示例#1
0
        public bool DisableExpirationDateCheck()
        {
            ABCFile    abc           = ABCFiles[2];
            ASInstance windowContext = abc.FindInstanceByName("WindowContext");

            if (windowContext == null)
            {
                return(false);
            }

            using (var inCode = new FlashReader(windowContext.Constructor.Body.Bytecode))
                using (var outCode = new FlashWriter())
                {
                    int setLocal11Itterations = 0;
                    while (inCode.Position != inCode.Length)
                    {
                        OPCode op = inCode.ReadOP();
                        outCode.WriteOP(op);
                        if (op != OPCode.SetLocal)
                        {
                            continue;
                        }

                        int setLocalIndex = inCode.Read7BitEncodedInt();
                        outCode.Write7BitEncodedInt(setLocalIndex);
                        if (setLocalIndex != 11 || (++setLocal11Itterations != 2))
                        {
                            continue;
                        }

                        outCode.WriteOP(OPCode.ReturnVoid);
                        outCode.Write(inCode.ToArray(), inCode.Position,
                                      inCode.Length - inCode.Position);

                        windowContext.Constructor.Body.Bytecode = outCode.ToArray();
                        return(true);
                    }
                }
            return(false);
        }
示例#2
0
        public ASClass GetIncomingParser(ASInstance incomingInstance)
        {
            if (_incomingParsersCache.ContainsKey(incomingInstance))
            {
                return(_incomingParsersCache[incomingInstance]);
            }

            ASClass parserClass = null;
            ABCFile abc         = incomingInstance.ABC;

            try
            {
                using (var codeOut = new FlashReader(
                           incomingInstance.Constructor.Body.Bytecode))
                {
                    while (codeOut.IsDataAvailable)
                    {
                        OPCode   op     = codeOut.ReadOP();
                        object[] values = codeOut.ReadValues(op);
                        if (op != OPCode.GetLex)
                        {
                            continue;
                        }

                        var         getLexIndex = (int)values[0];
                        ASMultiname getLexName  = abc.Constants.Multinames[getLexIndex];
                        parserClass = abc.FindClassByName(getLexName.ObjName);
                        if (parserClass != null)
                        {
                            return(parserClass);
                        }
                        break;
                    }
                }

                ASInstance incomingSuperInstance = abc.FindInstanceByName(
                    incomingInstance.SuperType.ObjName);

                ASMultiname parserReturnType = incomingSuperInstance
                                               .FindGetter("parser").Method.ReturnType;

                SlotConstantTrait parserSlot = incomingSuperInstance
                                               .FindSlot("*", parserReturnType.ObjName);

                foreach (ASTrait trait in incomingInstance.Traits)
                {
                    if (trait.TraitType != TraitType.Method)
                    {
                        continue;
                    }

                    var mgsTrait = (MethodGetterSetterTrait)trait.Data;
                    if (mgsTrait.Method.Parameters.Count != 0)
                    {
                        continue;
                    }

                    using (var codeOut = new FlashReader(
                               mgsTrait.Method.Body.Bytecode))
                    {
                        while (codeOut.IsDataAvailable)
                        {
                            OPCode   op     = codeOut.ReadOP();
                            object[] values = codeOut.ReadValues(op);
                            if (op != OPCode.GetLex)
                            {
                                continue;
                            }

                            var         getLexIndex = (int)values[0];
                            ASMultiname getLexType  = abc.Constants.Multinames[getLexIndex];
                            if (getLexType.ObjName != parserSlot.ObjName)
                            {
                                continue;
                            }

                            parserClass = abc.FindClassByName(mgsTrait.Method.ReturnType.ObjName);
                            if (parserClass != null)
                            {
                                return(parserClass);
                            }
                            break;
                        }
                    }
                }
                return(parserClass);
            }
            finally
            {
                if (parserClass != null)
                {
                    _incomingParsersCache[incomingInstance] = parserClass;
                }
            }
        }
示例#3
0
        public bool ReplaceRSA(int exponent, string modulus)
        {
            ABCFile abc          = ABCFiles[2];
            int     modulusIndex = abc.Constants.AddString(modulus);

            int exponentIndex = abc.Constants
                                .AddString(exponent.ToString("x"));

            int        rsaStart  = 0;
            ASInstance commClass = abc.FindInstanceByName("HabboCommunicationDemo");
            ASMethod   verifier  = FindVerifyMethod(commClass, abc, out rsaStart);

            using (var inCode = new FlashReader(verifier.Body.Bytecode))
                using (var outCode = new FlashWriter(inCode.Length))
                {
                    bool searchingKeys = true;
                    inCode.Position = rsaStart;
                    outCode.Write(inCode.ToArray(), 0, rsaStart);

                    while (inCode.Position != inCode.Length)
                    {
                        byte codeByte = inCode.ReadByte();
                        outCode.Write(codeByte);

                        if (!searchingKeys)
                        {
                            outCode.Write(inCode.ToArray(),
                                          inCode.Position, inCode.Length - inCode.Position);

                            break;
                        }
                        switch ((OPCode)codeByte)
                        {
                        case OPCode.GetLex:
                        {
                            outCode.Position--;
                            outCode.WriteOP(OPCode.PushString);

                            int         typeIndex = inCode.Read7BitEncodedInt();
                            ASMultiname type      = abc.Constants.Multinames[typeIndex];

                            inCode.ReadOP();
                            inCode.Read7BitEncodedInt();
                            inCode.Read7BitEncodedInt();

                            if (modulusIndex > 0)
                            {
                                outCode.Write7BitEncodedInt(modulusIndex);
                                modulusIndex = -1;
                            }
                            else if (searchingKeys)
                            {
                                outCode.Write7BitEncodedInt(exponentIndex);
                                searchingKeys = false;
                            }
                            break;
                        }

                        case OPCode.PushString:
                        {
                            int    stringIndex = inCode.Read7BitEncodedInt();
                            string value       = abc.Constants.Strings[stringIndex];

                            if (string.IsNullOrWhiteSpace(Modulus))
                            {
                                Modulus = value;
                                outCode.Write7BitEncodedInt(modulusIndex);
                            }
                            else if (string.IsNullOrWhiteSpace(Exponent))
                            {
                                Exponent = value;
                                outCode.Write7BitEncodedInt(exponentIndex);

                                searchingKeys = false;
                            }
                            break;
                        }

                        default: continue;
                        }
                    }

                    verifier.Body.Bytecode = outCode.ToArray();
                    if (!searchingKeys)
                    {
                        return(true);
                    }
                }
            return(false);
        }
示例#4
0
        public bool BypassRemoteHostCheck()
        {
            ABCFile    abc         = ABCFiles[2];
            ASInstance commManager = abc.FindInstanceByName("HabboCommunicationManager");

            if (commManager == null)
            {
                return(false);
            }

            // The "host" value is always the first slot, for now.
            string hostValueSlotName = commManager.FindTraits <SlotConstantTrait>(TraitType.Slot)
                                       .Where(t => t.Type.ObjName == "String").ToArray()[0].ObjName;

            ASMethod initComponent = commManager.FindMethod("initComponent", "void").Method;

            if (initComponent == null)
            {
                return(false);
            }

            using (var inCode = new FlashReader(initComponent.Body.Bytecode))
                using (var outCode = new FlashWriter(inCode.Length))
                {
                    int hostSlotIndex = abc.Constants.IndexOfMultiname(hostValueSlotName);
                    while (inCode.Position != inCode.Length)
                    {
                        OPCode op = inCode.ReadOP();
                        outCode.WriteOP(op);
                        if (op != OPCode.GetLocal_0)
                        {
                            continue;
                        }

                        op = inCode.ReadOP();
                        outCode.WriteOP(op);
                        if (op != OPCode.CallPropVoid)
                        {
                            continue;
                        }

                        int callPropVoidIndex = inCode.Read7BitEncodedInt();
                        outCode.Write7BitEncodedInt(callPropVoidIndex);

                        int callPropVoidArgCount = inCode.Read7BitEncodedInt();
                        outCode.Write7BitEncodedInt(callPropVoidArgCount);

                        if (callPropVoidArgCount != 0)
                        {
                            continue;
                        }

                        int getPropertyNameIndex = abc.Constants
                                                   .IndexOfMultiname("getProperty");

                        outCode.WriteOP(OPCode.GetLocal_0);
                        outCode.WriteOP(OPCode.FindPropStrict);
                        outCode.Write7BitEncodedInt(getPropertyNameIndex);

                        outCode.WriteOP(OPCode.PushString);
                        outCode.Write7BitEncodedInt(abc.Constants.AddString("connection.info.host"));

                        outCode.WriteOP(OPCode.CallProperty);
                        outCode.Write7BitEncodedInt(getPropertyNameIndex);
                        outCode.Write7BitEncodedInt(1);

                        outCode.WriteOP(OPCode.InitProperty);
                        outCode.Write7BitEncodedInt(hostSlotIndex);

                        outCode.Write(inCode.ToArray(),
                                      inCode.Position, inCode.Length - inCode.Position);

                        do
                        {
                            op = inCode.ReadOP();
                        }while (op != OPCode.CallPropVoid);

                        callPropVoidIndex = inCode.Read7BitEncodedInt();
                        ASMultiname callPropVoidName = abc.Constants.Multinames[callPropVoidIndex];
                        ASMethod    connectMethod    = commManager.FindMethod(callPropVoidName.ObjName, "void").Method;
                        RemoveHostSuffix(abc, connectMethod);

                        initComponent.Body.Bytecode = outCode.ToArray();
                        return(true);
                    }
                }
            return(false);
        }