.NET反编译得知api授权地址，怎么变成本地验证或者取消网络验证！
本帖最后由 Ninja18 于 2019-10-17 01:54 编辑在破解.NET程序时，我的思路是先找验证（因为本身是网络授权），先搜索授权码几个字符，发现都是通过判断才能验证成功的，，于是就找出了他的网络验证地址，图片中的代码看的不是很懂，但是我知道图片框内字符是 base64 编码，解码出来 https://域名/plus-user-check_licence_code?html=1 （域名可以私聊我），由于本人是菜鸟第一次来研究这个，只能做到这里，希望大神能够给予指点，怎么样才能绕过它这个网络验证。
图片中代码private string a(string A_0, int A_1 = 0x3a98)
{
// This item is obfuscated and can not be translated.
f f;
c c;
int num;
string str2;
int num2 = 0;
switch (num2)
{
case 0:
break;
default:
k k;
bool flag;
bool flag2;
string str3;
break;
if (1 != 0)
{
}
switch (num2)
{
case 0:
num2 = 4;
goto Label_0016;
case 1:
case 4:
flag = str2 != "";
num2 = 11;
goto Label_0016;
case 2:
case 6:
str3 = str2;
num2 = 8;
goto Label_0016;
case 3:
case 5:
flag2 = num < 3;
num2 = 7;
goto Label_0016;
case 7:
if (flag2)
{
Application.DoEvents();
k = f.g(c);
str2 = k.m();
num2 = 9;
}
else
{
num2 = 2;
}
goto Label_0016;
case 8:
return str3;
case 9:
if (k.j() != HttpStatusCode.OK)
{
num2 = 1;
}
else
{
num2 = 0;
}
goto Label_0016;
case 10:
num2 = 6;
goto Label_0016;
case 11:
if (!flag)
{
num++;
num2 = 5;
}
else
{
num2 = 10;
}
goto Label_0016;
}
break;
}
f = new f();
string str = i.i("aHR0cHM6Ly93d3cueHhmc2VvLmNvbS9wbHVzLXVzZXItY2hlY2tfbGljZW5jZV9jb2RlP2h0bWw9MQ==");
c c1 = new c();
c1.ak(str);
c1.ar("POST");
c1.al(A_1);
c1.ao(false);
c1.aq("code=" + HttpUtility.UrlEncode(A_0));
c1.@as("application/x-www-form-urlencoded");
c = c1;
num = 0;
str2 = "";
num = 0;
num2 = 3;
goto Label_0016;
}
private void b(object A_0, EventArgs A_1)
{
string str;
string str2;
bool flag2;
bool flag3;
Label_003F:
str = this.a0.Text.Trim();
bool flag = str == "";
int num = 8;
Label_0010:
switch (num)
{
case 0:
case 1:
case 4:
case 5:
{
int expressionStack_1F3_0 = 1;
if (expressionStack_1F3_0 == 0)
{
}
return;
}
case 2:
MessageBox.Show("请输入授权码", "温馨提示");
num = 0;
goto Label_0010;
case 3:
if (!flag3)
{
this.h = false;
this.aw.Visible = true;
MessageBox.Show("未知响应，请重试！", "提示");
num = 1;
}
else
{
num = 7;
}
goto Label_0010;
case 6:
this.h = true;
this.i = false;
this.aw.Visible = false;
MessageBox.Show("授权验证成功！请开始你的表演！", "提示");
i.b(this.j, this.b(str));
num = 5;
goto Label_0010;
case 7:
this.h = false;
this.aw.Visible = true;
MessageBox.Show("授权码错误！", "提示");
num = 4;
goto Label_0010;
case 8:
if (!flag)
{
Application.DoEvents();
base.BeginInvoke(new Action(this.a));
str2 = this.a(str, 0x3a98);
this.az.Text = "提交授权码";
flag2 = str2 == "1";
num = 9;
}
else
{
num = 2;
}
goto Label_0010;
case 9:
if (!flag2)
{
flag3 = str2 == "0";
num = 3;
}
else
{
num = 6;
}
goto Label_0010;
}
goto Label_003F;
}
另外一个段带授权码的代码private void p(object A_0, EventArgs A_1)
{
string str;
bool flag;
bool flag2;
string str2;
string str3;
bool flag3;
bool flag4;
int num = 0;
switch (num)
{
default:
goto Label_004B;
}
Label_0010:
switch (num)
{
case 0:
goto Label_00AC;
case 1:
this.h = false;
this.aw.Visible = true;
MessageBox.Show("授权码错误，重新提交授权码！", "提示");
num = 9;
goto Label_0010;
case 2:
this.h = true;
i.b(this.j, this.b(str2));
num = 0;
goto Label_0010;
case 3:
goto Label_01A2;
case 4:
if (!flag4)
{
goto Label_00AC;
}
num = 1;
goto Label_0010;
case 5:
case 9:
return;
case 6:
if (!flag)
{
goto Label_0146;
}
num = 12;
goto Label_0010;
case 7:
if (!flag3)
{
flag4 = str3 == "0";
int expressionStack_1C5_0 = 1;
if (expressionStack_1C5_0 == 0)
{
}
num = 4;
}
else
{
num = 2;
}
goto Label_0010;
case 8:
str2 = i.f(this.j);
str2 = this.a(str2);
str3 = this.a(str2, 0xbb8);
flag3 = str3 == "1";
num = 7;
goto Label_0010;
case 10:
if (!flag2)
{
goto Label_01A2;
}
num = 8;
goto Label_0010;
case 11:
goto Label_0146;
case 12:
this.h = true;
flag2 = (i.a() - i.b(this.j)) > 0x3f480;
num = 10;
goto Label_0010;
}
Label_004B:
str = i.k("xxfseo" + this.g());
this.j = Application.StartupPath + @"\xxxxxx_" + str + ".txt";
flag = i.e(this.j);
num = 6;
goto Label_0010;
Label_00AC:
num = 3;
goto Label_0010;
Label_0146:
this.k();
num = 5;
goto Label_0010;
Label_01A2:
num = 11;
goto Label_0010;
}
本帖最后由 zhjzcbm 于 2019-10-17 09:52 编辑
很简单阿，3个办法。
1.改代码里的判断case 6改成0，0改成6，或者把6下面的代码全部放到其他选项里。
2.改他的请求地址，就是你自己再自己的服务器里写个api服务让他返回6.然后改代码里的请求地址为你的服务器api并编码成base64.
3.直接改本地host文件地址指向127.0.0.1.然后写个本地api服务返回6 那个base64就是一个地址, 孤狼微博 发表于 2019-10-17 02:20
那个base64就是一个地址,
这个是验证地址呀，但是不知道要给这个验证地址POST啥 Ninja18 发表于 2019-10-17 02:25
这个是验证地址呀，但是不知道要给这个验证地址POST啥
你先提交抓个包,有正确的号不看看返回的什么,有没有加密单纯的这样看一个bs返回的不太好猜 粗看下他的返回值，你把失败的改成成功的不就好了？ 软件呢？发上来大家一起研究一下啊！ 本地搭一个站点 设置一个hosts 指向过去 返回0或者1, 0是错误的，1是对的，修改对0和1的判断 本地搭建一个只要访问返回值是6就行
页:
[1]
2