掌上书院UMD文件格式分析

前端时间一家公司的面试题就是掌上书院UMD文件格式解析（逆向分析UMD播放器并写出解析代码），最后待遇没有谈拢，代码留着也无用，分享出来大家共同进步。具体的逆向过程就不多说了，文件解析类如下：

 

UMDDecode.h

/* ============================================================================ Name : UMDDecode.h Author : PanZhenyu Copyright : PanZhenyu MSN&Email : panzhenyu88@gmail.com ============================================================================ */ #ifndef __UMDDECODE_H__ #define __UMDDECODE_H__ #include <stdlib.h> #include <stdio.h> #include <stdarg.h> #include <memory.h> #include <string.h> #include <windows.h> #include <vector> class UMDDecode { public: UMDDecode(); ~UMDDecode(); public: int Parse(char *pFileName); private: void ReadSection(short id, unsigned char b, unsigned char length); void ReadAdditional(short id, unsigned int check, unsigned int length); int ParseHeader(); void EntelFilter(unsigned char* p,unsigned int len); int ParseContent(); private: void FreeMemory(); void PrintLog(const char *format,...); private: FILE *m_pUMDFile; unsigned long m_nUMDFileSize; unsigned char *m_pUMDBuffer; unsigned char *m_pCurrent; private: unsigned short m_nPkgSeed; unsigned int m_nCid; unsigned int m_nAdditionalCheck; unsigned int m_nContentLength; int m_nChapLen; unsigned int *m_pChapOffset; struct ZIPSEGMENG { unsigned char* m_pSeg; unsigned int m_nlen; }; std::vector<ZIPSEGMENG*> m_vZipSeg; }; #endif // __UMDDECODE_H__

 

UMDDecode.cpp

/* ============================================================================ Name : UMDDecode.cpp Author : PanZhenyu Copyright : PanZhenyu MSN&Email : panzhenyu88@gmail.com ============================================================================ */ #include "UMDDecode.h" #include "lib/zlib.h" #define MAXBUFFERSIZE 1024*32 unsigned char BUFFER[MAXBUFFERSIZE]; #pragma comment(lib,"lib/zlib.lib") UMDDecode::UMDDecode() { m_pUMDFile = NULL; m_nUMDFileSize = NULL; m_pUMDBuffer = NULL; m_pChapOffset = NULL; m_pChapOffset = NULL; m_nPkgSeed = 0; m_nCid = 0; m_nAdditionalCheck = 0; m_nContentLength = 0; m_nChapLen = 0; DeleteFile("Content.txt"); DeleteFile("Cover.gif"); DeleteFile("Information.txt"); } UMDDecode::~UMDDecode() { FreeMemory(); } void UMDDecode::FreeMemory() { if (m_pUMDFile) { fclose(m_pUMDFile); m_pUMDFile = NULL; } if (m_pUMDBuffer) { free(m_pUMDBuffer); m_pUMDBuffer = NULL; } if (m_pChapOffset) { free(m_pChapOffset); m_pChapOffset = NULL; } for(int i=0;i<m_vZipSeg.size();i++) { free(m_vZipSeg[i]); } } //打印单行小于100字节 void UMDDecode::PrintLog(const char *format,...) { va_list args; char buffer[100]; va_start(args, format); vsprintf(buffer, format, args); puts(buffer); FILE *Log = fopen("Information.txt", "a"); fprintf(Log, "%s",buffer); fclose(Log); } void UMDDecode::ReadAdditional(short id, unsigned int check, unsigned int length) { switch(id) { case 0x81: break; case 0x82: { char *imagepath[3] = {"Cover.bmp","Cover.jpg","Cover.gif"}; int type = 0; unsigned short flag = *(unsigned short*)m_pCurrent; if (flag == 0xD8FF) { type = 1; }else if (flag == 0x4947) { type = 2; }else if (flag == 0x4D42) { type = 0; } FILE *image = fopen(imagepath[type], "wb"); fwrite(m_pCurrent,1,length,image); fclose(image); } break; case 0x83: { m_nChapLen = length/4; m_pChapOffset = (unsigned int*)calloc(m_nChapLen,sizeof(unsigned int)); for (int i=0;i<m_nChapLen;i++) { m_pChapOffset[i] = *((unsigned int*)m_pCurrent + i); } PrintLog("章节数:%d/n",m_nChapLen); } break; case 0x84: { if (m_nAdditionalCheck != check) { //这里估计是读取zip压缩段的地方 ZIPSEGMENG *seg = (ZIPSEGMENG*)calloc(1,sizeof(ZIPSEGMENG)); seg->m_pSeg = m_pCurrent; seg->m_nlen = length; m_vZipSeg.push_back(seg); }else{ unsigned int index = 0; int i = 0; while (index < length) { unsigned char count = *(m_pCurrent+index); memset(BUFFER,0,MAXBUFFERSIZE); index++; WideCharToMultiByte(CP_ACP,0,(unsigned short*)(m_pCurrent+index),count/2,(char*)BUFFER,MAXBUFFERSIZE,NULL,false); PrintLog("章节名称:《%s》|章节偏移:%d/n",BUFFER,m_pChapOffset[i++]); index += count; } } } break; } m_pCurrent += length; } void UMDDecode::ReadSection(short id, unsigned char b, unsigned char length) { switch(id) { case 1: m_nPkgSeed = *(unsigned short*)m_pCurrent; break; case 2: memset(BUFFER,0,MAXBUFFERSIZE); WideCharToMultiByte(CP_ACP,0,(unsigned short*)m_pCurrent,length/2,(char*)BUFFER,MAXBUFFERSIZE,NULL,false); PrintLog("书名:%s/n",BUFFER); break; case 3: memset(BUFFER,0,MAXBUFFERSIZE); WideCharToMultiByte(CP_ACP,0,(unsigned short*)m_pCurrent,length/2,(char*)BUFFER,MAXBUFFERSIZE,NULL,false); PrintLog("作者:%s/n",BUFFER); break; case 4: memset(BUFFER,0,MAXBUFFERSIZE); WideCharToMultiByte(CP_ACP,0,(unsigned short*)m_pCurrent,length/2,(char*)BUFFER,MAXBUFFERSIZE,NULL,false); PrintLog("出版年份:%s/n",BUFFER); break; case 5: memset(BUFFER,0,MAXBUFFERSIZE); WideCharToMultiByte(CP_ACP,0,(unsigned short*)m_pCurrent,length/2,(char*)BUFFER,MAXBUFFERSIZE,NULL,false); PrintLog("出版月份:%s/n",BUFFER); break; case 6: memset(BUFFER,0,MAXBUFFERSIZE); WideCharToMultiByte(CP_ACP,0,(unsigned short*)m_pCurrent,length/2,(char*)BUFFER,MAXBUFFERSIZE,NULL,false); PrintLog("出版日子:%s/n",BUFFER); break; case 7: memset(BUFFER,0,MAXBUFFERSIZE); WideCharToMultiByte(CP_ACP,0,(unsigned short*)m_pCurrent,length/2,(char*)BUFFER,MAXBUFFERSIZE,NULL,false); PrintLog("作品类型:%s/n",BUFFER); break; case 8: memset(BUFFER,0,MAXBUFFERSIZE); WideCharToMultiByte(CP_ACP,0,(unsigned short*)m_pCurrent,length/2,(char*)BUFFER,MAXBUFFERSIZE,NULL,false); PrintLog("发行商:%s/n",BUFFER); break; case 9: break; case 10: m_nCid = *(unsigned int*)m_pCurrent; break; case 11: m_nContentLength = *(unsigned int*)m_pCurrent; break; case 12: break; case 0x81: case 0x82: case 0x83: case 0x84: m_nAdditionalCheck = *(unsigned int*)m_pCurrent; break; } m_pCurrent += length; } int UMDDecode::ParseHeader() { //检查文件头 unsigned int magicint = *(unsigned int*)m_pCurrent; if (magicint != 0xde9a9b89) { PrintLog("文件头错误!/n"); return -1; } m_pCurrent += 4; char ch = *m_pCurrent; while (ch == '#') { m_pCurrent += 1; short id = *(short*)m_pCurrent;m_pCurrent += 2; unsigned char b = *m_pCurrent;m_pCurrent += 1; unsigned char len = *m_pCurrent - 5;m_pCurrent += 1; ReadSection(id, b, len); ch = (char)*m_pCurrent; switch (id) { case 0xf1: case 10: id = 0x84; break; } while (ch == '$') { m_pCurrent += 1; unsigned long check = *(unsigned long*)m_pCurrent;m_pCurrent+=4; unsigned long num6 = *(unsigned long*)m_pCurrent - 9;m_pCurrent+=4; ReadAdditional(id,check,num6); ch = *m_pCurrent; } } return 0; } void UMDDecode::EntelFilter(unsigned char* p,unsigned int len) { unsigned short* A = (unsigned short*)p; for (int i=0;i<len/2;i++) { if (*(A+i) == 0x2029) { *(A+i) = 0x0A0D; } } } int UMDDecode::ParseContent() { //接下来解析压缩内容 FILE *content = fopen("Content.txt", "ab"); short Unicode = (short)0xFEFF;fwrite(&Unicode,sizeof(short),1,content); for (int i=0;i<m_vZipSeg.size();i++) { unsigned long deslen = MAXBUFFERSIZE; if (Z_OK == uncompress(BUFFER,&deslen,m_vZipSeg[i]->m_pSeg,m_vZipSeg[i]->m_nlen)) { EntelFilter(BUFFER,deslen); fwrite(BUFFER,1,deslen,content); }else{ PrintLog("内容解压失败!/n"); return -1; } } fclose(content); return 0; } int UMDDecode::Parse(char *pFileName) { if (pFileName == NULL) return -1; FreeMemory(); if((m_pUMDFile = fopen(pFileName, "rb")) == NULL) { PrintLog("文件打开失败!/n"); return -1; } //因为是测试代码，所以直接全部都读取到内存中 fseek(m_pUMDFile, 0, SEEK_END); m_nUMDFileSize = ftell(m_pUMDFile); m_pUMDBuffer = (unsigned char*)calloc(m_nUMDFileSize, 1); m_pCurrent = m_pUMDBuffer; fseek(m_pUMDFile, 0, SEEK_SET); if (fread((void*)m_pUMDBuffer, sizeof(unsigned char), m_nUMDFileSize, m_pUMDFile) != m_nUMDFileSize) { PrintLog("文件读取失败!/n"); return -1; } if (ParseHeader()) return -1; if (ParseContent()) return -1; PrintLog("/n/nAuthor:PanZhenyu,Email:panzhenyu@188.com!/n"); return 0; }

 

唉，无语，不能够上传zip附件，代码对齐也有问题。。。。为什么上篇文章的代码可以对齐咧，邪念。。。。