• 高校教务系统密码加密逻辑及JS逆向——山东女子学院，蚌埠医学院，郑州工商学院，新疆大学，河南机电职业学院

    高校教务系统密码加密逻辑及JS逆向

    本文将介绍高校教务系统的密码加密逻辑以及使用JavaScript进行逆向分析的过程。通过本文，你将了解到密码加密的基本概念、常用加密算法以及如何通过逆向分析来破解密码。

    本文仅供交流学习，勿用于非法用途。

    一、密码加密基本概念

    密码加密是一种保护信息安全的技术手段，它通过将明文（原始信息）转换为密文（加密后的信息），以防止未经授权的访问和篡改。常见的密码加密算法有MD5、SHA-1、SHA-256等。

    1.1 加密过程

    加密过程通常包括以下步骤：

    1. 密钥扩展：将密钥扩展为多个轮值，每个轮值都与明文的一部分有关。
    2. 初始轮值生成：将扩展后的密钥与轮常数进行某种运算，生成第一轮加密的密文。
    3. 多轮迭代：对密文进行多轮迭代操作，每轮操作都包括非线性函数、模运算和轮常数的变换。
    4. 最终密文：经过多轮迭代后，得到最终的密文。

    1.2 解密过程

    解密过程与加密过程相反，通过反向操作来恢复原始明文。通常需要知道加密时使用的密钥和算法。

    二、高校教务系统密码加密逻辑分析

    2.1 以山东女子学院为例

    我们可以看到这几个学校的教务系统网页是一样的，可能还有其他学校也在用这个，我这里就不一样列举了，如果，你们学校也是用这个，可以参考我下面介绍的案例，如果可以的话，留下你们学校的名字。

    2.2 抓包

    我们首先打开教务系统的登录页面，我们可以看到，有学号和密码，有的高校会有验证码，或者有的高校是错误一次密码，会验证验证码。

    我们打开开发者工具，尝试登录抓包，网页会返回这样的数据接口。

    我们可以看到基本上所有参数都是密文，而且，我们并没有看到用户名和密码的关键词，这里是以表单的形式呈现，所以，接下来，我们就来逆向这个params。

    2.3 分析加密参数

    我们接下来，就是来分析这个密码是怎么加密的。我们全局搜索params。定位到加密的位置。

    1. function getEncParams(params) { 
    2.  var timestamp = _nowtime; 
    3.  var token = md5(md5(params)+md5(timestamp)); 
    4.  var _params = b64_encode(des_encode(params)); 
    5.  _params = "params=" + _params + "&token="+token+"×tamp="+timestamp; 
    6.  return _params; 
    7.  }

    代码简单解释 

    1. 首先，定义了一个变量timestamp，它被设置为当前时间这是为了确保每次调用函数时都有一个独特的时间戳，可以用于检查请求的新鲜度
    2. 然后，定义了一个变量token这个变量是通过将参数（params）和时间戳（timestamp）进行MD5哈希，并将这两个值连接起来后再次进行MD5哈希得到的这样做是为了生成一个唯一的令牌，可以用于验证请求的来源
    3. 之后，定义了一个变量_params，这个变量是通过先对参数进行DES编码，然后再进行Base64编码得到的这样做是为了确保参数的安全性和保密性
    4. 最后，将_params、token和timestamp以查询参数的形式拼接在一起，并返回这个字符串

    接下来，我们就来写这个params和token是怎么加密的。

    三、JS逆向分析方法

    逆向分析是指从已知的加密文本或程序中还原出原始信息的过程。在本例中，我们将使用JavaScript编写一个简单的逆向分析工具，用于逆向高校教务系统的密码。

    环境使用

    • python 3.9
    • pycharm
    • node

    代码实现

    我们首先定位到params，看看，这个是怎么定义的，上面显示的加密params函数。

    1. username = base64encode(username+";;"+_sessionid);
    2. var params = p_username+"="+username+"&"+p_password+"="+password+"&randnumber="+randnumber+"&isPasswordPolicy="+passwordPolicy+             "&txt_mm_expression="+txt_mm_expression+"&txt_mm_length="+txt_mm_length+"&txt_mm_userzh="+txt_mm_userzh+"&hid_flag="+hid_flag+"&hidlag=1";
    3. 	
    4. params = getEncParams(params)+"&deskey="+_deskey+"&ssessionid="+_ssessionid;

     虽然说都是常规加密，这里，我还是带大家扣代码，首先，我们先把params扣出来。

    1.  
    2. var randnumber = ''
    3. var p_username = "_u" + randnumber;
    4. var p_password = "_p" + randnumber;
    5. var _sessionid = _ssessionid;
    6. var username = base64encode('12345' + ";;" + _sessionid);
    7. var password = hex_md5(hex_md5('12345') + hex_md5(randnumber.toLowerCase()));
    8. var passwordPolicy = isPasswordPolicy(username, password);
    9.  
    10. function isPasswordPolicy(username, password) {
    11.     if (password == "" || password == null || username == password) {
    12.         return "0";
    13.     }
    14.     var passwordlen = new String(password).length;
    15.     if (passwordlen < 6) {
    16.         return "0";
    17.     }
    18.     return "1";
    19. }
    20.  
    21. var txt_mm_expression = 8;
    22. var txt_mm_length = 4;
    23. var txt_mm_userzh = 1;
    24. var hid_flag = 1;
    25. var params = p_username + "=" + username + "&" + p_password + "=" + password + "&randnumber=" + randnumber + "&isPasswordPolicy=" + passwordPolicy +
    26.     "&txt_mm_expression=" + txt_mm_expression + "&txt_mm_length=" + txt_mm_length + "&txt_mm_userzh=" + txt_mm_userzh + "&hid_flag=" + hid_flag + "&hidlag=1";
    27. console.log(params)

     这里就把表单生成了，我们可以看到里面有六个参数，其中：

    • 用户名加密，是用户名和sessionid拼接后，base64加密
    var username = base64encode('12345' + ";;" + _sessionid);
    •  密码加密，显然是md5加密
    var password = hex_md5(hex_md5('12345') + hex_md5(randnumber.toLowerCase()));
    • passwordPolicy加密，这里调用了一个函数
    1. var passwordPolicy = isPasswordPolicy(username, password);
    2.  
    3. function isPasswordPolicy(username, password) {
    4.     if (password == "" || password == null || username == password) {
    5.         return "0";
    6.     }
    7.     var passwordlen = new String(password).length;
    8.     if (passwordlen < 6) {
    9.         return "0";
    10.     }
    11.     return "1";
    12. }
    • 其他参数，都是固定值。
    1.     var txt_mm_expression = 8;
    2.     var txt_mm_length = 4;
    3.     var txt_mm_userzh = 1;
    4.     var hid_flag = 1;

    我们拿到params后，传给加密函数之后，就可以得到我们想要的内容，不过，这里要注意token加密的时候还有时间加密。

    1.     var timestamp = _nowtime;
    2.     var token = md5(md5(params) + md5(timestamp));

    所有代码:

    1.  
    2. var hexcase = 0;  /* hex output format. 0 - lowercase; 1 - uppercase        */
    3. var b64pad = ""; /* base-64 pad character. "=" for strict RFC compliance   */
    4. var chrsz = 8;  /* bits per input character. 8 - ASCII; 16 - Unicode      */
    5. var _deskey = '13713169718853137878582';
    6. var _nowtime = '2023-10-13 17:15:31';
    7. var _ssessionid = 'BE85759922B42B2C89CF49C5527C2C35';
    8. var timestamp = _nowtime;
    9.  
    10. function getEncParams(params) {
    11.     var timestamp = _nowtime;
    12.     var token = md5(md5(params) + md5(timestamp));
    13.     var _params = b64_encode(des_encode(params));
    14.     _params = "params=" + _params + "&token=" + token + "×tamp=" + timestamp;
    15.     return _params;
    16. }
    17.  
    18. function b64_encode(data) {
    19.     return base64encode(utf16to8(data));
    20. }
    21.  
    22. function b64_decode(data) {
    23.     return utf8to16(base64decode(data));
    24. }
    25.  
    26. function md5(data) {
    27.     return hex_md5(data);
    28. }
    29.  
    30. function des_encode(data) {
    31.     return strEnc(data, _deskey, null, null);
    32. }
    33.  
    34. function des_decode(data) {
    35.     return strDec(data, _deskey, null, null);
    36. }
    37.  
    38. /**
    39.  function des_encode(data, key){
    40.  if (typeof key == "undefined" || key == null || key.length == 0) { key = _deskey; }
    41.  var result = strEnc(data, key, null, null);
    42.  return result ;
    43.  }
    45.  function des_decode(data, key) {
    46.  if (typeof key == "undefined" || key == null || key.length == 0) { key = _deskey; }
    47.  return strDec(data, key, null, null);
    48.  }
    49.  */
    50.  
    51. /**
    52.  * DES加密
    53.  * encrypt the string to string made up of hex
    54.  * return the encrypted string
    55.  */
    56. function strEnc(data, firstKey, secondKey, thirdKey) {
    57.  
    58.     var leng = data.length;
    59.     var encData = "";
    60.     var firstKeyBt, secondKeyBt, thirdKeyBt, firstLength, secondLength, thirdLength;
    61.     if (firstKey != null && firstKey != "") {
    62.         firstKeyBt = getKeyBytes(firstKey);
    63.         firstLength = firstKeyBt.length;
    64.     }
    65.     if (secondKey != null && secondKey != "") {
    66.         secondKeyBt = getKeyBytes(secondKey);
    67.         secondLength = secondKeyBt.length;
    68.     }
    69.     if (thirdKey != null && thirdKey != "") {
    70.         thirdKeyBt = getKeyBytes(thirdKey);
    71.         thirdLength = thirdKeyBt.length;
    72.     }
    73.  
    74.     if (leng > 0) {
    75.         if (leng < 4) {
    76.             var bt = strToBt(data);
    77.             var encByte;
    78.             if (firstKey != null && firstKey != "" && secondKey != null && secondKey != "" && thirdKey != null && thirdKey != "") {
    79.                 var tempBt;
    80.                 var x, y, z;
    81.                 tempBt = bt;
    82.                 for (x = 0; x < firstLength; x++) {
    83.                     tempBt = enc(tempBt, firstKeyBt[x]);
    84.                 }
    85.                 for (y = 0; y < secondLength; y++) {
    86.                     tempBt = enc(tempBt, secondKeyBt[y]);
    87.                 }
    88.                 for (z = 0; z < thirdLength; z++) {
    89.                     tempBt = enc(tempBt, thirdKeyBt[z]);
    90.                 }
    91.                 encByte = tempBt;
    92.             } else {
    93.                 if (firstKey != null && firstKey != "" && secondKey != null && secondKey != "") {
    94.                     var tempBt;
    95.                     var x, y;
    96.                     tempBt = bt;
    97.                     for (x = 0; x < firstLength; x++) {
    98.                         tempBt = enc(tempBt, firstKeyBt[x]);
    99.                     }
    100.                     for (y = 0; y < secondLength; y++) {
    101.                         tempBt = enc(tempBt, secondKeyBt[y]);
    102.                     }
    103.                     encByte = tempBt;
    104.                 } else {
    105.                     if (firstKey != null && firstKey != "") {
    106.                         var tempBt;
    107.                         var x = 0;
    108.                         tempBt = bt;
    109.                         for (x = 0; x < firstLength; x++) {
    110.                             tempBt = enc(tempBt, firstKeyBt[x]);
    111.                         }
    112.                         encByte = tempBt;
    113.                     }
    114.                 }
    115.             }
    116.             encData = bt64ToHex(encByte);
    117.         } else {
    118.             var iterator = parseInt(leng / 4);
    119.             var remainder = leng % 4;
    120.             var i = 0;
    121.             for (i = 0; i < iterator; i++) {
    122.                 var tempData = data.substring(i * 4 + 0, i * 4 + 4);
    123.                 var tempByte = strToBt(tempData);
    124.                 var encByte;
    125.                 if (firstKey != null && firstKey != "" && secondKey != null && secondKey != "" && thirdKey != null && thirdKey != "") {
    126.                     var tempBt;
    127.                     var x, y, z;
    128.                     tempBt = tempByte;
    129.                     for (x = 0; x < firstLength; x++) {
    130.                         tempBt = enc(tempBt, firstKeyBt[x]);
    131.                     }
    132.                     for (y = 0; y < secondLength; y++) {
    133.                         tempBt = enc(tempBt, secondKeyBt[y]);
    134.                     }
    135.                     for (z = 0; z < thirdLength; z++) {
    136.                         tempBt = enc(tempBt, thirdKeyBt[z]);
    137.                     }
    138.                     encByte = tempBt;
    139.                 } else {
    140.                     if (firstKey != null && firstKey != "" && secondKey != null && secondKey != "") {
    141.                         var tempBt;
    142.                         var x, y;
    143.                         tempBt = tempByte;
    144.                         for (x = 0; x < firstLength; x++) {
    145.                             tempBt = enc(tempBt, firstKeyBt[x]);
    146.                         }
    147.                         for (y = 0; y < secondLength; y++) {
    148.                             tempBt = enc(tempBt, secondKeyBt[y]);
    149.                         }
    150.                         encByte = tempBt;
    151.                     } else {
    152.                         if (firstKey != null && firstKey != "") {
    153.                             var tempBt;
    154.                             var x;
    155.                             tempBt = tempByte;
    156.                             for (x = 0; x < firstLength; x++) {
    157.                                 tempBt = enc(tempBt, firstKeyBt[x]);
    158.                             }
    159.                             encByte = tempBt;
    160.                         }
    161.                     }
    162.                 }
    163.                 encData += bt64ToHex(encByte);
    164.             }
    165.             if (remainder > 0) {
    166.                 var remainderData = data.substring(iterator * 4 + 0, leng);
    167.                 var tempByte = strToBt(remainderData);
    168.                 var encByte;
    169.                 if (firstKey != null && firstKey != "" && secondKey != null && secondKey != "" && thirdKey != null && thirdKey != "") {
    170.                     var tempBt;
    171.                     var x, y, z;
    172.                     tempBt = tempByte;
    173.                     for (x = 0; x < firstLength; x++) {
    174.                         tempBt = enc(tempBt, firstKeyBt[x]);
    175.                     }
    176.                     for (y = 0; y < secondLength; y++) {
    177.                         tempBt = enc(tempBt, secondKeyBt[y]);
    178.                     }
    179.                     for (z = 0; z < thirdLength; z++) {
    180.                         tempBt = enc(tempBt, thirdKeyBt[z]);
    181.                     }
    182.                     encByte = tempBt;
    183.                 } else {
    184.                     if (firstKey != null && firstKey != "" && secondKey != null && secondKey != "") {
    185.                         var tempBt;
    186.                         var x, y;
    187.                         tempBt = tempByte;
    188.                         for (x = 0; x < firstLength; x++) {
    189.                             tempBt = enc(tempBt, firstKeyBt[x]);
    190.                         }
    191.                         for (y = 0; y < secondLength; y++) {
    192.                             tempBt = enc(tempBt, secondKeyBt[y]);
    193.                         }
    194.                         encByte = tempBt;
    195.                     } else {
    196.                         if (firstKey != null && firstKey != "") {
    197.                             var tempBt;
    198.                             var x;
    199.                             tempBt = tempByte;
    200.                             for (x = 0; x < firstLength; x++) {
    201.                                 tempBt = enc(tempBt, firstKeyBt[x]);
    202.                             }
    203.                             encByte = tempBt;
    204.                         }
    205.                     }
    206.                 }
    207.                 encData += bt64ToHex(encByte);
    208.             }
    209.         }
    210.     }
    211.     return encData;
    212. }
    213.  
    214. /*
    215. * DES解密
    216. * decrypt the encrypted string to the original string
    217. * return  the original string
    218. */
    219. function strDec(data, firstKey, secondKey, thirdKey) {
    220.     var leng = data.length;
    221.     var decStr = "";
    222.     var firstKeyBt, secondKeyBt, thirdKeyBt, firstLength, secondLength, thirdLength;
    223.     if (firstKey != null && firstKey != "") {
    224.         firstKeyBt = getKeyBytes(firstKey);
    225.         firstLength = firstKeyBt.length;
    226.     }
    227.     if (secondKey != null && secondKey != "") {
    228.         secondKeyBt = getKeyBytes(secondKey);
    229.         secondLength = secondKeyBt.length;
    230.     }
    231.     if (thirdKey != null && thirdKey != "") {
    232.         thirdKeyBt = getKeyBytes(thirdKey);
    233.         thirdLength = thirdKeyBt.length;
    234.     }
    235.  
    236.     var iterator = parseInt(leng / 16);
    237.     var i = 0;
    238.     for (i = 0; i < iterator; i++) {
    239.         var tempData = data.substring(i * 16 + 0, i * 16 + 16);
    240.         var strByte = hexToBt64(tempData);
    241.         var intByte = new Array(64);
    242.         var j = 0;
    243.         for (j = 0; j < 64; j++) {
    244.             intByte[j] = parseInt(strByte.substring(j, j + 1));
    245.         }
    246.         var decByte;
    247.         if (firstKey != null && firstKey != "" && secondKey != null && secondKey != "" && thirdKey != null && thirdKey != "") {
    248.             var tempBt;
    249.             var x, y, z;
    250.             tempBt = intByte;
    251.             for (x = thirdLength - 1; x >= 0; x--) {
    252.                 tempBt = dec(tempBt, thirdKeyBt[x]);
    253.             }
    254.             for (y = secondLength - 1; y >= 0; y--) {
    255.                 tempBt = dec(tempBt, secondKeyBt[y]);
    256.             }
    257.             for (z = firstLength - 1; z >= 0; z--) {
    258.                 tempBt = dec(tempBt, firstKeyBt[z]);
    259.             }
    260.             decByte = tempBt;
    261.         } else {
    262.             if (firstKey != null && firstKey != "" && secondKey != null && secondKey != "") {
    263.                 var tempBt;
    264.                 var x, y, z;
    265.                 tempBt = intByte;
    266.                 for (x = secondLength - 1; x >= 0; x--) {
    267.                     tempBt = dec(tempBt, secondKeyBt[x]);
    268.                 }
    269.                 for (y = firstLength - 1; y >= 0; y--) {
    270.                     tempBt = dec(tempBt, firstKeyBt[y]);
    271.                 }
    272.                 decByte = tempBt;
    273.             } else {
    274.                 if (firstKey != null && firstKey != "") {
    275.                     var tempBt;
    276.                     var x, y, z;
    277.                     tempBt = intByte;
    278.                     for (x = firstLength - 1; x >= 0; x--) {
    279.                         tempBt = dec(tempBt, firstKeyBt[x]);
    280.                     }
    281.                     decByte = tempBt;
    282.                 }
    283.             }
    284.         }
    285.         decStr += byteToString(decByte);
    286.     }
    287.     return decStr;
    288. }
    289.  
    290. /*
    291. * chang the string into the bit array
    292. *
    293. * return bit array(it's length % 64 = 0)
    294. */
    295. function getKeyBytes(key) {
    296.     var keyBytes = new Array();
    297.     var leng = key.length;
    298.     var iterator = parseInt(leng / 4);
    299.     var remainder = leng % 4;
    300.     var i = 0;
    301.     for (i = 0; i < iterator; i++) {
    302.         keyBytes[i] = strToBt(key.substring(i * 4 + 0, i * 4 + 4));
    303.     }
    304.     if (remainder > 0) {
    305.         keyBytes[i] = strToBt(key.substring(i * 4 + 0, leng));
    306.     }
    307.     return keyBytes;
    308. }
    309.  
    310. function strToBt(str) {
    311.     var leng = str.length;
    312.     var bt = new Array(64);
    313.     if (leng < 4) {
    314.         var i = 0, j = 0, p = 0, q = 0;
    315.         for (i = 0; i < leng; i++) {
    316.             var k = str.charCodeAt(i);
    317.             for (j = 0; j < 16; j++) {
    318.                 var pow = 1, m = 0;
    319.                 for (m = 15; m > j; m--) {
    320.                     pow *= 2;
    321.                 }
    322.                 bt[16 * i + j] = parseInt(k / pow) % 2;
    323.             }
    324.         }
    325.         for (p = leng; p < 4; p++) {
    326.             var k = 0;
    327.             for (q = 0; q < 16; q++) {
    328.                 var pow = 1, m = 0;
    329.                 for (m = 15; m > q; m--) {
    330.                     pow *= 2;
    331.                 }
    332.                 bt[16 * p + q] = parseInt(k / pow) % 2;
    333.             }
    334.         }
    335.     } else {
    336.         for (i = 0; i < 4; i++) {
    337.             var k = str.charCodeAt(i);
    338.             for (j = 0; j < 16; j++) {
    339.                 var pow = 1;
    340.                 for (m = 15; m > j; m--) {
    341.                     pow *= 2;
    342.                 }
    343.                 bt[16 * i + j] = parseInt(k / pow) % 2;
    344.             }
    345.         }
    346.     }
    347.     return bt;
    348. }
    349.  
    350. /*
    351. * chang the bit(it's length = 4) into the hex
    352. *
    353. * return hex
    354. */
    355. function bt4ToHex(binary) {
    356.     var hex;
    357.     switch (binary) {
    358.         case "0000" :
    359.             hex = "0";
    360.             break;
    361.         case "0001" :
    362.             hex = "1";
    363.             break;
    364.         case "0010" :
    365.             hex = "2";
    366.             break;
    367.         case "0011" :
    368.             hex = "3";
    369.             break;
    370.         case "0100" :
    371.             hex = "4";
    372.             break;
    373.         case "0101" :
    374.             hex = "5";
    375.             break;
    376.         case "0110" :
    377.             hex = "6";
    378.             break;
    379.         case "0111" :
    380.             hex = "7";
    381.             break;
    382.         case "1000" :
    383.             hex = "8";
    384.             break;
    385.         case "1001" :
    386.             hex = "9";
    387.             break;
    388.         case "1010" :
    389.             hex = "A";
    390.             break;
    391.         case "1011" :
    392.             hex = "B";
    393.             break;
    394.         case "1100" :
    395.             hex = "C";
    396.             break;
    397.         case "1101" :
    398.             hex = "D";
    399.             break;
    400.         case "1110" :
    401.             hex = "E";
    402.             break;
    403.         case "1111" :
    404.             hex = "F";
    405.             break;
    406.     }
    407.     return hex;
    408. }
    409.  
    410. /*
    411. * chang the hex into the bit(it's length = 4)
    412. *
    413. * return the bit(it's length = 4)
    414. */
    415. function hexToBt4(hex) {
    416.     var binary;
    417.     switch (hex) {
    418.         case "0" :
    419.             binary = "0000";
    420.             break;
    421.         case "1" :
    422.             binary = "0001";
    423.             break;
    424.         case "2" :
    425.             binary = "0010";
    426.             break;
    427.         case "3" :
    428.             binary = "0011";
    429.             break;
    430.         case "4" :
    431.             binary = "0100";
    432.             break;
    433.         case "5" :
    434.             binary = "0101";
    435.             break;
    436.         case "6" :
    437.             binary = "0110";
    438.             break;
    439.         case "7" :
    440.             binary = "0111";
    441.             break;
    442.         case "8" :
    443.             binary = "1000";
    444.             break;
    445.         case "9" :
    446.             binary = "1001";
    447.             break;
    448.         case "A" :
    449.             binary = "1010";
    450.             break;
    451.         case "B" :
    452.             binary = "1011";
    453.             break;
    454.         case "C" :
    455.             binary = "1100";
    456.             break;
    457.         case "D" :
    458.             binary = "1101";
    459.             break;
    460.         case "E" :
    461.             binary = "1110";
    462.             break;
    463.         case "F" :
    464.             binary = "1111";
    465.             break;
    466.     }
    467.     return binary;
    468. }
    469.  
    470. /*
    471. * chang the bit(it's length = 64) into the string
    472. *
    473. * return string
    474. */
    475. function byteToString(byteData) {
    476.     var str = "";
    477.     for (i = 0; i < 4; i++) {
    478.         var count = 0;
    479.         for (j = 0; j < 16; j++) {
    480.             var pow = 1;
    481.             for (m = 15; m > j; m--) {
    482.                 pow *= 2;
    483.             }
    484.             count += byteData[16 * i + j] * pow;
    485.         }
    486.         if (count != 0) {
    487.             str += String.fromCharCode(count);
    488.         }
    489.     }
    490.     return str;
    491. }
    492.  
    493. function bt64ToHex(byteData) {
    494.     var hex = "";
    495.     for (i = 0; i < 16; i++) {
    496.         var bt = "";
    497.         for (j = 0; j < 4; j++) {
    498.             bt += byteData[i * 4 + j];
    499.         }
    500.         hex += bt4ToHex(bt);
    501.     }
    502.     return hex;
    503. }
    504.  
    505. function hexToBt64(hex) {
    506.     var binary = "";
    507.     for (i = 0; i < 16; i++) {
    508.         binary += hexToBt4(hex.substring(i, i + 1));
    509.     }
    510.     return binary;
    511. }
    512.  
    513. /*
    514. * the 64 bit des core arithmetic
    515. */
    516.  
    517. function enc(dataByte, keyByte) {
    518.     var keys = generateKeys(keyByte);
    519.     var ipByte = initPermute(dataByte);
    520.     var ipLeft = new Array(32);
    521.     var ipRight = new Array(32);
    522.     var tempLeft = new Array(32);
    523.     var i = 0, j = 0, k = 0, m = 0, n = 0;
    524.     for (k = 0; k < 32; k++) {
    525.         ipLeft[k] = ipByte[k];
    526.         ipRight[k] = ipByte[32 + k];
    527.     }
    528.     for (i = 0; i < 16; i++) {
    529.         for (j = 0; j < 32; j++) {
    530.             tempLeft[j] = ipLeft[j];
    531.             ipLeft[j] = ipRight[j];
    532.         }
    533.         var key = new Array(48);
    534.         for (m = 0; m < 48; m++) {
    535.             key[m] = keys[i][m];
    536.         }
    537.         var tempRight = xor(pPermute(sBoxPermute(xor(expandPermute(ipRight), key))), tempLeft);
    538.         for (n = 0; n < 32; n++) {
    539.             ipRight[n] = tempRight[n];
    540.         }
    541.  
    542.     }
    543.  
    544.  
    545.     var finalData = new Array(64);
    546.     for (i = 0; i < 32; i++) {
    547.         finalData[i] = ipRight[i];
    548.         finalData[32 + i] = ipLeft[i];
    549.     }
    550.     return finallyPermute(finalData);
    551. }
    552.  
    553. function dec(dataByte, keyByte) {
    554.     var keys = generateKeys(keyByte);
    555.     var ipByte = initPermute(dataByte);
    556.     var ipLeft = new Array(32);
    557.     var ipRight = new Array(32);
    558.     var tempLeft = new Array(32);
    559.     var i = 0, j = 0, k = 0, m = 0, n = 0;
    560.     for (k = 0; k < 32; k++) {
    561.         ipLeft[k] = ipByte[k];
    562.         ipRight[k] = ipByte[32 + k];
    563.     }
    564.     for (i = 15; i >= 0; i--) {
    565.         for (j = 0; j < 32; j++) {
    566.             tempLeft[j] = ipLeft[j];
    567.             ipLeft[j] = ipRight[j];
    568.         }
    569.         var key = new Array(48);
    570.         for (m = 0; m < 48; m++) {
    571.             key[m] = keys[i][m];
    572.         }
    573.  
    574.         var tempRight = xor(pPermute(sBoxPermute(xor(expandPermute(ipRight), key))), tempLeft);
    575.         for (n = 0; n < 32; n++) {
    576.             ipRight[n] = tempRight[n];
    577.         }
    578.     }
    579.  
    580.  
    581.     var finalData = new Array(64);
    582.     for (i = 0; i < 32; i++) {
    583.         finalData[i] = ipRight[i];
    584.         finalData[32 + i] = ipLeft[i];
    585.     }
    586.     return finallyPermute(finalData);
    587. }
    588.  
    589. function initPermute(originalData) {
    590.     var ipByte = new Array(64);
    591.     for (i = 0, m = 1, n = 0; i < 4; i++, m += 2, n += 2) {
    592.         for (j = 7, k = 0; j >= 0; j--, k++) {
    593.             ipByte[i * 8 + k] = originalData[j * 8 + m];
    594.             ipByte[i * 8 + k + 32] = originalData[j * 8 + n];
    595.         }
    596.     }
    597.     return ipByte;
    598. }
    599.  
    600. function expandPermute(rightData) {
    601.     var epByte = new Array(48);
    602.     for (i = 0; i < 8; i++) {
    603.         if (i == 0) {
    604.             epByte[i * 6 + 0] = rightData[31];
    605.         } else {
    606.             epByte[i * 6 + 0] = rightData[i * 4 - 1];
    607.         }
    608.         epByte[i * 6 + 1] = rightData[i * 4 + 0];
    609.         epByte[i * 6 + 2] = rightData[i * 4 + 1];
    610.         epByte[i * 6 + 3] = rightData[i * 4 + 2];
    611.         epByte[i * 6 + 4] = rightData[i * 4 + 3];
    612.         if (i == 7) {
    613.             epByte[i * 6 + 5] = rightData[0];
    614.         } else {
    615.             epByte[i * 6 + 5] = rightData[i * 4 + 4];
    616.         }
    617.     }
    618.     return epByte;
    619. }
    620.  
    621. function xor(byteOne, byteTwo) {
    622.     var xorByte = new Array(byteOne.length);
    623.     for (i = 0; i < byteOne.length; i++) {
    624.         xorByte[i] = byteOne[i] ^ byteTwo[i];
    625.     }
    626.     return xorByte;
    627. }
    628.  
    629. function sBoxPermute(expandByte) {
    630.  
    631.     var sBoxByte = new Array(32);
    632.     var binary = "";
    633.     var s1 = [
    634.         [14, 4, 13, 1, 2, 15, 11, 8, 3, 10, 6, 12, 5, 9, 0, 7],
    635.         [0, 15, 7, 4, 14, 2, 13, 1, 10, 6, 12, 11, 9, 5, 3, 8],
    636.         [4, 1, 14, 8, 13, 6, 2, 11, 15, 12, 9, 7, 3, 10, 5, 0],
    637.         [15, 12, 8, 2, 4, 9, 1, 7, 5, 11, 3, 14, 10, 0, 6, 13]];
    638.  
    639.     /* Table - s2 */
    640.     var s2 = [
    641.         [15, 1, 8, 14, 6, 11, 3, 4, 9, 7, 2, 13, 12, 0, 5, 10],
    642.         [3, 13, 4, 7, 15, 2, 8, 14, 12, 0, 1, 10, 6, 9, 11, 5],
    643.         [0, 14, 7, 11, 10, 4, 13, 1, 5, 8, 12, 6, 9, 3, 2, 15],
    644.         [13, 8, 10, 1, 3, 15, 4, 2, 11, 6, 7, 12, 0, 5, 14, 9]];
    645.  
    646.     /* Table - s3 */
    647.     var s3 = [
    648.         [10, 0, 9, 14, 6, 3, 15, 5, 1, 13, 12, 7, 11, 4, 2, 8],
    649.         [13, 7, 0, 9, 3, 4, 6, 10, 2, 8, 5, 14, 12, 11, 15, 1],
    650.         [13, 6, 4, 9, 8, 15, 3, 0, 11, 1, 2, 12, 5, 10, 14, 7],
    651.         [1, 10, 13, 0, 6, 9, 8, 7, 4, 15, 14, 3, 11, 5, 2, 12]];
    652.     /* Table - s4 */
    653.     var s4 = [
    654.         [7, 13, 14, 3, 0, 6, 9, 10, 1, 2, 8, 5, 11, 12, 4, 15],
    655.         [13, 8, 11, 5, 6, 15, 0, 3, 4, 7, 2, 12, 1, 10, 14, 9],
    656.         [10, 6, 9, 0, 12, 11, 7, 13, 15, 1, 3, 14, 5, 2, 8, 4],
    657.         [3, 15, 0, 6, 10, 1, 13, 8, 9, 4, 5, 11, 12, 7, 2, 14]];
    658.  
    659.     /* Table - s5 */
    660.     var s5 = [
    661.         [2, 12, 4, 1, 7, 10, 11, 6, 8, 5, 3, 15, 13, 0, 14, 9],
    662.         [14, 11, 2, 12, 4, 7, 13, 1, 5, 0, 15, 10, 3, 9, 8, 6],
    663.         [4, 2, 1, 11, 10, 13, 7, 8, 15, 9, 12, 5, 6, 3, 0, 14],
    664.         [11, 8, 12, 7, 1, 14, 2, 13, 6, 15, 0, 9, 10, 4, 5, 3]];
    665.  
    666.     /* Table - s6 */
    667.     var s6 = [
    668.         [12, 1, 10, 15, 9, 2, 6, 8, 0, 13, 3, 4, 14, 7, 5, 11],
    669.         [10, 15, 4, 2, 7, 12, 9, 5, 6, 1, 13, 14, 0, 11, 3, 8],
    670.         [9, 14, 15, 5, 2, 8, 12, 3, 7, 0, 4, 10, 1, 13, 11, 6],
    671.         [4, 3, 2, 12, 9, 5, 15, 10, 11, 14, 1, 7, 6, 0, 8, 13]];
    672.  
    673.     /* Table - s7 */
    674.     var s7 = [
    675.         [4, 11, 2, 14, 15, 0, 8, 13, 3, 12, 9, 7, 5, 10, 6, 1],
    676.         [13, 0, 11, 7, 4, 9, 1, 10, 14, 3, 5, 12, 2, 15, 8, 6],
    677.         [1, 4, 11, 13, 12, 3, 7, 14, 10, 15, 6, 8, 0, 5, 9, 2],
    678.         [6, 11, 13, 8, 1, 4, 10, 7, 9, 5, 0, 15, 14, 2, 3, 12]];
    679.  
    680.     /* Table - s8 */
    681.     var s8 = [
    682.         [13, 2, 8, 4, 6, 15, 11, 1, 10, 9, 3, 14, 5, 0, 12, 7],
    683.         [1, 15, 13, 8, 10, 3, 7, 4, 12, 5, 6, 11, 0, 14, 9, 2],
    684.         [7, 11, 4, 1, 9, 12, 14, 2, 0, 6, 10, 13, 15, 3, 5, 8],
    685.         [2, 1, 14, 7, 4, 10, 8, 13, 15, 12, 9, 0, 3, 5, 6, 11]];
    686.  
    687.     for (m = 0; m < 8; m++) {
    688.         var i = 0, j = 0;
    689.         i = expandByte[m * 6 + 0] * 2 + expandByte[m * 6 + 5];
    690.         j = expandByte[m * 6 + 1] * 2 * 2 * 2
    691.             + expandByte[m * 6 + 2] * 2 * 2
    692.             + expandByte[m * 6 + 3] * 2
    693.             + expandByte[m * 6 + 4];
    694.         switch (m) {
    695.             case 0 :
    696.                 binary = getBoxBinary(s1[i][j]);
    697.                 break;
    698.             case 1 :
    699.                 binary = getBoxBinary(s2[i][j]);
    700.                 break;
    701.             case 2 :
    702.                 binary = getBoxBinary(s3[i][j]);
    703.                 break;
    704.             case 3 :
    705.                 binary = getBoxBinary(s4[i][j]);
    706.                 break;
    707.             case 4 :
    708.                 binary = getBoxBinary(s5[i][j]);
    709.                 break;
    710.             case 5 :
    711.                 binary = getBoxBinary(s6[i][j]);
    712.                 break;
    713.             case 6 :
    714.                 binary = getBoxBinary(s7[i][j]);
    715.                 break;
    716.             case 7 :
    717.                 binary = getBoxBinary(s8[i][j]);
    718.                 break;
    719.         }
    720.         sBoxByte[m * 4 + 0] = parseInt(binary.substring(0, 1));
    721.         sBoxByte[m * 4 + 1] = parseInt(binary.substring(1, 2));
    722.         sBoxByte[m * 4 + 2] = parseInt(binary.substring(2, 3));
    723.         sBoxByte[m * 4 + 3] = parseInt(binary.substring(3, 4));
    724.     }
    725.     return sBoxByte;
    726. }
    727.  
    728. function pPermute(sBoxByte) {
    729.     var pBoxPermute = new Array(32);
    730.     pBoxPermute[0] = sBoxByte[15];
    731.     pBoxPermute[1] = sBoxByte[6];
    732.     pBoxPermute[2] = sBoxByte[19];
    733.     pBoxPermute[3] = sBoxByte[20];
    734.     pBoxPermute[4] = sBoxByte[28];
    735.     pBoxPermute[5] = sBoxByte[11];
    736.     pBoxPermute[6] = sBoxByte[27];
    737.     pBoxPermute[7] = sBoxByte[16];
    738.     pBoxPermute[8] = sBoxByte[0];
    739.     pBoxPermute[9] = sBoxByte[14];
    740.     pBoxPermute[10] = sBoxByte[22];
    741.     pBoxPermute[11] = sBoxByte[25];
    742.     pBoxPermute[12] = sBoxByte[4];
    743.     pBoxPermute[13] = sBoxByte[17];
    744.     pBoxPermute[14] = sBoxByte[30];
    745.     pBoxPermute[15] = sBoxByte[9];
    746.     pBoxPermute[16] = sBoxByte[1];
    747.     pBoxPermute[17] = sBoxByte[7];
    748.     pBoxPermute[18] = sBoxByte[23];
    749.     pBoxPermute[19] = sBoxByte[13];
    750.     pBoxPermute[20] = sBoxByte[31];
    751.     pBoxPermute[21] = sBoxByte[26];
    752.     pBoxPermute[22] = sBoxByte[2];
    753.     pBoxPermute[23] = sBoxByte[8];
    754.     pBoxPermute[24] = sBoxByte[18];
    755.     pBoxPermute[25] = sBoxByte[12];
    756.     pBoxPermute[26] = sBoxByte[29];
    757.     pBoxPermute[27] = sBoxByte[5];
    758.     pBoxPermute[28] = sBoxByte[21];
    759.     pBoxPermute[29] = sBoxByte[10];
    760.     pBoxPermute[30] = sBoxByte[3];
    761.     pBoxPermute[31] = sBoxByte[24];
    762.     return pBoxPermute;
    763. }
    764.  
    765. function finallyPermute(endByte) {
    766.     var fpByte = new Array(64);
    767.     fpByte[0] = endByte[39];
    768.     fpByte[1] = endByte[7];
    769.     fpByte[2] = endByte[47];
    770.     fpByte[3] = endByte[15];
    771.     fpByte[4] = endByte[55];
    772.     fpByte[5] = endByte[23];
    773.     fpByte[6] = endByte[63];
    774.     fpByte[7] = endByte[31];
    775.     fpByte[8] = endByte[38];
    776.     fpByte[9] = endByte[6];
    777.     fpByte[10] = endByte[46];
    778.     fpByte[11] = endByte[14];
    779.     fpByte[12] = endByte[54];
    780.     fpByte[13] = endByte[22];
    781.     fpByte[14] = endByte[62];
    782.     fpByte[15] = endByte[30];
    783.     fpByte[16] = endByte[37];
    784.     fpByte[17] = endByte[5];
    785.     fpByte[18] = endByte[45];
    786.     fpByte[19] = endByte[13];
    787.     fpByte[20] = endByte[53];
    788.     fpByte[21] = endByte[21];
    789.     fpByte[22] = endByte[61];
    790.     fpByte[23] = endByte[29];
    791.     fpByte[24] = endByte[36];
    792.     fpByte[25] = endByte[4];
    793.     fpByte[26] = endByte[44];
    794.     fpByte[27] = endByte[12];
    795.     fpByte[28] = endByte[52];
    796.     fpByte[29] = endByte[20];
    797.     fpByte[30] = endByte[60];
    798.     fpByte[31] = endByte[28];
    799.     fpByte[32] = endByte[35];
    800.     fpByte[33] = endByte[3];
    801.     fpByte[34] = endByte[43];
    802.     fpByte[35] = endByte[11];
    803.     fpByte[36] = endByte[51];
    804.     fpByte[37] = endByte[19];
    805.     fpByte[38] = endByte[59];
    806.     fpByte[39] = endByte[27];
    807.     fpByte[40] = endByte[34];
    808.     fpByte[41] = endByte[2];
    809.     fpByte[42] = endByte[42];
    810.     fpByte[43] = endByte[10];
    811.     fpByte[44] = endByte[50];
    812.     fpByte[45] = endByte[18];
    813.     fpByte[46] = endByte[58];
    814.     fpByte[47] = endByte[26];
    815.     fpByte[48] = endByte[33];
    816.     fpByte[49] = endByte[1];
    817.     fpByte[50] = endByte[41];
    818.     fpByte[51] = endByte[9];
    819.     fpByte[52] = endByte[49];
    820.     fpByte[53] = endByte[17];
    821.     fpByte[54] = endByte[57];
    822.     fpByte[55] = endByte[25];
    823.     fpByte[56] = endByte[32];
    824.     fpByte[57] = endByte[0];
    825.     fpByte[58] = endByte[40];
    826.     fpByte[59] = endByte[8];
    827.     fpByte[60] = endByte[48];
    828.     fpByte[61] = endByte[16];
    829.     fpByte[62] = endByte[56];
    830.     fpByte[63] = endByte[24];
    831.     return fpByte;
    832. }
    833.  
    834. function getBoxBinary(i) {
    835.     var binary = "";
    836.     switch (i) {
    837.         case 0 :
    838.             binary = "0000";
    839.             break;
    840.         case 1 :
    841.             binary = "0001";
    842.             break;
    843.         case 2 :
    844.             binary = "0010";
    845.             break;
    846.         case 3 :
    847.             binary = "0011";
    848.             break;
    849.         case 4 :
    850.             binary = "0100";
    851.             break;
    852.         case 5 :
    853.             binary = "0101";
    854.             break;
    855.         case 6 :
    856.             binary = "0110";
    857.             break;
    858.         case 7 :
    859.             binary = "0111";
    860.             break;
    861.         case 8 :
    862.             binary = "1000";
    863.             break;
    864.         case 9 :
    865.             binary = "1001";
    866.             break;
    867.         case 10 :
    868.             binary = "1010";
    869.             break;
    870.         case 11 :
    871.             binary = "1011";
    872.             break;
    873.         case 12 :
    874.             binary = "1100";
    875.             break;
    876.         case 13 :
    877.             binary = "1101";
    878.             break;
    879.         case 14 :
    880.             binary = "1110";
    881.             break;
    882.         case 15 :
    883.             binary = "1111";
    884.             break;
    885.     }
    886.     return binary;
    887. }
    888.  
    889. /*
    890. * generate 16 keys for xor
    891. *
    892. */
    893. function generateKeys(keyByte) {
    894.     var key = new Array(56);
    895.     var keys = new Array();
    896.  
    897.     keys[0] = new Array();
    898.     keys[1] = new Array();
    899.     keys[2] = new Array();
    900.     keys[3] = new Array();
    901.     keys[4] = new Array();
    902.     keys[5] = new Array();
    903.     keys[6] = new Array();
    904.     keys[7] = new Array();
    905.     keys[8] = new Array();
    906.     keys[9] = new Array();
    907.     keys[10] = new Array();
    908.     keys[11] = new Array();
    909.     keys[12] = new Array();
    910.     keys[13] = new Array();
    911.     keys[14] = new Array();
    912.     keys[15] = new Array();
    913.     var loop = [1, 1, 2, 2, 2, 2, 2, 2, 1, 2, 2, 2, 2, 2, 2, 1];
    914.  
    915.     for (i = 0; i < 7; i++) {
    916.         for (j = 0, k = 7; j < 8; j++, k--) {
    917.             key[i * 8 + j] = keyByte[8 * k + i];
    918.         }
    919.     }
    920.  
    921.     var i = 0;
    922.     for (i = 0; i < 16; i++) {
    923.         var tempLeft = 0;
    924.         var tempRight = 0;
    925.         for (j = 0; j < loop[i]; j++) {
    926.             tempLeft = key[0];
    927.             tempRight = key[28];
    928.             for (k = 0; k < 27; k++) {
    929.                 key[k] = key[k + 1];
    930.                 key[28 + k] = key[29 + k];
    931.             }
    932.             key[27] = tempLeft;
    933.             key[55] = tempRight;
    934.         }
    935.         var tempKey = new Array(48);
    936.         tempKey[0] = key[13];
    937.         tempKey[1] = key[16];
    938.         tempKey[2] = key[10];
    939.         tempKey[3] = key[23];
    940.         tempKey[4] = key[0];
    941.         tempKey[5] = key[4];
    942.         tempKey[6] = key[2];
    943.         tempKey[7] = key[27];
    944.         tempKey[8] = key[14];
    945.         tempKey[9] = key[5];
    946.         tempKey[10] = key[20];
    947.         tempKey[11] = key[9];
    948.         tempKey[12] = key[22];
    949.         tempKey[13] = key[18];
    950.         tempKey[14] = key[11];
    951.         tempKey[15] = key[3];
    952.         tempKey[16] = key[25];
    953.         tempKey[17] = key[7];
    954.         tempKey[18] = key[15];
    955.         tempKey[19] = key[6];
    956.         tempKey[20] = key[26];
    957.         tempKey[21] = key[19];
    958.         tempKey[22] = key[12];
    959.         tempKey[23] = key[1];
    960.         tempKey[24] = key[40];
    961.         tempKey[25] = key[51];
    962.         tempKey[26] = key[30];
    963.         tempKey[27] = key[36];
    964.         tempKey[28] = key[46];
    965.         tempKey[29] = key[54];
    966.         tempKey[30] = key[29];
    967.         tempKey[31] = key[39];
    968.         tempKey[32] = key[50];
    969.         tempKey[33] = key[44];
    970.         tempKey[34] = key[32];
    971.         tempKey[35] = key[47];
    972.         tempKey[36] = key[43];
    973.         tempKey[37] = key[48];
    974.         tempKey[38] = key[38];
    975.         tempKey[39] = key[55];
    976.         tempKey[40] = key[33];
    977.         tempKey[41] = key[52];
    978.         tempKey[42] = key[45];
    979.         tempKey[43] = key[41];
    980.         tempKey[44] = key[49];
    981.         tempKey[45] = key[35];
    982.         tempKey[46] = key[28];
    983.         tempKey[47] = key[31];
    984.         switch (i) {
    985.             case 0:
    986.                 for (m = 0; m < 48; m++) {
    987.                     keys[0][m] = tempKey[m];
    988.                 }
    989.                 break;
    990.             case 1:
    991.                 for (m = 0; m < 48; m++) {
    992.                     keys[1][m] = tempKey[m];
    993.                 }
    994.                 break;
    995.             case 2:
    996.                 for (m = 0; m < 48; m++) {
    997.                     keys[2][m] = tempKey[m];
    998.                 }
    999.                 break;
    1000.             case 3:
    1001.                 for (m = 0; m < 48; m++) {
    1002.                     keys[3][m] = tempKey[m];
    1003.                 }
    1004.                 break;
    1005.             case 4:
    1006.                 for (m = 0; m < 48; m++) {
    1007.                     keys[4][m] = tempKey[m];
    1008.                 }
    1009.                 break;
    1010.             case 5:
    1011.                 for (m = 0; m < 48; m++) {
    1012.                     keys[5][m] = tempKey[m];
    1013.                 }
    1014.                 break;
    1015.             case 6:
    1016.                 for (m = 0; m < 48; m++) {
    1017.                     keys[6][m] = tempKey[m];
    1018.                 }
    1019.                 break;
    1020.             case 7:
    1021.                 for (m = 0; m < 48; m++) {
    1022.                     keys[7][m] = tempKey[m];
    1023.                 }
    1024.                 break;
    1025.             case 8:
    1026.                 for (m = 0; m < 48; m++) {
    1027.                     keys[8][m] = tempKey[m];
    1028.                 }
    1029.                 break;
    1030.             case 9:
    1031.                 for (m = 0; m < 48; m++) {
    1032.                     keys[9][m] = tempKey[m];
    1033.                 }
    1034.                 break;
    1035.             case 10:
    1036.                 for (m = 0; m < 48; m++) {
    1037.                     keys[10][m] = tempKey[m];
    1038.                 }
    1039.                 break;
    1040.             case 11:
    1041.                 for (m = 0; m < 48; m++) {
    1042.                     keys[11][m] = tempKey[m];
    1043.                 }
    1044.                 break;
    1045.             case 12:
    1046.                 for (m = 0; m < 48; m++) {
    1047.                     keys[12][m] = tempKey[m];
    1048.                 }
    1049.                 break;
    1050.             case 13:
    1051.                 for (m = 0; m < 48; m++) {
    1052.                     keys[13][m] = tempKey[m];
    1053.                 }
    1054.                 break;
    1055.             case 14:
    1056.                 for (m = 0; m < 48; m++) {
    1057.                     keys[14][m] = tempKey[m];
    1058.                 }
    1059.                 break;
    1060.             case 15:
    1061.                 for (m = 0; m < 48; m++) {
    1062.                     keys[15][m] = tempKey[m];
    1063.                 }
    1064.                 break;
    1065.         }
    1066.     }
    1067.     return keys;
    1068. }
    1069.  
    1070. function utf16to8(str) {
    1071.     var out, i, len, c;
    1072.  
    1073.     out = "";
    1074.     len = str.length;
    1075.     for (i = 0; i < len; i++) {
    1076.         c = str.charCodeAt(i);
    1077.         if ((c >= 0x0001) && (c <= 0x007F)) {
    1078.             out += str.charAt(i);
    1079.         } else if (c > 0x07FF) {
    1080.             out += String.fromCharCode(0xE0 | ((c >> 12) & 0x0F));
    1081.             out += String.fromCharCode(0x80 | ((c >> 6) & 0x3F));
    1082.             out += String.fromCharCode(0x80 | ((c >> 0) & 0x3F));
    1083.         } else {
    1084.             out += String.fromCharCode(0xC0 | ((c >> 6) & 0x1F));
    1085.             out += String.fromCharCode(0x80 | ((c >> 0) & 0x3F));
    1086.         }
    1087.     }
    1088.     return out;
    1089. }
    1090.  
    1091. function utf8to16(str) {
    1092.     var out, i, len, c;
    1093.     var char2, char3;
    1094.  
    1095.     out = "";
    1096.     len = str.length;
    1097.     i = 0;
    1098.     while (i < len) {
    1099.         c = str.charCodeAt(i++);
    1100.         switch (c >> 4) {
    1101.             case 0:
    1102.             case 1:
    1103.             case 2:
    1104.             case 3:
    1105.             case 4:
    1106.             case 5:
    1107.             case 6:
    1108.             case 7:
    1109.                 // 0xxxxxxx
    1110.                 out += str.charAt(i - 1);
    1111.                 break;
    1112.             case 12:
    1113.             case 13:
    1114.                 // 110x xxxx   10xx xxxx
    1115.                 char2 = str.charCodeAt(i++);
    1116.                 out += String.fromCharCode(((c & 0x1F) << 6) | (char2 & 0x3F));
    1117.                 break;
    1118.             case 14:
    1119.                 // 1110 xxxx  10xx xxxx  10xx xxxx
    1120.                 char2 = str.charCodeAt(i++);
    1121.                 char3 = str.charCodeAt(i++);
    1122.                 out += String.fromCharCode(((c & 0x0F) << 12) |
    1123.                     ((char2 & 0x3F) << 6) |
    1124.                     ((char3 & 0x3F) << 0));
    1125.                 break;
    1126.         }
    1127.     }
    1128.  
    1129.     return out;
    1130. }
    1131.  
    1132. var base64EncodeChars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
    1133. var base64DecodeChars = new Array(
    1134.     -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
    1135.     -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
    1136.     -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63,
    1137.     52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, -1, -1, -1,
    1138.     -1, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
    1139.     15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, -1, -1, -1, -1, -1,
    1140.     -1, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40,
    1141.     41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, -1, -1, -1, -1, -1);
    1142.  
    1143. function base64encode(str) {
    1144.     var out, i, len;
    1145.     var c1, c2, c3;
    1146.  
    1147.     len = str.length;
    1148.     i = 0;
    1149.     out = "";
    1150.     while (i < len) {
    1151.         c1 = str.charCodeAt(i++) & 0xff;
    1152.         if (i == len) {
    1153.             out += base64EncodeChars.charAt(c1 >> 2);
    1154.             out += base64EncodeChars.charAt((c1 & 0x3) << 4);
    1155.             out += "==";
    1156.             break;
    1157.         }
    1158.         c2 = str.charCodeAt(i++);
    1159.         if (i == len) {
    1160.             out += base64EncodeChars.charAt(c1 >> 2);
    1161.             out += base64EncodeChars.charAt(((c1 & 0x3) << 4) | ((c2 & 0xF0) >> 4));
    1162.             out += base64EncodeChars.charAt((c2 & 0xF) << 2);
    1163.             out += "=";
    1164.             break;
    1165.         }
    1166.         c3 = str.charCodeAt(i++);
    1167.         out += base64EncodeChars.charAt(c1 >> 2);
    1168.         out += base64EncodeChars.charAt(((c1 & 0x3) << 4) | ((c2 & 0xF0) >> 4));
    1169.         out += base64EncodeChars.charAt(((c2 & 0xF) << 2) | ((c3 & 0xC0) >> 6));
    1170.         out += base64EncodeChars.charAt(c3 & 0x3F);
    1171.     }
    1172.     return out;
    1173. }
    1174.  
    1175. function base64decode(str) {
    1176.     var c1, c2, c3, c4;
    1177.     var i, len, out;
    1178.  
    1179.     len = str.length;
    1180.     i = 0;
    1181.     out = "";
    1182.     while (i < len) {
    1183.         /* c1 */
    1184.         do {
    1185.             c1 = base64DecodeChars[str.charCodeAt(i++) & 0xff];
    1186.         } while (i < len && c1 == -1);
    1187.         if (c1 == -1)
    1188.             break;
    1189.  
    1190.         /* c2 */
    1191.         do {
    1192.             c2 = base64DecodeChars[str.charCodeAt(i++) & 0xff];
    1193.         } while (i < len && c2 == -1);
    1194.         if (c2 == -1)
    1195.             break;
    1196.  
    1197.         out += String.fromCharCode((c1 << 2) | ((c2 & 0x30) >> 4));
    1198.  
    1199.         /* c3 */
    1200.         do {
    1201.             c3 = str.charCodeAt(i++) & 0xff;
    1202.             if (c3 == 61)
    1203.                 return out;
    1204.             c3 = base64DecodeChars[c3];
    1205.         } while (i < len && c3 == -1);
    1206.         if (c3 == -1)
    1207.             break;
    1208.  
    1209.         out += String.fromCharCode(((c2 & 0XF) << 4) | ((c3 & 0x3C) >> 2));
    1210.  
    1211.         /* c4 */
    1212.         do {
    1213.             c4 = str.charCodeAt(i++) & 0xff;
    1214.             if (c4 == 61)
    1215.                 return out;
    1216.             c4 = base64DecodeChars[c4];
    1217.         } while (i < len && c4 == -1);
    1218.         if (c4 == -1)
    1219.             break;
    1220.         out += String.fromCharCode(((c3 & 0x03) << 6) | c4);
    1221.     }
    1222.     return out;
    1223. }
    1224.  
    1225. //js_base64 encode
    1226. function str_encode(str) {
    1227.     return base64encode(utf16to8(str));
    1228. }
    1229.  
    1230. //js_base64 decode
    1231. function str_decode(str) {
    1232.     return utf8to16(base64decode(str));
    1233. }
    1234.  
    1235.  
    1236. function hex_md5(s) {
    1237.     return binl2hex(core_md5(str2binl(s), s.length * chrsz));
    1238. }
    1239.  
    1240. function binl2hex(binarray) {
    1241.     var hex_tab = hexcase ? "0123456789ABCDEF" : "0123456789abcdef";
    1242.     var str = "";
    1243.     for (var i = 0; i < binarray.length * 4; i++) {
    1244.         str += hex_tab.charAt((binarray[i >> 2] >> ((i % 4) * 8 + 4)) & 0xF) +
    1245.             hex_tab.charAt((binarray[i >> 2] >> ((i % 4) * 8)) & 0xF);
    1246.     }
    1247.     return str;
    1248. }
    1249.  
    1250. function core_md5(x, len) {
    1251.     /* append padding */
    1252.     x[len >> 5] |= 0x80 << ((len) % 32);
    1253.     x[(((len + 64) >>> 9) << 4) + 14] = len;
    1254.  
    1255.     var a = 1732584193;
    1256.     var b = -271733879;
    1257.     var c = -1732584194;
    1258.     var d = 271733878;
    1259.  
    1260.     for (var i = 0; i < x.length; i += 16) {
    1261.         var olda = a;
    1262.         var oldb = b;
    1263.         var oldc = c;
    1264.         var oldd = d;
    1265.  
    1266.         a = md5_ff(a, b, c, d, x[i + 0], 7, -680876936);
    1267.         d = md5_ff(d, a, b, c, x[i + 1], 12, -389564586);
    1268.         c = md5_ff(c, d, a, b, x[i + 2], 17, 606105819);
    1269.         b = md5_ff(b, c, d, a, x[i + 3], 22, -1044525330);
    1270.         a = md5_ff(a, b, c, d, x[i + 4], 7, -176418897);
    1271.         d = md5_ff(d, a, b, c, x[i + 5], 12, 1200080426);
    1272.         c = md5_ff(c, d, a, b, x[i + 6], 17, -1473231341);
    1273.         b = md5_ff(b, c, d, a, x[i + 7], 22, -45705983);
    1274.         a = md5_ff(a, b, c, d, x[i + 8], 7, 1770035416);
    1275.         d = md5_ff(d, a, b, c, x[i + 9], 12, -1958414417);
    1276.         c = md5_ff(c, d, a, b, x[i + 10], 17, -42063);
    1277.         b = md5_ff(b, c, d, a, x[i + 11], 22, -1990404162);
    1278.         a = md5_ff(a, b, c, d, x[i + 12], 7, 1804603682);
    1279.         d = md5_ff(d, a, b, c, x[i + 13], 12, -40341101);
    1280.         c = md5_ff(c, d, a, b, x[i + 14], 17, -1502002290);
    1281.         b = md5_ff(b, c, d, a, x[i + 15], 22, 1236535329);
    1282.  
    1283.         a = md5_gg(a, b, c, d, x[i + 1], 5, -165796510);
    1284.         d = md5_gg(d, a, b, c, x[i + 6], 9, -1069501632);
    1285.         c = md5_gg(c, d, a, b, x[i + 11], 14, 643717713);
    1286.         b = md5_gg(b, c, d, a, x[i + 0], 20, -373897302);
    1287.         a = md5_gg(a, b, c, d, x[i + 5], 5, -701558691);
    1288.         d = md5_gg(d, a, b, c, x[i + 10], 9, 38016083);
    1289.         c = md5_gg(c, d, a, b, x[i + 15], 14, -660478335);
    1290.         b = md5_gg(b, c, d, a, x[i + 4], 20, -405537848);
    1291.         a = md5_gg(a, b, c, d, x[i + 9], 5, 568446438);
    1292.         d = md5_gg(d, a, b, c, x[i + 14], 9, -1019803690);
    1293.         c = md5_gg(c, d, a, b, x[i + 3], 14, -187363961);
    1294.         b = md5_gg(b, c, d, a, x[i + 8], 20, 1163531501);
    1295.         a = md5_gg(a, b, c, d, x[i + 13], 5, -1444681467);
    1296.         d = md5_gg(d, a, b, c, x[i + 2], 9, -51403784);
    1297.         c = md5_gg(c, d, a, b, x[i + 7], 14, 1735328473);
    1298.         b = md5_gg(b, c, d, a, x[i + 12], 20, -1926607734);
    1299.  
    1300.         a = md5_hh(a, b, c, d, x[i + 5], 4, -378558);
    1301.         d = md5_hh(d, a, b, c, x[i + 8], 11, -2022574463);
    1302.         c = md5_hh(c, d, a, b, x[i + 11], 16, 1839030562);
    1303.         b = md5_hh(b, c, d, a, x[i + 14], 23, -35309556);
    1304.         a = md5_hh(a, b, c, d, x[i + 1], 4, -1530992060);
    1305.         d = md5_hh(d, a, b, c, x[i + 4], 11, 1272893353);
    1306.         c = md5_hh(c, d, a, b, x[i + 7], 16, -155497632);
    1307.         b = md5_hh(b, c, d, a, x[i + 10], 23, -1094730640);
    1308.         a = md5_hh(a, b, c, d, x[i + 13], 4, 681279174);
    1309.         d = md5_hh(d, a, b, c, x[i + 0], 11, -358537222);
    1310.         c = md5_hh(c, d, a, b, x[i + 3], 16, -722521979);
    1311.         b = md5_hh(b, c, d, a, x[i + 6], 23, 76029189);
    1312.         a = md5_hh(a, b, c, d, x[i + 9], 4, -640364487);
    1313.         d = md5_hh(d, a, b, c, x[i + 12], 11, -421815835);
    1314.         c = md5_hh(c, d, a, b, x[i + 15], 16, 530742520);
    1315.         b = md5_hh(b, c, d, a, x[i + 2], 23, -995338651);
    1316.  
    1317.         a = md5_ii(a, b, c, d, x[i + 0], 6, -198630844);
    1318.         d = md5_ii(d, a, b, c, x[i + 7], 10, 1126891415);
    1319.         c = md5_ii(c, d, a, b, x[i + 14], 15, -1416354905);
    1320.         b = md5_ii(b, c, d, a, x[i + 5], 21, -57434055);
    1321.         a = md5_ii(a, b, c, d, x[i + 12], 6, 1700485571);
    1322.         d = md5_ii(d, a, b, c, x[i + 3], 10, -1894986606);
    1323.         c = md5_ii(c, d, a, b, x[i + 10], 15, -1051523);
    1324.         b = md5_ii(b, c, d, a, x[i + 1], 21, -2054922799);
    1325.         a = md5_ii(a, b, c, d, x[i + 8], 6, 1873313359);
    1326.         d = md5_ii(d, a, b, c, x[i + 15], 10, -30611744);
    1327.         c = md5_ii(c, d, a, b, x[i + 6], 15, -1560198380);
    1328.         b = md5_ii(b, c, d, a, x[i + 13], 21, 1309151649);
    1329.         a = md5_ii(a, b, c, d, x[i + 4], 6, -145523070);
    1330.         d = md5_ii(d, a, b, c, x[i + 11], 10, -1120210379);
    1331.         c = md5_ii(c, d, a, b, x[i + 2], 15, 718787259);
    1332.         b = md5_ii(b, c, d, a, x[i + 9], 21, -343485551);
    1333.  
    1334.         a = safe_add(a, olda);
    1335.         b = safe_add(b, oldb);
    1336.         c = safe_add(c, oldc);
    1337.         d = safe_add(d, oldd);
    1338.     }
    1339.     return Array(a, b, c, d);
    1340.  
    1341. }
    1342.  
    1343. function str2binl(str) {
    1344.     var bin = Array();
    1345.     var mask = (1 << chrsz) - 1;
    1346.     for (var i = 0; i < str.length * chrsz; i += chrsz)
    1347.         bin[i >> 5] |= (str.charCodeAt(i / chrsz) & mask) << (i % 32);
    1348.     return bin;
    1349. }
    1350.  
    1351.  
    1352. function md5_cmn(q, a, b, x, s, t) {
    1353.     return safe_add(bit_rol(safe_add(safe_add(a, q), safe_add(x, t)), s), b);
    1354. }
    1355.  
    1356. function md5_ff(a, b, c, d, x, s, t) {
    1357.     return md5_cmn((b & c) | ((~b) & d), a, b, x, s, t);
    1358. }
    1359.  
    1360. function md5_gg(a, b, c, d, x, s, t) {
    1361.     return md5_cmn((b & d) | (c & (~d)), a, b, x, s, t);
    1362. }
    1363.  
    1364. function md5_hh(a, b, c, d, x, s, t) {
    1365.     return md5_cmn(b ^ c ^ d, a, b, x, s, t);
    1366. }
    1367.  
    1368. function md5_ii(a, b, c, d, x, s, t) {
    1369.     return md5_cmn(c ^ (b | (~d)), a, b, x, s, t);
    1370. }
    1371.  
    1372. function safe_add(x, y) {
    1373.     var lsw = (x & 0xFFFF) + (y & 0xFFFF);
    1374.     var msw = (x >> 16) + (y >> 16) + (lsw >> 16);
    1375.     return (msw << 16) | (lsw & 0xFFFF);
    1376. }
    1377.  
    1378. function bit_rol(num, cnt) {
    1379.     return (num << cnt) | (num >>> (32 - cnt));
    1380. }
    1381.  
    1382. var randnumber = ''
    1383. var p_username = "_u" + randnumber;
    1384. var p_password = "_p" + randnumber;
    1385. var _sessionid = _ssessionid;
    1386. var username = base64encode('12345' + ";;" + _sessionid);
    1387. var password = hex_md5(hex_md5('12345') + hex_md5(randnumber.toLowerCase()));
    1388. var passwordPolicy = isPasswordPolicy(username, password);
    1389.  
    1390. function isPasswordPolicy(username, password) {
    1391.     if (password == "" || password == null || username == password) {
    1392.         return "0";
    1393.     }
    1394.     var passwordlen = new String(password).length;
    1395.     if (passwordlen < 6) {
    1396.         return "0";
    1397.     }
    1398.     return "1";
    1399. }
    1400.  
    1401. var txt_mm_expression = 8;
    1402. var txt_mm_length = 4;
    1403. var txt_mm_userzh = 1;
    1404. var hid_flag = 1;
    1405. var params = p_username + "=" + username + "&" + p_password + "=" + password + "&randnumber=" + randnumber + "&isPasswordPolicy=" + passwordPolicy +
    1406.     "&txt_mm_expression=" + txt_mm_expression + "&txt_mm_length=" + txt_mm_length + "&txt_mm_userzh=" + txt_mm_userzh + "&hid_flag=" + hid_flag + "&hidlag=1";
    1407.  
    1408.  
    1409. console.log(getEncParams(params))

    效果展示

    我们可以看到我们成功逆向这个加密参数。

    1. NjRGREZCQURBQTRDREQ5NUE1QUY2MDIwMEVERjA1RThEMkU3NTJFNTE1ODVCNUU4MjYzMEYzQURENTBDOEVFMjhBMjRGOTU1REY4MTNENDA4Mzc4MUUxQ0FEMzYxOUVDMzU1RjU5MzBENUUxNEI5MT
    2. JFRDQ1QTAyNEFBRUY3QkFGNkIwMEZGODA2N0M2QzJERkU1MjM5OTc2RjNCMDAxQzgyRDg5NEQwMkE4N0IwNURDMTBFQTJCOURGN0NDM0NEMzMzNDU1RjhBNjE2ODgwOTk2QkQwMEMyQzQzQ0JEQjE5RjhGMkU
    3. 5QThDNkI0MTk4NzNEQzc0RTk3ODIyRENFOENEMkNEQTA3QzczMDIyRUZEM0IzQjdGQjEzNEZGQ0MwQ0U5ODg4M0UyMkYyNkM4RjkyQTYxNUI0RDk3MTcyRUZGMzYxQ0MyQjBFMjQyNzhCRkMzMEYzNkE1NzA2
    4. RTE1ODlGNzhCNzQ4MkM2RkE4NTg5QTZFODY5MURFRTNBNjVCNTVFMjY2Njc5QUUyRjI0NUNGMkMyRDU3QzEzRjU4MEZBRkM1QUNFMzdCMTYzNDU2N0U1NEVFMzdFNkMwNTZBMUM1RTNEM0IxMDQyMUIzMEMyO
    5. TRCNEE2QjlBNThFOTVEODUzOUIyMDc2RkIwQkVFNjU4Q0QzN0Q2RDdERDM0OUVCQjMwMDM2Nzc5MDJDRDcwRjZDMTk0QjY4NTYzNEU3MzM1MEI2RTNFOUNGQkE0M0ExODJDODg4NjUyODZEOTI5NThDRDM3RD
    6. ZEN0REMzQ5RTRERTk4RUI3RTAzNkM4MEJERjU1MUE2RkUyNTEyMUFFM0JBRjlENEU4NzUyRjc3NjU4Q0QzN0Q2RDdERDM0OUUwQkIzRjcxOTZEM0Y3QTgyMkVGNzQ1OEVGNzlDODNEQTcwNzVFRTIzQzM1NzB
    7. DMTE5OTJBMjY3QUUwRTI3QjQwQjMyRjRCQkI2OEMyREVFQTQxMjNBOTc2NERFOUIzODEzMzNGNzQxOTQxOENGNTA0NzI4NzdDOUY2RUMwRTIyOQ==

    四、总结

    本文介绍了高校教务系统的密码加密逻辑以及使用JavaScript进行逆向分析的方法。通过学习这些知识，你可以更好地理解密码加密技术的原理，并掌握一定的逆向分析技巧。请注意，逆向分析可能涉及到法律问题，请在合法范围内进行研究和实践。

    五、累计更新

    争取到到底早日更新30所高校，大家可以在评论区留言。

    往期作品可以查看专栏👇👇👇

    全国高校教务系统登录页面JS分析_爱吃饼干的小白鼠的博客-CSDN博客

    6adf31c8c5dd4e6a83314f4805b30bc1.jpg

  • 相关阅读:
    数据结构--二叉树遍历
    MATLAB中的符号计算是什么？如何使用它？
    Linux环境下C++ 接入OpenSSL
    堆块的重叠
    【推送服务】【FAQ】Push Ki常见咨询合集7--其它问题
    类和对象8：数值方法
    Python的pytest框架(6)--测试钩子 (hooks)
    注意分号 ； 的在语法节奏感
    Linux基础 - Web服务基础
    Linux环境MySQL数据库主从复制保姆级教程
  • 原文地址：https://blog.csdn.net/BROKEN__Y/article/details/133815114