QQ2013解析最新QQ加密算法VB登陆方法

http://xmit.org.cn/forum.php?mod=viewthread&tid=3409&extra=page=1&page=1&

今天开始想写个验证QQ密码的工具，以前写过一个QQ验证器的程序，就拿了那个代码试了一下居然不能同。就到QQ登陆页面去抓包。




xmit.jpg (110.62 KB, 下载次数: 111)

下载附件 保存到相册

2013-3-19 23:18 上传

上图是抓包的数据

然后在登录页面找js加密代码。comm.js

var hexcase = 1;

var b64pad = "";

var chrsz = 8;

var mode = 32;

function md5(A) {

return hex_md5(A)

}

function hex_md5(A) {

return binl2hex(core_md5(str2binl(A), A.length * chrsz))

}

function str_md5(A) {

return binl2str(core_md5(str2binl(A), A.length * chrsz))

}

function hex_hmac_md5(A, B) {

return binl2hex(core_hmac_md5(A, B))

}

function b64_hmac_md5(A, B) {

return binl2b64(core_hmac_md5(A, B))

}

function str_hmac_md5(A, B) {

return binl2str(core_hmac_md5(A, B))

}

function core_md5(K, F) {

K[F >> 5] |= 128 << ((F) % 32);

K[(((F + 64) >>> 9) << 4) + 14] = F;

var J = 1732584193;

var I = -271733879;

var H = -1732584194;

var G = 271733878;

for (var C = 0; C < K.length; C += 16) {

var E = J;

var D = I;

var B = H;

var A = G;

J = md5_ff(J, I, H, G, K[C + 0], 7, -680876936);

G = md5_ff(G, J, I, H, K[C + 1], 12, -389564586);

H = md5_ff(H, G, J, I, K[C + 2], 17, 606105819);

I = md5_ff(I, H, G, J, K[C + 3], 22, -1044525330);

J = md5_ff(J, I, H, G, K[C + 4], 7, -176418897);

G = md5_ff(G, J, I, H, K[C + 5], 12, 1200080426);

H = md5_ff(H, G, J, I, K[C + 6], 17, -1473231341);

I = md5_ff(I, H, G, J, K[C + 7], 22, -45705983);

J = md5_ff(J, I, H, G, K[C + 8], 7, 1770035416);

G = md5_ff(G, J, I, H, K[C + 9], 12, -1958414417);

H = md5_ff(H, G, J, I, K[C + 10], 17, -42063);

I = md5_ff(I, H, G, J, K[C + 11], 22, -1990404162);

J = md5_ff(J, I, H, G, K[C + 12], 7, 1804603682);

G = md5_ff(G, J, I, H, K[C + 13], 12, -40341101);

H = md5_ff(H, G, J, I, K[C + 14], 17, -1502002290);

I = md5_ff(I, H, G, J, K[C + 15], 22, 1236535329);

J = md5_gg(J, I, H, G, K[C + 1], 5, -165796510);

G = md5_gg(G, J, I, H, K[C + 6], 9, -1069501632);

H = md5_gg(H, G, J, I, K[C + 11], 14, 643717713);

I = md5_gg(I, H, G, J, K[C + 0], 20, -373897302);

J = md5_gg(J, I, H, G, K[C + 5], 5, -701558691);

G = md5_gg(G, J, I, H, K[C + 10], 9, 38016083);

H = md5_gg(H, G, J, I, K[C + 15], 14, -660478335);

I = md5_gg(I, H, G, J, K[C + 4], 20, -405537848);

J = md5_gg(J, I, H, G, K[C + 9], 5, 568446438);

G = md5_gg(G, J, I, H, K[C + 14], 9, -1019803690);

H = md5_gg(H, G, J, I, K[C + 3], 14, -187363961);

I = md5_gg(I, H, G, J, K[C + 8], 20, 1163531501);

J = md5_gg(J, I, H, G, K[C + 13], 5, -1444681467);

G = md5_gg(G, J, I, H, K[C + 2], 9, -51403784);

H = md5_gg(H, G, J, I, K[C + 7], 14, 1735328473);

I = md5_gg(I, H, G, J, K[C + 12], 20, -1926607734);

J = md5_hh(J, I, H, G, K[C + 5], 4, -378558);

G = md5_hh(G, J, I, H, K[C + 8], 11, -2022574463);

H = md5_hh(H, G, J, I, K[C + 11], 16, 1839030562);

I = md5_hh(I, H, G, J, K[C + 14], 23, -35309556);

J = md5_hh(J, I, H, G, K[C + 1], 4, -1530992060);

G = md5_hh(G, J, I, H, K[C + 4], 11, 1272893353);

H = md5_hh(H, G, J, I, K[C + 7], 16, -155497632);

I = md5_hh(I, H, G, J, K[C + 10], 23, -1094730640);

J = md5_hh(J, I, H, G, K[C + 13], 4, 681279174);

G = md5_hh(G, J, I, H, K[C + 0], 11, -358537222);

H = md5_hh(H, G, J, I, K[C + 3], 16, -722521979);

I = md5_hh(I, H, G, J, K[C + 6], 23, 76029189);

J = md5_hh(J, I, H, G, K[C + 9], 4, -640364487);

G = md5_hh(G, J, I, H, K[C + 12], 11, -421815835);

H = md5_hh(H, G, J, I, K[C + 15], 16, 530742520);

I = md5_hh(I, H, G, J, K[C + 2], 23, -995338651);

J = md5_ii(J, I, H, G, K[C + 0], 6, -198630844);

G = md5_ii(G, J, I, H, K[C + 7], 10, 1126891415);

H = md5_ii(H, G, J, I, K[C + 14], 15, -1416354905);

I = md5_ii(I, H, G, J, K[C + 5], 21, -57434055);

J = md5_ii(J, I, H, G, K[C + 12], 6, 1700485571);

G = md5_ii(G, J, I, H, K[C + 3], 10, -1894986606);

H = md5_ii(H, G, J, I, K[C + 10], 15, -1051523);

I = md5_ii(I, H, G, J, K[C + 1], 21, -2054922799);

J = md5_ii(J, I, H, G, K[C + 8], 6, 1873313359);

G = md5_ii(G, J, I, H, K[C + 15], 10, -30611744);

H = md5_ii(H, G, J, I, K[C + 6], 15, -1560198380);

I = md5_ii(I, H, G, J, K[C + 13], 21, 1309151649);

J = md5_ii(J, I, H, G, K[C + 4], 6, -145523070);

G = md5_ii(G, J, I, H, K[C + 11], 10, -1120210379);

H = md5_ii(H, G, J, I, K[C + 2], 15, 718787259);

I = md5_ii(I, H, G, J, K[C + 9], 21, -343485551);

J = safe_add(J, E);

I = safe_add(I, D);

H = safe_add(H, B);

G = safe_add(G, A)

}

if (mode == 16) {

return Array(I, H)

} else {

return Array(J, I, H, G)

}

}

function md5_cmn(F, C, B, A, E, D) {

return safe_add(bit_rol(safe_add(safe_add(C, F), safe_add(A, D)), E), B)

}

function md5_ff(C, B, G, F, A, E, D) {

return md5_cmn((B & G) | ((~B) & F), C, B, A, E, D)

}

function md5_gg(C, B, G, F, A, E, D) {

return md5_cmn((B & F) | (G & (~F)), C, B, A, E, D)

}

function md5_hh(C, B, G, F, A, E, D) {

return md5_cmn(B ^ G ^ F, C, B, A, E, D)

}

function md5_ii(C, B, G, F, A, E, D) {

return md5_cmn(G ^ (B | (~F)), C, B, A, E, D)

}

function core_hmac_md5(C, F) {

var E = str2binl(C);

if (E.length > 16) {

E = core_md5(E, C.length * chrsz)

}

var A = Array(16),

D = Array(16);

for (var B = 0; B < 16; B++) {

A[B] = E[B] ^ 909522486;

D[B] = E[B] ^ 1549556828

}

var G = core_md5(A.concat(str2binl(F)), 512 + F.length * chrsz);

return core_md5(D.concat(G), 512 + 128)

}

function safe_add(A, D) {

var C = (A & 65535) + (D & 65535);

var B = (A >> 16) + (D >> 16) + (C >> 16);

return (B << 16) | (C & 65535)

}

function bit_rol(A, B) {

return (A << B) | (A >>> (32 - B))

}

function str2binl(D) {

var C = Array();

var A = (1 << chrsz) - 1;

for (var B = 0; B < D.length * chrsz; B += chrsz) {

C[B >> 5] |= (D.charCodeAt(B / chrsz) & A) << (B % 32)

}

return C

}

function binl2str(C) {

var D = "";

var A = (1 << chrsz) - 1;

for (var B = 0; B < C.length * 32; B += chrsz) {

D += String.fromCharCode((C[B >> 5] >>> (B % 32)) & A)

}

return D

}

function binl2hex(C) {

var B = hexcase ? "0123456789ABCDEF": "0123456789abcdef";

var D = "";

for (var A = 0; A < C.length * 4; A++) {

D += B.charAt((C[A >> 2] >> ((A % 4) * 8 + 4)) & 15) + B.charAt((C[A >> 2] >> ((A % 4) * 8)) & 15)

}

return D

}

function binl2b64(D) {

var C = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";

var F = "";

for (var B = 0; B < D.length * 4; B += 3) {

var E = (((D[B >> 2] >> 8 * (B % 4)) & 255) << 16) | (((D[B + 1 >> 2] >> 8 * ((B + 1) % 4)) & 255) << 8) | ((D[B + 2 >> 2] >> 8 * ((B + 2) % 4)) & 255);

for (var A = 0; A < 4; A++) {

if (B * 8 + A * 6 > D.length * 32) {

F += b64pad

} else {

F += C.charAt((E >> 6 * (3 - A)) & 63)

}

}

}

return F

}

function hexchar2bin(str) {

var arr = [];

for (var i = 0; i < str.length; i = i + 2) {

arr.push("\\x" + str.substr(i, 2))

}

arr = arr.join("");

eval("var temp = '" + arr + "'");

return temp

}

复制代码
说下QQ密码加密的过程

MD5( MD5(HexChar2Bin(MD5(密码))& pt_uin) & 转换大写(验证码))

pt_uin就是在获取验证码过程会出现的。也就是图片上的那个

ptui_checkVC('0','!VFZ','这里的值就是pt_uin');

复制代码
HexChar2Bin在js的代码如下

代码意思是 把加密好的md5解析成\X形式

例如md5是000000003CCB4845 每个两位就加\X

\x00\x00\x00\x00\x3c\xcb\x48\x45

function hexchar2bin(str) {

var arr = [];

for (var i = 0; i < str.length; i = i + 2) {

arr.push("\\x" + str.substr(i, 2))

}

arr = arr.join("");

eval("var temp = '" + arr + "'");

return temp

}

复制代码
最后是VB代码写法 QQ624475210

-----------完美分割-------------------------------------

获取验证码数据包

GET /check?uin=624475210&appid=2001601&js_ver=10024&js_type=0&login_sig=w7Qp74zpqu9F54TvPTxIT-QD*GJDtnYyPomst4qzu*Hj6jtyrG5Tn-9j28X**F5h&u1=http%3A%2F%2Faq.qq.com%2Fcn2%2Findex&r=0.3231462363368756 HTTP/1.1

Accept: */*

Referer: https://ui.ptlogin2.qq.com/cgi-bin/login?appid=2001601&no_verifyimg=1&f_url=loginerroralert&lang=0&target=top&hide_title_bar=1&s_url=http%3A//aq.qq.com/cn2/index&qlogin_jumpname=aqjump&qlogin_param=aqdest%3Dhttp%253A//aq.qq.com/cn2/index&css=https%3A//aq.qq.com/v2/css/login.css
Accept-Language: zh-cn

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Host: ssl.ptlogin2.qq.com

Connection: Keep-Alive

Cookie: ptisp=ctc; pgv_pvi=2165683210; pgv_pvid=9443471012; pt2gguin=o624475210; RK=TjbXU61q/f; ptui_loginuin=1255240802; o_cookie=624475210; verifysession=h00ba1daa53a6b6d33c754afc343db2340a5efdf79b81c20ef508edcd26c4c980867db892c5ca0f9f545a1f4584725e05c9;
ptcz=e5f1078720f1aecb439f759fa9d77943198a7aa8d4888e2c72970f6d291a7749; uikey=c61a0233c14f20eceb6a3fcd476d6ae326f4e15deada6975e10a9a50ca1d39f5; chkuin=624475210; confirmuin=1255240802; ptvfsession=bb5e93319ac81ea3550dac9ffb00f8540288c4e5649cebfedfe999683019ba9ae483104b8ea8845d338703f7b1aeeef6;
ETK=Moqjel9E9*X*cSwGgRawqrIb-kQOJX05qOOn11cZiVIbZ9PHqiztXxnQZu-onB7S0mDgHmKTvfJGuFpg3DC0Cg__

复制代码
返回数据

3c

ptui_checkVC('0','!VFZ','\x00\x00\x00\x00\x26\x8c\xd0\x10');

0

GET登陆QQ数据包

GET /login?u=624475210&p=49E3214E176FCA73F2CEE205BE109E2F&verifycode=!VEZ&aid=2001601&u1=http%3A%2F%2Faq.qq.com%2Fcn2%2Findex&h=1&ptredirect=1&ptlang=2052&from_ui=1&dumy=&fp=loginerroralert&action=3-6-9687&mibao_css=&t=1&g=1&js_type=0&js_ver=10024&login_sig=w7Qp74zpqu9F54TvPTxIT-QD*GJDtnYyPomst4qzu*Hj6jtyrG5Tn-9j28X**F5h
HTTP/1.1

Accept: */*

Referer: https://ui.ptlogin2.qq.com/cgi-bin/login?appid=2001601&no_verifyimg=1&f_url=loginerroralert&lang=0&target=top&hide_title_bar=1&s_url=http%3A//aq.qq.com/cn2/index&qlogin_jumpname=aqjump&qlogin_param=aqdest%3Dhttp%253A//aq.qq.com/cn2/index&css=https%3A//aq.qq.com/v2/css/login.css
Accept-Language: zh-cn

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Host: ssl.ptlogin2.qq.com

Connection: Keep-Alive

Cookie: ptisp=ctc; pgv_pvi=2135683200; pgv_pvid=9243471012; pt2gguin=o624475210; RK=TjbXU61q/f; ptui_loginuin=1255240802; o_cookie=624475210; verifysession=h00ba1daa53a6b6d33c754afc343db2340a5efef79b81c20ef508edcd26c4c980867db892c5ca0f9f545a1f4584725e05c9;
ptcz=e5f1078720f1aecb439f759fa9d77943198a7aa8d4888e2c72970f6d291a7749; uikey=c61a0233c1df20eceb6a3fcd476d6ae326f4e15eeada6975e10a9a50ca1d39f5; chkuin=624475210; confirmuin=624475210; ptvfsession=d53eef18c6512eb9bbab032174f38f49175d8df386abbbc9eb06d0b58e8b3b66978c323b61710858510ac7abff008566;
ETK=Moqjel9E9*X*cSwGgRawqrIb-kQOJX05qOOn11cZiVIbZ9PHqiztXxnQZu-onB7S0mDgHmKTvfJGuFpg3DC0Cg__

复制代码
登陆返回数据包

58

ptuiCB('0','0','http://web.qq.com/loginproxy.html?login2qq=1&webqq_type=10','0','登录成功！','dzzzzzzzz');

0

QQ登陆错误数据包

ptuiCB('7','0','','0','很遗憾，网络连接出现异常，请您稍后再试。(2772435371)', '624475210');

ptuiCB('3','0','','0','您输入的帐号或密码不正确，请重新输入。', '624475210');

ptuiCB('4','3','','0','登录失败，请重试。*', '624475210');

----------------------------------------------------------------------------------------------