最近发现了850棋牌游戏计算客户电脑机器码的方法,但本人还不知道这个发现有没有什么用处,先把该技术储备起来了。有需要查询850棋牌机器码或者修改机器码的朋友,可以联系我。其他棋牌的机器码相关功能也可以付费研究。
以下是850棋牌游戏客户端登录保险箱时的代码:
提交网络数据时,保险箱密码是MD5加密的。但这不是重点,目前没用。
下面的 00B8DAE3 FF15 0435BA00 call dword ptr ds:[<&ServiceCore.CWHService::GetMachineIDEx>; ServiceC.CWHService::GetMachineIDEx,这行就是计算客户机器码的代码,该call内部的代码是:
完整的内部代码:
003E44D0 > 83EC 30 sub esp,0x30
003E44D3 A1 50F03E00 mov eax,dword ptr ds:[0x3EF050]
003E44D8 33C9 xor ecx,ecx
003E44DA 894C24 12 mov dword ptr ss:[esp+0x12],ecx
003E44DE 894C24 16 mov dword ptr ss:[esp+0x16],ecx
003E44E2 33C4 xor eax,esp
003E44E4 894C24 1A mov dword ptr ss:[esp+0x1A],ecx
003E44E8 894C24 1E mov dword ptr ss:[esp+0x1E],ecx
003E44EC 894424 2C mov dword ptr ss:[esp+0x2C],eax
003E44F0 8B4424 34 mov eax,dword ptr ss:[esp+0x34]
003E44F4 8D5424 10 lea edx,dword ptr ss:[esp+0x10]
003E44F8 894C24 22 mov dword ptr ss:[esp+0x22],ecx
003E44FC 52 push edx
003E44FD 894424 04 mov dword ptr ss:[esp+0x4],eax
003E4501 66:C74424 14 00>mov word ptr ss:[esp+0x14],0x0
003E4508 894C24 2A mov dword ptr ss:[esp+0x2A],ecx
003E450C E8 DFFBFFFF call ServiceC.CWHService::GetMACAddress ; 获取网卡MAC地址
003E4511 0FB6C0 movzx eax,al
003E4514 83C0 03 add eax,0x3
003E4517 C1E8 02 shr eax,0x2
003E451A 83C4 04 add esp,0x4
003E451D 66:3D 0300 cmp ax,0x3
003E4521 C74424 04 C8B83>mov dword ptr ss:[esp+0x4],ServiceC.003EB8C8 ; UNICODE “C:\”
003E4529 C74424 08 C0B83>mov dword ptr ss:[esp+0x8],ServiceC.003EB8C0 ; UNICODE “D:\”
003E4531 C74424 0C B8B83>mov dword ptr ss:[esp+0xC],ServiceC.003EB8B8 ; UNICODE “E:\”
003E4539 73 44 jnb XServiceC.003E457F
003E453B 53 push ebx
003E453C 55 push ebp
003E453D 8B2D 80A03E00 mov ebp,dword ptr ds:[<&KERNEL32.GetVolumeInformationW>] ; kernel32.GetVolumeInformationW
003E4543 56 push esi
003E4544 0FB7F0 movzx esi,ax
003E4547 B9 03000000 mov ecx,0x3
003E454C 2BC8 sub ecx,eax
003E454E 57 push edi
003E454F 8D74B4 20 lea esi,dword ptr ss:[esp+esi*4+0x20]
003E4553 8D7C24 14 lea edi,dword ptr ss:[esp+0x14]
003E4557 0FB7D9 movzx ebx,cx
003E455A 8D9B 00000000 lea ebx,dword ptr ds:[ebx]
003E4560 8B17 mov edx,dword ptr ds:[edi]
003E4562 6A 00 push 0x0
003E4564 6A 00 push 0x0
003E4566 6A 00 push 0x0
003E4568 6A 00 push 0x0
003E456A 56 push esi
003E456B 6A 00 push 0x0
003E456D 6A 00 push 0x0
003E456F 52 push edx
003E4570 FFD5 call ebp
003E4572 83C6 04 add esi,0x4
003E4575 83C7 04 add edi,0x4
003E4578 4B dec ebx
003E4579 ^ 75 E5 jnz XServiceC.003E4560
003E457B 5F pop edi
003E457C 5E pop esi
003E457D 5D pop ebp
003E457E 5B pop ebx
003E457F 8B0424 mov eax,dword ptr ss:[esp]
003E4582 50 push eax
003E4583 8D4C24 14 lea ecx,dword ptr ss:[esp+0x14]
003E4587 51 push ecx
003E4588 E8 73EBFFFF call ServiceC.CWHEncrypt::MD5Encrypt
003E458D 8B4C24 34 mov ecx,dword ptr ss:[esp+0x34]
003E4591 83C4 08 add esp,0x8
003E4594 33CC xor ecx,esp
003E4596 B0 01 mov al,0x1
003E4598 E8 8A040000 call ServiceC.003E4A27
003E459D 83C4 30 add esp,0x30
003E45A0 C3 retn
003E44D0 > 83EC 30 sub esp,0x30
003E44D3 A1 50F03E00 mov eax,dword ptr ds:[0x3EF050]
003E44D8 33C9 xor ecx,ecx
003E44DA 894C24 12 mov dword ptr ss:[esp+0x12],ecx
003E44DE 894C24 16 mov dword ptr ss:[esp+0x16],ecx
003E44E2 33C4 xor eax,esp
003E44E4 894C24 1A mov dword ptr ss:[esp+0x1A],ecx
003E44E8 894C24 1E mov dword ptr ss:[esp+0x1E],ecx
003E44EC 894424 2C mov dword ptr ss:[esp+0x2C],eax
003E44F0 8B4424 34 mov eax,dword ptr ss:[esp+0x34]
003E44F4 8D5424 10 lea edx,dword ptr ss:[esp+0x10]
003E44F8 894C24 22 mov dword ptr ss:[esp+0x22],ecx
003E44FC 52 push edx
003E44FD 894424 04 mov dword ptr ss:[esp+0x4],eax
003E4501 66:C74424 14 00>mov word ptr ss:[esp+0x14],0x0
003E4508 894C24 2A mov dword ptr ss:[esp+0x2A],ecx
003E450C E8 DFFBFFFF call ServiceC.CWHService::GetMACAddress ; 获取网卡MAC地址
003E4511 0FB6C0 movzx eax,al
003E4514 83C0 03 add eax,0x3
003E4517 C1E8 02 shr eax,0x2
003E451A 83C4 04 add esp,0x4
003E451D 66:3D 0300 cmp ax,0x3
003E4521 C74424 04 C8B83>mov dword ptr ss:[esp+0x4],ServiceC.003EB8C8 ; UNICODE “C:\”
003E4529 C74424 08 C0B83>mov dword ptr ss:[esp+0x8],ServiceC.003EB8C0 ; UNICODE “D:\”
003E4531 C74424 0C B8B83>mov dword ptr ss:[esp+0xC],ServiceC.003EB8B8 ; UNICODE “E:\”
003E4539 73 44 jnb XServiceC.003E457F
003E453B 53 push ebx
003E453C 55 push ebp
003E453D 8B2D 80A03E00 mov ebp,dword ptr ds:[<&KERNEL32.GetVolumeInformationW>] ; kernel32.GetVolumeInformationW
003E4543 56 push esi
003E4544 0FB7F0 movzx esi,ax
003E4547 B9 03000000 mov ecx,0x3
003E454C 2BC8 sub ecx,eax
003E454E 57 push edi
003E454F 8D74B4 20 lea esi,dword ptr ss:[esp+esi*4+0x20]
003E4553 8D7C24 14 lea edi,dword ptr ss:[esp+0x14]
003E4557 0FB7D9 movzx ebx,cx
003E455A 8D9B 00000000 lea ebx,dword ptr ds:[ebx]
003E4560 8B17 mov edx,dword ptr ds:[edi]
003E4562 6A 00 push 0x0
003E4564 6A 00 push 0x0
003E4566 6A 00 push 0x0
003E4568 6A 00 push 0x0
003E456A 56 push esi
003E456B 6A 00 push 0x0
003E456D 6A 00 push 0x0
003E456F 52 push edx
003E4570 FFD5 call ebp
003E4572 83C6 04 add esi,0x4
003E4575 83C7 04 add edi,0x4
003E4578 4B dec ebx
003E4579 ^ 75 E5 jnz XServiceC.003E4560
003E457B 5F pop edi
003E457C 5E pop esi
003E457D 5D pop ebp
003E457E 5B pop ebx
003E457F 8B0424 mov eax,dword ptr ss:[esp]
003E4582 50 push eax
003E4583 8D4C24 14 lea ecx,dword ptr ss:[esp+0x14]
003E4587 51 push ecx
003E4588 E8 73EBFFFF call ServiceC.CWHEncrypt::MD5Encrypt
003E458D 8B4C24 34 mov ecx,dword ptr ss:[esp+0x34]
003E4591 83C4 08 add esp,0x8
003E4594 33CC xor ecx,esp
003E4596 B0 01 mov al,0x1
003E4598 E8 8A040000 call ServiceC.003E4A27
003E459D 83C4 30 add esp,0x30
003E45A0 C3 retn
从代码中可以看出,850棋牌游戏计算客户电脑机器码时,是根据客户电脑的网卡mac地址和硬盘信息算的。最后的机器码是经过MD5加密后生成的一个32位的字符串。
最新评论