琢磨了几天终于成功了!
方法就是利用 Fiddler 来查看登录时发送的数据,主要是查看HTTP数据的header,不过登录http://my.qq.com/ 还要发送内容。
进入加密相册稍微简单一些,只要带上验证码图片返回的Cookie值,然后GET以下地址即可得到该相册的XML数据:
http://xa.photo.qq.com/cgi-bin/common/cgi_view_album?uin=QQ号&refer=portal&albumid=相册ID&password=密码MD5值&verifycode=验证码
希望对大家有所帮助,有不明白的地方或者发现错误请留言告知。
声明:文章所讲的并不是如何破解相册密码,只是提供一种正确的登录方式,即如何向腾讯的服务器发送验证数据。如果连这都搞不定,破解更无从谈起。
下载地址见 http://lvehe.ys168.com/ “原创小软件”下的 VerifyQQ.exe。
一、登录到 http://my.qq.com/ 的加密方式
MD5加密三次,得到的32位密钥转为大写后,再与4位大写验证码连接成一个字符串,再对此字符串进行一次MD5加密,再转为大写即可。
二、显示验证码图片、获取验证码Cookie
图片地址为 http://ptlogin2.qq.com/getimage,得到其响应返回的Set-Cookie值,即“verifysession=...”,其值共80位,保存该值为一个全局变量。
三、发送登录QQ的验证数据。得到的 Set-Cookie 字符串在拆分上个人觉得不太理想,但也还凑合。谁有更好的办法请留言,谢谢。
ShowAvator(string myCookie) 方法得到头像的地址是 http://my.qq.com/qq_face.php,参数myCookie即那个全局变量,记得要传输这个Cookie才能得到正确的头像。
private void btnShowFace_Click(object sender, EventArgs e) { string loginUrl = @"http://ptlogin2.qq.com/login"; HttpWebRequest request = (HttpWebRequest)WebRequest.Create(loginUrl); request.Method = WebRequestMethods.Http.Post; request.KeepAlive = true; //必须禁止自动重定向才能获得 Set-Cookie request.AllowAutoRedirect = false; //设置提交的数据 string postData = @"fp=loginerroralert&u=" + txtQQNum.Text; postData += @"&p=" + Calc3MD5(txtPwd.Text, txtVCode.Text); postData += @"&verifycode=" + txtVCode.Text; postData += @"&u1=http%3A%2F%2Fmy.qq.com&aid=8000203"; request.ContentLength = postData.Length; //设置 Cookie request.Headers.Set("Cookie", "verifysession=" + strCookie); Stream requestStream = request.GetRequestStream(); StreamWriter myStreamWriter = new StreamWriter(requestStream); myStreamWriter.Write(postData, 0, postData.Length); myStreamWriter.Close(); requestStream.Close(); HttpWebResponse response = (HttpWebResponse)request.GetResponse(); string redirectUrl = response.GetResponseHeader("Location"); string[] setCookies = response.Headers["Set-Cookie"].Split(';'); response.Close(); string myCookie = "verifysession=" + strCookie; foreach (string set in setCookies) { if (set.Contains("pt2gguin=") || set.Contains("uin=") || set.Contains("skey=") || set.Contains("ptcz=")) { myCookie += "; " + set.Trim(','); } } ShowAvator(myCookie); }
四、发送加密相册的验证数据,得到该相册的XML数据
private void btnPost_Click(object sender, EventArgs e) { string hostUrl = @"http://xa.photo.qq.com"; hostUrl += @"/cgi-bin/common/cgi_view_album?uin=" + txtQQNum.Text; hostUrl += @"&refer=portal&albumid=" + txtID.Text; hostUrl += @"&password=" + CalcMD5(txtPhotoPwd.Text); hostUrl += @"&verifycode=" + txtVCode.Text; HttpWebRequest request = (HttpWebRequest)WebRequest.Create(hostUrl); request.Referer = @"http://xa.photo.qq.com/proxy.html"; request.Method = "GET"; request.Headers["Accept-Language"] = "zh-cn"; request.KeepAlive = true; //设置 Cookie request.Headers.Set("Cookie", "verifysession=" + strCookie); HttpWebResponse response = (HttpWebResponse)request.GetResponse(); Stream myResponseStream = response.GetResponseStream(); StreamReader myStreamReader = new StreamReader(myResponseStream, Encoding.GetEncoding("gb2312")); string dataGot = myStreamReader.ReadToEnd(); myStreamReader.Close(); myResponseStream.Close(); richTextBox1.Text = dataGot; }