羊了个羊地图加密分析 9.20

jjjzw

从9.18开始，羊了个羊不再使用明文传输地图信息，改为32位字符串

破解通关方法见：羊了个羊快速通关（已解决名片不显示问题 9.20） https://www.52pojie.cn/thread-1688911-1-1.html

在上一篇帖子中，发现9.18和9.20两版本中，80001地图的字符串均为32位的046ef1bab26e5b9bfe2473ded237b572

9.18：

9.20：

因此猜测这是某些固定内容的md5

要搞清楚原来的内容，先得知道这是用来做什么的

尝试修改第二个字符串为00000000000000000000000000000000

则响应结构为：（注：map_seed值不影响游戏开始，但影响卡牌种类和个数）

{"err_code":0,"err_msg":"","data":{"map_md5":["046ef1bab26e5b9bfe2473ded237b572","00000000000000000000000000000000"],"map_seed":[0,0,0,0]}}

开始游戏，无法正常进行，Charles中出现新的get请求404：

这是之前没见过的，也有可能只在第一次运行时加载了一次

新的请求为：

https://cat-match-static.easygame2021.com/maps/00000000000000000000000000000000.txt

map_md5中的字符串成为了新的参数

到这里可以确定游戏将地图信息放在了一个txt文件里

浏览器打开网址：https://cat-match-static.easygame2021.com/maps/046ef1bab26e5b9bfe2473ded237b572.txt尝试获取第一关信息：

{"levelKey":80001,"levelData":{"1":[{"id":"1-16-16","type":0,"rolNum":16,"rowNum":16,"layerNum":1,"moldType":1,"blockNode":null},{"id":"1-28-16","type":0,"rolNum":28,"rowNum":16,"layerNum":1,"moldType":1,"blockNode":null},{"id":"1-40-16","type":0,"rolNum":40,"rowNum":16,"layerNum":1,"moldType":1,"blockNode":null},{"id":"1-16-32","type":0,"rolNum":16,"rowNum":32,"layerNum":1,"moldType":1,"blockNode":null},{"id":"1-28-32","type":0,"rolNum":28,"rowNum":32,"layerNum":1,"moldType":1,"blockNode":null},{"id":"1-40-32","type":0,"rolNum":40,"rowNum":32,"layerNum":1,"moldType":1,"blockNode":null},{"id":"1-16-48","type":0,"rolNum":16,"rowNum":48,"layerNum":1,"moldType":2,"blockNode":null},{"id":"1-28-48","type":0,"rolNum":28,"rowNum":48,"layerNum":1,"moldType":2,"blockNode":null},{"id":"1-40-48","type":0,"rolNum":40,"rowNum":48,"layerNum":1,"moldType":2,"blockNode":null}],"2":[{"id":"2-16-36","type":0,"rolNum":16,"rowNum":36,"layerNum":2,"moldType":1,"blockNode":null},{"id":"2-28-36","type":0,"rolNum":28,"rowNum":36,"layerNum":2,"moldType":1,"blockNode":null},{"id":"2-40-36","type":0,"rolNum":40,"rowNum":36,"layerNum":2,"moldType":1,"blockNode":null},{"id":"2-16-20","type":1,"rolNum":16,"rowNum":20,"layerNum":2,"moldType":1,"blockNode":null},{"id":"2-28-20","type":1,"rolNum":28,"rowNum":20,"layerNum":2,"moldType":1,"blockNode":null},{"id":"2-40-20","type":1,"rolNum":40,"rowNum":20,"layerNum":2,"moldType":1,"blockNode":null},{"id":"2-16-49","type":0,"rolNum":16,"rowNum":49,"layerNum":2,"moldType":2,"blockNode":null},{"id":"2-28-49","type":0,"rolNum":28,"rowNum":49,"layerNum":2,"moldType":2,"blockNode":null},{"id":"2-40-49","type":0,"rolNum":40,"rowNum":49,"layerNum":2,"moldType":2,"blockNode":null}],"3":[]},"blockTypeData":{"1":1,"2":2,"3":2},"heightNum":10,"widthNum":8}

果然得到了地图信息

接下来考虑如何得到md5，最简单的尝试就是把整个json进行一次md5

这样一来就得到了原来的字符串046ef1bab26e5b9bfe2473ded237b572

了解了得到map_md5的方法，也就知道了本次更新后加载地图的方式，便可以想到一种修改游戏的方式：自定义一张地图，本地修改游戏源码，将地图信息请求修改到本地，再通过重写响应等方式指向该文件，可以达到修改游戏的目的

ofo

有白云的日子。 发表于 2022-9-20 07:29
分析的很好，但这个确确来讲失效了，就算通关也不会记录。

这游戏本身就一个单机游戏，手机和PC数据是不通的，也不会上传到服务器，数据统计是直接取所有客户端的统计数据，就一LJ东西

007xiaolei

感谢大佬分析

spreadbrave

摩拜大佬

wlax

前排沙发学习！感谢大佬分析

jun5302

谢谢分享

喜哈哈婚庆公司

不会记录的

acusp

向大佬学习！

bennyt

真的是来学习一下的

zholongsheng

搜噶，会了

leoshishagua

感谢分享 大神

秦旭网络

直接把第二个MD5改成第一个不就可以了吗，跟80001同理