Where's the Android phone? 7.2 Version Client account storage information analysis

1.data/data/com.qunar under the Sharepref folder Qunarperferences.xml
Username,phone and so on in the file are encrypted processed fields

function of finding keyword _phone under 2.jdgui

3. Analyze read Sharepref function and Java layer cryptographic function and call native function.

4. Load the corresponding so, analyze the function that the derived function JNI dynamic registration binds to.

The DA binding function is dumpalso.

5. Load so dumpalso to trigger the breakpoint debug trace. trace function found 0100ffff as the head flag does not participate in parsing, can be directly crossed. The primary processing process is to vary or subtract directly from the generated key.

6. Write code validation results.