EBT 道客巴巴的加密與破解 －免費下載器的基礎

標籤：actionscript   doc88_cracker   javascript   doc88下載破解   

前一節《EBT 道客巴巴的加密與破解 序章》粗略講了一些關係DOC88文檔下載的一些枝節，主要是通過Chrome等工具來開啟VIP模式，開啟道客巴巴文檔內容複寫和列印功能，這一篇開始將進行更深入的研究。

還是以《Soilless Culture- Theory and Practice》為例：http://www.doc88.com/p-362142082976.html

DOC88文檔頁面中的每一頁內容都由JavaScript代碼和ActionScript代碼兩部分功能結合顯現的，JavaScript部分主要是由一個稱為Viewer的類來實現DOC88檔案的加密解密，併產生頁面的FLASH內嵌程式碼，包括了頁面內容ebt檔案的伺服器端地址。而ActionScript部分則主要是通過pv.swf這個FLASH檔案來實現頁面內容的展示，同時它還需要為文檔頁的內容進行解密，這就是本文的重點內容。

先通過Chrom瀏覽器，FireFox也可以，取得網頁的一斷代碼：

<object type="application/x-shockwave-flash" data="http://assets.doc88.com/assets/swf/pv.swf?v=1.7" width="100%" height="100%" id="pageflash_0" style="visibility: visible;">  <param name="hasPriority" value="true">  <param name="wmode" value="transparent">  <param name="swliveconnect" value="true">  <param name="FlashVars" value="hn=1&ph=http://ebt246.doc88.com/getebt-0rUXzqMX2LkT0qEd1qEd0jPR0jP50qEd0jPR0jP50qEX2q3V0jBApIlVpTsTsqs=.ebt&pk=http://ebt246.doc88.com/getebt-0rUR0Ln50TMQzq3R0jvS1SUV1SUS0LMS0LkR1SUS0LMS0LkR1TP50jsS1l9MGotI1q1p1v==.ebt&ptm=GotoPage&hlm=HeaderLoaded&fn=0&e404m=ViewerError&st=GetSURL&v=0&sp=false">  <param name="allowScriptAccess" value="always"></object>

這裡取得的代碼就是《Soilless Culture- Theory and Practice》的封面頁，是一張大圖片。這裡重要的內容是FlashVars對應的參數，其中包含了兩個ebt檔案的URL地址，通過這個地址就可以下載到想要的頁面了。這隻是第一步，後頭才是關鍵。這兩個檔案分別標記ph和pk，ph指向的這個檔案是共用的，每一頁內容都會需要它。URL地址中，在getebt-到副檔名之間有一段編碼內容，明眼人一看就知道是BASE64編碼內容，但其實只對了一半，它是BASE64的一種變體，我在破解中稱其為BASE64DOC88編碼。現在就通過連結下載這兩個ebt 檔案：

PH EBT：http://ebt246.doc88.com/getebt-0rUXzqMX2LkT0qEd1qEd0jPR0jP50qEd0jPR0jP50qEX2q3V0jBApIlVpTsTsqs=.ebt

PK EBT：http://ebt246.doc88.com/getebt-0rUR0Ln50TMQzq3R0jvS1SUV1SUS0LMS0LkR1SUS0LMS0LkR1TP50jsS1l9MGotI1q1p1v==.ebt

接下來就是要破解它們，讓它們變成可以看的書封。在stackoverflow.com上我找到了一段代碼，省了我不少時間，這裡貼上修改後的代碼，使用FlashDevelop編譯後可以得到一個DOC88 EBT破解工具，運行後，會彈出檔案選擇框，就選擇前面下載的兩個ebt檔案，DOC88破解工具會將產生最後直接可用的SWF頁面內容：

package {import flash.display.Sprite;import flash.events.Event;import flash.net.FileFilter;import flash.net.FileReference;import flash.text.TextField;import flash.utils.*;/** * ... * @author Ace  * Modify by Jimbowhy *  * http://stackoverflow.com/questions/12121062/how-to-decompress-a-lzma-compressed-file-using-bytearray-method-in-as3 * This is the code that I'am using to compress/decompress files. *  * My problem : This method doesn't decompress LZMA compressed files :( * Can anyone please tell me how to restructure the above code to achieve LZMA decompression * and whether the above compression code is good enough for LZMA-compression?If not,  * please do give an example of it. *  * EDIT : After long hours of searching,I got this but I can't quite understand the  * example code in it :( Some help,anyone? * https://helpx.adobe.com/flash-player/kb/exception-thrown-you-decompress-lzma-compressed.html */public class Compressor extends Sprite{private var ref:FileReference;private var txf:TextField;private var buffer:ByteArray;private var glue:String = "";private var dos:String = "Nothing";private var MAGIC_ZWS:String = "ZWS";private var MAGIC_CWS:String = "CWS";private var MAGIC_FWS:String = "FWS";private var MAGIC_EBT:String = "YBD";private var MAGIC_EBK:String = "EBT_PK";private var MAKEUP:Boolean = true;public function Compressor(){txf = new TextField();txf.text = "SWF Compressor and Decompressor";txf.width = txf.textWidth + 200;txf.x = stage.stageWidth / 2 - txf.width / 2;txf.y = stage.stageHeight / 2 - txf.height / 2;parent.addChild(txf);open();}private function open():void{ref = new FileReference();ref.addEventListener(Event.SELECT, load);ref.browse([new FileFilter("SWF Files", "*.swf;*.ebt")]);}private function load(e:Event):void{ref.addEventListener(Event.COMPLETE, processSWF);ref.load();}private function processSWF(e:Event):void{var swf:ByteArray;dos = ref.data.readMultiByte(3, "us-ascii");switch(dos){case MAGIC_CWS:swf = decompress(ref.data);break;case MAGIC_ZWS:txf.text = "ZWS detected, donothing. SWF 13 and later use LZMA.";break;case MAGIC_FWS:swf = compress(ref.data);break;case MAGIC_EBT:swf = decompressEBT_PH(ref.data);break;default://throw Error("Not SWF...");dos = MAGIC_EBK;swf = decompressEBT_PK(ref.data); // ebt is a compress file and light encryptbreak;}if ( swf && glue && MAKEUP) {txf.text = "Need the 2nd part of ebt to makeup a page.";open(); // deal the 2nd part of ebt.MAKEUP = false}else if (swf && glue && dos!=glue) {var b:Boolean = glue == MAGIC_EBT;swf = makeup(b?buffer:swf, b?swf:buffer);glue = null;}if( (swf && !glue) || dos==glue ){txf.text = dos + " Dectected.";new FileReference().save(swf);}}private function makeup(ebt_ph:ByteArray, ebt_pk:ByteArray):ByteArray{var buff:ByteArray = new ByteArray();ebt_ph.position = 0;ebt_pk.position = 0;buff.endian = Endian.LITTLE_ENDIAN;buff.writeBytes(ebt_ph, 0, ebt_ph.bytesAvailable);buff.writeBytes(ebt_pk, 0, ebt_pk.bytesAvailable);            buff.writeByte(64); // make 4 bytes ending            buff.writeByte(0);            buff.writeByte(0);            buff.writeByte(0);            buff.position = 4;            buff.writeUnsignedInt(buff.length); // write file size back to header            buff.position = 0;return buff;}private function decompressEBT_PH(data:ByteArray):ByteArray{data.position = 40; // 40 bytes bypassvar buff:ByteArray = new ByteArray();buff.endian = Endian.LITTLE_ENDIAN;var ebt:ByteArray = new ByteArray();ebt.endian = Endian.LITTLE_ENDIAN;//ebt.writeBytes(data, 0, data.bytesAvailable); // different belowdata.readBytes(ebt, 0, data.bytesAvailable);try {ebt.uncompress();buff.writeBytes(ebt, 0, ebt.length);buff.position = 4;buff.writeUnsignedInt(buff.length);}catch (e:Error) {txf.text = e.message + " at line:" + /\\.+\.as:([0-9]+)]/.exec(e.getStackTrace())[1];return null;}if (!buffer) {buffer = buff;glue = MAGIC_EBT;}return buff;}private function decompressEBT_PK(data:ByteArray):ByteArray{data.position = 32; // 32bytes bypass in pk ebtvar ebt:ByteArray = new ByteArray();var buff:ByteArray = new ByteArray();ebt.endian = Endian.LITTLE_ENDIAN;buff.endian = Endian.LITTLE_ENDIAN;data.readBytes(buff, 0, data.bytesAvailable);try {buff.uncompress();ebt.writeMultiByte(MAGIC_FWS, "ANSI");//ebt.position = 4;//ebt.writeUnsignedInt(buff.length+8);ebt.writeBytes(buff);} catch (e:Error) {txf.text = e.message + " at line:" + /\\.+\.as:([0-9]+)]/.exec(e.getStackTrace())[1];return null;}if (!buffer) {buffer = buff;glue = MAGIC_EBK;}return ebt;}private function compress(data:ByteArray):ByteArray{var header:ByteArray = new ByteArray();var decompressed:ByteArray = new ByteArray();var compressed:ByteArray = new ByteArray();header.writeBytes(data, 3, 5); //read the header, excluding the signaturedecompressed.writeBytes(data, 8); //read the restdecompressed.compress();compressed.writeMultiByte("CWS", "us-ascii"); //mark as compressedcompressed.writeBytes(header);compressed.writeBytes(decompressed);return compressed;}private function decompress(data:ByteArray):ByteArray{var header:ByteArray = new ByteArray();var compressed:ByteArray = new ByteArray();var decompressed:ByteArray = new ByteArray();header.writeBytes(data, 3, 5); //read the uncompressed header, excluding the signaturecompressed.writeBytes(data, 8); //read the rest, compressedcompressed.uncompress();decompressed.writeMultiByte("FWS", "us-ascii"); //mark as uncompresseddecompressed.writeBytes(header); //write the header backdecompressed.writeBytes(compressed); //write the now uncompressed contentreturn decompressed;}}}

編譯好的工具可以在CSDN下載中心找到，搜尋DOC88_CRACKER_JIMBOWHY就可以得到。工具使用如下，得到的SWF檔案內容見：

註：本人的破解工作中，已經可以直接完成ebt檔案的匯出，而不必藉助工具：

破解DOC88文檔下載系列未完待續。。。

著作權聲明：本文為博主原創文章，未經博主允許不得轉載。

EBT 道客巴巴的加密與破解 －免費下載器的基礎