Tencent 3366 game score Modification

Source: Internet
Author: User

3366 any one can and friends PK scores of the game, such as The Feitian Ninja Cat http://www.3366.com/flash/1000168.shtml to start the game, at the end of the Tamper packet: POST Data is: qzversion = 0 & platform = 1 & key = Success & submit = true & uin = XXXXXX & score = 230 & act = set & pid = 1000168 success), and decompile the analysis code. We found a function:

private function getFinalKey(param1:String, param2:Number) : String{if (param1){}if (param1.length == 48){}if (param2 > 999999999){return null;}var _loc_3:* = param1;param1 = param1.substr(42, 6);var _loc_4:* = parseInt(param1, 36);var _loc_5:* = _loc_4.toString(35);var _loc_6:* = _loc_5.length;var _loc_7:* = parseInt(param1.substr((param1.length - 1)), 36) % _loc_6;var _loc_8:* = param2.toString(36);var _loc_9:* = _loc_5.substr(0, _loc_7);var _loc_10:* = _loc_5.substr(_loc_7);var _loc_11:* = _loc_7 + 10;var _loc_12:* = _loc_11 + _loc_8.length;var _loc_13:* = MD5.hash(_loc_11.toString() + param2.toString() + _loc_12.toString());var _loc_14:* = _loc_13.substring(6, 10);var _loc_15:* = [_loc_11.toString(36), _loc_9, _loc_8, _loc_10, _loc_14, _loc_12.toString(36), _loc_3].join("");return _loc_15;}// end function


This function is used to generate the final KEY. This function has two input values, one is the score (we modify this), and the other is a KEY (param1 ). Observe: var _ loc_3: * = param1; and var _ loc_15: * = [_ loc_11.toString (36), _ loc_9, _ loc_8, _ loc_10, _ loc_14, _ loc_12.toString (36), _ loc_3]. join (""); you can know that this KEY is at the end of the final KEY. The last 48 digits of the final KEY remain unchanged after packet capture. So we try to take the KEY as the last 48 digits of the final KEY. Then we use the KEY and the score to be modified as the parameter to execute the algorithm in this function (you can change the as code to js Code and run it directly in the browser console) to get the final KEY. Then tamper submits the request. Modified successfully.

1. Complete the authentication algorithm and do not put the KEY in the final KEY. 2. obfuscation of key code source code.

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.