SubCommand20

mirai-core-qqandroid/src/commonMain/kotlin/net/mamoe/mirai/qqandroid/network/QQAndroidBotNetworkHandler.kt

@@ -73,11 +73,10 @@ internal class QQAndroidBotNetworkHandler(bot: QQAndroidBot) : BotNetworkHandler
 
                 is SMSVerifyCodeNeeded -> {
                     val result = bot.configuration.loginSolver.onGetPhoneNumber()
-                    response = LoginPacket.SubCommand7(
+                    response = LoginPacket.SubCommand20(
                         bot.client,
-                        response.t174,
                         response.t402,
-                        result
+                        response.t403
                     ).sendAndExpect()
                     continue@mainloop
                 }

mirai-core-qqandroid/src/commonMain/kotlin/net/mamoe/mirai/qqandroid/network/protocol/packet/login/LoginPacket.kt

@@ -46,6 +46,29 @@ internal object LoginPacket : PacketFactory<LoginPacket.LoginPacketResponse>("wt
         }
     }
 
+    object SubCommand20 {
+        private const val appId = 16L
+        private const val subAppId = 537062845L
+
+        @UseExperimental(MiraiInternalAPI::class)
+        operator fun invoke(
+            client: QQAndroidClient,
+            t402: ByteArray,
+            t403: ByteArray
+        ): OutgoingPacket = buildLoginOutgoingPacket(client, bodyType = 2) { sequenceId ->
+            writeSsoPacket(client, subAppId, commandName, sequenceId = sequenceId) {
+                writeOicqRequestPacket(client, EncryptMethodECDH7(client.ecdh), 0x0810) {
+                    writeShort(20) // subCommand
+                    writeShort(4) // count of TLVs, probably ignored by server?
+                    t8(2052)
+                    t104(client.t104)
+                    t116(150470524, 66560)
+                    t401(client.device.guid + "stMNokHgxZUGhsYp".toByteArray() + t402)
+                }
+            }
+        }
+    }
+
     object SubCommand7 {
         private const val appId = 16L
         private const val subAppId = 537062845L
@@ -253,7 +276,7 @@ internal object LoginPacket : PacketFactory<LoginPacket.LoginPacketResponse>("wt
 
         class UnsafeLogin(val url: String) : LoginPacketResponse()
 
-        class SMSVerifyCodeNeeded(val t174: ByteArray, val t402: ByteArray) : LoginPacketResponse()
+        class SMSVerifyCodeNeeded(val t402: ByteArray, val t403: ByteArray) : LoginPacketResponse()
     }
 
     @InternalAPI
@@ -290,7 +313,8 @@ internal object LoginPacket : PacketFactory<LoginPacket.LoginPacketResponse>("wt
         bot: QQAndroidBot
     ): LoginPacketResponse.SMSVerifyCodeNeeded {
         bot.client.t104 = tlvMap.getOrFail(0x104)
-        return LoginPacketResponse.SMSVerifyCodeNeeded(tlvMap[0x174] ?: EMPTY_BYTE_ARRAY, tlvMap.getOrFail(0x402))
+        println("403： " + tlvMap[0x403]?.toUHexString())
+        return LoginPacketResponse.SMSVerifyCodeNeeded(tlvMap[0x402]!!, tlvMap.getOrFail(0x403))
     }
 
     private fun onUnsafeDeviceLogin(tlvMap: TlvMap): LoginPacketResponse.UnsafeLogin {

mirai-core-qqandroid/src/jvmTest/kotlin/test/SmsTest.kt

 package test
 
-import kotlinx.io.core.ByteReadPacket
 import net.mamoe.mirai.utils.cryptor.contentToString
 import net.mamoe.mirai.utils.io.hexToBytes
 import net.mamoe.mirai.utils.io.readTLVMap
@@ -15,5 +14,8 @@ fun main(){
     //client to server
     val c2s = "00 08 00 08 00 00 00 00 08 04 00 00 01 04 00 24 41 69 4E 54 75 7A 50 2F 48 6D 5A 30 74 37 64 54 71 57 7A 67 79 35 54 4C 77 39 55 69 53 59 69 45 71 67 3D 3D 01 16 00 0E 00 08 F7 FF 7C 00 01 04 00 01 5F 5E 10 E2 01 74 00 61 45 66 43 39 46 4B 63 70 47 30 5F 5A 55 41 4F 6A 4E 4C 6F 72 56 30 77 66 4B 67 49 4D 33 33 6E 58 44 37 5F 4B 61 75 56 6D 4F 6F 54 68 6A 64 38 62 72 44 64 69 5F 62 48 51 5A 66 37 6E 4F 6B 78 43 35 6E 47 4E 38 6B 6A 35 39 6D 37 32 71 47 66 78 4E 76 50 51 53 39 33 66 37 6B 72 71 66 71 78 63 5F 01 7A 00 04 00 00 00 09 01 97 00 01 00".hexToBytes().toIoBuffer().readTLVMap()
 
+    println(get_mpasswd())
     println(s2c.contentToString())
-}
+
\ No newline at end of file
+}
+