綜合專案之閃訊破解(一)之 閃訊撥號使用者名稱核心演算法

2021-07-24 05:05:25 字數 4008 閱讀 5356

md5.h檔案主要是定義了md5演算法中用到的一些引數型別,直接拿走即可。在這個演算法中他的時間戳除以了5,也就是說你的真實使用者名稱過5s就變乙個,閃訊最坑的是真實使用者名稱的0-1位字元,我相信許多人知道真實使用者名稱都想用cmd手動撥號了,但正是這兩位字元,你無論如何用手動的方法都撥不出去。

附上c的源**

typedef unsigned long uint4;

typedef long int4;

#define _uint4_t

typedef struct md5_ctx;

typedef unsigned char

byte;

static

void transform(uint4 *buf, uint4 *in);

static unsigned char padding[64] = ;

/* f, g, h and i are basic md5 functions */

#define f(x, y, z) (((x) & (y)) | ((~x) & (z)))

#define g(x, y, z) (((x) & (z)) | ((y) & (~z)))

#define h(x, y, z) ((x) ^ (y) ^ (z))

#define i(x, y, z) ((y) ^ ((x) | (~z)))

/* rotate_left rotates x left n bits */

#define rotate_left(x, n) (((x) << (n)) | ((x) >> (32-(n))))

/* ff, gg, hh, and ii transformations for rounds 1, 2, 3, and 4 */

/* rotation is separate from addition to prevent recomputation */

#define ff(a, b, c, d, x, s, ac) \

#define gg(a, b, c, d, x, s, ac) \

#define hh(a, b, c, d, x, s, ac) \

#define ii(a, b, c, d, x, s, ac) \

#ifdef __stdc__

#define ul(x) x##u

#else

#define ul(x) x

#endif

/* the routine md5_init initializes the message-digest context

mdcontext. all fields are set to zero.

*/void md5_init(md5_ctx *mdcontext)

/* the routine md5update updates the message-digest context to

account for the presence of each of the characters inbuf[0..inlen-1]

in the message whose digest is being computed.

*/void md5_update(md5_ctx *mdcontext, unsigned char *inbuf, unsigned int inlen)

}}/* the routine md5final terminates the message-digest computation and

ends with the desired message digest in mdcontext->digest[0...15].

*/void md5_final(unsigned char hash, md5_ctx *mdcontext)

memcpy(hash, mdcontext->digest, 16);

}/* basic md5 step. transforms buf based on in.

*/static

void transform(uint4 *buf, uint4 *in)

void connect(int pppoenumber, int username_1, int username_2, int username_3, int userpassward_1, int userpassward_2)

; byte md501h[2];

char *md501 = (char *)malloc(sizeof(unsigned char) * 3);

byte timehash[4]; //time encryption from timebyte

byte pin27[6]; //time encryption from timehash

int seconds = time((time_t*)null);;

timedivbyfive = seconds / 5;

for (i = 0; i < 4; i++)

//beforemd5

memcpy(beforemd5, timebyte, 4);//array_copy

//locate character "@" in username

i = 11;

memcpy(beforemd5 + 4, username, i);

i = i + 4;

//beforemd5=+++'\0';default length in chongqing is 31

memcpy(beforemd5 + i, "singlenet01", strlen("singlenet01"));

beforemd5[26] = '\0';

//aftermd5

int length = 0;

while (beforemd5[length] != '\0')

md5_init(&md5);

md5_update(&md5, beforemd5, length);

md5_final(aftermd5, &md5);//generate md5 sum

md501h[0] = aftermd5[0] >> 4 & 0xf;//get md5[0]

md501h[1] = aftermd5[0] & 0xf;//get md5[1]

sprintf(md501, "%x%x", md501h[0], md501h[1]);

//pin27

for (i = 0; i < 32; i++)

for (i = 0; i < 4; i++)

temp[1] = (timehash[0] & 3) << 4;

temp[0] = (timehash[0] >> 2) & 0x3f;

temp[2] = (timehash[1] & 0xf) << 2;

temp[1] = (timehash[1] >> 4 & 0xf) + temp[1];

temp[3] = timehash[2] & 0x3f;

temp[2] = ((timehash[2] >> 6) & 0x3) + temp[2];

temp[5] = (timehash[3] & 3) << 4;

temp[4] = (timehash[3] >> 2) & 0x3f;

for (i = 0; i < 6; i++)

}//pin

pin[0] = '\r';

pin[1] = '\n';

memcpy(pin + 2, pin27, 6);

pin[8] = md501[0];

pin[9] = md501[1];

memcpy(pin + 10, username, 19);

char pin_[29];

char userpassward_[6];

for (int count = 0; count < 29; count++)

}

這是從dll**上拉出來的 所以傳入的變數都是int型

dwr之IM專案 一

本專案的基本架構主要是基於struts2 jpa1.0 spring2.5 dwr3框架,前台頁面js主要用到了 jquery庫。此專案可以直接加入到其它已有的專案中,如oa erp等專案。目錄 第一部分 dwr之im專案前期開發篇 1.1 專案需求及分析 1.2 領域物件設計 1.3 第乙個簡單的...

Python專案一之疑問

1.from django.db import models 首先,django是乙個包,db是django的子包,models也是乙個包。因為在其目錄下都有 init py 另外,models中沒有model,至於你可以使用models.model這樣的語法是因為models的 init py中有...

專案總結之SSI 一

這是我進公司之後做的第乙個新專案,從無到有。去年夏天和同事在會議室裡度過的日子還恍如昨日啊,時光啊,你慢些走。作為乙個外部專案,美工設計了乙個win8風格的介面,看到現在做前台的同學做的一樣是這種介面,頓時覺得真是潮流前線。首先,這是我第一次接觸div,同事教了我很多,怎樣把美工的樣式加到前台頁面,...