EBT Baba's encryption and hack-free downloader basics

The previous section, "EBT-BA's encryption and cracking prologue," a little bit about the relationship DOC88 document download Some of the details, mainly through the chrome and other tools to turn on VIP mode, open the content copy and print features of the BA Ba, this article began to conduct a more in-depth study.

Or take soilless culture-theory and practice as an example: http://www.doc88.com/p-362142082976.html

The content of each page in the DOC88 document page is shown by the combination of JavaScript code and ActionScript code, and the JavaScript part is primarily a class called viewer that implements the encryption and decryption of the DOC88 file. and generate the page Flash embed code, including the page content EBT file server-side address. The ActionScript part is mainly through pv.swf this flash file to achieve the display of the page content, and it also needs to decrypt the contents of the document page, this is the focus of this article.

First through the Chrom browser, Firefox can also get a broken code page:

<object type= "Application/x-shockwave-flash" Data= "http://assets.doc88.com/assets/swf/pv.swf?v=1.7" width= "100 % "height=" 100% "id=" Pageflash_0 "style=" visibility:visible; " >  <param name= "haspriority" value= "true" >  <param name= "wmode" value= "Transparent" >  < param name= "Swliveconnect" value= "true" >  <param name= "flashvars" value= "hn=1&ph=http:// ebt246.doc88.com/getebt-0ruxzqmx2lkt0qed1qed0jpr0jp50qed0jpr0jp50qex2q3v0jbapilvptstsqs=.ebt&pk=http:// ebt246.doc88.com/getebt-0rur0ln50tmqzq3r0jvs1suv1sus0lms0lkr1sus0lms0lkr1tp50jss1l9mgoti1q1p1v==.ebt&ptm= Gotopage&hlm=headerloaded&fn=0&e404m=viewererror&st=getsurl&v=0&sp=false ">  < param name= "allowscriptaccess" value= "Always" ></object>

The code obtained here is the cover page of "Soilless Culture-theory and Practice", which is a large picture. The important content here is the Flashvars parameter, which contains the URL address of two EBT files, which can be downloaded to the desired page. This is only the first step, and the key is behind it. The two files labeled ph and pk,ph point to this file are shared, each page of content will need it. URL address, between the getebt-to the extension has a piece of encoded content, discerning eye see is BASE64 encoded content, but in fact only half, it is a variant of BASE64, I call it the BASE64DOC88 code in the crack. Download these two EBT files via the link now:

PH EBT:HTTP://EBT246.DOC88.COM/GETEBT-0RUXZQMX2LKT0QED1QED0JPR0JP50QED0JPR0JP50QEX2Q3V0JBAPILVPTSTSQS=.EBT

PK EBT:HTTP://EBT246.DOC88.COM/GETEBT-0RUR0LN50TMQZQ3R0JVS1SUV1SUS0LMS0LKR1SUS0LMS0LKR1TP50JSS1L9MGOTI1Q1P1V==.EBT

The next thing to do is to crack them and make them into a book seal that you can read. In the stackoverflow.com I found a piece of code, save me a lot of time, here paste the modified code, use FlashDevelop compiled can get a DOC88 ebt hack tool, after running, will pop up file selection box, Just select the two EBT files that you downloaded earlier, the DOC88 hack tool will generate the last directly available SWF page content:

Package {Import Flash.display.sprite;import flash.events.event;import Flash.net.filefilter;import  Flash.net.filereference;import flash.text.textfield;import flash.utils.*;/** * ... * @author Ace * Modify by jimbowhy * * http://stackoverflow.com/questions/12121062/ HOW-TO-DECOMPRESS-A-LZMA-COMPRESSED-FILE-USING-BYTEARRAY-METHOD-IN-AS3 * This was the code that I'm using to compress/ Decompress files. * * My Problem:this method doesn ' t decompress LZMA compressed Files:(* Can Anyone please tell me what to restructure T He above code to achieve LZMA decompression * and whether the above compression code are good enough for lzma-compression?i F not, * Please do give an example of it. * * Edit:after long hours of Searching,i got this but I can ' t quite understand the * example code in IT:( Some Help,anyone? * Https://helpx.adobe.com/flash-player/kb/exception-thrown-you-decompress-lzma-compressed.html */public class Compressor extends sprite{private var ref:filereference;private var txf:textfield;private var buffer:bytearray;private var glue:string = "";p rivate var dos:string = "Nothing";p rivate var magic_z  ws:string = "ZWS";p rivate var magic_cws:string = "CWS";p rivate var magic_fws:string = "FWS";p rivate var magic_ebt:string = "YBD";p rivate var magic_ebk:string = "EBT_PK";p rivate var Makeup:boolean = true;public function Compressor () {txf = new Te Xtfield (); txf.text = "SWF Compressor and decompressor"; txf.width = txf.textwidth + 200;txf.x = stage.stagewidth/2-TxF. WIDTH/2;TXF.Y = STAGE.STAGEHEIGHT/2-Txf.height/2;parent.addchild (TXF); open ();} Private Function Open (): Void{ref = new Filereference (); Ref.addeventlistener (event.select, load); Ref.browse ([New FileFilter ("SWF Files", "*.swf;*.ebt")]);} Private function Load (e:event): Void{ref.addeventlistener (Event.complete, processswf); Ref.load ();} Private Function processswf (e:event): Void{var Swf:bytearray;dos = Ref.data.readMultiByte (3, "us-ascii"); switch (Dos) { Case magic_cws:swf = decompress (ref.data); Break;case magic_ZWS:txf.text = "ZWS detected, donothing. SWF and later use LZMA. "; Break;case magic_fws:swf = compress (ref.data); Break;case magic_ebt:swf = Decompressebt_ph (ref.data); break;default:// Throw Error ("not SWF ...");d os = magic_ebk;swf = DECOMPRESSEBT_PK (Ref.data); EBT is a compress file and light encryptbreak;} if (SwF && glue && MAKEUP) {txf.text = "need the 2nd part of EBT to MAKEUP a page."; o Pen (); Deal the 2nd part of EBT. MAKEUP = False}else if (swf && glue && dos!=glue) {var B:boolean = glue = = magic_ebt;swf = MAKEUP (b?buffer : SWF, b?swf:buffer); glue = null;} if (swf &&!glue) | | dos==glue) {txf.text = dos + "dectected."; New Filereference (). Save (SWF);}} Private Function Makeup (Ebt_ph:bytearray, Ebt_pk:bytearray): Bytearray{var Buff:bytearray = new ByteArray (); Ebt_ Ph.position = 0;ebt_pk.position = 0;buff.endian = Endian.little_endian;buff.writebytes (ebt_ph, 0, Ebt_          ph.bytesavailable); Buff.writebytes (EBT_PK, 0, ebt_pk.bytesavailable);  Buff.writebyte (64);            Make 4 bytes ending buff.writebyte (0);            Buff.writebyte (0);            Buff.writebyte (0);            Buff.position = 4; Buff.writeunsignedint (buff.length); Write file size back to header buff.position = 0;return buff;} Private Function Decompressebt_ph (data:bytearray): Bytearray{data.position = +;//+ bytes Bypassvar Buff:bytearray = NE W ByteArray (); Buff.endian = Endian.little_endian;var Ebt:bytearray = new ByteArray (); Ebt.endian = Endian.little_endian ;//ebt.writebytes (data, 0, data.bytesavailable); Different belowdata.readbytes (EBT, 0, data.bytesavailable); try {ebt.uncompress (); Buff.writebytes (EBT, 0, Ebt.length); buff.position = 4;buff.writeunsignedint (buff.length);} catch (e:error) {txf.text = E.message + "at line:" +/\\.+\.as: ([0-9]+)]/.exec (E.getstacktrace ()) [1];return null;} if (!buffer) {buffer = Buff;glue = MAGIC_EBT;} return buff;} Private Function Decompressebt_pk (data:bytearray): Bytearray{data.position =32; 32bytes Bypass in pk ebtvar Ebt:bytearray = new ByteArray (), var buff:bytearray = new ByteArray (); Ebt.endian = Endian.li Ttle_endian;buff.endian = endian.little_endian;data.readbytes (buff, 0, data.bytesavailable); try {buff.uncompress (); Ebt.writemultibyte (Magic_fws, "ANSI");//ebt.position = 4;//ebt.writeunsignedint (buff.length+8); Ebt.writeBytes ( Buff);} catch (e:error) {txf.text = E.message + "at line:" +/\\.+\.as: ([0-9]+)]/.exec (E.getstacktrace ()) [1];return null;} if (!buffer) {buffer = Buff;glue = MAGIC_EBK;} return EBT;} Private function Compress (Data:bytearray): Bytearray{var Header:bytearray = new ByteArray (); var decompressed:bytearray = new ByteArray (); var compressed:bytearray = new ByteArray (); header.writebytes (data, 3, 5); Read the header, excluding the Signaturedecompressed.writebytes (data, 8); Read the restdecompressed.compress (); Compressed.writemultibyte ("CWS", "us-ascii"); Mark as Compressedcompressed.writebytes (header); Compressed.writebytes (decompressed); return Compressed;} Private function Decompress (Data:bytearray): Bytearray{var Header:bytearray = new ByteArray (); var compressed:bytearray = new ByteArray (); var decompressed:bytearray = new ByteArray (); header.writebytes (data, 3, 5); Read the uncompressed header, excluding the Signaturecompressed.writebytes (data, 8); Read the rest, compressedcompressed.uncompress ();d ecompressed.writemultibyte ("FWS", "us-ascii"); Mark as Uncompresseddecompressed.writebytes (header); Write the header backdecompressed.writebytes (compressed); Write the now uncompressed Contentreturn decompressed;}}

Compiled tools can be found in the CSDN Download Center, search doc88_cracker_jimbowhy can be obtained. The tool uses the following, resulting SWF file contents see:

Note: My hack work, can already directly complete the export of EBT file, without the use of tools:

Crack DOC88 document Download series not to be continued ...

Copyright NOTICE: This article for Bo Master original article, without Bo Master permission not reproduced.

EBT Baba's encryption and hack-free downloader basics