求助，内网里一个大系统的魔改国密算法

发表于: 2024-7-8 17:22 3902

求助，内网里一个大系统的魔改国密算法

中文名go

2024-7-8 17:22

3902

需求

我是想做爬虫的，但是这个算法确实搞不定，水平有限，而且我总觉得我的思路不对，希望算法和爬虫大佬能给一些指点和思路。
我不懂算法，我之前的经验都是js里的算法提出来翻译成python，但是这次这个确实是硬茬。

情况说明

系统使用的是国密算法，SM2，SM3，SM4。
网页框架是Vue.js。
提交数据是2个参数：data 和 privateParam
参数生成的方法如下：

e是原文，类似于{"mgtOrgCode":"123456"}

单步跟进发现算法是魔改的，我目前只看了SM3的，相关情况是：
SG_sm3encrypt进入后是Lr函数，然后进到vr里面算了一通，最后结果是个64位字符串，
我尝试用AI把js翻译成python，翻译了十几次都没有成功，错误的地方大概是：
1、ProcessBlock里的

1 2	`for` `e` `in` `range(16,` `68):` `t.append(self.P1(t[e` `-` `16] ^ t[e` `-` `9] ^ Fr(t[e` `-` `3],` `15)) ^ Fr(t[e` `-` `13],` `7) ^ t[e` `-` `6])`

Fr(t[e - 3]出现index溢出

2、GetHex的

for o in range(0, 2 * len(e), 2):
    t[o >> 3] |= int(e[r]) << (24 - o % 8 * 4)
    r += 1

t[o >> 3]出现index溢出

3、死循环，算不出来。
下面我会把代码贴上。

代码部分

1、Lr函数如下：

function Lr(e) {
            if (void 0 != e && "" != e) {
                var t = S.enc.Utf8.parse(e)
                  , r = new vr;
                t = r.GetWords(t.toString()),
                r.BlockUpdate(t, 0, t.length);
                var o = new Array(32);
                r.DoFinal(o, 0);
                var n = r.GetHex(o).toString();
                return n
            }
        }

2、vr的结构如下：

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

function vr() {
    this.BYTE_LENGTH = 64,
        this.xBuf = [],
        this.xBufOff = 0,
        this.byteCount = 0,
        this.DIGEST_LENGTH = 32,
        this.v0 = [1937774191, 1226093241, 388252375, -628488704, -1452330820, 372324522, -477237683, -1325724082],
        this.v = [0, 0, 0, 0, 0, 0, 0, 0],
        this.v_ = [0, 0, 0, 0, 0, 0, 0, 0],
        this.X0 = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
        this.X = [68],
        this.xOff = 0,
        this.T_00_15 = 2043430169,
        this.T_16_63 = 2055708042,
        arguments.length > 0 ? this.InitDigest(arguments[0]) : this.Init()
}
 
vr.prototype = {
    Init: function () {
        this.xBuf = [0, 0, 0, 0],
            this.Reset()
    },
    InitDigest: function (e) {
        this.xBuf = [e.xBuf.length],
            Array.Copy(e.xBuf, 0, this.xBuf, 0, e.xBuf.length),
            this.xBufOff = e.xBufOff,
            this.byteCount = e.byteCount,
            Array.Copy(e.X, 0, this.X, 0, e.X.length),
            this.xOff = e.xOff,
            Array.Copy(e.v, 0, this.v, 0, e.v.length)
    },
    GetDigestSize: function () {
        return this.DIGEST_LENGTH
    },
    Reset: function () {
        this.byteCount = 0,
            this.xBufOff = 0,
            Array.Clear(this.xBuf, 0, this.xBuf.length),
            Array.Copy(this.v0, 0, this.v, 0, this.v0.length),
            this.xOff = 0,
            Array.Copy(this.X0, 0, this.X, 0, this.X0.length)
    },
    GetByteLength: function () {
        return this.BYTE_LENGTH
    },
    ProcessBlock: function () {
        var e, t = this.X, r = [64];
        for (e = 16; e < 68; e += 1)
            t[e] = this.P1(t[e - 16] ^ t[e - 9] ^ Fr(t[e - 3], 15)) ^ Fr(t[e - 13], 7) ^ t[e - 6];
        for (e = 0; e < 64; e += 1)
            r[e] = t[e] ^ t[e + 4];
        var o, n, i, s, a, u = this.v, c = this.v_;
        for (Array.Copy(u, 0, c, 0, this.v0.length),
            e = 0; e < 16; e += 1)
            a = Fr(c[0], 12),
                o = a + c[4] + Fr(this.T_00_15, e),
                o = Fr(o, 7),
                n = o ^ a,
                i = this.FF_00_15(c[0], c[1], c[2]) + c[3] + n + r[e],
                s = this.GG_00_15(c[4], c[5], c[6]) + c[7] + o + t[e],
                c[3] = c[2],
                c[2] = Fr(c[1], 9),
                c[1] = c[0],
                c[0] = i,
                c[7] = c[6],
                c[6] = Fr(c[5], 19),
                c[5] = c[4],
                c[4] = this.P0(s);
        for (e = 16; e < 64; e += 1)
            a = Fr(c[0], 12),
                o = a + c[4] + Fr(this.T_16_63, e),
                o = Fr(o, 7),
                n = o ^ a,
                i = this.FF_16_63(c[0], c[1], c[2]) + c[3] + n + r[e],
                s = this.GG_16_63(c[4], c[5], c[6]) + c[7] + o + t[e],
                c[3] = c[2],
                c[2] = Fr(c[1], 9),
                c[1] = c[0],
                c[0] = i,
                c[7] = c[6],
                c[6] = Fr(c[5], 19),
                c[5] = c[4],
                c[4] = this.P0(s);
        for (e = 0; e < 8; e += 1)
            u[e] ^= c[e];
        this.xOff = 0,
            Array.Copy(this.X0, 0, this.X, 0, this.X0.length)
    },
    ProcessWord: function (e, t) {
        var r = e[t] << 24;
        r |= (255 & e[t += 1]) << 16,
            r |= (255 & e[t += 1]) << 8,
            r |= 255 & e[t += 1],
            this.X[this.xOff] = r,
            16 == ++this.xOff && this.ProcessBlock()
    },
    ProcessLength: function (e) {
        this.xOff > 14 && this.ProcessBlock(),
            this.X[14] = this.URShiftLong(e, 32),
            this.X[15] = 4294967295 & e
    },
    IntToBigEndian: function (e, t, r) {
        t[r] = e >>> 24 & 255,
            t[r += 1] = e >>> 16 & 255,
            t[r += 1] = e >>> 8 & 255,
            t[r += 1] = 255 & e
    },
    DoFinal: function (e, t) {
        this.Finish();
        for (var r = 0; r < 8; r += 1)
            this.IntToBigEndian(this.v[r], e, t + 4 * r);
        return this.Reset(),
            this.DIGEST_LENGTH
    },
    Update: function (e) {
        this.xBuf[this.xBufOff++] = e,
            this.xBufOff == this.xBuf.length && (this.ProcessWord(this.xBuf, 0),
                this.xBufOff = 0),
            this.byteCount++
    },
    BlockUpdate: function (e, t, r) {
        while (0 != this.xBufOff && r > 0)
            this.Update(e[t]),
                t += 1,
                r -= 1;
        while (r > this.xBuf.length)
            this.ProcessWord(e, t),
                t += this.xBuf.length,
                r -= this.xBuf.length,
                this.byteCount += this.xBuf.length;
        while (r > 0)
            this.Update(e[t]),
                t += 1,
                r -= 1
    },
    Finish: function () {
        var e = this.byteCount << 3;
        this.Update(128);
        while (0 != this.xBufOff)
            this.Update(0);
        this.ProcessLength(e),
            this.ProcessBlock()
    },
    ROTATE: function (e, t) {
        return e << t | this.URShift(e, 32 - t)
    },
    P0: function (e) {
        return e ^ Fr(e, 9) ^ Fr(e, 17)
    },
    P1: function (e) {
        return e ^ Fr(e, 15) ^ Fr(e, 23)
    },
    FF_00_15: function (e, t, r) {
        return e ^ t ^ r
    },
    FF_16_63: function (e, t, r) {
        return e & t | e & r | t & r
    },
    GG_00_15: function (e, t, r) {
        return e ^ t ^ r
    },
    GG_16_63: function (e, t, r) {
        return e & t | ~e & r
    },
    URShift: function (e, t) {
        return console.error(e),
            (e > Int32.maxValue || e < Int32.minValue) && (console.error(e),
                e = Cr(e)),
            e >= 0 ? e >> t : (e >> t) + (2 << ~t)
    },
    URShiftLong: function (e, t) {
        var r, o = new E;
        if (o.fromInt(e),
            o.signum() >= 0)
            r = o.shiftRight(t).intValue();
        else {
            var n = new E;
            n.fromInt(2);
            var i = ~t
                , s = "";
            if (i < 0) {
                for (var a = 64 + i, u = 0; u < a; u += 1)
                    s += "0";
                var c = new E;
                c.fromInt(e >> t);
                var l = new E("10" + s, 2);
                s = l.toRadix(10);
                var f = l.add(c);
                r = f.toRadix(10)
            } else
                s = n.shiftLeft(~t).intValue(),
                    r = (e >> t) + s
        }
        return r
    },
    GetZ: function (e, t, r) {
        var o = S.enc.Utf8.parse(r)
            , n = 4 * o.words.length * 8;
        this.Update(n >> 8 & 255),
            this.Update(255 & n);
        var i = this.GetWords(o.toString());
        this.BlockUpdate(i, 0, i.length);
        var s = this.GetWords(e.curve.a.toBigInteger().toRadix(16))
            , a = this.GetWords(e.curve.b.toBigInteger().toRadix(16))
            , u = this.GetWords(e.getX().toBigInteger().toRadix(16))
            , c = this.GetWords(e.getY().toBigInteger().toRadix(16))
            , l = this.GetWords(t.substr(0, 64))
            , f = this.GetWords(t.substr(64, 64));
        this.BlockUpdate(s, 0, s.length),
            this.BlockUpdate(a, 0, a.length),
            this.BlockUpdate(u, 0, u.length),
            this.BlockUpdate(c, 0, c.length),
            this.BlockUpdate(l, 0, l.length),
            this.BlockUpdate(f, 0, f.length);
        var h = [this.GetDigestSize()];
        return this.DoFinal(h, 0),
            h
    },
    GetWords: function (e) {
        for (var t = [], r = e.length, o = 0; o < r; o += 2)
            t[t.length] = parseInt(e.substr(o, 2), 16);
        return t
    },
    GetHex: function (e) {
        for (var t = [], r = 0, o = 0; o < 2 * e.length; o += 2)
            t[o >>> 3] |= parseInt(e[r]) << 24 - o % 8 * 4,
                r += 1;
        var n = new S.lib.WordArray.init(t, e.length);
        return n
    }
}

3、vr内的Fr函数如下

function Fr(e, t) {
            return e << t | e >>> -t
        }

[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)

收藏・0

免费・0

支持

最新回复 (0)
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

中文名go

发帖

回帖

RANK

关注

私信

他的文章

求助，内网里一个大系统的魔改国密算法 3903

关于我们

联系我们

企业服务

看雪公众号