掌上书院UMD文件格式分析

前端时间一家公司的面试题就是掌上书院UMD文件格式解析（逆向分析UMD播放器并写出解析代码），最后待遇没有谈拢，代码留着也无用，分享出来大家共同进步。具体的逆向过程就不多说了，文件解析类如下：

 

UMDDecode.h

/*============================================================================ Name: UMDDecode.h Author: PanZhenyu Copyright: PanZhenyu MSN&Email: [e-mail]============================================================================*/#ifndef __UMDDECODE_H__#define __UMDDECODE_H__#include <stdlib.h>#include <stdio.h>#include <stdarg.h>#include <memory.h>#include <string.h>#include <windows.h>#include <vector>class UMDDecode{public:UMDDecode();~UMDDecode();public:int Parse(char *pFileName);private:void ReadSection(short id, unsigned char b, unsigned char length);void ReadAdditional(short id, unsigned int check, unsigned int length);int ParseHeader();void EntelFilter(unsigned char* p,unsigned int len);int ParseContent();private:void FreeMemory();void PrintLog(const char *format,...);private:FILE *m_pUMDFile;unsigned long m_nUMDFileSize;unsigned char *m_pUMDBuffer;unsigned char *m_pCurrent;private:unsigned short m_nPkgSeed;unsigned int m_nCid;unsigned int m_nAdditionalCheck;unsigned int m_nContentLength;int m_nChapLen;unsigned int *m_pChapOffset;struct ZIPSEGMENG {unsigned char* m_pSeg;unsigned int m_nlen;};std::vector<ZIPSEGMENG*> m_vZipSeg;};#endif // __UMDDECODE_H__

 

UMDDecode.cpp

/*============================================================================ Name: UMDDecode.cpp Author: PanZhenyu Copyright: PanZhenyu MSN&Email: [e-mail]============================================================================*/#include "UMDDecode.h"#include "lib/zlib.h"#define MAXBUFFERSIZE 1024*32unsigned char BUFFER[MAXBUFFERSIZE];#pragma comment(lib,"lib/zlib.lib")UMDDecode::UMDDecode(){m_pUMDFile = NULL;m_nUMDFileSize = NULL;m_pUMDBuffer = NULL;m_pChapOffset = NULL;m_pChapOffset = NULL;m_nPkgSeed = 0;m_nCid = 0;m_nAdditionalCheck = 0;m_nContentLength = 0;m_nChapLen = 0;DeleteFile("Content.txt");DeleteFile("Cover.gif");DeleteFile("Information.txt");}UMDDecode::~UMDDecode(){FreeMemory();}void UMDDecode::FreeMemory(){if (m_pUMDFile){fclose(m_pUMDFile);m_pUMDFile = NULL;}if (m_pUMDBuffer){free(m_pUMDBuffer);m_pUMDBuffer = NULL;}if (m_pChapOffset){free(m_pChapOffset);m_pChapOffset = NULL;}for(int i=0;i<m_vZipSeg.size();i++){free(m_vZipSeg[i]);}}//打印单行小于100字节void UMDDecode::PrintLog(const char *format,...){va_list args; char buffer[100]; va_start(args, format); vsprintf(buffer, format, args); puts(buffer);FILE *Log = fopen("Information.txt", "a");fprintf(Log, "%s",buffer);fclose(Log);}void UMDDecode::ReadAdditional(short id, unsigned int check, unsigned int length){switch(id){case 0x81:break;case 0x82:{char *imagepath[3] = {"Cover.bmp","Cover.jpg","Cover.gif"};int type = 0;unsigned short flag = *(unsigned short*)m_pCurrent;if (flag == 0xD8FF){type = 1;}else if (flag == 0x4947){type = 2;}else if (flag == 0x4D42){type = 0;}FILE *image = fopen(imagepath[type], "wb");fwrite(m_pCurrent,1,length,image);fclose(image);}break;case 0x83:{m_nChapLen = length/4;m_pChapOffset = (unsigned int*)calloc(m_nChapLen,sizeof(unsigned int));for (int i=0;i<m_nChapLen;i++){m_pChapOffset[i] = *((unsigned int*)m_pCurrent + i);}PrintLog("章节数:%d/n",m_nChapLen);} break;case 0x84:{if (m_nAdditionalCheck != check){//这里估计是读取zip压缩段的地方ZIPSEGMENG *seg = (ZIPSEGMENG*)calloc(1,sizeof(ZIPSEGMENG));seg->m_pSeg = m_pCurrent;seg->m_nlen = length;m_vZipSeg.push_back(seg);}else{unsigned int index = 0;int i = 0;while (index < length){unsigned char count = *(m_pCurrent+index);memset(BUFFER,0,MAXBUFFERSIZE);index++;WideCharToMultiByte(CP_ACP,0,(unsigned short*)(m_pCurrent+index),count/2,(char*)BUFFER,MAXBUFFERSIZE,NULL,false);PrintLog("章节名称:《%s》|章节偏移:%d/n",BUFFER,m_pChapOffset[i++]);index += count;}}} break;}m_pCurrent += length;}void UMDDecode::ReadSection(short id, unsigned char b, unsigned char length){switch(id){case 1:m_nPkgSeed = *(unsigned short*)m_pCurrent;break;case 2:memset(BUFFER,0,MAXBUFFERSIZE);WideCharToMultiByte(CP_ACP,0,(unsigned short*)m_pCurrent,length/2,(char*)BUFFER,MAXBUFFERSIZE,NULL,false);PrintLog("书名:%s/n",BUFFER);break;case 3:memset(BUFFER,0,MAXBUFFERSIZE);WideCharToMultiByte(CP_ACP,0,(unsigned short*)m_pCurrent,length/2,(char*)BUFFER,MAXBUFFERSIZE,NULL,false);PrintLog("作者:%s/n",BUFFER); break;case 4:memset(BUFFER,0,MAXBUFFERSIZE);WideCharToMultiByte(CP_ACP,0,(unsigned short*)m_pCurrent,length/2,(char*)BUFFER,MAXBUFFERSIZE,NULL,false);PrintLog("出版年份:%s/n",BUFFER); break;case 5:memset(BUFFER,0,MAXBUFFERSIZE);WideCharToMultiByte(CP_ACP,0,(unsigned short*)m_pCurrent,length/2,(char*)BUFFER,MAXBUFFERSIZE,NULL,false);PrintLog("出版月份:%s/n",BUFFER);break;case 6:memset(BUFFER,0,MAXBUFFERSIZE);WideCharToMultiByte(CP_ACP,0,(unsigned short*)m_pCurrent,length/2,(char*)BUFFER,MAXBUFFERSIZE,NULL,false);PrintLog("出版日子:%s/n",BUFFER);break;case 7:memset(BUFFER,0,MAXBUFFERSIZE);WideCharToMultiByte(CP_ACP,0,(unsigned short*)m_pCurrent,length/2,(char*)BUFFER,MAXBUFFERSIZE,NULL,false);PrintLog("作品类型:%s/n",BUFFER); break;case 8:memset(BUFFER,0,MAXBUFFERSIZE);WideCharToMultiByte(CP_ACP,0,(unsigned short*)m_pCurrent,length/2,(char*)BUFFER,MAXBUFFERSIZE,NULL,false);PrintLog("发行商:%s/n",BUFFER); break;case 9:break;case 10:m_nCid = *(unsigned int*)m_pCurrent;break;case 11:m_nContentLength = *(unsigned int*)m_pCurrent; break;case 12: break;case 0x81:case 0x82:case 0x83:case 0x84:m_nAdditionalCheck = *(unsigned int*)m_pCurrent;break;}m_pCurrent += length;}int UMDDecode::ParseHeader(){//检查文件头unsigned int magicint = *(unsigned int*)m_pCurrent;if (magicint != 0xde9a9b89){PrintLog("文件头错误!/n");return -1;}m_pCurrent += 4;char ch = *m_pCurrent;while (ch == '#'){m_pCurrent += 1;short id = *(short*)m_pCurrent;m_pCurrent += 2;unsigned char b = *m_pCurrent;m_pCurrent += 1;unsigned char len = *m_pCurrent - 5;m_pCurrent += 1;ReadSection(id, b, len);ch = (char)*m_pCurrent;switch (id) { case 0xf1: case 10: id = 0x84; break; }while (ch == '$'){m_pCurrent += 1;unsigned long check = *(unsigned long*)m_pCurrent;m_pCurrent+=4;unsigned long num6 = *(unsigned long*)m_pCurrent - 9;m_pCurrent+=4;ReadAdditional(id,check,num6);ch = *m_pCurrent;}}return 0;}void UMDDecode::EntelFilter(unsigned char* p,unsigned int len){unsigned short* A = (unsigned short*)p;for (int i=0;i<len/2;i++){if (*(A+i) == 0x2029){*(A+i) = 0x0A0D;}}}int UMDDecode::ParseContent(){//接下来解析压缩内容FILE *content = fopen("Content.txt", "ab");short Unicode = (short)0xFEFF;fwrite(&Unicode,sizeof(short),1,content);for (int i=0;i<m_vZipSeg.size();i++){unsigned long deslen = MAXBUFFERSIZE;if (Z_OK == uncompress(BUFFER,&deslen,m_vZipSeg[i]->m_pSeg,m_vZipSeg[i]->m_nlen)){EntelFilter(BUFFER,deslen);fwrite(BUFFER,1,deslen,content);}else{PrintLog("内容解压失败!/n");return -1;}}fclose(content);return 0;}int UMDDecode::Parse(char *pFileName){if (pFileName == NULL) return -1;FreeMemory();if((m_pUMDFile = fopen(pFileName, "rb")) == NULL){PrintLog("文件打开失败!/n");return -1;}//因为是测试代码，所以直接全部都读取到内存中fseek(m_pUMDFile, 0, SEEK_END); m_nUMDFileSize = ftell(m_pUMDFile);m_pUMDBuffer = (unsigned char*)calloc(m_nUMDFileSize, 1);m_pCurrent = m_pUMDBuffer;fseek(m_pUMDFile, 0, SEEK_SET); if (fread((void*)m_pUMDBuffer, sizeof(unsigned char), m_nUMDFileSize, m_pUMDFile) != m_nUMDFileSize){PrintLog("文件读取失败!/n");return -1;}if (ParseHeader()) return -1;if (ParseContent()) return -1;PrintLog("/n/nAuthor:PanZhenyu,Email:[e-mail]!/n");return 0;}

 

唉，无语，不能够上传zip附件，代码对齐也有问题。。。。为什么上篇文章的代码可以对齐咧，邪念。。。。