum):
    b = e_phoff + i * e_phentsize
    if struct.unpack_from('<I', f, b)[0] == 1:          # PT_LOAD
        segs.append((struct.unpack_from('<Q', f, b + 0x10)[0],
                     struct.unpack_from('<Q', f, b + 0x08)[0],
                     struct.unpack_from('<Q', f, b + 0x20)[0]))

def off(v):
    for va, o, fs in segs:
        if va <= v < va + fs:
            return o + (v - va)

blob = f[off(0xe2da8):off(0xe2da8) + 84]

key    = blob[0:32]      # prod-ключ (если stage-флаг - blob[32:64])
algo   = blob[64:67]     # b'AES'
cipher = blob[67:84]     # b'AES/CFB/NoPadding'

print('key    :', key.hex())
print('algo   :', algo)
print('cipher :', cipher)

import base64, json, os, time
from Crypto.Cipher import AES

KEY = bytes.fromhex('5d3a9d9237450777b3028be69a06bd1376ccc0d2f73748bedfc28909a551d789')
CIPHER = 'AES/CFB/NoPadding'

def decode_fingerprint(payload: str) -> str:
    raw = base64.b64decode(payload)
    iv, ct = raw[:16], raw[16:]
    c = AES.new(KEY, AES.MODE_CFB, iv=iv, segment_size=128)
    return c.decrypt(ct).decode()

def build_mf(dto: dict, mf_token: str = None) -> str:
    key = KEY
    if mf_token is not None:
        key = KEY[0:24] + mf_token[-8:].encode()

    plain = f"{int(time.time() * 1000)}," + json.dumps(dto, separators=(',', ':'), ensure_ascii=False)
    iv = os.urandom(16)
    c = AES.new(key, AES.MODE_CFB, iv=iv, segment_size=128)
    ct = c.encrypt(plain.encode())
    return base64.b64encode(iv + ct).decode()

def fingerprint_dto(dtype: str, device_id: str) -> dict:
    return {
        "androidFingerprintType": dtype,
        "androidModel": "Pixel 7",
        "androidManufacturer": "Google",
        "androidBrand": "google",
        "androidHardware": "panther",
        "androidBoard": "panther",
        "androidDevice": "panther",
        "androidProduct": "panther",
        "androidSdk": 34,
        "androidRelease": "14",
        "androidSecurityPatch": "2024-01-05",
        "androidBuildId": "UP1A.231005.007",
        "androidRadioVersion": "g5300g-000000-240101-B-11012446",
        "androidFingerprint": "google/panther/panther:14/UP1A.231005.007/10754064:user/release-keys",
        "androidTags": "release-keys",
        "androidType": "user",
        "androidTime": 1698796800000,
        "androidUser": "android-build",
        "androidBootloader": "slider-1.0-10062794",
        "androidSku": "unknown",
        "androidOdmSku": "unknown",
        "androidDisplay": "UP1A.231005.007",
        "androidHost": "abfarm-release-rbe-64-0004",
        "androidSupportedAbis": ["arm64-v8a", "armeabi-v7a", "armeabi"],
        "androidSocManufacturer": "Google",
        "androidSocModel": "Tensor G2",
        "androidScreenWidth": 1080,
        "androidScreenHeight": 2400,
        "androidDensity": 2.75,
        "androidDensityWidth": 420.0,
        "androidDensityHeight": 420.0,
        "androidPackageName": "ru.ozon.fintech.finance",
        "androidVersionName": "19.33.1",
        "androidFirstInstallTime": 1780000000000,
        "androidLastUpdateTime": 1780000000000,
        "androidVersionCode": 16030341,
        "androidLocales": ["ru-RU"],
        "androidTimezoneId": "Asia/Krasnoyarsk",
        "androidTimezoneRawOffset": 25200000,
        "androidTimezoneDisplayName": "Krasnoyarsk Standard Time",
        "androidIsDeviceSecure": True,
        "androidIsDebug": False,
        "androidConnectionType": "WIFI",
        "androidIsVpnConnected": False,
        "androidIsRoot": False,
        "androidIdentifierForVendor": None,
        "androidDeviceId": device_id,
        "androidDevelopmentSettingsEnabled": 0,
        "androidAdbEnabled": 0,
        "androidStayOnWhilePluggedIn": 0,
        "androidDebugApp": None,
        "androidWaitForDebugger": 0,
        "androidIsEmulator": None,
        "androidOzonIdSdkVersion": "14.15.0",
    }

if __name__ == '__main__':
    dto = fingerprint_dto('asyncOnLogin', '3f96f7afad658ec0')
    mf = build_mf(dto)
    print('mf =', mf)
    print('decoded =', decode_fingerprint(mf))

package ru.ozon.id.ad;

public final class AdManager {

    static {
        System.loadLibrary("ozon-id-sdk");
    }

    public AdManager() {}

    // instance-методы: 6 строк должны попасть в x2..x7 на arm64
    public final native byte[] getValue1(String s1, String s2, String s3, String s4, String s5, String s6);
    public final native String getValue2();
}

public final class Sign {
    private static final AdManager AD = new AdManager();

    public static String xadid(String url, String method, String app,
                               String ver, String xo3fp, String adId) {
        byte[] sig = AD.getValue1(url, app, ver, xo3fp, method, adId);
        return android.util.Base64.encodeToString(sig, android.util.Base64.NO_WRAP);
    }
}

SDK=/opt/android-sdk
BT=$SDK/build-tools/34.0.0
AJ=$SDK/platforms/android-34/android.jar

rm -rf build && mkdir -p build/classes build/dexout
$BT/aapt2 link -o build/base.apk --manifest AndroidManifest.xml -I $AJ --auto-add-overlay
javac -source 8 -target 8 -bootclasspath $AJ -d build/classes $(find src -name '*.java')
$BT/d8 --lib $AJ --min-api 24 --output build/dexout $(find build/classes -name '*.class')

cp build/base.apk build/unsigned.apk
( cd build/dexout && zip -q ../unsigned.apk classes.dex )
zip -qr build/unsigned.apk lib      # lib/arm64-v8a/libozon-id-sdk.so + x86_64

$BT/zipalign -f -p 4 build/unsigned.apk build/aligned.apk
keytool -genkeypair -keystore build/ks.jks -storepass android -keypass android \
    -alias k -keyalg RSA -keysize 2048 -validity 10000 -dname "CN=d,O=d,C=US" >/dev/null 2>&1
$BT/apksigner sign --ks build/ks.jks --ks-pass pass:android --key-pass pass:android \
    --out build/oracle.apk build/aligned.apk
adb install -r build/oracle.apk

public final class Socks5 {

    public static Socket connect(String ph, int pp, String user, String pass,
                                 String host, int port) throws IOException {
        Socket s = new Socket();
        s.connect(new InetSocketAddress(ph, pp), 12000);
        s.setSoTimeout(20000);
        s.setTcpNoDelay(true);

        InputStream in = s.getInputStream();
        OutputStream out = s.getOutputStream();

        out.write(new byte[]{5, 1, 2});              // VER, NMETHODS, USER/PASS
        out.flush();
        byte[] r = readN(in, 2);
        if (r[1] == 2) {
            byte[] u = user.getBytes("UTF-8");
            byte[] p = pass.getBytes("UTF-8");
            ByteArrayOutputStream b = new ByteArrayOutputStream();
            b.write(1); b.write(u.length); b.write(u);
            b.write(p.length); b.write(p);
            out.write(b.toByteArray()); out.flush();
            r = readN(in, 2);
            if (r[1] != 0) throw new IOException("socks5 auth code=" + r[1]);
        } else if (r[1] != 0) {
            throw new IOException("socks5 method code=" + r[1]);
        }

        byte[] hb = host.getBytes("UTF-8");
        ByteArrayOutputStream b = new ByteArrayOutputStream();
        b.write(5); b.write(1); b.write(0); b.write(3);   // VER CMD RSV ATYP=DOMAIN
        b.write(hb.length); b.write(hb);
        b.write((port >> 8) & 0xff); b.write(port & 0xff);
        out.write(b.toByteArray()); out.flush();

        byte[] rep = readN(in, 4);
        if (rep[1] != 0) throw new IOException("socks5 connect code=" + rep[1]);
        int atyp = rep[3];
        if (atyp == 1) readN(in, 4);
        else if (atyp == 3) readN(in, readN(in, 1)[0]);
        else if (atyp == 4) readN(in, 16);
        readN(in, 2);
        return s;
    }

    private static byte[] readN(InputStream in, int n) throws IOException {
        byte[] b = new byte

public final class Http {

    public final String ph; public final int pp;
    public final String user; public final String pass;
    public final Jar jar = new Jar();

    public Http(String ph, int pp, String user, String pass) {
        this.ph = ph; this.pp = pp; this.user = user; this.pass = pass;
    }

    public Resp req(String method, String url, String body, Map<String, String> headers) throws IOException {
        String rest = url.substring(url.indexOf("://") + 3);
        String hostPort = rest, path = "/";
        int slash = rest.indexOf('/');
        if (slash >= 0) { hostPort = rest.substring(0, slash); path = rest.substring(slash); }
        int port = 443; String host = hostPort;
        int colon = hostPort.indexOf(':');
        if (colon >= 0) { host = hostPort.substring(0, colon); port = Integer.parseInt(hostPort.substring(colon + 1)); }

        Socket tunnel = Socks5.connect(ph, pp, user, pass, host, port);
        SSLSocket ssl = (SSLSocket) SSLSocketFactory.getDefault()
                .createSocket(tunnel, host, port, true);
        SSLParameters p = ssl.getSSLParameters();
        p.setServerNames(Collections.singletonList(new SNIHostName(host)));
        ssl.setSSLParameters(p);
        ssl.startHandshake();

        StringBuilder h = new StringBuilder();
        h.append(method).append(' ').append(path).append(" HTTP/1.1\r\n");
        h.append("Host: ").append(host).append("\r\n");
        for (Map.Entry<String, String> e : headers.entrySet())
            h.append(e.getKey()).append(": ").append(e.getValue()).append("\r\n");
        if (!jar.header().isEmpty()) h.append("Cookie: ").append(jar.header()).append("\r\n");
        byte[] bb = body == null ? new byte[0] : body.getBytes("UTF-8");
        h.append("Content-Length: ").append(bb.length).append("\r\n");
        h.append("Connection: close\r\n\r\n");

        OutputStream os = ssl.getOutputStream();
        os.write(h.toString().getBytes("ISO-8859-1"));
        if (bb.length > 0) os.write(bb);
        os.flush();

        Resp r = readResponse(ssl.getInputStream());
        ssl.close();
        return r;
    }

    // readResponse + Jar опущены для краткости, логика обычная:
    // status line -> headers -> (chunked | content-length | read-all)
    // каждый Set-Cookie кладем в jar.
}

public final class Identity {
    public final String androidId, installId, deviceId, sessionId;

    public static Identity load(Context ctx, String key) {
        SharedPreferences sp = ctx.getSharedPreferences("rat_id_" + key, Context.MODE_PRIVATE);
        String a = sp.getString("android_id", null);
        String i = sp.getString("install_id", null);
        String d = sp.getString("device_id", null);
        String s = sp.getString("session_id", null);
        boolean dirty = false;
        if (a == null) { a = randHex(16); dirty = true; }
        if (i == null) { i = UUID.randomUUID().toString(); dirty = true; }
        if (d == null) { d = UUID.randomUUID().toString(); dirty = true; }
        if (s == null) { s = UUID.randomUUID().toString(); dirty = true; }
        if (dirty) sp.edit().putString("android_id", a).putString("install_id", i)
                .putString("device_id", d).putString("session_id", s).apply();
        return new Identity(a, i, d, s);
    }

    private static String randHex(int n) {
        SecureRandom r = new SecureRandom();
        StringBuilder sb = new StringBuilder();
        for (int k = 0; k < n; k++) sb.append(Character.forDigit(r.nextInt(16), 16));
        return sb.toString();
    }
}

public final class MfEncoder {

    private static final byte[] BLOB = hex(
        "5d3a9d9237450777b3028be69a06bd1376ccc0d2f73748bedfc28909a551d789" +
        "290752c732d0da1d0a78cb327d53c8b66e61a67e6f6ae39c9bdf0d3c78832622" +
        "4145534145532f4346422f4e6f50616464696e67");

    public static String encode(String json) throws Exception {
        byte[] key = slice(BLOB, 0, 32);
        String cipher = new String(slice(BLOB, 67, 84), "UTF-8");  // AES/CFB/NoPadding
        String algo   = new String(slice(BLOB, 64, 67), "UTF-8");  // AES

        String plain = System.currentTimeMillis() + "," + json;
        byte[] iv = new byte[16];
        new SecureRandom().nextBytes(iv);

        Cipher c = Cipher.getInstance(cipher);
        c.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(key, algo), new IvParameterSpec(iv));
        byte[] ct = c.doFinal(plain.getBytes("UTF-8"));

        byte[] out = new byte[iv.length + ct.length];
        System.arraycopy(iv, 0, out, 0, iv.length);
        System.arraycopy(ct, 0, out, iv.length, ct.length);
        return Base64.encodeToString(out, Base64.NO_WRAP);
    }

    private static byte[] slice(byte[] a, int i, int j) {
        byte[] r = new byte[j - i]; System.arraycopy(a, i, r, 0, j - i); return r;
    }
    private static byte[] hex(String s) {
        byte[] r = new byte[s.length() / 2];
        for (int i = 0; i < r.length; i++) r

public final class ChallengeSolver {
    private static final String API = "https://api.ozon.ru";

    public static String solve(Activity act, String url, Map<String,String> seed, long timeoutMs) {
        final CountDownLatch latch = new CountDownLatch(1);
        final CookieManager cm = CookieManager.getInstance();
        cm.setAcceptCookie(true);
        act.runOnUiThread(new Start(act, url, seed, cm, latch));
        try { latch.await(timeoutMs, TimeUnit.MILLISECONDS); } catch (InterruptedException ignored) {}
        return cm.getCookie(API);
    }

    static final class Start implements Runnable {
        final Activity act; final String url; final Map<String,String> seed;
        final CookieManager cm; final CountDownLatch latch;
        Start(Activity a, String u, Map<String,String> s, CookieManager c, CountDownLatch l) {
            act = a; url = u; seed = s; cm = c; latch = l;
        }
        public void run() {
            WebView wv = new WebView(act);
            WebSettings s = wv.getSettings();
            s.setJavaScriptEnabled(true);
            s.setDomStorageEnabled(true);
            s.setDatabaseEnabled(true);
            s.setUserAgentString("Mozilla/5.0 (Linux; Android 14; Pixel 7 Build/UP1A.231005.007; wv) "
                    + "AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/120.0.0.0 Mobile Safari/537.36");
            cm.setAcceptThirdPartyCookies(wv, true);
            if (seed != null)
                for (Map.Entry<String,String> e : seed.entrySet())
                    cm.setCookie(API, e.getKey() + "=" + e.getValue());
            cm.flush();
            act.setContentView(wv);
            wv.setWebViewClient(new WebViewClient());
            wv.loadUrl(url);
            new Handler(Looper.getMainLooper()).postDelayed(new Poll(cm, latch), 1500);
        }
    }

    static final class Poll implements Runnable {
        final CookieManager cm; final CountDownLatch latch; String base; int tries;
        Poll(CookieManager c, CountDownLatch l) { cm = c; latch = l; }
        public void run() {
            String c = cm.getCookie(API);
            if (base == null) base = c;
            if (tries++ >= 18 || (tries > 2 && c != null && !c.equals(base))) { latch.countDown(); return; }
            new Handler(Looper.getMainLooper()).postDelayed(this, 1000);
        }
    }
}

public static void run(Context ctx) throws Exception {
    Identity id = Identity.load(ctx, "p10811");
    Http http = new Http("192.168.3.66", 10811, "user", "pass");

    // 1) initAuth
    String initUrl = API + "/composer-api.bx/_action/initAuth?type=OnSessionInit";
    http.req("POST", initUrl, "{\"clientId\":\"ozonbankfinance_android\",\"traceId\":null}", h(initUrl, "POST", id));
    sleep(2500);

    // 2) entry (ожидаем 403 + antibot)
    String entry = API + "/composer-api.bx/_action/ozonIdPageEntry?iso=RU";
    Http.Resp r = http.req("POST", entry, entryBody(id), h(entry, "POST", id));
    r = follow(http, r, entryBody(id), id);

    // 3) антибот-пейлоад
    String abt = API + "/abt/result-mobile?isAsyncOnLogin=true";
    String mf = MfEncoder.encode(Fingerprint.json("asyncOnLogin", id.androidId));
    http.req("POST", abt, "{\"mf\":\"" + mf + "\",\"mfToken\":null,\"n\":null}", h(abt, "POST", id));
    sleep(2500);

    // 4) авто-солвер челленджа
    String challenge = field(r.body, "challengeURL");
    if (challenge != null && ctx instanceof Activity) {
        String cookies = ChallengeSolver.solve((Activity) ctx, challenge, http.jar.entries(), 20000);
        http.jar.merge(cookies);
        sleep(1000);
    }

    // 5) повтор entry -> 200 EntryDTO
    Http.Resp r2 = http.req("POST", entry, entryBody(id), h(entry, "POST", id));
    r2 = follow(http, r2, entryBody(id), id);
    Log.i("RATNET", "final: " + r2.code + " " + r2.body);
}

private static Map<String,String> h(String url, String method, Identity id) {
    String ver = "19.33.1(16030341)";
    Map<String,String> m = new LinkedHashMap<>();
    m.put("Content-Type", "application/json");
    m.put("User-Agent", UA);
    m.put("x-requested-with", "ru.ozon.app");
    m.put("x-o3-app-name", "ozonbankfinance_android");
    m.put("x-o3-app-version", ver);
    m.put("x-o3-device-type", "mobile");
    m.put("x-o3-device-language", "ru");
    m.put("x-o3-fp", "1.d9f8368943e8fe03");
    m.put("x-app-uuid", id.installId);
    m.put("x-ob-sessionid", id.sessionId);
    m.put("x-ob-model-device", "Google Pixel 7");
    m.put("x-ad-id", Sign.xadid(url, method, "ozonbankfinance_android", ver,
                                "1.d9f8368943e8fe03", id.installId));
    return m;
}

import requests, base64

API = 'https://api.ozon.ru'
XO3FP = '1.d9f8368943e8fe03'

def build_headers(url, method, app, ver, ad_id, xad_id):
    return {
        'content-type': 'application/json',
        'user-agent': 'Mozilla/5.0 (Linux; Android 14; Pixel 7) AppleWebKit/537.36 Chrome/120 Mobile Safari/537.36',
        'x-requested-with': 'ru.ozon.app',
        'x-o3-app-name': app,
        'x-o3-app-version': ver,
        'x-o3-device-type': 'mobile',
        'x-o3-device-language': 'ru',
        'x-o3-fp': XO3FP,
        'x-app-uuid': ad_id,
        'x-ob-model-device': 'Google Pixel 7',
        'x-ad-id': xad_id,
    }

s = requests.Session()

r = s.post(f'{API}/composer-api.bx/_action/initAuth?type=OnSessionInit',
           json={'clientId': 'ozonbankfinance_android', 'traceId': None})

r = s.post(f'{API}/composer-api.bx/_action/ozonIdPageEntry?iso=RU',
           json={'deviceId': DEVICE_ID, 'supportCountrySelect': True})

mf = build_mf(fingerprint_dto('asyncOnLogin', ANDROID_ID))
s.post(f'{API}/abt/result-mobile?isAsyncOnLogin=true',
       json={'mf': mf, 'mfToken': None, 'n': None})

r = s.post(f'{API}/composer-api.bx/_action/ozonIdPageEntry?iso=RU',
           json={'deviceId': DEVICE_ID, 'supportCountrySelect': True})
print(r.status_code, r.text[:400])