羊了个羊MatchPlayInfo序列化分析-吾爱汇编-防破解,反调试,反汇编,软件安全,逆向分析-52hb.com

459121520 发表于 2022-11-17 21:43

羊了个羊MatchPlayInfo序列化分析

通过分析源码可以得到以下MatchPlayInfo序列的生成代码const protobuf = require("protobufjs");
var i = protobuf.Reader, a = protobuf.Writer, r = protobuf.util;
MatchStepInfo = function () {
function t(t) {
   if (t)
         for (var e = Object.keys(t), o = 0; o < e.length; ++o) null != t] &&
            (this] = t])
}
return t.prototype.chessIndex = 0, t.prototype.timeTag = 0, t.create = function (
   e) {
   return new t(e)
}, t.encode = function (t, e) {
   return e || (e = a.create()), null != t.chessIndex && Object.hasOwnProperty
         .call(t, "chessIndex") && e.uint32(8).int32(t.chessIndex), null !=
         t.timeTag && Object.hasOwnProperty.call(t, "timeTag") && e.uint32(
            16).int32(t.timeTag), e
}, t.decode=1 = function (t, e) {
   t instanceof i || (t = i.create(t));
   for (var o = void 0 === e ? t.len : t.pos + e, n = new MatchStepInfo; t
         .pos < o;) {
         var a = t.uint32();
         switch (a >>> 3) {
            case 1:
               n.chessIndex = t.int32();
               break;
            case 2:
               n.timeTag = t.int32();
               break;
            default:
               t.skipType(7 & a)
         }
   }
   return n
}, t
}(), MatchPlayInfo = function () {
function t(t) {
   if (this.stepInfoList = [], t)
         for (var e = Object.keys(t), o = 0; o < e.length; ++o) null != t] &&
            (this] = t])
}
return t.prototype.gameType = 0, t.prototype.mapId = 0, t.prototype.mapSeed = 0,
   t.prototype.stepInfoList = r.emptyArray, t.create = function (e) {
         return new t(e)
   }, t.encode = function (t, e) {
         if (e || (e = a.create()), null != t.gameType && Object.hasOwnProperty.call(
            t, "gameType") && e.uint32(8).int32(t.gameType), null != t.mapId &&
            Object.hasOwnProperty.call(t, "mapId") && e.uint32(16).int32(t.mapId),
            null != t.mapSeed && Object.hasOwnProperty.call(t, "mapSeed") && e.uint32(
               24).int32(t.mapSeed), null != t.stepInfoList && t.stepInfoList.length
         )
            for (var o = 0; o < t.stepInfoList.length; ++o) MatchStepInfo
               .encode(t.stepInfoList, e.uint32(34).fork()).ldelim();
         return e
   }, t.decode=1 = function (t, e) {
         t instanceof i || (t = i.create(t));
         for (var o = void 0 === e ? t.len : t.pos + e, n = new MatchPlayInfo; t
            .pos < o;) {
            var a = t.uint32();
            switch (a >>> 3) {
               case 1:
                     n.gameType = t.int32();
                     break;
               case 2:
                     n.mapId = t.int32();
                     break;
               case 3:
                     n.mapSeed = t.int32();
                     break;
               case 4:
                     n.stepInfoList && n.stepInfoList.length || (n.stepInfoList = []),
                        n.stepInfoList.push(MatchStepInfo.decode=1(t,
                           t.uint32()));
                     break;
               default:
                     t.skipType(7 & a)
            }
         }
         return n
   }, t
}()
var operationList = []
function addOp(t, e) { //增加操作
void 0 === e && (e = -100);
var o = {
   id: t, // 操作卡片的id，从levelData第一层开始按顺序编号
   time: Date.now() // 操作时间
};
operationList.push(o)
}
function sleep(delay) {
for (var t = Date.now(); Date.now() - t <= delay;);
}
let range = n => [...Array(n).keys()]
for (let i of range(50)) { // 生成了50次操作
addOp(i);
sleep(Math.random() * 10); // 模拟操作过程中的等待
}
console.log(operationList)
for (var u = operationList, p = [], d = 0, h = 0; h < u.length; h++) // 把时间戳转换为两次操作的间隔
p.push({ chessIndex: u.id, timeTag: 0 == d ? 0 : u.time - d }), d = u.time;
console.log(p)
GAMEDAILY = 3
GAMETOPIC = 4
for (var f = { gameType: GAMEDAILY, stepInfoList: p }, y = MatchPlayInfo.create(f), v = MatchPlayInfo.encode(y).finish(), b = "", _ = 0; _ < v.length; _++)
b += String.fromCharCode(v); // 序列化
var data = Buffer.from(b).toString('base64');
console.log(data);
data = Buffer.from(data, 'base64');
console.log(data);
console.log(MatchPlayInfo.decode=1(data));

分析一下MatchPlayInfo的生成操作
首先可以得知MatchPlayInfo是由stepInfoList和gameType组成的，stepInfoList里有两个参数分别是chessIndex和timeTag，分别记录点击卡片id和两次操作间隔
观察MatchPlayInfo.encode可以看到

e = a.create()

会创建一个protobuf.Writer对象

e.uint32(8).int32(t.gameType)

会创建序列"\x08\x03"，虽然写着是32但是经过调试发现是1字节的，不知道是为什么

MatchStepInfo.encode(t.stepInfoList, e.uint32(34).fork()).ldelim()
这里首先插入1字节34变成"\x08\x03\x22"，接着fork函数会生成一个分叉，类似于git等待处理完这个分支后调用ldelim就会把当前分支上内容的长度和内容合并回主分支，分析MatchStepInfo.encode后可以得知会插入4个字节，分别是[8,chessIndex,16,timeTag]，此时序列就是"\x08\x03\x22"+"\x04"+"\x08\x00\x10\x00"="\x08\x03\x22\x04\x08\x00\x10\x00"，重复这个过程把stepInfoList里的chessIndex和timeTag循环增加到序列，可以得知生成过程是MatchPlayInfo="\x08\x03“+("\x22\x04\x08\x??\x10\x??"*卡牌个数)

t｛chessIndex: 120, timeTag: 120｝，t｛chessIndex: 121, timeTag: 121｝，
t｛chessIndex: 122, timeTag: 122｝，
t｛chessIndex: 123, timeTag: 123｝，
t｛chessIndex: 124, timeTag: 124｝，
t｛chessIndex: 125, timeTag: 125｝，
t｛chessIndex: 126, timeTag: 126｝，
t｛chessIndex: 127, timeTag: 127｝，
t｛chessIndex: 16450, timeTag: 16450｝，t｛chessIndex: 16578, timeTag: 16578｝，
t｛chessIndex: 16706, timeTag: 16716｝，
t｛chessIndex: 16834, timeTag: 16834｝，
t｛chessIndex: 16962, timeTag: 16962｝，
t｛chessIndex: 17090, timeTag: 17090｝，
t｛chessIndex: 17218, timeTag: 17218｝，

然而生成的序列无法增加通关次数，研究了一下发现stepInfoList里的值大于127的数值是错误的，不知道是什么原因，于是过滤掉大于127的数可以成功增加通关次数
python代码如下

import struct
import base64
import requests

headers = {
't': '',
'User-Agent': '',
'Referer': 'https://servicewechat.com/wx141bfb9b73c970a9/23/page-frame.html'

}
url = 'https://cat-match.easygame2021.com/sheep/v1/game/personal_info?'
r = requests.get(url, headers=headers)
print(r.json())
url = 'https://cat-match.easygame2021.com/sheep/v1/game/map_info_ex?matchType=3'
r = requests.get(url, headers=headers)
map_md5 = r.json()['data']['map_md5']
url = f'https://cat-match-static.easygame2021.com/maps/{map_md5}.txt'# 由于每天获取的地图不一样，需要计算地图大小
r = requests.get(url)
levelData = r.json()['levelData']
p = []
for h in range(len(sum(levelData.values(), []))):# 生成操作序列
p.append({'chessIndex': 127 if h > 127 else h, 'timeTag': 127 if h > 127 else h})
GAME_DAILY = 3
GAME_TOPIC = 4
data = struct.pack('BB', 8, GAME_DAILY)
for i in p:
c, t = i.values()
data += struct.pack('BBBBBB', 34, 4, 8, c, 16, t)
MatchPlayInfo = base64.b64encode(data)
print(MatchPlayInfo)
url = 'https://cat-match.easygame2021.com/sheep/v1/game/game_over_ex?'
r = requests.post(url, headers=headers,
               json={'rank_score': 1, 'rank_state': 1, 'rank_time': 1, 'rank_role': 1, 'skin': 1,
                     'MatchPlayInfo': MatchPlayInfo})
print(r.json())
url = 'https://cat-match.easygame2021.com/sheep/v1/game/personal_info?'
r = requests.get(url, headers=headers)
print(r.json())

补充一下，int采用了多字节编码，所以大于127的数并不是错误的，而是需要进行编码，编码后需要重新计算长度

def multi_byte_int(number: int):
# <128    : 1
# <16384 : 2
# <2097152: 3
# <268435456: 4
# else    : 5
if number < 128:
   return struct.pack('B', number)
elif number < 16384:
   return struct.pack('BB', number & 127 | 128, number >> 7)
elif number < 2097152:
   return struct.pack('BBB', number & 127 | 128, number >> 7 & 127 | 128, number >> 14)
elif number < 268435456:
   return struct.pack('BBBB', number & 127 | 128, number >> 7 & 127 | 128, number >> 14 & 127 | 128, number >> 21)
else:
   return struct.pack('BBBBB', number & 127 | 128, number >> 7 & 127 | 128, number >> 14 & 127 | 128, number >> 21 & 127 | 128, number >> 28)

关于游戏更新后通关次数无法增加的问题，原因是接口增加了判断，游戏时间小于1分钟的不算有效记录

三斤回锅肉 发表于 2022-11-17 23:55

支持一下啊免得冷场了

459121520 发表于 2022-11-18 07:37

三斤回锅肉发表于 2022-11-17 23:55
支持一下啊免得冷场了

多谢支持，我总感觉都是要冷场的了

Cerolluo 发表于 2022-11-18 08:26

继续跟楼主学习！

男孩子 发表于 2022-11-18 09:58

没玩过这游戏听说很弱智，支持一下

别管我了行 发表于 2022-11-23 17:33

曾经沧海 发表于 2023-2-23 21:39

跟着大佬少走弯路

一生逍遥 发表于 2023-3-11 08:10

不错,感谢楼主分享!

页: [1]

吾爱汇编's Archiver

羊了个羊MatchPlayInfo序列化分析