Files
geedge-jira/attachment/59885/extract_qq_id.lua

75 lines
2.4 KiB
Lua
Raw Normal View History

2025-09-14 22:00:20 +00:00
---------------------------------------------------------------------------------------------
-- Script functionality: Search for QQ numbers with specific characteristics in the data. --
-- Input --
-- APP.data --
-- Features --
-- 02 | 3c 43 | 00 62 | 71 7f | 25 3b 63 d9 | 02 00 00 00 01 01 01 00 00 --
-- flag | version | command | sequence | qq number | Data --
---------------------------------------------------------------------------------------------
local data = APP.data
local data_len = string.len(data)
local max_qq_number_len = 12
-- Determine the length of the input data
if data_len < 11 then
return ""
end
-- 0: OPENING, 2: CLOSE, 3: DATA
if(APP.get_session_state() ~= 3) then
return ""
end
-- 1: client to server, 2: server to client
if(APP.get_session_direction() ~= 2) then
return ""
end
-- The first byte (Flag) is 0x02
if (string.byte(data, 1) ~= 2) then
return ""
end
-- The 4th and 5th bytes identify the Command
-- 00 98: Request login
-- It can be optimized in the following way:
-- if string.byte(data, 4)==0 string.byte(data, 5)=="98 1 101 103 109 13 153 166 170 181 184 1852 202 209 212 216 23 2362939 60 62 92 1"
if ((string.byte(data, 4) ~= 0)) then
return ""
end
-- data:\x02\x00\x00\00
local pos = string.find(data, "\x02\x00\x00\00")
if not pos then
return ""
end
-- Obtain the string of the QQ number
local qq_number_str = string.sub(data, 8, pos - 1)
if not qq_number_str then
return ""
end
local qq_number_hex= ""
for i = 1, #qq_number_str do
qq_number_hex = qq_number_hex .. string.format("%02X", qq_number_str:byte(i))
end
-- Obtain the QQ number
local qq_number=tonumber(qq_number_hex, 16)
if not qq_number then
return ""
end
-- Obtain the length of the QQ number
local qq_number_length = math.floor(math.log10(qq_number) + 1)
if qq_number_length > max_qq_number_len then
return ""
end
APP.log_debug("state", APP.get_session_state(), "session", APP.get_session_direction(), "command", string.byte(data, 4), string.byte(data, 5), "qqnumber:", qq_number)
APP.append_extra_info("qqnumber:", qq_number)
return qq_number_length, tostring(qq_number)