【3】分析淘宝数据包头部信息 x-signx-mini-wua、x-sgext、x-umt、wua 参数

原创已于 2026-01-31 00:28:02 修改 · 1k 阅读

6 ·

本内容遵循CC 4.0 BY-SA版权协议

GEO检测

标签

#python #android

于 2026-01-31 00:21:56 首次发布

阿里系列专栏收录该内容

4 篇文章

订阅专栏

Python3.8

Python 是一种高级、解释型、通用的编程语言，以其简洁易读的语法而闻名，适用于广泛的应用，包括Web开发、数据分析、人工智能和自动化脚本

为例

请求地址：

https://acs.m.taobao.com/gw/mtop.taobao.commonuse.mloginservice.genqrcode/1.0/

参数分析：

参数	说明
mtop.taobao.commonuse.mloginservice.genqrcode	方法名称
1.0	版本号

请求头：

{
  "x-sgext": "JBRM6m3AP052V%2B3mZ1zuVOp92nzefMl%2B33%2FZfMl92W%2FJfd1603neft983G%2FafNp82nzafNp82nzafNp8yX3Yb9pv2nzJfNp82m%2Fab9tv22%2Fbb9tv22%2FYb9pv22%2Fbb9pv2m%2Fab9pv2m%2Fab9pvySnJfMl8ySjZL4x82m%2FafNp82m%2Fab9913m%2Fab8l%2FyX3Jf8l8yTaGDbNv2m%2FKbMotymzKfMl8tQ2NP6gNjQ2uDah4qwSdDdcT0xPbYdphtS21fsx4zHusE4gT23nZYdth2mHbYdt4x37Hfsx9zHzMfcx9x3zHfd1603nZet1%2B0mHbEtt73HXff9x72HS0fMx%2BzHTdE44TvxqkHrx9pB6%2Ffa9xtSq1f8d8x33deMd%2B32HYeNwT2361fMd93mHTdd4T23%2B1DY0Nqw2rDasNqw2rDasNqw2rDasNqw2rDasNqxPbeLUNjQ2vDbsNqw2NDasNuRSCdJ0PiQ27DasOvH%2BTNZMf2w2ND9IJjQvaY7oBqyKrCasNqwebFa8ogQ2uO6sNqR%2FbDasNqw2rNYx8hTq8PKd4qA2rGasN3DyNHtgdqxyrDasGphmrDa4BqwqNAaACjQiIfasN3g2pH9sNqw2QDatx12q6Otk2qwadDqsNq3G1fdwT2hPbdbV7zGHbatpi2nzafMx4zHzMfMx8zHzMfLV9iBPaYdoT2y%2B1fd9%2FzHzMf8x123XMddt1zHXbdcxh337MYdJ0zHTTat4u22rZE9sotXzMfbV9jxPdfsd72BPYfLV8x361ftkT23nZasd9xHzafNpq22raatpq3mraatpq2mraat8T2Hi1fcd8x3jHecd7x3zHfcd7x33aYd0T",
  "x-social-attr": "3",
  "x-sign": "azYBCM007xAAj1EwJfxglh6Y668h71E%2FU3DWucahnhYCMNEu%2Fpvi9VjhcRaRM1oMPTCIhPVVmDm6hUV78n4VewCLB69RL1E%2FUS9RP1",
  "x-nettype": "WIFI",
  "Accept-Encoding": "zstd, gzip",
  "x-pv": "6.3",
  "x-nq": "WIFI",
  "login_sdk_version": "7.8.9",
  "cro-privacy-recommend-switch-without-uid": "true",
  "x-region-channel": "CN",
  "x-features": "27",
  "x-app-conf-v": "0",
  "x-mini-wua": "aGwSMuBeW1I528kHtHPMlFmHn7M17MP%2BeeEYveJSCQcNP9aNr4PN03bKJ9GcbayqS6HCgc5J54rjFtGX5UCiMobEw01EXq2Q3ELG3ckdY3fWbqc6AchOS%2B1QgSYii4PtsLrKcUis%2B7Dhz6r8xMUQA0Hz9uLSzJI8ennGFI4VqGg71XI%2By1TTgu34q08RjVBAaPJt7Dt8Djc9wQLzENo1XjtboRXTEkEuixtbry8C29Z9duCunnQiZLGCQQUVCBTIQzrXHqcvHIcda%2BQ%3D%3D",
  "content-type": "application/x-www-form-urlencoded;charset=UTF-8",
  "Content-Length": "1263",
  "x-t": "1769542516",
  "Content-Type": "application/x-www-form-urlencoded;charset=UTF-8",
  "cro-privacy-recommend-switch": "noUid",
  "x-bx-version": "6.7.250504",
  "f-refer": "mtop",
  "x-extdata": "openappkey%3DDEFAULT_AUTH",
  "x-ttid": "600129%40taobao_android_10.50.0",
  "x-app-ver": "10.50.0",
  "x-c-traceid": "7pEWuDAg",
  "a-orange-dq": "appKey=21646297&appVersion=10.50.0&clientAppIndexVersion=1120260128000700471",
  "x-regid": "reg0SVciK0bv9wGIOCoAZRFv0BvfDTdo",
  "x-umt": "MPgBGvpLPKCd4gKcAMCzNsD9m7pGrJBu",
  "x-utdid": "aXj4IhktJn4DAHr8QqyD3xnd",
  "c-launch-info": "0,0,1769542516426,1769542504760,3",
  "x-appkey": "21646297",
  "x-falco-id": "7pEWuDAg",
  "x-page-url": "http%3A%2F%2Fm.taobao.com%2Findex.htm",
  "x-page-name": "com.ali.user.mobile.login.ui.UserLoginActivity",
  "x-devid": "BjbfD0vHhSiz7BJfnNxNSuiomRzs7IRDJRVI_XWvxZcwGSnBQHHZXSdUw0O46NTr",
  "user-agent": "MTOPSDK%2F3.1.1.7+%28Android%3B12%3BIntel%3BAOSP+on+Intel+Platform%29+DeviceType%28Pad%29",
  "Host": "acs.m.taobao.com",
  "Connection": "Keep-Alive"
}
}

x-系列为头部算法修改后重新发送的情况下
我们用 reqable 进行重发

{
  "api": "mtop.taobao.commonuse.mloginservice.genqrcode",
  "v": "1.0",
  "ret": [
    "FAIL_SYS_ILEGEL_SIGN::非法请求签名"
  ],
  "data": {}
}

说明是必备参数，下面分析如何生成的

如何获取x-signx-mini-wua、x-sgext、x-umt、wua等头部参数

定位

jadx1.4.5 jdk11 加载apk分析，搜索x-sign
找到与x-sign相关的逻辑，发现位于mgd类，这下边的类可以每个jadx加载出来不一样，其中mgd接口和mge，mgc都是都关系的
mgd实例化在 InnerProtocolParamBuilderImpl，我们通过hook到mgd的实例，获取到类、方法
通过反射invoke调用，至于具体参数，可以hook此方法看到，下边也会提到
注意，此a方法可能find 失败，可以再次查找，参数多一个，有6个

直接获取

那么也可以使用我写好的接口，直接获取
请求地址：

http://47.113.222.164:12345/api/taobao/sign

方式：POST

请求参数示例：

{"device": {"AppPid": "12571", "x_appkey": "21646297", "utdid": "aWpi3wcaAowDAK5weLrw0FGv", "x-ttid": "231200@taobao_android_10.50.0", "AppUid": "10086", "appInode": "10121", "HOST": "c4-miui-ota-bd146.bj", "MODEL": "Redmi 9 Prime", "BRAND": "Xiaomi", "eeid": "M1gAEat7cYo+H2OtThcDH6MabOGLtHWwINnTZ65m4HFBAKxm4TsuiLMIaooFY1tL4rNLcuDPmchrZ4dfFK8kYDVOiBuyXv2D/TMBPOEqz9/wRA==", "osVersion": "5", "FINGERPRINT": "Xiaomi/cepheus/cepheus:5.0.0/OPR1.170623.032/V9.6.1.0.OAAMIFD:user/release-keys", "x_extdata": "openappkey=DEFAULT_AUTH", "x-umt": "VOuBOQBLPE0dZwKbx4HK2NHQkkHtxPLi", "PRODUCT": "davinciin", "x-utdid": "aWpi3wcaAowDAK5weLrw0FGv", "androidInode": "13947", "systemInode": "12474", "tbInode": "10987", "x_features": "27", "TYPE": "user", "x-devid": "AgrYDM_lAoCmu2AzdgCsOL4ScGXGAmG2OKEPrg9Gx2ZU", "user-agent": "MTOPSDK/3.1.1.7+(Android;5;Xiaomi;Redmi 10X 5G)"}, "user": {"x_uid": "2215825536555", "x_sid": "2b6e9b8398a489e1c351d0830cb9b44a"}, "api": {"api": "mtop.taobao.mbis.updatedeliveraddress", "v": "2.0"}, "data": {}, "useWua": true}

需要传递的参数分析：

键名	值	说明
device	{}	设备信息可以通过我的接口进行生成参考
user	{“x_uid”: “2215825536555”, “x_sid”: “2b6e9b8398a489e1c351d0830cb9b44a”}	用户信息在cookie中
api	mtop.taobao.commonuse.mloginservice.genqrcode	方法名，在url中
data	{}	请求体，在data中
useWua	true

http://47.113.222.164:12345/api/taobao/device

响应数据：

{
	"msg": "success",
	"code": "200",
	"data": "{}",
	"header": "{\"wua\":\"FKr2_Kb2xChW9caO7tYj9pbeE%2BuTh7Bh7KClFLtTdXVCKhQLoyxSqcCwOJiXT9631HMYPfZavVjox3dRxsk%2Fjlt2fa5OhQ9qouoOGLXtBI33LP0GkJB0D%2Fm1Tlf0AjYlbbxpbN4Vamoja0Yh9QXimX0%2BvM6%2FRqr7DkhPUWptw8LeDYqk1YMEQsnDQiHvJSp1dd0n1cakL1M5Yr57NbVDxyZd1d28oIMovTeNXqsFIuzGaqX8NV4tcd3phlePW3PjdqREOmmLAUYLNU5zrnIa9OX4NB%2FLyh69bRjaiCa3SQzXBSSG8jmMYDacRzLTrWwj0zgEAzfGrEajLwAaxJuHnw4vSWWcR59bLZ1%2BVwhwv7TlBv2%2FrCa6Dmo4fFhlW%2FeYxWqU5\",\"x-sgext\":\"JBI8HGToJ%2BzJ%2FmdQwhKaQi0MLAQqHy0OKQstHy0IPw4wDDAMMAwwDDAMMAwwDDAMMAwwDDAMMAwwDDAMMAw%2FDSsKJQkoDy0OLR8sDCwMLAwsDCwMLAwsDCwMPww%2FDD8MLB8sDCwMPww%2FDT8NPw0%2FDT8NPw0%2FDD8MPww%2FDD8MPww%2FDD8MPww%2FDD8%3D\",\"f-refer\":\"mtop\",\"x-extdata\":\"openappkey%3DDEFAULT_AUTH\",\"x-ttid\":\"231200%40taobao_android_10.50.0\",\"x-sign\":\"azYBCM004xAAI%2FoCZKobBADi5XOK4%2FoD93c0db2dNSqu7toQXVdJzqn72iuDMdzzRQSXNysfK635ud5HWVnOR6u3r5P6E%2FoD%2BhP6A%2F\",\"x-social-attr\":\"3\",\"x-sid\":\"2b6e9b8398a489e1c351d0830cb9b44a\",\"User-Agent\":\"MTOPSDK/3.1.1.7+(Android;5;Xiaomi;Redmi 10X 5G)\",\"x-uid\":\"2215825536555\",\"x-nettype\":\"WIFI\",\"x-pv\":\"6.3\",\"x-nq\":\"WIFI\",\"x-region-channel\":\"CN\",\"x-features\":\"27\",\"x-umt\":\"VOuBOQBLPE0dZwKbx4HK2NHQkkHtxPLi\",\"x-app-conf-v\":\"0\",\"x-mini-wua\":\"aNATbjcx%2BbS9vqsmrQ4mPSuhHQi2IJcuScIM3JO1RERdcZVHXBCkAfGmPAmZ2eNnlrsIhT6XMLoUYZM9PElTWsCYv7MyP2KdNnlAZUP1GpQckGCza7qJuXw1iWiVZuH4z9o3nZ8ybIQ%2BwwsJ2QZEqurUTTAKevAkBKB9it%2BgdFF8bo2YDQplqE%2FoGkFu%2FOq2Bbts%3D\",\"x-utdid\":\"aWpi3wcaAowDAK5weLrw0FGv\",\"x-appkey\":\"21646297\",\"content-type\":\"application/x-www-form-urlencoded;charset=UTF-8\",\"x-devid\":\"AgrYDM_lAoCmu2AzdgCsOL4ScGXGAmG2OKEPrg9Gx2ZU\",\"x-t\":\"1769543121\"}",
	"url": "https://guide-acs.m.taobao.com/gw/mtop.taobao.mbis.updatedeliveraddress/2.0/"
}

其中 header就是生成的头部x系列，data为携带请求的数据包，url为请求的地址

然后到reqable验证以下是否通过，也可以使用python生成一个自动化请求的脚本

注册device设备接口：http://47.113.222.164:12345/api/taobao/device

申明

本教程方法 仅允许个人学习使用，下面简称学习者，学习者严禁用于商业目的或分发给第三方。
学习者必须遵守国家相关法律法规，不得侵犯任何应用程序的权限、隐私及其他合法权益。
学习者需对自身使用行为负全部责任，我不对因不当使用导致的法律责任承担连带责任。
学习者需自行承担使用风险，我不对学习者造成的任何直接或间接损失负责。
任何情况下，不承担因使用或无法使用本教程导致的损害赔偿责任。
若本教程侵犯了您的合法权益，请立即联系我删除相关内容。
我的联系邮箱：lele2020o1314@gmail.com /tg:@ali882028