破解emby-server-软件逆向-看雪-安全社区|安全招聘|kanxue.com

破解emby-server

2020-11-17 17:05 42443

破解emby-server

Explorerl

2020-11-17 17:05

42443

现在很多服务的正常运行都依赖某个中心服务器，如果服务器升级或出现故障或者公司跑路，付费用户将无法继续正常使用。emby也是如此，程序要访问mb3admin.com确认你是付费用户才能使用更多的功能，不管你的个人网络还是他们服务器出问题，都将不能使用付费功能。

网络上有一些解决方案，但大都需要搭建一个nginx伪装站点，生成ssl证书，emby服务器上添加证书并且修改hosts文件，客户端也需要修改hosts或者重定向mb3admin.com到伪站……我认为这样破解太过复杂了，用别人的伪站又担心不稳定。

所以，就有了今天的尝试，修改emby程序，让其在不设置伪站的情况下也能使用最基本的是付费功能。

破解过程

需要用到下面两个工具：

emby-server在Linux系统中安装于/opt/emby-server/，把此文件夹复制到hack-emby目录，并在此目录执行下面的脚本，美化javascript代码，以方便阅读。

#!/bin/bash
 
for f in $(find emby-server/ -name "*.js")
do
    echo "$f"
    js-beautify "$f" > tmp
    mv tmp "$f"
done

在浏览器打开emby，在Emby Premiere页面随便输入一个key按保存后提示Emby Premiere key is missing or invalid.

图片描述

搜索定义并调用这个字符串的位置，发现仅在system/dashboard-ui/embypremiere/embypremiere.html中有调用这个字符串，同目录有个embypremiere.js，根据MediaBrowser.Model.dll中的某些函数返回值，执行相关的判断。修改MediaBrowser.Model.dll中的get_IsMBSupporter和get_SupporterKey的返回值后不再提示这个错误，不过也不像付费用户一样显示。

图片描述

还需要修改emby-server/system/dashboard-ui/embypremiere/embypremiere.js中的load(page)函数，去除访问mb3admin.com相关的代码，并且硬编码返回给付费用户的json数据才能正常显示。

function load(page) {
    var apiClient;
    loading.show(), (apiClient = ApiClient).getJSON(apiClient.getUrl("Plugins/SecurityInfo")).then(function(info) {
        var key, postData;
        page.querySelector("#txtSupporterKey").value = info.SupporterKey || "", page.querySelector("#txtSupporterKey").classList.remove("invalidEntry"), page.querySelector(".notSupporter").classList.add("hide")
                var statusInfo = {"deviceStatus":"0","planType":"Lifetime","subscriptions":{}};
                var statusLine, indicator = page.querySelector("#status-indicator .listItemIcon"),
                    extendedPlans = page.querySelector("#extended-plans");
                switch (extendedPlans.innerHTML = globalize.translate("MessagePremiereExtendedPlans", '<a is="emby-linkbutton" class="button-link" href="https://emby.media/premiere-ext.html" target="_blank">', "</a>"), statusInfo.deviceStatus) {
                    default:
                        statusLine = globalize.translate("MessagePremiereStatusGood", statusInfo.planType), indicator.classList.remove("expiredBackground"), indicator.classList.remove("nearExpiredBackground"), indicator.innerHTML = "&#xE5CA;", extendedPlans.classList.add("hide")
                }
                page.querySelector("#premiere-status").innerHTML = statusLine;
                var sub, subsElement = page.querySelector("#premiere-subs");
                statusInfo.subscriptions && 0 < statusInfo.subscriptions.length ? (page.querySelector("#premiere-subs-content").innerHTML = (subs = statusInfo.subscriptions, key = info.SupporterKey, subs.map(function(item) {
                    var itemHtml = "",
                        makeLink = item.autoRenew && "Stripe" === item.store,
                        tagName = makeLink ? "button" : "div";
                    return itemHtml += ("button" == tagName ? '<button type="button"' : "<div") + ' class="listItem listItem-button listItem-noborder' + (makeLink ? " lnkSubscription" : "") + '" data-feature="' + item.feature + '" data-key="' + key + '">', itemHtml += '<i class="listItemIcon md-icon">dvr</i>', itemHtml += '<div class="listItemBody two-line">', itemHtml += '<div class="listItemBodyText">', itemHtml += globalize.translate("ListItemPremiereSub", item.planType, item.expDate, item.store), itemHtml += "</div>", itemHtml += '<div class="listItemBodyText listItemBodyText-secondary">', itemHtml += globalize.translate("Stripe" === item.store ? item.autoRenew ? "LabelClickToCancel" : "LabelAlreadyCancelled" : "LabelCancelInfo", item.store), itemHtml += "</div>", itemHtml += "</div>", itemHtml += "</" + tagName + ">"
                })), (sub = page.querySelector(".lnkSubscription")) && sub.addEventListener("click", cancelSub), subsElement.classList.remove("hide")) : subsElement.classList.add("hide"), page.querySelector(".isSupporter").classList.remove("hide")
            //var subs, key
    }), loading.hide()
}

图片描述

这里并不是最重要的，也许恰恰是最不重要的，因为我修改相关的代码后，Dashboard页面并没有显示徽章，不能使用付费主题，不能看live tv,右上角的升级会员按钮没有消失。这个程序以前是开源的，后来闭源后越来越不好破解了！(不过javascript和C#跟开源没啥区别)

显示徽章

Dashboard中徽章位于emby-server/system/dashboard-ui/css/images/supporter/supporterbadge.png，脚本system/dashboard-ui/dashboard/dashboard.js中的renderSupporterIcon函数使用了这个图标，调用这个函数的代码段为：

function() {
    var apiClient = window.ApiClient;
    return apiClient ? connectionManager.getRegistrationInfo("themes", apiClient, {
        viewOnly: !0
    }).then(function(result) {
        return {
            IsMBSupporter: !0
        }
    }, function() {
        return {
            IsMBSupporter: !1
        }
    }) : Promise.reject()
}().then(function(pluginSecurityInfo) {
    DashboardPage.renderSupporterIcon(page, pluginSecurityInfo);
    var html, supporterPromotionElem = page.querySelector(".supporterPromotion"),
        isSupporter = pluginSecurityInfo.IsMBSupporter;

只要把IsMBSupporter: !1改为IsMBSupporter: !0就可以显示徽章了。修改emby-server/system/dashboard-ui/bower_components/emby-apiclient/connectionmanager.js的getRegistrationInfo应该会更好，因为多处代码都调用了这个函数！

key: "getRegistrationInfo",
value: function(feature, apiClient, options) {
    var params = {  
        serverId: apiClient.serverId(),
        deviceId: this.deviceId(),
        deviceName: this.deviceName(),
        appName: this.appName(),
        appVersion: this.appVersion(),
        embyUserName: ""
    };
    (options = options || {}).viewOnly && (params.viewOnly = options.viewOnly);
    var cacheKey = getCacheKey(feature, apiClient, options),
        regInfo = JSON.parse(this.appStorage.getItem(cacheKey) || "{}"),
        timeSinceLastValidation = Date.now() - (regInfo.lastValidDate || 0);  
    if (timeSinceLastValidation <= 864e5) return console.log("getRegistrationInfo returning cached info"), Promise.resolve();
    var regCacheValid = timeSinceLastValidation <= 864e5 * (regInfo.cacheExpirationDays || 7);  
    params.embyUserName = apiClient.getCurrentUserName();
    var currentUserId = apiClient.getCurrentUserId();
    if (currentUserId && "81f53802ea0247ad80618f55d9b4ec3c" === currentUserId.toLowerCase() && "21585256623b4beeb26d5d3b09dec0ac" === params.serverId.toLowerCase()) return Promise.reject();
    var appStorage = this.appStorage,
        getRegPromise = ajax({
            url: "https://mb3admin.com/admin/service/registration/validateDevice?" + paramsToString(params),
            type: "POST",
            dataType: "json"
        }).then(function(response) {
            return appStorage.setItem(cacheKey, JSON.stringify({
                lastValidDate: Date.now(),
                deviceId: params.deviceId,
                cacheExpirationDays: response.cacheExpirationDays
            })), Promise.resolve()
        }, function(response) {
            var status = (response || {}).status;
            return console.log("getRegistrationInfo response: " + status), 403 === status ? Promise.reject("overlimit") : status && status < 500 ? Promise.reject() : function(err) {
                if (console.log("getRegistrationInfo failed: " + err), regCacheValid) return console.log("getRegistrationInfo returning cached info"), Promise.resolve();
                throw err   
            }(response)
        });
    return regCacheValid ? (console.log("getRegistrationInfo returning cached info"), Promise.resolve()) : getRegPromise
}

把if (timeSinceLastValidation <= 864e5) return console.log("getRegistrationInfo returning cached info"), Promise.resolve();中的timeSinceLastValidation <= 864e5替换为true，确保始终返回本地缓存中的数据，而不再需要找服务器验证。

不过程序可能为了防止这个js文件被修改，在emby-server/system/dashboard-ui/app.js中有这么一段代码：

1	`define("connectionManagerFactory", [], getDynamicImport("./bower_components/emby-apiclient/connectionmanager.js"))`

运行时从emby-server/system/Emby.Web.dll中动态导入这个js文件，而不是使用emby-server/system/dashboard-ui/bower_components/emby-apiclient/connectionmanager.js，使用dnSpy的Hex Editor修改这几个字节就可以了。

破解会员功能

上面两个并没那么重要，上传、下载、电视直播和dvr这类功能才是更加实用的，这些都跟validateFeature有关系。

同样，这个函数不仅存在于system/dashboard-ui/modules/registrationservices/registrationservices.js，在Emby.Web.dll中也有备份，我们要修改后者才能生效。

{
       validateFeature: function(feature, options) {
           return options = options || {}, console.log("validateFeature: " + feature), iapManager.isUnlockedByDefault(feature, options).then(function() {
               return showPeriodicMessageIfNeeded(feature)
           }, function() {
               var unlockableFeatureCacheKey = "featurepurchased-" + feature;
               if ("1" === appSettings.get(unlockableFeatureCacheKey)) return showPeriodicMessageIfNeeded(feature);
               var unlockableProduct = iapManager.getProductInfo(feature);
               if (unlockableProduct) {
                   var unlockableCacheKey = "productpurchased-" + unlockableProduct.id;
                   if (unlockableProduct.owned) return appSettings.set(unlockableFeatureCacheKey, "1"), appSettings.set(unlockableCacheKey, "1"), showPeriodicMessageIfNeeded(feature);
                   if ("1" === appSettings.get(unlockableCacheKey)) return showPeriodicMessageIfNeeded(feature)
               }
               var unlockableProductInfo = unlockableProduct ? { 
                   enableAppUnlock: !0, 
                   id: unlockableProduct.id,
                   price: unlockableProduct.price,
                   feature: feature
               } : null;
               return iapManager.getSubscriptionOptions().then(function(subscriptionOptions) {
                   if (0 < subscriptionOptions.filter(function(p) {
                           return p.owned
                       }).length) return Promise.resolve();
                   var registrationOptions = { 
                       viewOnly: options.viewOnly
                   };
                   return connectionManager.getRegistrationInfo(iapManager.getAdminFeatureName(feature), connectionManager.currentApiClient(), registrationOptions).catch(function(errorResult) {
                       return !1 === options.showDialog ? Promise.reject() : ("overlimit" === errorResult && (alertPromise = alertText("Your Emby Premiere device limit has been exceeded. Please check with the owner of your Emby Server and have them contact Emby support at support@emby.media if necessary.").catch(function() {
                           return Promise.resolve()
                       })), (alertPromise = alertPromise || Promise.resolve()).then(function() {
                           var dialogOptions = { 
                               title: globalize.translate("HeaderUnlockFeature"),
                               feature: feature
                           };
                           return currentValidatingFeature = feature, showInAppPurchaseInfo(subscriptionOptions, unlockableProductInfo, dialogOptions)
                       }));
                       var alertPromise
                   })
               })
           })
       },
       showPremiereInfo: showPremiereInfo
   }

修改这个函数的返回值，并保存。替换掉系统中相关的文件，刷新浏览器缓存，就可以使用会员的大部分功能了。

图片描述

上图是破解前，即使正版程序，在局域网无法访问mb3admin.com时，可能也无法使用付费功能。下图为破解后，emby-server不再访问mb3admin.com而是直接返回缓存中/硬编码在dll和js中的数据。

图片描述

开发不易，不再公开提供破解版本。仅供学习交流

参考链接

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课

最后于 2020-11-30 22:00 被Explorerl编辑，原因：完善破解过程

收藏・9

点赞・0

打赏

最新回复 (4)
mb_uiordqig 雪币：能力值： ( LV1，RANK：0 ) 在线值：发帖 0 回帖 1 粉丝 0 关注私信	mb_uiordqig 2021-4-11 19:49 2 楼 0 不行了，最后那个步骤没说是改成什么，而且改了也不行，实测还有一个dll文件需要修改才能硬解和转换下载。
KeNuo 雪币： 429 活跃值： (423) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 3 粉丝 0 关注私信	KeNuo 2021-9-15 23:04 3 楼 0 新版好像是做了eazfuscator的混淆
张云逸雪币： 0 活跃值： (26) 能力值： ( LV2，RANK：10 ) 在线值：发帖 0 回帖 1 粉丝 0 关注私信	张云逸 2021-10-11 17:22 4 楼 0 根据大佬的思路，成功破解
stevenlong 雪币： 86 活跃值： (222) 能力值： ( LV4，RANK：50 ) 在线值：发帖 4 回帖 32 粉丝 0 关注私信	stevenlong 2021-10-12 11:24 5 楼 0 记得咸鱼上有人挂VPN协议破解
	游客登录 \| 注册方可回帖　回帖　表情雪币赚取及消费高级回复