Tencent 3366 game score Modification

3366 any one can and friends PK scores of the game, such as The Feitian Ninja Cat http://www.3366.com/flash/1000168.shtml to start the game, at the end of the Tamper packet: POST Data is: qzversion = 0 & platform = 1 & key = Success & submit = true & uin = XXXXXX & score = 230 & act = set & pid = 1000168 success), and decompile the analysis code. We found a function:

private function getFinalKey(param1:String, param2:Number) : String{if (param1){}if (param1.length == 48){}if (param2 > 999999999){return null;}var _loc_3:* = param1;param1 = param1.substr(42, 6);var _loc_4:* = parseInt(param1, 36);var _loc_5:* = _loc_4.toString(35);var _loc_6:* = _loc_5.length;var _loc_7:* = parseInt(param1.substr((param1.length - 1)), 36) % _loc_6;var _loc_8:* = param2.toString(36);var _loc_9:* = _loc_5.substr(0, _loc_7);var _loc_10:* = _loc_5.substr(_loc_7);var _loc_11:* = _loc_7 + 10;var _loc_12:* = _loc_11 + _loc_8.length;var _loc_13:* = MD5.hash(_loc_11.toString() + param2.toString() + _loc_12.toString());var _loc_14:* = _loc_13.substring(6, 10);var _loc_15:* = [_loc_11.toString(36), _loc_9, _loc_8, _loc_10, _loc_14, _loc_12.toString(36), _loc_3].join("");return _loc_15;}// end function

 

This function is used to generate the final KEY. This function has two input values, one is the score (we modify this), and the other is a KEY (param1 ). Observe: var _ loc_3: * = param1; and var _ loc_15: * = [_ loc_11.toString (36), _ loc_9, _ loc_8, _ loc_10, _ loc_14, _ loc_12.toString (36), _ loc_3]. join (""); you can know that this KEY is at the end of the final KEY. The last 48 digits of the final KEY remain unchanged after packet capture. So we try to take the KEY as the last 48 digits of the final KEY. Then we use the KEY and the score to be modified as the parameter to execute the algorithm in this function (you can change the as code to js Code and run it directly in the browser console) to get the final KEY. Then tamper submits the request. Modified successfully.
  Solution:

1. Complete the authentication algorithm and do not put the KEY in the final KEY. 2. obfuscation of key code source code.