google pagerank checksum算法

作者： david

本文地址： http://blog.iyi.cn/user/david/archives/2005/01/210.html

原来网上早就有了checksum的相关破解，下面试checksum的汇编代码和vb版的破解。

目前我所用的就是vb版的checksum代码。

checksum的汇编代码：

> GOOGLECHECK proc near
>
> var_8 = dword ptr -8
> var_4 = dword ptr -4
> url_offset = dword ptr 8
> url_length = dword ptr 0Ch
> magic_dword = dword ptr 10h
>
> push ebp
> mov ebp, esp
> push ecx
> push ecx
> mov eax, [ebp+url_length]
> cmp eax, 0Ch
> push ebx
> push esi
> mov esi, [ebp+magic_dword] ; = 0xE6359A60
> push edi
> mov edi, 9E3779B9h ; derived from the golden number, hi TEA ;)
> mov ebx, edi
> mov [ebp+var_4], eax
> jb jump_1
> push 0Ch
> pop ecx
> xor edx, edx
> div ecx
> mov ecx, [ebp+url_offset]
> mov [ebp+var_8], eax
>
> loop_1:
> movzx eax, byte ptr [ecx+7]
> movzx edx, byte ptr [ecx+6]
> shl eax, 8
> add eax, edx
> movzx edx, byte ptr [ecx+5]
> shl eax, 8
> add eax, edx
> movzx edx, byte ptr [ecx+4]
> add edx, edi
> shl eax, 8
> lea edi, [edx+eax]
> movzx eax, byte ptr [ecx+0Bh]
> movzx edx, byte ptr [ecx+0Ah]
> shl eax, 8
> add eax, edx
> movzx edx, byte ptr [ecx+9]
> shl eax, 8
> add eax, edx
> movzx edx, byte ptr [ecx+8]
> add edx, esi
> shl eax, 8
> lea esi, [edx+eax]
> movzx edx, byte ptr [ecx+3]
> movzx eax, byte ptr [ecx+2]
> shl edx, 8
> add edx, eax
> movzx eax, byte ptr [ecx+1]
> shl edx, 8
> add edx, eax
> movzx eax, byte ptr [ecx]
> shl edx, 8
> add edx, eax
> sub edx, edi
> sub edx, esi
> mov eax, esi
> shr eax, 0Dh
> add edx, ebx
> xor edx, eax
> sub edi, edx
> sub edi, esi
> mov eax, edx
> shl eax, 8
> xor edi, eax
> sub esi, edi
> sub esi, edx
> mov eax, edi
> shr eax, 0Dh
> xor esi, eax
> sub edx, edi
> sub edx, esi
> mov eax, esi
> shr eax, 0Ch
> xor edx, eax
> sub edi, edx
> sub edi, esi
> mov eax, edx
> shl eax, 10h
> xor edi, eax
> sub esi, edi
> sub [ebp+var_4], 0Ch
> sub esi, edx
> mov eax, edi
> shr eax, 5
> xor esi, eax
> sub edx, edi
> mov eax, esi
> shr eax, 3
> sub edx, esi
> xor edx, eax
> mov ebx, edx
> sub edi, ebx
> sub edi, esi
> mov eax, ebx
> shl eax, 0Ah
> xor edi, eax
> sub esi, edi
> mov eax, edi
> sub esi, ebx
> shr eax, 0Fh
> xor esi, eax
> add ecx, 0Ch
> dec [ebp+var_8]
> jnz loop_1
> jmp short jump_2
>
> jump_1:
> mov ecx, [ebp+url_offset]
>
> jump_2:
> add esi, [ebp+url_length]
> mov eax, [ebp+var_4]
> dec eax
> cmp eax, 0Ah ; switch 11 cases
> ja defaultswitch ; default
> jmp ds:off_100307EA[eax*4] ; switch jump
>
> switch_10:
> movzx eax, byte ptr [ecx+0Ah] ; case 0xA
> shl eax, 18h
> add esi, eax
>
> switch_9:
> movzx eax, byte ptr [ecx+9] ; case 0x9
> shl eax, 10h
> add esi, eax
>
> switch_8:
> movzx eax, byte ptr [ecx+8] ; case 0x8
> shl eax, 8
> add esi, eax
>
> switch_7:
> movzx eax, byte ptr [ecx+7] ; case 0x7
> movzx edx, byte ptr [ecx+6]
> shl eax, 8
> add eax, edx
> movzx edx, byte ptr [ecx+5]
> shl eax, 8
> add eax, edx
> movzx edx, byte ptr [ecx+4]
> shl eax, 8
> add edx, edi
> lea edi, [edx+eax]
> jmp short switch_3 ; case 0x3
>
> switch_6:
> movzx eax, byte ptr [ecx+6] ; case 0x6
> shl eax, 10h
> add edi, eax
>
> switch_5:
> movzx eax, byte ptr [ecx+5] ; case 0x5
> shl eax, 8
> add edi, eax
>
> switch_4:
> movzx eax, byte ptr [ecx+4] ; case 0x4
> add edi, eax
>
> switch_3:
> movzx eax, byte ptr [ecx+3] ; case 0x3
> movzx edx, byte ptr [ecx+2]
> shl eax, 8
> add eax, edx
> movzx edx, byte ptr [ecx+1]
> movzx ecx, byte ptr [ecx]
> shl eax, 8
> add eax, edx
> shl eax, 8
> add ecx, ebx
> lea ebx, [ecx+eax]
> jmp short defaultswitch ; default
>
> switch_2:
> movzx eax, byte ptr [ecx+2] ; case 0x2
> shl eax, 10h
> add ebx, eax
>
> switch_1:
> movzx eax, byte ptr [ecx+1] ; case 0x1
> shl eax, 8
> add ebx, eax
>
> switch_0:
> movzx eax, byte ptr [ecx] ; case 0x0
> add ebx, eax
>
> defaultswitch:
> sub ebx, edi ; default
> sub ebx, esi
> mov eax, esi
> shr eax, 0Dh
> xor ebx, eax
> sub edi, ebx
> sub edi, esi
> mov eax, ebx
> shl eax, 8
> xor edi, eax
> sub esi, edi
> sub esi, ebx
> mov eax, edi
> shr eax, 0Dh
> xor esi, eax
> sub ebx, edi
> sub ebx, esi
> mov eax, esi
> shr eax, 0Ch
> xor ebx, eax
> sub edi, ebx
> sub edi, esi
> mov eax, ebx
> shl eax, 10h
> xor edi, eax
> sub esi, edi
> mov eax, edi
> sub esi, ebx
> shr eax, 5
> xor esi, eax
> sub ebx, edi
> mov eax, esi
> mov ecx, eax
> sub ebx, eax
> shr ecx, 3
> xor ebx, ecx
> sub edi, ebx
> sub edi, eax
> mov ecx, ebx
> shl ecx, 0Ah
> xor edi, ecx
> sub eax, edi
> sub eax, ebx
> shr edi, 0Fh
> xor eax, edi
> pop edi
> pop esi
> pop ebx
> leave
> retn
> GOOGLECHECK endp
>
> ; Switch table
> off_100307EA
> dd offset switch_0
> dd offset switch_1
> dd offset switch_2
> dd offset switch_3
> dd offset switch_4
> dd offset switch_5
> dd offset switch_6
> dd offset switch_7
> dd offset switch_8
> dd offset switch_9
> dd offset switch_10

checksum的vb代码：

> '=========================================================
> ' functions for the checksum:
> '
> ' Function sl(ByVal x, ByVal n)
> ' Function sr(ByVal x, ByVal n)
> ' Function zeroFill(ByVal a, ByVal b)
> ' Private Function uadd(ByVal L1, ByVal L2)
> ' Private Function usub(ByVal L1, ByVal L2)
> ' Function mix(ByVal ia, ByVal ib, ByVal ic)
> ' Function gc(ByVal s, ByVal i)
> ' function GoogleCH(ByVal sURL)
> ' Function CalculateChecksum(sURL)
> '=========================================================
> Function sl(ByVal x, ByVal n)
> If n = 0 Then
> sl = x
> Else
> Dim k
> k = CLng(2 ^ (32 - n - 1))
> Dim d
> d = x And (k - 1)
> Dim c
> c = d * CLng(2 ^ n)
> If x And k Then
> c = c Or &H80000000
> End If
> sl = c
> End If
> End Function > > Function sr(ByVal x, ByVal n)
> If n = 0 Then
> sr = x
> Else
> Dim y
> y = x And &H7FFFFFFF
> Dim z
> If n = 32 - 1 Then
> z = 0
> Else
> z = y \ CLng(2 ^ n)
> End If
> If y <> x Then
> z = z Or CLng(2 ^ (32 - n - 1))
> End If
> sr = z
> End If
> End Function > > Function zeroFill(ByVal a, ByVal b)
> Dim x
> if (&H80000000 AND a) then
> x = sr(a,1)
> x = x AND (NOT &H80000000)
> x = x OR &H40000000
> x = sr(x,b-1)
> else
> x = sr(a,b)
> end if
> zeroFill = x
> End Function > > Private Function uadd(ByVal L1, ByVal L2)
> Dim L11, L12, L21, L22, L31, L32
> L11 = L1 And &HFFFFFF
> L12 = (L1 And &H7F000000) \ &H1000000
> If L1 < 0 Then L12 = L12 Or &H80
> L21 = L2 And &HFFFFFF
> L22 = (L2 And &H7F000000) \ &H1000000
> If L2 < 0 Then L22 = L22 Or &H80
> L32 = L12 + L22
> L31 = L11 + L21
> If (L31 And &H1000000) Then L32 = L32 + 1
> uadd = (L31 And &HFFFFFF) + (L32 And &H7F) * &H1000000
> If L32 And &H80 Then uadd = uadd Or &H80000000
> End Function > > Private Function usub(ByVal L1, ByVal L2)
> Dim L11, L12, L21, L22, L31, L32
> L11 = L1 And &HFFFFFF
> L12 = (L1 And &H7F000000) \ &H1000000
> If L1 < 0 Then L12 = L12 Or &H80
> L21 = L2 And &HFFFFFF
> L22 = (L2 And &H7F000000) \ &H1000000
> If L2 < 0 Then L22 = L22 Or &H80
> L32 = L12 - L22
> L31 = L11 - L21
> If L31 < 0 Then
> L32 = L32 - 1
> L31 = L31 + &H1000000
> End If
> usub = L31 + (L32 And &H7F) * &H1000000
> If L32 And &H80 Then usub = usub Or &H80000000
> End Function
>
> Function mix(ByVal ia, ByVal ib, ByVal ic)
> Dim a, b, c
> a = ia
> b = ib
> c = ic
>
> a = usub(a,b)
> a = usub(a,c)
> a = a XOR zeroFill(c,13)
>
> b = usub(b,c)
> b = usub(b,a)
> b = b XOR sl(a,8)
>
> c = usub(c,a)
> c = usub(c,b)
> c = c XOR zeroFill(b,13)
>
> a = usub(a,b)
> a = usub(a,c)
> a = a XOR zeroFill(c,12)
>
> b = usub(b,c)
> b = usub(b,a)
> b = b XOR sl(a,16)
>
> c = usub(c,a)
> c = usub(c,b)
> c = c XOR zeroFill(b,5)
>
> a = usub(a,b)
> a = usub(a,c)
> a = a XOR zeroFill(c,3)
>
> b = usub(b,c)
> b = usub(b,a)
> b = b XOR sl(a,10)
>
> c = usub(c,a)
> c = usub(c,b)
> c = c XOR zeroFill(b,15)
>
> Dim ret(3)
>
> ret(0) = a
> ret(1) = b
> ret(2) = c
>
> mix = ret
> End Function > > Function gc(ByVal s, ByVal i)
> gc = Asc(Mid(s,i+1,1))
> End Function > > function GoogleCH(ByVal sURL)
> Dim iLength, a, b, c, k, iLen, m
> iLength = Len(sURL) > > a = &H9E3779B9
> b = &H9E3779B9
> c = GOOGLE_MAGIC
> k = 0
>
> iLen = iLength
> do while iLen >= 12
> a = uadd(a,(uadd(gc(sURL,k+0),uadd(sl(gc(sURL,k+1),8),uadd(sl(gc(sURL,k+2),16),sl(gc(sURL,k+3),24))))))
> b = uadd(b,(uadd(gc(sURL,k+4),uadd(sl(gc(sURL,k+5),8),uadd(sl(gc(sURL,k+6),16),sl(gc(sURL,k+7),24))))))
> c = uadd(c,(uadd(gc(sURL,k+8),uadd(sl(gc(sURL,k+9),8),uadd(sl(gc(sURL,k+10),16),sl(gc(sURL,k+11),24)))))) > > m = mix(a,b,c)
>
> a = m(0)
> b = m(1)
> c = m(2)
>
> k = k + 12 > > iLen = iLen - 12
> loop > > c = uadd(c,iLength) > > select case iLen ' all the case statements fall through
> case 11
> c = uadd(c,sl(gc(sURL,k+10),24))
> c = uadd(c,sl(gc(sURL,k+9),16))
> c = uadd(c,sl(gc(sURL,k+8),8))
> b = uadd(b,sl(gc(sURL,k+7),24))
> b = uadd(b,sl(gc(sURL,k+6),16))
> b = uadd(b,sl(gc(sURL,k+5),8))
> b = uadd(b,gc(sURL,k+4))
> a = uadd(a,sl(gc(sURL,k+3),24))
> a = uadd(a,sl(gc(sURL,k+2),16))
> a = uadd(a,sl(gc(sURL,k+1),8))
> a = uadd(a,gc(sURL,k+0))
> case 10
> c = uadd(c,sl(gc(sURL,k+9),16))
> c = uadd(c,sl(gc(sURL,k+8),8))
> b = uadd(b,sl(gc(sURL,k+7),24))
> b = uadd(b,sl(gc(sURL,k+6),16))
> b = uadd(b,sl(gc(sURL,k+5),8))
> b = uadd(b,gc(sURL,k+4))
> a = uadd(a,sl(gc(sURL,k+3),24))
> a = uadd(a,sl(gc(sURL,k+2),16))
> a = uadd(a,sl(gc(sURL,k+1),8))
> a = uadd(a,gc(sURL,k+0))
> case 9
> c = uadd(c,sl(gc(sURL,k+8),8))
> b = uadd(b,sl(gc(sURL,k+7),24))
> b = uadd(b,sl(gc(sURL,k+6),16))
> b = uadd(b,sl(gc(sURL,k+5),8))
> b = uadd(b,gc(sURL,k+4))
> a = uadd(a,sl(gc(sURL,k+3),24))
> a = uadd(a,sl(gc(sURL,k+2),16))
> a = uadd(a,sl(gc(sURL,k+1),8))
> a = uadd(a,gc(sURL,k+0))
> case 8
> b = uadd(b,sl(gc(sURL,k+7),24))
> b = uadd(b,sl(gc(sURL,k+6),16))
> b = uadd(b,sl(gc(sURL,k+5),8))
> b = uadd(b,gc(sURL,k+4))
> a = uadd(a,sl(gc(sURL,k+3),24))
> a = uadd(a,sl(gc(sURL,k+2),16))
> a = uadd(a,sl(gc(sURL,k+1),8))
> a = uadd(a,gc(sURL,k+0))
> case 7
> b = uadd(b,sl(gc(sURL,k+6),16))
> b = uadd(b,sl(gc(sURL,k+5),8))
> b = uadd(b,gc(sURL,k+4))
> a = uadd(a,sl(gc(sURL,k+3),24))
> a = uadd(a,sl(gc(sURL,k+2),16))
> a = uadd(a,sl(gc(sURL,k+1),8))
> a = uadd(a,gc(sURL,k+0))
> case 6
> b = uadd(b,sl(gc(sURL,k+5),8))
> b = uadd(b,gc(sURL,k+4))
> a = uadd(a,sl(gc(sURL,k+3),24))
> a = uadd(a,sl(gc(sURL,k+2),16))
> a = uadd(a,sl(gc(sURL,k+1),8))
> a = uadd(a,gc(sURL,k+0))
> case 5
> b = uadd(b,gc(sURL,k+4))
> a = uadd(a,sl(gc(sURL,k+3),24))
> a = uadd(a,sl(gc(sURL,k+2),16))
> a = uadd(a,sl(gc(sURL,k+1),8))
> a = uadd(a,gc(sURL,k+0))
> case 4
> a = uadd(a,sl(gc(sURL,k+3),24))
> a = uadd(a,sl(gc(sURL,k+2),16))
> a = uadd(a,sl(gc(sURL,k+1),8))
> a = uadd(a,gc(sURL,k+0))
> case 3
> a = uadd(a,sl(gc(sURL,k+2),16))
> a = uadd(a,sl(gc(sURL,k+1),8))
> a = uadd(a,gc(sURL,k+0))
> case 2
> a = uadd(a,sl(gc(sURL,k+1),8))
> a = uadd(a,gc(sURL,k+0))
> case 1
> a = uadd(a,gc(sURL,k+0))
> End Select
>
> m = mix(a,b,c)
>
> GoogleCH = m(2)
> End Function > > Function CalculateChecksum(sURL)
> CalculateChecksum = "6" & CStr(GoogleCH("info:" & sURL) AND &H7FFFFFFF)
> End Function
>

获取google pagerank值的研究

IYI web stat. system(iyi网站统计系统) 我实现出来的显示pagerank的网站统计小插件