Dual-game design flaws: Listening to encrypted channel calls

Dual-game design flaws: Listening to encrypted channel calls

Read the sub-ID information and modify the local data to listen for encrypted channel calls.

Detailed description:

 

The sub-channel ID is obtained successfully.

In the encryption mode, the address offset of array allocation in the YY process is directly found in hexadecimal notation of the current Id.

At this time, YY thinks that you are in the channel and can hear other people talking and chatting.

Proof of vulnerability:

I can't prove the voice content, but there's money on the Internet ..

Selling the author's video: http://pan.baidu.com/s/1eQAoI8i

I will not write the test code. I have sold finished products on the Internet. I can use it directly. This vulnerability is not discovered by myself, but is intended to reverse the problem. Ask for an invitation code.

Solution:

Channel information can be encrypted using symmetric algorithms. webpage data can be returned in encrypted mode. It is also happy to receive comments.