ida81输入密码验证算法分析以及破解思路

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

proc m4ZQu {password LZQjH} {

    set ::maui::util::H6VeX ""

    set ::maui::util::EL0BW [string repeat \\0 32]

    package require tcltwofish

    package require sha256

    if {[string length $LZQjH] == 0} {

        error "Unable to initialize encryption - missing essential data"

    }

    //1.展开payload 获取相关参数

    if {[binary scan $LZQjH Ia16a32a64a32a* times iv passwordKey encryptedKey payloadIVsHash encryptedPayloadIVs] < 6} {

        error "Unable to initialize encryption - header missing or corrupt"

    }

    //2.使用输入的密码计算sha256，然后根据迭代次数times加密passwordkey，最后计算结果的sha256

    set iHcWR [a64bL $password $passwordKey $iv $times]

    //3.取上一步中的后32字节

    set BJvoG [string range [tcltwofish::decrypt $iHcWR $encryptedKey] 32 63]

    //4.使用上一步中的结果作为key 循环times/64次 解密encryptedPayloadIVs

    //这一步没有指定iv 实际过程为16个字节的0x00

    for {set i 0} {$i < $times} {incr i 64} {

        set encryptedPayloadIVs [tcltwofish::decrypt $BJvoG $encryptedPayloadIVs]

    }

    //5.获取32字节后的数据

    set ZQpQw [string range $encryptedPayloadIVs 32 end]

    //6.计算上一步结果的sha256，和预置的hash比对，一致则密码正确

    if {[sha2::sha256 -bin $ZQpQw] != $payloadIVsHash} {

        maui::d_RUj "Invalid payload password"

    }

    //7.使用第五步中的结果作为后续选取iv的数据

    set ::maui::util::H6VeX $ZQpQw

    //8.使用第三步中的结果作为密钥

    set ::maui::util::EL0BW $BJvoG

}

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

//根据输入密码生成payload

proc yOZ7q {password {times 16000}} {

        set ::maui::util::H6VeX ""

        set ::maui::util::EL0BW [string repeat \\0 32]

        package require tcltwofish

        package require sha256

        set BJvoG [qA4kM 32]

        set passwordKey [qA4kM 32]

        set ZQpQw [qA4kM [expr {16 * 256}]]

        set payloadIVsHash [sha2::sha256 -bin $ZQpQw]

        set encryptedPayloadIVs "[qA4kM 32]$ZQpQw"

        for {set i 0} {$i < $times} {incr i 64} {

            set encryptedPayloadIVs [tcltwofish::encrypt $BJvoG $encryptedPayloadIVs]

        }

        set iv [qA4kM 16]

        set iHcWR [a64bL $password $passwordKey $iv $times]

        set encryptedKey [tcltwofish::encrypt $iHcWR "[qA4kM 32]$BJvoG"]

        set LZQjH [binary format Ia16a32a64a32a* $times $iv $passwordKey $encryptedKey $payloadIVsHash $encryptedPayloadIVs]

        set ::maui::util::H6VeX $ZQpQw

        set ::maui::util::EL0BW $BJvoG

        return $LZQjH

    }

//生成随机数据

 proc qA4kM {length} {

        set YKL8w ""

        if {[RLPut unix]} {

            foreach xML4B {/dev/urandom /dev/random} {

                if {[catch {

                    set WyLEv [open $xML4B r]

                    fconfigure $WyLEv -translation binary

                    set YKL8w [read $WyLEv $length]

                    close $WyLEv

                }]} {

                    catch {close $WyLEv}

                }  else  {

                    break

                }

            }

        }  else  {

        }

        if {[string length $YKL8w] != $length} {

            incr length -[string length $YKL8w]

            while {$length >= 2} {

                append YKL8w [binary format S [expr {int([maui::util::rand] * 0x10000)}]]

                incr length -2

            }

            if {$length > 0} {

                append YKL8w [binary format c [expr {int([maui::util::rand] * 0x100)}]]

            }

        }

        return $YKL8w

    }

    proc rand {} {

        if {[maui::util::RLPut "windows"] && [info commands ::bitrock::secure::rand_s] != ""} {

            if {[catch {

                set r [::bitrock::secure::rand_s]

            } V77Ls]} {

                maui::util::debug "failed to call rand_s: $V77Ls"

                set r [expr {rand()}]

            }

        } else {

            set r [expr {rand()}]

        }

        return $r

    }

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

proc MmyBM {compressionAlgorithm command data} {

        if {[catch {

            //1.压缩数据

            if {($compressionAlgorithm == "lzma") || ($compressionAlgorithm == "lzma-ultra") || ($compressionAlgorithm == "lzham") || ($compressionAlgorithm == "lzham-ultra")} {

                set data [eval [concat $command [list $data]]]

            }  else  {

                set data [vfs::zip -mode compress -nowrap 1 $data]

            }

            //2.1 前面添加四个字节的长度，然后末尾补全32的倍数

            //2.2 前面添加32字节的随机数据

            set data [qA4kM 32][UOijU $data 32] 

            //3.在H6VeX中截取16字节的iv

            set PG2JA [expr {int([maui::util::rand] * 0x100)}]

            set iv [string range $::maui::util::H6VeX [expr {$PG2JA * 16}] [expr {$PG2JA * 16 + 15}]]

            //4.计算crc32

            set hbA8n [format 0x%08x [expr {[zlib crc32 $data] & 0xffffffff}]]

            //5.使用EL0BW中的数据作为key 加密

            set data [tcltwofish::encrypt $::maui::util::EL0BW $data iv]

            //6. 前面填充四个字节的crc32以及选取iv的位置，共加了五个字节

            set YKL8w [binary format Ica* $hbA8n $PG2JA $data]

        } V77Ls]} {

            set ykaki $::errorCode

            set qXoNi $::errorInfo

            maui::util::debug "encryptPayload: error encrypting: $V77Ls"

            error $V77Ls $qXoNi $ykaki

        }

        return $YKL8w

    }

1

2

3

4

5

6

7

8

9

proc UOijU {data DeSRF} {

    //1. 将四字节的长度添加在数据前

    set data [binary format Ia* [string length $data] $data]

    //2. 计算末尾添加padding的长度

    set add [expr {($DeSRF - ([string length $data] % $DeSRF)) % $DeSRF}]

    //3. 生成随机padding并附加在末尾

    append data [qA4kM $add]

    return $data

}