某平台作弊检测方法&bypass思路

luly靓

在分析某平台检测作弊玩家方式时，发现此平台思路与众不同，将反作弊的方法与地图联系在一起。
该地图内嵌lua脚本，似乎使用了 https://github.com/actboy168/YDWE 这个项目制作

解包地图后发现大量无规律编号的lua脚本
根据“作弊”关键字定位到有关的lua脚本 __f0361__.lua
[Lua] 纯文本查看 复制代码local __0x0046__=require '__F1098__'local __0x0004__=require 'jass.message'local __0x0000__=require 'jass.common'local __0x0001__=require '__F1094__'local __0x0001__=require '__F0273__'local __0x0004__=require '__F0777__'local __0x0111__=require '__F0157__'local __0x0080__=require 'jass.storm'__0x0004__.__0x0002__:__0x0006__ '\xe6\xb8\xb8\xe6\x88\x8f-\xe8\x84\x9a\xe6\x9c\xac\xe9\x87\x8d\xe8\xbd\xbd\xe7\xbb\x93\xe6\x9d\x9f' (function(__0x0006__)__0x0006__:__0x0010__()reload '__F0361__'end)local __0x0196__=math.randomlocal __0x0007__={__0x0258__=0,__0x0259__=0,__0x0259__=0,__0x0259__=0,__0x2593__=0,__0x2594__=0,}local function __0x2595__(__0x2596__)if __0x0049__.__0x0050__.self:__0x1654__() then__0x0049__.__0x0050__.self:__0x0074__(__0x2596__)endendlocal function __0x2597__(__0x0058__)local __0x2598__=0local __0x2599__=falselocal __0x2600__=89if __0x0058__.__0x2591__>0 then__0x2599__=trueendif __0x0058__.__0x2592__>0 then__0x2599__=trueendif __0x0058__.__0x2593__>0 then__0x2598__=__0x2598__+99__0x2600__=99endif __0x0058__.__0x2590__>30 thenlocal __0x2601__=0.7local __0x2602__=__0x0058__.__0x2589__/__0x0058__.__0x2590__/__0x2601__*100__0x2598__=__0x2598__+__0x2602__if __0x2602__>=100 then__0x2599__=trueendendif __0x0058__.__0x2594__>0 then__0x2598__=math.max(__0x2598__,50)local __0x2603__=10__0x2598__=__0x2598__+__0x0058__.__0x2594__*__0x2603__endif __0x2599__ then__0x2598__=100else__0x2598__=math.min(__0x2598__,__0x2600__)endreturn math.floor(__0x2598__)endlocal function __0x2604__(__0x0050__)if __0x0050__.__0x2605__>=99 thenif __0x1963__(1,100)0 then__0x0049__.__0x0050__[__0x0285__].__0x2605__=__0x2625____0x0049__.__0x0050__[__0x0285__].__0x2609__=__0x0293__[__0x0285__]table.insert(__0x2624__,__0x0049__.__0x0050__[__0x0285__])__0x2604__(__0x0049__.__0x0050__[__0x0285__])endendif #__0x2624__>0 thenfor _,__0x0050__ in ipairs(__0x2624__) do__0x2613__(__0x0050__)__0x2607__(__0x0050__)endelse__0x2595__((string.char(229,189,147,229,137,141,230,151,182,233,151,180,32,37,115)):format(os.date(string.char(37,89,45,37,109,45,37,100,32,37,72,58,37,77,58,37,83))))end__0x0912__:__0x0104__()returnend__0x0911__=__0x0911__-1if __0x0911__0 thenreturnendif __0x0077__:__0x2627__('Aneu')>0 thenreturnendif __0x0077__:__0x2627__('A405')>0 thenreturnendif __0x0077__:__0x2627__('A408')>0 thenreturnendlocal __0x2628__=nilfor __0x0249__=0,3 dofor __0x0250__=0,2 dolocal __0x2629__,__0x0068__=__0x0046__.button(__0x0249__,__0x0250__)if __0x0068__ then__0x2628__=trueendendendif __0x2628__ then__0x0075__.__0x2594__=__0x0075__.__0x2594__+1endendendend)__0x0049__.__0x0028__:__0x0066__ (string.char(230,184,184,230,136,143,45,233,128,137,230,139,169,230,168,161,229,188,143,231,187,147,230,157,159)) (function(__0x0067__,__0x0050__,__0x0296__)__0x0067__:__0x0104__()local __0x2630__={[(string.char(105,109))]=true,[(string.char(97,112))]=true,[(string.char(99,109))]=true,[(string.char(99,100))]=true,[(string.char(114,100))]=true,[(string.char(111,103))]=true,[(string.char(109,103))]=true,}local __0x0644__=falsefor _,__0x1039__ in pairs(__0x0296__) doif __0x2630__[__0x1039__] then__0x0644__=trueendendif __0x0644__ then__0x0049__.__0x0065__.__0x2589__=__0x0049__.__0x0028__:__0x0066__ (string.char(231,142,169,229,174,182,45,232,129,138,229,164,169)) (function(self,__0x0050__,__0x0220__)if not __0x0050__:__0x1654__() thenreturnendif __0x0220__==(string.char(45,77,65,32)) then__0x2595__('开启MA')__0x2615__()endend)__0x0049__.__0x0112__(7*1000,function ()local __0x0054__=__0x1963__(0x927C0,0x124F80)local __0x0070__=__0x1963__(0x1D4C0,0x124F80)__0x0049__.__0x0112__(__0x0054__,function ()if __0x0049__.__0x0050__:__0x2631__()