QQ空間現在採用的是動態加密，加密結果和驗證碼有密切關系，
也就是說是：密碼+演算法+驗證碼在一起，加密演算法如下：
public static string smethod_0(string s)
{
MD5 mD = MD5.Create();
byte[] bytes = Encoding.ASCII.GetBytes(s);
byte[] array = mD.ComputeHash(bytes);
StringBuilder stringBuilder = new StringBuilder();
byte[] array2 = array;
for (int i = 0; i < array2.Length; i++)
{
byte b = array2[i];
stringBuilder.Append(b.ToString("x").PadLeft(2, '0'));
}
return stringBuilder.ToString().ToUpper();
}
public static byte[] EncyptMD5Bytes(string s)
{
MD5 mD = MD5.Create();
byte[] bytes = Encoding.ASCII.GetBytes(s);
return mD.ComputeHash(bytes);
}
public static string smethod_1(byte[] s)
{
MD5 mD = MD5.Create();
byte[] array = mD.ComputeHash(s);
StringBuilder stringBuilder = new StringBuilder();
byte[] array2 = array;
for (int i = 0; i < array2.Length; i++)
{
byte b = array2[i];
stringBuilder.Append(b.ToString("x").PadLeft(2, '0'));
}
return stringBuilder.ToString().ToUpper();
}
public static string EncryptQQWebMd5(string s)
{
MD5 mD = MD5.Create();
byte[] bytes = Encoding.ASCII.GetBytes(s);
byte[] array = mD.ComputeHash(bytes);
StringBuilder stringBuilder = new StringBuilder();
byte[] array2 = array;
for (int i = 0; i < array2.Length; i++)
{
byte b = array2[i];
stringBuilder.Append("\\x");
stringBuilder.Append(b.ToString("x2"));
}
return stringBuilder.ToString();
}
public static string EncryptOld(string password, string verifyCode)
{
return smethod_0(EncyptMD5_3_16(password) + verifyCode.ToUpper());
}
public static string Encrypt(string qq, string password, string verifyCode)
{
return Encrypt((long)Convert.ToDouble(qq), password, verifyCode);
}
public class ByteBuffer
{
private byte[] byte_0;
public Stream BaseStream;
public ByteBuffer()
{
this.BaseStream = new MemoryStream();
this.byte_0 = new byte[16];
}
public virtual long Seek(int offset, SeekOrigin origin)
{
return this.BaseStream.Seek((long)offset, origin);
}
public bool Peek()
{
return this.BaseStream.Position < this.BaseStream.Length;
}
public byte[] ToByteArray()
{
//long position = this.BaseStream.Position;
//this.BaseStream.Position = 0L;
//byte[] array = new byte[(int)((object)((IntPtr)this.BaseStream.Length))];
//this.BaseStream.Read(array, 0, array.Length);
//this.BaseStream.Position = position;
//return array;
long position = this.BaseStream.Position;
this.BaseStream.Position = 0L;
byte[] buffer = new byte[this.BaseStream.Length];
this.BaseStream.Read(buffer, 0, buffer.Length);
this.BaseStream.Position = position;
return buffer;
}
public void Put(bool value)
{
this.byte_0[0] = value ? ((byte)1) : ((byte)0);
this.BaseStream.Write(this.byte_0, 0, 1);
}
public void Put(byte value)
{
this.BaseStream.WriteByte(value);
}
public void Put(byte[] value)
{
if (value == null)
{
throw new ArgumentNullException("value");
}
this.BaseStream.Write(value, 0, value.Length);
}
public void PutInt(int value)
{
this.PutInt((uint)value);
}
public void PutInt(uint value)
{
this.byte_0[0] = (byte)(value >> 24);
this.byte_0[1] = (byte)(value >> 16);
this.byte_0[2] = (byte)(value >> 8);
this.byte_0[3] = (byte)value;
this.BaseStream.Write(this.byte_0, 0, 4);
}
public void PutInt(int index, uint value)
{
int offset = (int)this.BaseStream.Position;
this.Seek(index, SeekOrigin.Begin);
this.PutInt(value);
this.Seek(offset, SeekOrigin.Begin);
}
public byte Get()
{
return (byte)this.BaseStream.ReadByte();
}
}
public static string Encrypt(long qq, string password, string verifyCode)
{
ByteBuffer byteBuffer = new ByteBuffer();
byteBuffer.Put(EncyptMD5Bytes(password));
byteBuffer.PutInt(0);
byteBuffer.PutInt((uint)qq);
EncryptQQWebMd5(password);
byte[] s = byteBuffer.ToByteArray();
string str = smethod_1(s);
return smethod_0(str + verifyCode.ToUpper());
}
上面的加密演算法，調用方法是:string str = Encrypt(QQ號, QQ密碼, 驗證碼);
加密後的密碼會返回到str中，然後使用返回的密碼進行登錄。
註：QQ空間登錄是採用的GET而不是POST。
Ⅱ QQ密碼加密原理
QQ2005 賀歲版登錄口令加密演算法及其源代碼http://www.cnhello.com Binny（[email protected]） 2005-12-11 3:27:33 查看: 次 星級: 文字大小: 較大 正常 較小 收藏此頁到365Key 收藏此頁到新浪ViVi 【導讀】拿到QQ 2005賀歲版後，發現其加密原理並沒有新的改變，經過跟蹤和分析，編制出暴力破解本地QQ密碼的程序。QQ密碼在正確登陸後，會將加密的結果保存在用戶目錄的ewh.db文件中，加密採用公開的MD5演算法，通過N次循環以及異或後求反，最終計算出加密的結果，與用戶的ewh.db文件中的密文比較後，發出「輸入密碼與上次成功登錄的密碼不一致,$0A是否到伺服器驗證?」（這條信息在BasicCtrlDll.dll的資源中，$0A在C的格式化中為回車）。根據這個提示，完成本地QQ密碼的暴力破解。 拿到QQ 2005賀歲版後，發現其加密原理並沒有新的改變，經過跟蹤和分析，編制出暴力破解本地QQ密碼的程序。
QQ密碼在正確登陸後，會將加密的結果保存在用戶目錄的ewh.db文件中，加密採用公開的MD5演算法，通過N次循環以及異或後求反，最終計算出加密的結果，與用戶的ewh.db文件中的密文比較後，發出「輸入密碼與上次成功登錄的密碼不一致,$0A是否到伺服器驗證?」（這條信息在BasicCtrlDll.dll的資源中，$0A在C的格式化中為回車）。根據這個提示，完成本地QQ密碼的暴力破解。
在QQ系統中，「QD」標志代表QQ Data，例如，我們可以在文件User.db或ewh.db中找到這個以QD開頭的數據結構。
一、 ewh.db原始數據
51 44 01 01 03 00 04 03 00 BD AF A8 04 00 00 00
00 2E 06 00 07 03 00 B9 AB B4 10 00 00 00 07 22
AA 96 56 19 A3 9E 82 19 B7 2B BD 2D 34 4A 04 03
00 A9 B5 B2 04 00 00 00 3C A8 93 06
其中，紅色為AST循環次數，蘭色為EWH加密字元串，綠色為UIN QQ號（110340156=0x0693A83C，Intel體系內存中排列順序為：3CA89306）。
二、 ewh.db數據結構
HEX
偏移 DEC
偏移 數據 注釋 變數
標志
0000 1 51 44 QD，QQ Data 數據標志 Flag
0002 3 01 01 保留的數據結構 Reserve
0004 5 03 00 總數據段（Data Sections）的個數 Sections
0006 7 04 第一個數據段（簡稱1S，下同）的類型，可以從0x01到0x0F，04代表本數據沒經過加密處理。 Type1S
0007 8 03 00 1S標志的長度。 LenFlag1S
0009 10 BD AF A8 1S標志（例如AST、UIN、EWH等），是經過簡單的異或並求反計算處理的，此處是AST，可能是Algorithm Shift Times 或Axxx Switch Time，管他的呢！ Flag1S
000C 13 04 00 00 00 1S數據的長度 LenData1S
0010 17 00 2E 06 00
= (404992) 1S數據，這里是進行MD5轉換的次數。
這個數據是同計算機的性能有關的，性能越高的計算機，在QQ注冊成功後產生的這個循環控制變數就越大。 Data1S
0014 21 07 2S數據的類型，07代表使用MD5進行加密 Type2S
0015 22 03 00 2S標志的長度 LenFlag2S
0017 24 B9 AB B4 2S標志，此處是EWH，代表本數據段是EWH密碼數據，可能是Encrypt With Hash的縮寫 Flag2S
001A 27 10 00 00 00 2S數據的長度 LenData2S
001E 31 07 22 AA 96
56 19 A3 9E
82 19 B7 2B
BD 2D 34 4A 2S數據，是經過MD5加密計算後產生的數據，當然還要經過異或並求反的計算處理，參考下面程序中的1000B858 行代碼。 Data2S
002E 47 04 3S數據的類型 Type3S
002F 48 03 00 3S標志的長度 LenFlag3S
0031 50 A9 B5 B2 3S標志，此處是UIN，代表本數據段是QQ號碼，可能是：User Identifier Number的縮寫 Flag3S
0034 53 04 00 00 00 3S數據的長度 LenData3S
0038 57 3C A8 93 06 3S數據，3C A8 93 06 = 110340156 Data3S
三、 加密原理
下面VB偽代碼的部分符號引自以上第二點《結構說明》中的變數標志，請注意理解：
Pwd = MD5(Pwd, Len(Pwd)) ' Pwd為用戶輸入的密碼，第一輪MD5後，Pwd成為16位位元組長度的MD5串。
XorKey As Long = 0 'XorKey為用於解密的位元組
For k = 1 To Data1S – 1 '因為前面已經做過一輪，所以此處要減一
Pwd = MD5(Pwd, 16)
Next k
XorKey = XorKey And &HFFFF
XorKey = (LenData2S And &HFF) Xor (LenData2S \ 256)
XorKey = &HFF - XorKey '求反
For k = 1 To 16
Pwd(k) = Pwd(k) Xor XorKey
Next k
If Pwd <> Data2S Then
MsgBox "輸入密碼與上次成功登錄的密碼不一致," & vbcrlf & "是否到伺服器驗證?"
End If
通過以上的流程，我真的佩服QQ的設計者，如此巨大的循環量，加上循環次數的隨機性，如果希望產生一個QQ MD5詞典簡直不可能。雖然理論上，可以產生一個MD5字典，但是，這個字典將有1.15E+77*16個位元組之巨，因此，只好根據ewh.db文件提供的數據暴力破解了，不知是不是有更好的方法呢？
不過我的感覺是，循環次數加多了，應該會產生更多的MD5碰撞，不見得是個好事。
還有一種破解思路，也許更加直接，將在後面的文章中詳細探討。但是我只有在有時間做完實驗後才有資格評述，不在本文章的討論范圍內。
四、 破解演算法
重復進行數十萬次MD5加密，會消耗計算機很多時間，如果使用傳統的VB或VC，對於一個密碼的等待時間也是很可觀的（例如使用VB代碼，消耗的時間可能是匯編的400倍），因此，我使用匯編語言來編制低層加密解密演算法，通過MASM32編譯連接，最後用高級語言調用。通過提供演算法動態庫的方式，方便其他有興趣的讀者自己增加豐富的功能。例如增加多線程等，這也將在以後的探討中實現。在此不做深入討論。
附帶的例子為VB和VC調用匯編語言動態庫的例子，VB代碼簡單實現了通過密碼字典進行單線程破解的功能，讀者可以豐富其內容。增加更多的功能。
五、 QQ數據結構分析
下面為動態庫BasicCtrlDll.dll中反匯編的代碼以及代碼分析，主要用於分析EWH.DB中數據結構以及QQ數據解調演算法的問題。另外，這個演算法也可以將User.db中的數據提取出來。深入研究下去，做一個聊天記錄查看器之類的軟體也非難事。
1000B71D B8 AC160110 mov eax,BasicCtr.100116AC
1000B722 E8 89460000 call BasicCtr.1000FDB0
1000B727 83EC 3C sub esp,3C
1000B72A 8B45 08 mov eax,dword ptr ss:[ebp+8] 將數據的開始地址賦給EAX，實際數據為**Data，EAX=*Data
1000B72D 53 push ebx
1000B72E 56 push esi
1000B72F 57 push edi
1000B730 8B30 mov esi,dword ptr ds:[eax] 需要轉換的字元串，EAX指示一個結構，第一個成員為實際的數據指針
1000B732 894D D8 mov dword ptr ss:[ebp-28],ecx 局部變數[ebp-28]保存全局的標志結構，ECX為全局參數地址，在調用本函數時跟入
1000B735 8B46 F8 mov eax,dword ptr ds:[esi-8] 為CString結構中長度的成員，表示總共多少個位元組
1000B738 83F8 06 cmp eax,6 如果長度小於6，則為無效的數據
1000B73B 0F82 81020000 jb BasicCtr.1000B9C2 如果比6小則跳轉退出，說明數據量不夠解調的
1000B741 803E 51 cmp byte ptr ds:[esi],51 是否為 QQ Data 的數據，QD為QQ數據標志
1000B744 0F85 78020000 jnz BasicCtr.1000B9C2
1000B74A 807E 01 44 cmp byte ptr ds:[esi+1],44
1000B74E 0F85 6E020000 jnz BasicCtr.1000B9C2
1000B754 66:8B7E 04 mov di,word ptr ds:[esi+4] 對於EWH來說，為第4+1個位元組，為0003
1000B758 83C6 04 add esi,4 指向數據段(Sections)的個數
1000B75B 46 inc esi
1000B75C 83C0 FA add eax,-6 EAX去掉6個位元組，對於EWH來說，剩下36H個位元組
1000B75F 46 inc esi
1000B760 8945 08 mov dword ptr ss:[ebp+8],eax 指向第一個數據段
1000B763 E8 CE050000 call BasicCtr.1000BD36 在內存（ECX+9C）處開辟一個(100H)位元組的空間，空間地址返回到EAX
1000B768 8365 E0 00 and dword ptr ss:[ebp-20],0 局部變數[ebp-20]清零
1000B76C 0FB7C7 movzx eax,di 轉換到EAX，對於EWH，di=3。表示有3段數據
1000B76F 85C0 test eax,eax
1000B771 8945 B8 mov dword ptr ss:[ebp-48],eax 局部變數[ebp-48]保存數據的段數
1000B774 0F8E 21020000 jle BasicCtr.1000B99B
1000B77A 837D 08 07 cmp dword ptr ss:[ebp+8],7 如果整個長度小於7，則剩下的應該是QQ號了。第一次進入時=36H
1000B77E 0F82 3E020000 jb BasicCtr.1000B9C2 如果剩餘的數據長度小於7則退出
1000B784 8A06 mov al,byte ptr ds:[esi] 第一次進入時，ESI指向第7個數據即數據段的類型，例如 04
1000B786 66:8B4E 01 mov cx,word ptr ds:[esi+1] CX=後一個數據，及數據段標志的長度，例如 0003
1000B78A 46 inc esi
1000B78B 8B55 08 mov edx,dword ptr ss:[ebp+8] 剩餘的數據長度，如36H
1000B78E 836D 08 03 sub dword ptr ss:[ebp+8],3 去掉3個，例如成為33H=51
1000B792 894D C8 mov dword ptr ss:[ebp-38],ecx 局部變數[ebp-38]保存數據段中標志長度
1000B795 0FB7F9 movzx edi,cx EDI為標志長度了
1000B798 46 inc esi
1000B799 8845 E4 mov byte ptr ss:[ebp-1C],al 局部變數[ebp-1C]保存本段的類型
1000B79C 8D4F 04 lea ecx,dword ptr ds:[edi+4] ECX為取得的標志長度再加上4，例如=7
1000B79F 46 inc esi 第一次時，ESI指向第一個數據段的標志欄位了，例如指向BDAFA8，第9個數據開始
1000B7A0 394D 08 cmp dword ptr ss:[ebp+8],ecx 如果剩餘的數據比「標志長度+4」還少，則沒有數據，因此不進行處理
1000B7A3 0F82 19020000 jb BasicCtr.1000B9C2
1000B7A9 8B0C37 mov ecx,dword ptr ds:[edi+esi] 跳過數據段的標志部分，將數據段的長度賦值給ECX。例如[edi+esi]=4
1000B7AC 8D1C37 lea ebx,dword ptr ds:[edi+esi] EBX保存新的指針，指向數據段中數據部分的長度部分，例如，[EBX]=4
1000B7AF 895D C4 mov dword ptr ss:[ebp-3C],ebx 局部變數[ebp-3C]保存數據段中數據部分的長度指針
1000B7B2 8D4C0F 07 lea ecx,dword ptr ds:[edi+ecx+7] 從標志（自身長3，加上4個長度位=7）開始，加上數據長度，為完整數據長度。例如E
1000B7B6 3BCA cmp ecx,edx 如果剩下的數據長度（如36H）不夠，則退出
1000B7B8 894D CC mov dword ptr ss:[ebp-34],ecx 局部變數[ebp-34]保存本數據段的總長度
1000B7BB 0F87 01020000 ja BasicCtr.1000B9C2 如果小於則退出程序
1000B7C1 8365 F0 00 and dword ptr ss:[ebp-10],0 局部變數[ebp-10]清零
1000B7C5 3C 01 cmp al,1 al保存本段的類型，有效的類型是4或7
1000B7C7 74 18 je short BasicCtr.1000B7E1
1000B7C9 3C 02 cmp al,2
1000B7CB 74 14 je short BasicCtr.1000B7E1
1000B7CD 3C 03 cmp al,3
1000B7CF 74 10 je short BasicCtr.1000B7E1
1000B7D1 3C 04 cmp al,4
1000B7D3 74 0C je short BasicCtr.1000B7E1
1000B7D5 3C 05 cmp al,5
1000B7D7 74 08 je short BasicCtr.1000B7E1
1000B7D9 3C 07 cmp al,7
1000B7DB 74 04 je short BasicCtr.1000B7E1
1000B7DD 3C 06 cmp al,6
1000B7DF 75 19 jnz short BasicCtr.1000B7FA
1000B7E1 51 push ecx 為本段的總長度，包括（段類型+標志長度+標志+數據長度+數據），例如，對於密碼段=1AH
1000B7E2 E8 23430000 call <MFC42.operator new>
1000B7E7 FF75 CC push dword ptr ss:[ebp-34] n=[ebp-34]，局部變數[ebp-34]保存本數據段的總長度
1000B7EA 8D4E FD lea ecx,dword ptr ds:[esi-3] [esi-3]指向本段的開始（從段類型算起）
1000B7ED 8945 F0 mov dword ptr ss:[ebp-10],eax 局部變數[ebp-10]保存拷貝後的數據
1000B7F0 51 push ecx src
1000B7F1 50 push eax dest
1000B7F2 E8 E5450000 call <MSVCRT.memcpy> memcpy，將本段的整段數據拷貝到新的地方，數據指針保存在局部變數[ebp-10]中
1000B7F7 83C4 10 add esp,10
1000B7FA 8B45 C8 mov eax,dword ptr ss:[ebp-38] 局部變數[ebp-38]保存數據段中標志長度
1000B7FD 33C9 xor ecx,ecx
1000B7FF 32C4 xor al,ah 將低位長度與高位異或，例如3 xor 0=3
1000B801 85FF test edi,edi EDI為標志位的長度
1000B803 76 12 jbe short BasicCtr.1000B817 如果本段沒有段標志，則跳轉
1000B805 8A1431 mov dl,byte ptr ds:[ecx+esi] 開始循環，循環次數為標志的長度。 ECX第一次時為0，將第一個數據載入到DL中。
1000B808 32D0 xor dl,al AL為長度的高位和低位的異或，這里為3
1000B80A F6D2 not dl DL=NOT ([數據] xor [數據段標志長度的高位 xor 數據段標志長度的低位])
1000B80C 881431 mov byte ptr ds:[ecx+esi],dl 數據保存在原始的內存中相應的地方
1000B80F 41 inc ecx
1000B810 3BCF cmp ecx,edi
1000B812 72 F1 jb short BasicCtr.1000B805
1000B814 8B5D C4 mov ebx,dword ptr ss:[ebp-3C] 局部變數[ebp-3C]保存數據段中數據部分的長度指針
1000B817 57 push edi EDI為標志位的長度
1000B818 56 push esi ESI為指向解密以後的數據，例如AST
1000B819 8D4D E8 lea ecx,dword ptr ss:[ebp-18] 局部變數[ebp-18]存放強制類型轉換以後的數據指針的指針，例如AST
1000B81C E8 5B430000 call <MFC42.CString::CString> 將解密後的數據變成CString類型。返回的類型放在EAX指示的地址中
1000B821 8365 FC 00 and dword ptr ss:[ebp-4],0 局部變數[ebp-4]清零
1000B825 6A FC push -4
1000B827 58 pop eax EAX=-4=FFFFFFFC
1000B828 8BF3 mov esi,ebx ebx保存數據段中數據部分的長度指針
1000B82A 2BC7 sub eax,edi EAX=EAX-EDI=FFFFFFFC-3=FFFFFFF9
1000B82C 8B1E mov ebx,dword ptr ds:[esi] ebx為數據段中數據部分的長度了
1000B82E 0145 08 add dword ptr ss:[ebp+8],eax 第一次時，[EBP+8]=33。執行後=2C，相當於33H-7H=2CH
1000B831 83C6 04 add esi,4 ESI指向數據段中的數據部分了
1000B834 395D 08 cmp dword ptr ss:[ebp+8],ebx [ebp+8]=2C，ebx=4
1000B837 0F82 6A010000 jb BasicCtr.1000B9A7
1000B83D 807D E4 07 cmp byte ptr ss:[ebp-1C],7 局部變數[ebp-1C]保存本段的類型， 4或者7
1000B841 74 06 je short BasicCtr.1000B849
1000B843 807D E4 06 cmp byte ptr ss:[ebp-1C],6 如果類型不為6，則執行1000B862
1000B847 75 19 jnz short BasicCtr.1000B862
1000B849 8AC3 mov al,bl 如果數據段的類型為7，則執行此語句。BL包含本段的長度
1000B84B 33FF xor edi,edi
1000B84D 32C7 xor al,bh al=（長度的低位 xor 長度的高位）
1000B84F 85DB test ebx,ebx
1000B851 76 0F jbe short BasicCtr.1000B862 如果長度為0，則表示沒有密碼
1000B853 8A0C37 mov cl,byte ptr ds:[edi+esi]
1000B856 32C8 xor cl,al
1000B858 F6D1 not cl DL=NOT ([數據] xor [數據段標志長度的高位xor 數據段標志長度的低位])
1000B85A 880C37 mov byte ptr ds:[edi+esi],cl
1000B85D 47 inc edi
1000B85E 3BFB cmp edi,ebx
1000B860 72 F1 jb short BasicCtr.1000B853 循環直到全部數據解調完畢
1000B862 53 push ebx 數據串的長度
1000B863 56 push esi 原始的需要變換的數據
1000B864 8D4D EC lea ecx,dword ptr ss:[ebp-14] 局部變數[ebp-14]存放強制CString類型轉換以後的數據指針的指針，例如DB2E0600
1000B867 E8 10430000 call <MFC42.CString::CString>
1000B86C 8A45 E4 mov al,byte ptr ss:[ebp-1C] 局部變數[ebp-1C]保存本段的類型，4或者7
1000B86F 295D 08 sub dword ptr ss:[ebp+8],ebx 去掉已經處理的數據，執行後 [ebp+8]=28H，ebx為數據段中數據部分的長度
1000B872 03F3 add esi,ebx ESI指向下一個數據段的開始部分，ebx保存數據段中數據部分的長度指針
1000B874 33FF xor edi,edi
1000B876 84C0 test al,al 測試本段的類型是否為0
1000B878 C645 FC 01 mov byte ptr ss:[ebp-4],1 局部布爾型變數[ebp-4]=1
1000B87C 0F86 A3010000 jbe BasicCtr.1000BA25 如果本段的數據類型為0，則執行 1000BA25後退出
1000B882 3C 07 cmp al,7
1000B884 0F86 B6000000 jbe BasicCtr.1000B940 如果小於等於7，則跳轉到1000B940執行。對於EWH來說就是這樣
1000B88A 3C 08 cmp al,8
1000B88C 0F84 74010000 je BasicCtr.1000BA06 如果數據類型為8，則直接退出。
1000B892 3C 09 cmp al,9
1000B894 74 5D je short BasicCtr.1000B8F3
1000B896 3C 0A cmp al,0A
1000B898 0F85 87010000 jnz BasicCtr.1000BA25
1000B89E 8B4D D8 mov ecx,dword ptr ss:[ebp-28] 當數據類型為A時，執行本程序代碼
1000B8A1 8D45 D4 lea eax,dword ptr ss:[ebp-2C]
1000B8A4 50 push eax
1000B8A5 E8 47FEFFFF call BasicCtr.1000B6F1
1000B8AA 8B45 D4 mov eax,dword ptr ss:[ebp-2C]
1000B8AD FF75 EC push dword ptr ss:[ebp-14]
1000B8B0 8B08 mov ecx,dword ptr ds:[eax]
1000B8B2 53 push ebx
1000B8B3 50 push eax
1000B8B4 FF91 BC000000 call dword ptr ds:[ecx+BC]
1000B8BA 8BD8 mov ebx,eax
1000B8BC 85DB test ebx,ebx
1000B8BE 0F85 12010000 jnz BasicCtr.1000B9D6
1000B8C4 8B45 D4 mov eax,dword ptr ss:[ebp-2C]
1000B8C7 6A 04 push 4
1000B8C9 8945 DC mov dword ptr ss:[ebp-24],eax
1000B8CC 8D45 DC lea eax,dword ptr ss:[ebp-24]
1000B8CF 50 push eax
1000B8D0 8D4D C0 lea ecx,dword ptr ss:[ebp-40]
1000B8D3 E8 A4420000 call <MFC42.CString::CString>
1000B8D8 50 push eax
1000B8D9 8D4D EC lea ecx,dword ptr ss:[ebp-14]
1000B8DC C645 FC 03 mov byte ptr ss:[ebp-4],3
1000B8E0 E8 C3400000 call <MFC42.CString::operator=>
1000B8E5 C645 FC 01 mov byte ptr ss:[ebp-4],1
1000B8E9 8D4D C0 lea ecx,dword ptr ss:[ebp-40]
1000B8EC E8 AB400000 call <MFC42.CString::~CString>
1000B8F1 EB 50 jmp short BasicCtr.1000B943
1000B8F3 8B4D D8 mov ecx,dword ptr ss:[ebp-28] 當數據類型為9時，執行這個操作
1000B8F6 8D45 D0 lea eax,dword ptr ss:[ebp-30]
1000B8F9 50 push eax
1000B8FA E8 4E180000 call BasicCtr.1000D14D
1000B8FF 8B45 D0 mov eax,dword ptr ss:[ebp-30]
1000B902 FF75 EC push dword ptr ss:[ebp-14]
1000B905 8B08 mov ecx,dword ptr ds:[eax]
1000B907 53 push ebx
1000B908 50 push eax
1000B909 FF51 78 call dword ptr ds:[ecx+78]
1000B90C 8BD8 mov ebx,eax
1000B90E 85DB test ebx,ebx
1000B910 0F85 D4000000 jnz BasicCtr.1000B9EA
1000B916 8B45 D0 mov eax,dword ptr ss:[ebp-30]
1000B919 6A 04 push 4
1000B91B 8945 DC mov dword ptr ss:[ebp-24],eax
1000B91E 8D45 DC lea eax,dword ptr ss:[ebp-24]
1000B921 50 push eax
1000B922 8D4D BC lea ecx,dword ptr ss:[ebp-44]
1000B925 E8 52420000 call <MFC42.CString::CString>
1000B92A 50 push eax
1000B92B 8D4D EC lea ecx,dword ptr ss:[ebp-14]
1000B92E C645 FC 02 mov byte ptr ss:[ebp-4],2
1000B932 E8 71400000 call <MFC42.CString::operator=>
1000B937 C645 FC 01 mov byte ptr ss:[ebp-4],1
1000B93B 8D4D BC lea ecx,dword ptr ss:[ebp-44]
1000B93E EB AC jmp short BasicCtr.1000B8EC
1000B940 6A 01 push 1 當數據段的類型<=7時，直接從此處執行
1000B942 5F pop edi
1000B943 8B5D D8 mov ebx,dword ptr ss:[ebp-28] 局部變數[ebp-28]保存全局的標志結構
1000B946 8D45 EC lea eax,dword ptr ss:[ebp-14] 局部變數[ebp-14]存放強制類型轉換以後的數據指針的指針，例如DB2E0600
1000B949 50 push eax EAX存放強制類型轉換以後的數據指針
1000B94A 8D45 E8 lea eax,dword ptr ss:[ebp-18] 局部變數[ebp-18]存放強制類型轉換以後的數據指針的指針，例如AST
1000B94D FF75 E4 push dword ptr ss:[ebp-1C] 局部變數[ebp-1C]中的第一個位元組保存本段的類型，4或者7
1000B950 8BCB mov ecx,ebx
1000B952 50 push eax
1000B953 E8 B4FCFFFF call BasicCtr.1000B60C call 1000B60C(CString,Flag,CString)
1000B958 85FF test edi,edi
1000B95A 74 18 je short BasicCtr.1000B974
1000B95C 8B45 E0 mov eax,dword ptr ss:[ebp-20] 局部變數[ebp-28]第一次為0，為一個計數器
1000B95F 8B4B 64 mov ecx,dword ptr ds:[ebx+64] 存在於標志結構中，為一個全局地址
1000B962 8B55 F0 mov edx,dword ptr ss:[ebp-10] 局部變數[ebp-10]保存拷貝後的數據，即沒有經過處理的。例如040300BDAF……
1000B965 C1E0 02 shl eax,2 EAX=EAX*2
1000B968 891401 mov dword ptr ds:[ecx+eax],edx 將未做解調的原始數據放到全局結構中某個指針指示的內存中
1000B96B 8B4B 78 mov ecx,dword ptr ds:[ebx+78] 存在於標志結構中，為一個全局地址
1000B96E 8B55 CC mov edx,dword ptr ss:[ebp-34] 局部變數[ebp-34]保存本數據段的總長度
1000B971 891401 mov dword ptr ds:[ecx+eax],edx 將數據長度放到全局結構中某個指針指示的內存中
1000B974 8065 FC 00 and byte ptr ss:[ebp-4],0 局部布爾型變數[ebp-4]=0
1000B978 8D4D EC lea ecx,dword ptr ss:[ebp-14]
1000B97B E8 1C400000 call <MFC42.CString::~CString> 清除數據段中的數據部分CString
1000B980 834D FC FF or dword ptr ss:[ebp-4],FFFFFFFF 局部布爾型變數[ebp-4]=-1，為True
1000B984 8D4D E8 lea ecx,dword ptr ss:[ebp-18]
1000B987 E8 10400000 call <MFC42.CString::~CString> 清除數據段中的標志部分CString，例如AST
1000B98C FF45 E0 inc dword ptr ss:[ebp-20] 局部變數[ebp-28]計數器加一
1000B98F 8B45 E0 mov eax,dword ptr ss:[ebp-20]
1000B992 3B45 B8 cmp eax,dword ptr ss:[ebp-48] 局部變數[ebp-48]保存數據的段數
1000B995 0F8C DFFDFFFF jl BasicCtr.1000B77A 循環解調每個數據段
1000B99B 8B45 08 mov eax,dword ptr ss:[ebp+8] 最後剩餘的長度
1000B99E F7D8 neg eax
1000B9A0 1BC0 sbb eax,eax
1000B9A2 83E0 04 and eax,4
1000B9A5 EB 1E jmp short BasicCtr.1000B9C5
1000B9A7 837D F0 00 cmp dword ptr ss:[ebp-10],0
1000B9AB 74 09 je short BasicCtr.1000B9B6
1000B9AD FF75 F0 push dword ptr ss:[ebp-10]
1000B9B0 E8 FF3F0000 call <MFC42.operator delete>
1000B9B5 59 pop ecx
1000B9B6 834D FC FF or dword ptr ss:[ebp-4],FFFFFFFF
1000B9BA 8D4D E8 lea ecx,dword ptr ss:[ebp-18]
1000B9BD E8 DA3F0000 call <MFC42.CString::~CString>
1000B9C2 6A 04 push 4
1000B9C4 58 pop eax
1000B9C5 8B4D F4 mov ecx,dword ptr ss:[ebp-C]
1000B9C8 5F pop edi
1000B9C9 5E pop esi
1000B9CA 5B pop ebx
1000B9CB 64:890D 000000 mov dword ptr fs:[0],ecx
1000B9D2 C9 leave
1000B9D3 C2 0400 retn 4
1000B9D6 837D F0 00 cmp dword ptr ss:[ebp-10],0
1000B9DA 74 09 je short BasicCtr.1000B9E5
1000B9DC FF75 F0 push dword ptr ss:[ebp-10]
1000B9DF E8 D03F0000 call <MFC42.operator delete>
1000B9E4 59 pop ecx
1000B9E5 8B45 D4 mov eax,dword ptr ss:[ebp-2C]
1000B9E8 EB 12 jmp short BasicCtr.1000B9FC
1000B9EA 837D F0 00 cmp dword ptr ss:[ebp-10],0
1000B9EE 74 09 je short BasicCtr.1000B9F9
1000B9F0 FF75 F0 push dword ptr ss:[ebp-10]
1000B9F3 E8 BC3F0000 call <MFC42.operator delete>
1000B9F8 59 pop ecx
1000B9F9 8B45 D0 mov eax,dword ptr ss:[ebp-30]
1000B9FC 8B08 mov ecx,dword ptr ds:[eax]
1000B9FE 50 push eax
1000B9FF FF51 08 call dword ptr ds:[ecx+8]
1000BA02 8BF3 mov esi,ebx
1000BA04 EB 03 jmp short BasicCtr.1000BA09
1000BA06 6A 04 push 4
1000BA08 5E pop esi
1000BA09 8065 FC 00 and byte ptr ss:[ebp-4],0
1000BA0D 8D4D EC lea ecx,dword ptr ss:[ebp-14]
1000
Ⅲ vb qq密碼加密問題
全部代碼如下：
一個form，3個text，一個command
Private m_lOnBits(30)
Private m_l2Power(30)
Private Const BITS_TO_A_BYTE = 8
Private Const BYTES_TO_A_WORD = 4
Private Const BITS_TO_A_WORD = 32
Function Hex2Bin(HexStr1 As String)
Select Case UCase(HexStr1)
Case "0"
q1 = "0000"
Case "1"
q1 = "0001"
Case "2"
q1 = "0010"
Case "3"
q1 = "0011"
Case "4"
q1 = "0100"
Case "5"
q1 = "0101"
Case "6"
q1 = "0110"
Case "7"
q1 = "0111"
Case "8"
q1 = "1000"
Case "9"
q1 = "1001"
Case "A"
q1 = "1010"
Case "B"
q1 = "1011"
Case "C"
q1 = "1100"
Case "D"
q1 = "1101"
Case "E"
q1 = "1110"
Case "F"
q1 = "1111"
End Select
Hex2Bin = q1
End Function
Function Hex2Bin1(HexStr2 As String)
q1 = Hex2Bin(Mid(HexStr2, 1, 1))
q2 = Hex2Bin(Mid(HexStr2, 2, 1))
q3 = Hex2Bin(Mid(HexStr2, 3, 1))
q4 = Hex2Bin(Mid(HexStr2, 4, 1))
q5 = Hex2Bin(Mid(HexStr2, 5, 1))
q6 = Hex2Bin(Mid(HexStr2, 6, 1))
q7 = Hex2Bin(Mid(HexStr2, 7, 1))
q8 = Hex2Bin(Mid(HexStr2, 8, 1))
q9 = Hex2Bin(Mid(HexStr2, 9, 1))
q10 = Hex2Bin(Mid(HexStr2, 10, 1))
q11 = Hex2Bin(Mid(HexStr2, 11, 1))
q12 = Hex2Bin(Mid(HexStr2, 12, 1))
Hex2Bin1 = q1 & q2 & q3 & q4 & q5 & q6 & q7 & q8 & q9 & q10 & q11 & q12
End Function
Function Bin324(BinCode1 As String)
q1 = Mid(BinCode1, 1, 6)
q2 = Mid(BinCode1, 7, 6)
q3 = Mid(BinCode1, 13, 6)
q4 = Mid(BinCode1, 19, 6)
q5 = Mid(BinCode1, 25, 6)
q6 = Mid(BinCode1, 31, 6)
q7 = Mid(BinCode1, 37, 6)
q8 = Mid(BinCode1, 43, 6)
Bin324 = "00" & q1 & "00" & q2 & "00" & q3 & "00" & q4 & "00" & q5 & "00" & q6 & "00" & q7 & "00" & q8
End Function
Function Bin2Hex(BinCode2 As String)
Select Case UCase(BinCode2)
Case "0000"
q1 = "0"
Case "0001"
q1 = "1"
Case "0010"
q1 = "2"
Case "0011"
q1 = "3"
Case "0100"
q1 = "4"
Case "0101"
q1 = "5"
Case "0110"
q1 = "6"
Case "0111"
q1 = "7"
Case "1000"
q1 = "8"
Case "1001"
q1 = "9"
Case "1010"
q1 = "A"
Case "1011"
q1 = "B"
Case "1100"
q1 = "C"
Case "1101"
q1 = "D"
Case "1110"
q1 = "E"
Case "1111"
q1 = "F"
End Select
Bin2Hex = q1
End Function
Function Bin2Hex2(BinCode As String)
q1 = Bin2Hex(Mid(BinCode, 1, 4))
q2 = Bin2Hex(Mid(BinCode, 5, 4))
q3 = Bin2Hex(Mid(BinCode, 9, 4))
q4 = Bin2Hex(Mid(BinCode, 13, 4))
Bin2Hex2 = q1 & q2 & q3 & q4
End Function
Function Bin2Hex3(BinCode3 As String)
q1 = Bin2Hex2(Mid(BinCode3, 1, 16))
q2 = Bin2Hex2(Mid(BinCode3, 17, 16))
q3 = Bin2Hex2(Mid(BinCode3, 33, 16))
q4 = Bin2Hex2(Mid(BinCode3, 49, 16))
Bin2Hex3 = q1 & q2 & q3 & q4
End Function
Function HexBase64(HexString As String)
HexBase64 = HexBase64_2(Bin2Hex3(Bin324(Hex2Bin1(HexString))))
End Function
Function HexBase64_1(HexString As String)
Select Case HexString
Case "00"
q1 = "A"
Case "01"
q1 = "B"
Case "02"
q1 = "C"
Case "03"
q1 = "D"
Case "04"
q1 = "E"
Case "05"
q1 = "F"
Case "06"
q1 = "G"
Case "07"
q1 = "H"
Case "08"
q1 = "I"
Case "09"
q1 = "J"
Case "0A"
q1 = "K"
Case "0B"
q1 = "L"
Case "0C"
q1 = "M"
Case "0D"
q1 = "N"
Case "0E"
q1 = "O"
Case "0F"
q1 = "P"
Case "10"
q1 = "Q"
Case "11"
q1 = "R"
Case "12"
q1 = "S"
Case "13"
q1 = "T"
Case "14"
q1 = "U"
Case "15"
q1 = "V"
Case "16"
q1 = "W"
Case "17"
q1 = "X"
Case "18"
q1 = "Y"
Case "19"
q1 = "Z"
Case "1A"
q1 = "a"
Case "1B"
q1 = "b"
Case "1C"
q1 = "c"
Case "1D"
q1 = "d"
Case "1E"
q1 = "e"
Case "1F"
q1 = "f"
Case "20"
q1 = "g"
Case "21"
q1 = "h"
Case "22"
q1 = "i"
Case "23"
q1 = "j"
Case "24"
q1 = "k"
Case "25"
q1 = "l"
Case "26"
q1 = "m"
Case "27"
q1 = "n"
Case "28"
q1 = "o"
Case "29"
q1 = "p"
Case "2A"
q1 = "q"
Case "2B"
q1 = "r"
Case "2C"
q1 = "s"
Case "2D"
q1 = "t"
Case "2E"
q1 = "u"
Case "2F"
q1 = "v"
Case "30"
q1 = "w"
Case "31"
q1 = "x"
Case "32"
q1 = "y"
Case "33"
q1 = "z"
Case "34"
q1 = "0"
Case "35"
q1 = "1"
Case "36"
q1 = "2"
Case "37"
q1 = "3"
Case "38"
q1 = "4"
Case "39"
q1 = "5"
Case "3A"
q1 = "6"
Case "3B"
q1 = "7"
Case "3C"
q1 = "8"
Case "3D"
q1 = "9"
Case "3E"
q1 = "+"
Case "3F"
q1 = "/"
End Select
HexBase64_1 = q1
End Function
Function HexBase64_2(HexString As String)
q1 = HexBase64_1(Mid(HexString, 1, 2))
q2 = HexBase64_1(Mid(HexString, 3, 2))
q3 = HexBase64_1(Mid(HexString, 5, 2))
q4 = HexBase64_1(Mid(HexString, 7, 2))
q5 = HexBase64_1(Mid(HexString, 9, 2))
q6 = HexBase64_1(Mid(HexString, 11, 2))
q7 = HexBase64_1(Mid(HexString, 13, 2))
q8 = HexBase64_1(Mid(HexString, 15, 2))
HexBase64_2 = q1 & q2 & q3 & q4 & q5 & q6 & q7 & q8
End Function
Function Hex2Base64(HexCode As String)
For i = 0 To Len(HexCode) Step 12
q1 = q1 & HexBase64(Mid(HexCode, i + 1, 12))
Next
Hex2Base64 = q1
End Function
Private Function md5_F(X, Y, z)
md5_F = (X And Y) Or ((Not X) And z)
End Function
Private Function md5_G(X, Y, z)
md5_G = (X And z) Or (Y And (Not z))
End Function
Private Function md5_H(X, Y, z)
md5_H = (X Xor Y Xor z)
End Function
Private Function md5_I(X, Y, z)
md5_I = (Y Xor (X Or (Not z)))
End Function
Private Sub md5_FF(a, b, c, d, X, s, ac)
a = AddUnsigned(a, AddUnsigned(AddUnsigned(md5_F(b, c, d), X), ac))
a = RotateLeft(a, s)
a = AddUnsigned(a, b)
End Sub
Private Sub md5_GG(a, b, c, d, X, s, ac)
a = AddUnsigned(a, AddUnsigned(AddUnsigned(md5_G(b, c, d), X), ac))
a = RotateLeft(a, s)
a = AddUnsigned(a, b)
End Sub
Private Sub md5_HH(a, b, c, d, X, s, ac)
a = AddUnsigned(a, AddUnsigned(AddUnsigned(md5_H(b, c, d), X), ac))
a = RotateLeft(a, s)
a = AddUnsigned(a, b)
End Sub
Private Sub md5_II(a, b, c, d, X, s, ac)
a = AddUnsigned(a, AddUnsigned(AddUnsigned(md5_I(b, c, d), X), ac))
a = RotateLeft(a, s)
a = AddUnsigned(a, b)
End Sub
Private Function ConvertToWordArray(sMessage)
Dim lMessageLength
Dim lNumberOfWords
Dim lWordArray()
Dim lBytePosition
Dim lByteCount
Dim lWordCount
Const MODULUS_BITS = 512
Const CONGRUENT_BITS = 448
lMessageLength = Len(sMessage)
lNumberOfWords = (((lMessageLength + ((MODULUS_BITS - CONGRUENT_BITS) \ BITS_TO_A_BYTE)) \ (MODULUS_BITS \ BITS_TO_A_BYTE)) + 1) * (MODULUS_BITS \ BITS_TO_A_WORD)
ReDim lWordArray(lNumberOfWords - 1)
lBytePosition = 0
lByteCount = 0
Do Until lByteCount >= lMessageLength
lWordCount = lByteCount \ BYTES_TO_A_WORD
lBytePosition = (lByteCount Mod BYTES_TO_A_WORD) * BITS_TO_A_BYTE
lWordArray(lWordCount) = lWordArray(lWordCount) Or LShift(Asc(Mid(sMessage, lByteCount + 1, 1)), lBytePosition)
lByteCount = lByteCount + 1
Loop
lWordCount = lByteCount \ BYTES_TO_A_WORD
lBytePosition = (lByteCount Mod BYTES_TO_A_WORD) * BITS_TO_A_BYTE
lWordArray(lWordCount) = lWordArray(lWordCount) Or LShift(&H80, lBytePosition)
lWordArray(lNumberOfWords - 2) = LShift(lMessageLength, 3)
lWordArray(lNumberOfWords - 1) = RShift(lMessageLength, 29)
ConvertToWordArray = lWordArray
End Function
Private Function WordToHex(lValue)
Dim lByte
Dim lCount
For lCount = 0 To 3
lByte = RShift(lValue, lCount * BITS_TO_A_BYTE) And m_lOnBits(BITS_TO_A_BYTE - 1)
WordToHex = WordToHex & Right("0" & Hex(lByte), 2)
Next
End Function
Public Function MD5(sMessage, stype)
m_lOnBits(0) = CLng(1)
m_lOnBits(1) = CLng(3)
m_lOnBits(2) = CLng(7)
m_lOnBits(3) = CLng(15)
m_lOnBits(4) = CLng(31)
m_lOnBits(5) = CLng(63)
m_lOnBits(6) = CLng(127)
m_lOnBits(7) = CLng(255)
m_lOnBits(8) = CLng(511)
m_lOnBits(9) = CLng(1023)
m_lOnBits(10) = CLng(2047)
m_lOnBits(11) = CLng(4095)
m_lOnBits(12) = CLng(8191)
m_lOnBits(13) = CLng(16383)
m_lOnBits(14) = CLng(32767)
m_lOnBits(15) = CLng(65535)
m_lOnBits(16) = CLng(131071)
m_lOnBits(17) = CLng(262143)
m_lOnBits(18) = CLng(524287)
m_lOnBits(19) = CLng(1048575)
m_lOnBits(20) = CLng(2097151)
m_lOnBits(21) = CLng(4194303)
m_lOnBits(22) = CLng(8388607)
m_lOnBits(23) = CLng(16777215)
m_lOnBits(24) = CLng(33554431)
m_lOnBits(25) = CLng(67108863)
m_lOnBits(26) = CLng(134217727)
m_lOnBits(27) = CLng(268435455)
m_lOnBits(28) = CLng(536870911)
m_lOnBits(29) = CLng(1073741823)
m_lOnBits(30) = CLng(2147483647)
m_l2Power(0) = CLng(1)
m_l2Power(1) = CLng(2)
m_l2Power(2) = CLng(4)
m_l2Power(3) = CLng(8)
m_l2Power(4) = CLng(16)
m_l2Power(5) = CLng(32)
m_l2Power(6) = CLng(64)
m_l2Power(7) = CLng(128)
m_l2Power(8) = CLng(256)
m_l2Power(9) = CLng(512)
m_l2Power(10) = CLng(1024)
m_l2Power(11) = CLng(2048)
m_l2Power(12) = CLng(4096)
m_l2Power(13) = CLng(8192)
m_l2Power(14) = CLng(16384)
m_l2Power(15) = CLng(32768)
m_l2Power(16) = CLng(65536)
m_l2Power(17) = CLng(131072)
m_l2Power(18) = CLng(262144)
m_l2Power(19) = CLng(524288)
m_l2Power(20) = CLng(1048576)
m_l2Power(21) = CLng(2097152)
m_l2Power(22) = CLng(4194304)
m_l2Power(23) = CLng(8388608)
m_l2Power(24) = CLng(16777216)
m_l2Power(25) = CLng(33554432)
m_l2Power(26) = CLng(67108864)
m_l2Power(27) = CLng(134217728)
m_l2Power(28) = CLng(268435456)
m_l2Power(29) = CLng(536870912)
m_l2Power(30) = CLng(1073741824)
Dim X
Dim k
Dim AA
Dim BB
Dim CC
Dim DD
Dim a
Dim b
Dim c
Dim d
Const S11 = 7
Const S12 = 12
Const S13 = 17
Const S14 = 22
Const S21 = 5
Const S22 = 9
Const S23 = 14
Const S24 = 20
Const S31 = 4
Const S32 = 11
Const S33 = 16
Const S34 = 23
Const S41 = 6
Const S42 = 10
Const S43 = 15
Const S44 = 21
X = ConvertToWordArray(sMessage)
a = &H67452301
b = &HEFCDAB89
c = &H98BADCFE
d = &H10325476
For k = 0 To UBound(X) Step 16
AA = a
BB = b
CC = c
DD = d
md5_FF a, b, c, d, X(k + 0), S11, &HD76AA478
md5_FF d, a, b, c, X(k + 1), S12, &HE8C7B756
md5_FF c, d, a, b, X(k + 2), S13, &H242070DB
md5_FF b, c, d, a, X(k + 3), S14, &HC1BDCEEE
md5_FF a, b, c, d, X(k + 4), S11, &HF57C0FAF
md5_FF d, a, b, c, X(k + 5), S12, &H4787C62A
md5_FF c, d, a, b, X(k + 6), S13, &HA8304613
md5_FF b, c, d, a, X(k + 7), S14, &HFD469501
md5_FF a, b, c, d, X(k + 8), S11, &H698098D8
md5_FF d, a, b, c, X(k + 9), S12, &H8B44F7AF
md5_FF c, d, a, b, X(k + 10), S13, &HFFFF5BB1
md5_FF b, c, d, a, X(k + 11), S14, &H895CD7BE
md5_FF a, b, c, d, X(k + 12), S11, &H6B901122
md5_FF d, a, b, c, X(k + 13), S12, &HFD987193
md5_FF c, d, a, b, X(k + 14), S13, &HA679438E
md5_FF b, c, d, a, X(k + 15), S14, &H49B40821
md5_GG a, b, c, d, X(k + 1), S21, &HF61E2562
md5_GG d, a, b, c, X(k + 6), S22, &HC040B340
md5_GG c, d, a, b, X(k + 11), S23, &H265E5A51
md5_GG b, c, d, a, X(k + 0), S24, &HE9B6C7AA
md5_GG a, b, c, d, X(k + 5), S21, &HD62F105D
md5_GG d, a, b, c, X(k + 10), S22, &H2441453
md5_GG c, d, a, b, X(k + 15), S23, &HD8A1E681
md5_GG b, c, d, a, X(k + 4), S24, &HE7D3FBC8
md5_GG a, b, c, d, X(k + 9), S21, &H21E1CDE6
md5_GG d, a, b, c, X(k + 14), S22, &HC33707D6
md5_GG c, d, a, b, X(k + 3), S23, &HF4D50D87
md5_GG b, c, d, a, X(k + 8), S24, &H455A14ED
md5_GG a, b, c, d, X(k + 13), S21, &HA9E3E905
md5_GG d, a, b, c, X(k + 2), S22, &HFCEFA3F8
md5_GG c, d, a, b, X(k + 7), S23, &H676F02D9
md5_GG b, c, d, a, X(k + 12), S24, &H8D2A4C8A
md5_HH a, b, c, d, X(k + 5), S31, &HFFFA3942
md5_HH d, a, b, c, X(k + 8), S32, &H8771F681
md5_HH c, d, a, b, X(k + 11), S33, &H6D9D6122
md5_HH b, c, d, a, X(k + 14), S34, &HFDE5380C
md5_HH a, b, c, d, X(k + 1), S31, &HA4BEEA44
md5_HH d, a, b, c, X(k + 4), S32, &H4BDECFA9
md5_HH c, d, a, b, X(k + 7), S33, &HF6BB4B60
md5_HH b, c, d, a, X(k + 10), S34, &HBEBFBC70
md5_HH a, b, c, d, X(k + 13), S31, &H289B7EC6
md5_HH d, a, b, c, X(k + 0), S32, &HEAA127FA
md5_HH c, d, a, b, X(k + 3), S33, &HD4EF3085
md5_HH b, c, d, a, X(k + 6), S34, &H4881D05
md5_HH a, b, c, d, X(k + 9), S31, &HD9D4D039
md5_HH d, a, b, c, X(k + 12), S32, &HE6DB99E5
md5_HH c, d, a, b, X(k + 15), S33, &H1FA27CF8
md5_HH b, c, d, a, X(k + 2), S34, &HC4AC5665
md5_II a, b, c, d, X(k + 0), S41, &HF4292244
md5_II d, a, b, c, X(k + 7), S42, &H432AFF97
md5_II c, d, a, b, X(k + 14), S43, &HAB9423A7
md5_II b, c, d, a, X(k + 5), S44, &HFC93A039
md5_II a, b, c, d, X(k + 12), S41, &H655B59C3
md5_II d, a, b, c, X(k + 3), S42, &H8F0CCC92
md5_II c, d, a, b, X(k + 10), S43, &HFFEFF47D
md5_II b, c, d, a, X(k + 1), S44, &H85845DD1
md5_II a, b, c, d, X(k + 8), S41, &H6FA87E4F
md5_II d, a, b, c, X(k + 15), S42, &HFE2CE6E0
md5_II c, d, a, b, X(k + 6), S43, &HA3014314
md5_II b, c, d, a, X(k + 13), S44, &H4E0811A1
md5_II a, b, c, d, X(k + 4), S41, &HF7537E82
md5_II d, a, b, c, X(k + 11), S42, &HBD3AF235
md5_II c, d, a, b, X(k + 2), S43, &H2AD7D2BB
md5_II b, c, d, a, X(k + 9), S44, &HEB86D391
a = AddUnsigned(a, AA)
b = AddUnsigned(b, BB)
c = AddUnsigned(c, CC)
d = AddUnsigned(d, DD)
Next
If stype = 32 Then
MD5 = LCase(WordToHex(a) & WordToHex(b) & WordToHex(c) & WordToHex(d))
Else
MD5 = LCase(WordToHex(b) & WordToHex(c))
End If
End Function
Private Function AddUnsigned(lX, lY)
Dim lX4
Dim lY4
Dim lX8
Dim lY8
Dim lResult
lX8 = lX And &H80000000
lY8 = lY And &H80000000
lX4 = lX And &H40000000
lY4 = lY And &H40000000
lResult = (lX And &H3FFFFFFF) + (lY And &H3FFFFFFF)
If lX4 And lY4 Then
lResult = lResult Xor &H80000000 Xor lX8 Xor lY8
ElseIf lX4 Or lY4 Then
If lResult And &H40000000 Then
lResult = lResult Xor &HC0000000 Xor lX8 Xor lY8
Else
lResult = lResult Xor &H40000000 Xor lX8 Xor lY8
End If
Else
lResult = lResult Xor lX8 Xor lY8
End If
AddUnsigned = lResult
End Function
Private Function LShift(lValue, iShiftBits)
If iShiftBits = 0 Then
LShift = lValue
Exit Function
ElseIf iShiftBits = 31 Then
If lValue And 1 Then
LShift = &H80000000
Else
LShift = 0
End If
Exit Function
ElseIf iShiftBits < 0 Or iShiftBits > 31 Then
Err.Raise 6
End If
If (lValue And m_l2Power(31 - iShiftBits)) Then
LShift = ((lValue And m_lOnBits(31 - (iShiftBits + 1))) * m_l2Power(iShiftBits)) Or &H80000000
Else
LShift = ((lValue And m_lOnBits(31 - iShiftBits)) * m_l2Power(iShiftBits))
End If
End Function
Private Function RShift(lValue, iShiftBits)
If iShiftBits = 0 Then
RShift = lValue
Exit Function
ElseIf iShiftBits = 31 Then
If lValue And &H80000000 Then
RShift = 1
Else
RShift = 0
End If
Exit Function
ElseIf iShiftBits < 0 Or iShiftBits > 31 Then
Err.Raise 6
End If
RShift = (lValue And &H7FFFFFFE) \ m_l2Power(iShiftBits)
If (lValue And &H80000000) Then
RShift = (RShift Or (&H40000000 \ m_l2Power(iShiftBits - 1)))
End If
End Function
Private Function RotateLeft(lValue, iShiftBits)
RotateLeft = LShift(lValue, iShiftBits) Or RShift(lValue, (32 - iShiftBits))
End Function
Public Function Str2QQPwdHash(Str1 As String)
Str2QQPwdHash = Hex2Base64(MD5(Str1, 32)) & "=="
End Function
'Private Sub Form_Load()
'Dim QQPath, QQNum, QQPass
'QQPath = "E:\聊天工具\QQ\QQ.exe" 'QQ所在路徑
'QQNum = "100000" 'QQ號碼
'QQPass = "阿蘇達三" 'QQ密碼
'Shell QQPath & " /START QQUIN:" & QQNum & " PWDHASH:" & Str2QQPwdHash(Trim(QQPass)) & " /STAT:40" '在線為41，隱身為40
'End '不想form退出,此處的end刪除或加'
'End Sub
'如果想運行程序就登陸的話，不要下面的command1的代碼，將formload代碼前的 ' 全部去掉~
'寫在最後，QQNum = "QQ號碼" 和 QQPass = "QQ密碼" 你可以用如下來代替~放在 command1 中,並將formload全部刪除，如下:
Private Sub Command1_Click()
Dim QQPath, QQNum, QQPass
QQPath = Text1.Text 'QQ所在路徑
QQNum = Text2.Text 'QQ號碼
QQPass = Text3.Text 'QQ密碼
Shell QQPath & " /START QQUIN:" & QQNum & " PWDHASH:" & Str2QQPwdHash(Trim(QQPass)) & " /STAT:40" '在線為41，隱身為40
End Sub