从9.18开始,羊了个羊不再使用明文传输地图信息,改为32位字符串

破解通关方法见:羊了个羊快速通关(已解决名片不显示问题 9.20) https://www.52pojie.cn/thread-1688911-1-1.html

在上一篇帖子中,发现9.18和9.20两版本中,80001地图的字符串均为32位的046ef1bab26e5b9bfe2473ded237b572

9.18:
羊了个羊地图加密分析 9.20

9.20:
羊了个羊地图加密分析 9.20

因此猜测这是某些固定内容的md5

要搞清楚原来的内容,先得知道这是用来做什么的

尝试修改第二个字符串为00000000000000000000000000000000

则响应结构为:(注:map_seed值不影响游戏开始,但影响卡牌种类和个数

{"err_code":0,"err_msg":"","data":{"map_md5":["046ef1bab26e5b9bfe2473ded237b572","00000000000000000000000000000000"],"map_seed":[0,0,0,0]}}

开始游戏,无法正常进行,Charles中出现新的get请求404:

羊了个羊地图加密分析 9.20

这是之前没见过的,也有可能只在第一次运行时加载了一次

新的请求为:

https://cat-match-static.easygame2021.com/maps/00000000000000000000000000000000.txt

map_md5中的字符串成为了新的参数

到这里可以确定游戏将地图信息放在了一个txt文件里

浏览器打开网址:https://cat-match-static.easygame2021.com/maps/046ef1bab26e5b9bfe2473ded237b572.txt尝试获取第一关信息:

{"levelKey":80001,"levelData":{"1":[{"id":"1-16-16","type":0,"rolNum":16,"rowNum":16,"layerNum":1,"moldType":1,"blockNode":null},{"id":"1-28-16","type":0,"rolNum":28,"rowNum":16,"layerNum":1,"moldType":1,"blockNode":null},{"id":"1-40-16","type":0,"rolNum":40,"rowNum":16,"layerNum":1,"moldType":1,"blockNode":null},{"id":"1-16-32","type":0,"rolNum":16,"rowNum":32,"layerNum":1,"moldType":1,"blockNode":null},{"id":"1-28-32","type":0,"rolNum":28,"rowNum":32,"layerNum":1,"moldType":1,"blockNode":null},{"id":"1-40-32","type":0,"rolNum":40,"rowNum":32,"layerNum":1,"moldType":1,"blockNode":null},{"id":"1-16-48","type":0,"rolNum":16,"rowNum":48,"layerNum":1,"moldType":2,"blockNode":null},{"id":"1-28-48","type":0,"rolNum":28,"rowNum":48,"layerNum":1,"moldType":2,"blockNode":null},{"id":"1-40-48","type":0,"rolNum":40,"rowNum":48,"layerNum":1,"moldType":2,"blockNode":null}],"2":[{"id":"2-16-36","type":0,"rolNum":16,"rowNum":36,"layerNum":2,"moldType":1,"blockNode":null},{"id":"2-28-36","type":0,"rolNum":28,"rowNum":36,"layerNum":2,"moldType":1,"blockNode":null},{"id":"2-40-36","type":0,"rolNum":40,"rowNum":36,"layerNum":2,"moldType":1,"blockNode":null},{"id":"2-16-20","type":1,"rolNum":16,"rowNum":20,"layerNum":2,"moldType":1,"blockNode":null},{"id":"2-28-20","type":1,"rolNum":28,"rowNum":20,"layerNum":2,"moldType":1,"blockNode":null},{"id":"2-40-20","type":1,"rolNum":40,"rowNum":20,"layerNum":2,"moldType":1,"blockNode":null},{"id":"2-16-49","type":0,"rolNum":16,"rowNum":49,"layerNum":2,"moldType":2,"blockNode":null},{"id":"2-28-49","type":0,"rolNum":28,"rowNum":49,"layerNum":2,"moldType":2,"blockNode":null},{"id":"2-40-49","type":0,"rolNum":40,"rowNum":49,"layerNum":2,"moldType":2,"blockNode":null}],"3":[]},"blockTypeData":{"1":1,"2":2,"3":2},"heightNum":10,"widthNum":8}

果然得到了地图信息

接下来考虑如何得到md5,最简单的尝试就是把整个json进行一次md5

羊了个羊地图加密分析 9.20

这样一来就得到了原来的字符串046ef1bab26e5b9bfe2473ded237b572

了解了得到map_md5的方法,也就知道了本次更新后加载地图的方式,便可以想到一种修改游戏的方式:自定义一张地图,本地修改游戏源码,将地图信息请求修改到本地,再通过重写响应等方式指向该文件,可以达到修改游戏的目的

华山资源网 Design By www.eoogi.com
广告合作:本站广告合作请联系QQ:858582 申请时备注:广告合作(否则不回)
免责声明:本站资源来自互联网收集,仅供用于学习和交流,请遵循相关法律法规,本站一切资源不代表本站立场,如有侵权、后门、不妥请联系本站删除!
华山资源网 Design By www.eoogi.com