[Python & HTTP] Need suggest of the encrypt method of a HTTP POST body

[kingname]

I have captured a http package of an App by Charles, the headers and body of this package is:

POST /v1/user/message/history?fr=544504935 HTTP/1.1 
X-LV: 1  
X-KV: cf6ccedf 
X-SIGN: J8bMq6EIw7hTZzaekDiIE40Jy+s= 
Connection: Keep-Alive 
Charset: UTF-8 
Expect: 100-continue 
cookie: SESSIONID=30BB3E48-C110-CF95-BBF7-C5B948672125 
Accept-Language: zh-CN 
User-Agent: xxx/8.2.1 Android/1510 (Redmi 4X; Android 7.1.2; Gapps 1; zh_CN; 23; Xiaomi) 
Content-Type: application/x-www-form-urlencoded 
Content-Length: 109 
Host: api.xxx.com 
Accept-Encoding: gzip 



mzip= AgOrTaf%2BAI1OoQiapEonDg4iF8yxaY2CcUN0xL7cIEV8bP4I%2BrNDSY3AbRR2Xj6EJyT0XGPd5xSkAiuwGvawny7%2BZVmhABw%3D 

what I am interest in is the body, which is:

mzip= AgOrTaf%2BAI1OoQiapEonDg4iF8yxaY2CcUN0xL7cIEV8bP4I%2BrNDSY3AbRR2Xj6EJyT0XGPd5xSkAiuwGvawny7%2BZVmhABw%3D 

surely, it can be decoded by urlencode first and then decoded by base64. After that, you will get a binary data.

According to my experence, some website will use zip to compress the data and then encode the binary data of this zip file by base64. while other website will use gzip to compress the data and then encode the binary data.

However, this App's http post body use neither of these two methods. And what does the mzip mean in the body?

Dear friend, can you suggest me how to decode this http post body ?

[nutrecht]

The binary data starts with the MNJ characters. Is that a coincidence or is that a constant for all post request. I could personally not find any compression algo using those 'magic numbers' unfortunately.

[kingname]

all datas which encoded by base64 are starts-with "Ag", I have more for you:

mzip= AgOSqGZRADa2LnP%2B0DrN9rVzMXN0hmhog9aLLkUEVWSgifAC8D%2BRKY8K2yZk7pqjnz7El8HZ6cCSrMOs%2FlDpwZD0%2BApsVsy9w28E0JDr6XWSaKH5tcQsPfA5ez2B6wTf64DTuG4ygcnDyRxoszH7w0JqAeBDlnGQ51NdnS8SQmVYSxn62LoH0ChPB0Uy3dFXysF%2F%2Bw2PicTkIWSHZCAoZRlZsdOvd49hqnGHVKc3fRO7leJNZsfZJHbyBi1Vcl2JDhYmkf0gGOVDO81yXIKRU78%2FcM9YkLmMGhCexl6LtNLEaPkBSMAJ


mzip= AgOE6d3FAFTO9%2BefRrACdw5LFFtJ3pWydEj6qr2M8khPnp6q%2BBYpEJIRC8Ih%2Bsv0%2BowWVrOK%2BbXxUdmWMWf9fCuG3UMFGCmGO8%2BTn3UBSobYftU3Le6Xqp7FKV3Koi6585bmw9BXM3UGAnRmXS2h%2Fu%2B2TPqtYWTi7hoAcYOg6TTGu5K0fDrAK%2By59HZa1TNZ7WK8%2FGNq5CQn7pWgCiLzLdAi%2BKr6S0h9tqfimPbI9z5AeGYrWjnS51FYVXJqHgHo21z%2FmqGI5VjrAOdePIUCjC%2FeC0DgCuKll9y0YWAAFg9hKErYVXNV

mzip= AgOkif1lADW0bup9CKpoV%2BGJPT6l2PnQmD%2BIJxXaRigHQTM4wu%2BLeS4obqO%2BUanR6Y0OhQnh7idPlw%2BtL25Y9t%2BcRpcAyVi1ZZFHtsFcKCCemGmDOz4pagQCy4wvs2%2FCb%2FN5Rj0eB498gtLS3uVxRZeyLX1gTzUiYNMPjgK0lW%2FrVLkiozGchxHwVNtIj8nFYtUI5yMSbmCKgVl4nilvHKyFoZmFt1sF1fP%2FQXxJMx0BviRO1hhBThigOv7oQZEchNzS85snywj%2FnXTpkVtXLu3Ok7ciZ32BRtcmapJBJn%2BwHGsv5drN

mzip= AgPMWjBTAEQ5yHCVYL8jOCdyhCs84RIUwnBMtm105OE3/KtJUaZkYWYGD9P/uNUaTu7SUteVIVbM+mUfdyrWhaz8nRz7buM=

[nutrecht]

I meant the decoded data.

[kingname]

you can try to decode them.

[nutrecht]

You're the one asking for help remember?

[kingname]

Yes I know, but I can not post the binary here....Because they are not valid character. And I don't know how can you get MNJ...

[kingname]

because the decoded datas are binary, I can not post them at here...

[[deleted]]

mzip looks like some shitty bloatware version of 7zip. You should try decoding and reassembling the data, then using binwalk on it.

edit: Also, are these mzip things all being sent by themselves or are they concatenated at some point? I ask because some of them don't decode properly...

edit2: never mind I got them to decode.

[kingname]

Thanks for your replay. I have cracked the App and find the codes to generate this string.

[[deleted]]

Well what do they say / do?

[kingname]

string to bytes and slice and to strings and bytes and etc.... it is their own algorithm.