[讨论]反汇编2700行的对称加密算法,晕-软件逆向-看雪-安全社区|安全招聘|kanxue.com

[讨论]反汇编2700行的对称加密算法,晕

发表于: 2008-10-27 01:27 6251

[讨论]反汇编2700行的对称加密算法,晕

kafly

2008-10-27 01:27

6251

终于把它找出来了。这个应该怎么分析？代码在附件里。

附相关数据表：

005D88F8  00 04 01 01 00 00 00 00 00 00 01 00 04 04 01 01  ........
005D8908  04 00 01 01 04 04 01 00 04 00 00 00 00 00 01 00  ........
005D8918  00 04 00 00 00 04 01 01 04 04 01 01 00 04 00 00  .......
005D8928  04 04 00 01 04 00 01 01 00 00 00 01 04 00 00 00  ........
005D8938  04 04 00 00 00 04 00 01 00 04 00 01 00 04 01 00  ........
005D8948  00 04 01 00 00 00 01 01 00 00 01 01 04 04 00 01  .......
005D8958  04 00 01 00 04 00 00 01 04 00 00 01 04 00 01 00  ........
005D8968  00 00 00 00 04 04 00 00 04 04 01 00 00 00 00 01  ..........
005D8978  00 00 01 00 04 04 01 01 04 00 00 00 00 00 01 01  ........
005D8988  00 04 01 01 00 00 00 01 00 00 00 01 00 04 00 00  ..........
005D8998  04 00 01 01 00 00 01 00 00 04 01 00 04 00 00 01  ........
005D89A8  00 04 00 00 04 00 00 00 04 04 00 01 04 04 01 00  ........
005D89B8  04 04 01 01 04 00 01 00 00 00 01 01 04 04 00 01  .....
005D89C8  04 00 00 01 04 04 00 00 04 04 01 00 00 04 01 01  ......
005D89D8  04 04 00 00 00 04 00 01 00 04 00 01 00 00 00 00  ..........
005D89E8  04 00 01 00 00 04 01 00 00 00 00 00 04 00 01 01  .........
005D89F8  20 80 10 80 00 80 00 80 00 80 00 00 20 80 10 00   €€.€.€.€.. €.
005D8A08  00 00 10 00 20 00 00 00 20 00 10 80 20 80 00 80  ... ... .€ €.€
005D8A18  20 00 00 80 20 80 10 80 00 80 10 80 00 00 00 80   ..€ €€.€€...€
005D8A28  00 80 00 80 00 00 10 00 20 00 00 00 20 00 10 80  .€.€... ... .€
005D8A38  00 80 10 00 20 00 10 00 20 80 00 80 00 00 00 00  .€. .. €.€....
005D8A48  00 00 00 80 00 80 00 00 20 80 10 00 00 00 10 80  ...€.€.. €...€
005D8A58  20 00 10 00 20 00 00 80 00 00 00 00 00 80 10 00   .. ..€.....€.
005D8A68  20 80 00 00 00 80 10 80 00 00 10 80 20 80 00 00   €...€€..€ €..
005D8A78  00 00 00 00 20 80 10 00 20 00 10 80 00 00 10 00  .... €. .€...
005D8A88  20 80 00 80 00 00 10 80 00 80 10 80 00 80 00 00   €.€..€.€€.€..
005D8A98  00 00 10 80 00 80 00 80 20 00 00 00 20 80 10 80  ..€.€.€ ... €€
005D8AA8  20 80 10 00 20 00 00 00 00 80 00 00 00 00 00 80   €. ....€.....€
005D8AB8  20 80 00 00 00 80 10 80 00 00 10 00 20 00 00 80   €...€€... ..€
005D8AC8  20 00 10 00 20 80 00 80 20 00 00 80 20 00 10 00   .. €.€ ..€ ..
005D8AD8  00 80 10 00 00 00 00 00 00 80 00 80 20 80 00 00  .€......€.€ €..
005D8AE8  00 00 00 80 20 00 10 80 20 80 10 80 00 80 10 00  ...€ .€ €€.€.
005D8AF8  08 02 00 00 00 02 02 08 00 00 00 00 08 00 02 08  ........
005D8B08  00 02 00 08 00 00 00 00 08 02 02 00 00 02 00 08  .........
005D8B18  08 00 02 00 08 00 00 08 08 00 00 08 00 00 02 00  .........
005D8B28  08 02 02 08 08 00 02 00 00 00 02 08 08 02 00 00  ......
005D8B38  00 00 00 08 08 00 00 00 00 02 02 08 00 02 00 00  ..........
005D8B48  00 02 02 00 00 00 02 08 08 00 02 08 08 02 02 00  ......
005D8B58  08 02 00 08 00 02 02 00 00 00 02 00 08 02 00 08  .......
005D8B68  08 00 00 00 08 02 02 08 00 02 00 00 00 00 00 08  .........
005D8B78  00 02 02 08 00 00 00 08 08 00 02 00 08 02 00 00  ........
005D8B88  00 00 02 00 00 02 02 08 00 02 00 08 00 00 00 00  ..........
005D8B98  00 02 00 00 08 00 02 00 08 02 02 08 00 02 00 08  .......
005D8BA8  08 00 00 08 00 02 00 00 00 00 00 00 08 00 02 08  ..........
005D8BB8  08 02 00 08 00 00 02 00 00 00 00 08 08 02 02 08  .......
005D8BC8  08 00 00 00 08 02 02 00 00 02 02 00 08 00 00 08  ........
005D8BD8  00 00 02 08 08 02 00 08 08 02 00 00 00 00 02 08  .......
005D8BE8  08 02 02 00 08 00 00 00 08 00 02 08 00 02 02 00  .......
005D8BF8  01 20 80 00 81 20 00 00 81 20 00 00 80 00 00 00   €.?..?..€...
005D8C08  80 20 80 00 81 00 80 00 01 00 80 00 01 20 00 00  € €.?€..€. ..
005D8C18  00 00 00 00 00 20 80 00 00 20 80 00 81 20 80 00  ..... €.. €.?€.
005D8C28  81 00 00 00 00 00 00 00 80 00 80 00 01 00 80 00  ?......€.€..€.
005D8C38  01 00 00 00 00 20 00 00 00 00 80 00 01 20 80 00  .... ....€. €.
005D8C48  80 00 00 00 00 00 80 00 01 20 00 00 80 20 00 00  €.....€. ..€ ..
005D8C58  81 00 80 00 01 00 00 00 80 20 00 00 80 00 80 00  ?€....€ ..€.€.
005D8C68  00 20 00 00 80 20 80 00 81 20 80 00 81 00 00 00  . ..€ €.?€.?..
005D8C78  80 00 80 00 01 00 80 00 00 20 80 00 81 20 80 00  €.€..€.. €.?€.
005D8C88  81 00 00 00 00 00 00 00 00 00 00 00 00 20 80 00  ?........... €.
005D8C98  80 20 00 00 80 00 80 00 81 00 80 00 01 00 00 00  € ..€.€.?€....
005D8CA8  01 20 80 00 81 20 00 00 81 20 00 00 80 00 00 00   €.?..?..€...
005D8CB8  81 20 80 00 81 00 00 00 01 00 00 00 00 20 00 00  ?€.?...... ..
005D8CC8  01 00 80 00 01 20 00 00 80 20 80 00 81 00 80 00  .€. ..€ €.?€.
005D8CD8  01 20 00 00 80 20 00 00 00 00 80 00 01 20 80 00   ..€ ....€. €.
005D8CE8  80 00 00 00 00 00 80 00 00 20 00 00 80 20 80 00  €.....€.. ..€ €.
005D8CF8  00 01 00 00 00 01 08 02 00 00 08 02 00 01 00 42  ........B
005D8D08  00 00 08 00 00 01 00 00 00 00 00 40 00 00 08 02  .........@..
005D8D18  00 01 08 40 00 00 08 00 00 01 00 02 00 01 08 40  .@......@
005D8D28  00 01 00 42 00 00 08 42 00 01 08 00 00 00 00 40  ..B..B.....@
005D8D38  00 00 00 02 00 00 08 40 00 00 08 40 00 00 00 00  .....@..@....
005D8D48  00 01 00 40 00 01 08 42 00 01 08 42 00 01 00 02  ..@.B.B..
005D8D58  00 00 08 42 00 01 00 40 00 00 00 00 00 00 00 42  ..B..@.......B
005D8D68  00 01 08 02 00 00 00 02 00 00 00 42 00 01 08 00  .......B..
005D8D78  00 00 08 00 00 01 00 42 00 01 00 00 00 00 00 02  .....B......
005D8D88  00 00 00 40 00 00 08 02 00 01 00 42 00 01 08 40  ...@....B.@
005D8D98  00 01 00 02 00 00 00 40 00 00 08 42 00 01 08 02  .....@..B.
005D8DA8  00 01 08 40 00 01 00 00 00 00 00 02 00 00 08 42  .@........B
005D8DB8  00 01 08 42 00 01 08 00 00 00 00 42 00 01 08 42  .B.....B.B
005D8DC8  00 00 08 02 00 00 00 00 00 00 08 40 00 00 00 42  ........@...B
005D8DD8  00 01 08 00 00 01 00 02 00 01 00 40 00 00 08 00  ......@...
005D8DE8  00 00 00 00 00 00 08 40 00 01 08 02 00 01 00 40  ......@...@
005D8DF8  10 00 00 20 00 00 40 20 00 40 00 00 10 40 40 20  .. ..@ .@..@@
005D8E08  00 00 40 20 10 00 00 00 10 40 40 20 00 00 40 00  ..@ ...@@ ..@.
005D8E18  00 40 00 20 10 40 40 00 00 00 40 00 10 00 00 20  .@. @@...@...
005D8E28  10 00 40 00 00 40 00 20 00 00 00 20 10 40 00 00  .@..@. ... @..
005D8E38  00 00 00 00 10 00 40 00 10 40 00 20 00 40 00 00  .....@.@. .@..
005D8E48  00 40 40 00 10 40 00 20 10 00 00 00 10 00 40 20  .@@.@. ....@
005D8E58  10 00 40 20 00 00 00 00 10 40 40 00 00 40 40 20  .@ ....@@..@@
005D8E68  10 40 00 00 00 40 40 00 00 40 40 20 00 00 00 20  @...@@..@@ ...
005D8E78  00 40 00 20 10 00 00 00 10 00 40 20 00 40 40 00  .@. ....@ .@@.
005D8E88  10 40 40 20 00 00 40 00 10 40 00 00 10 00 00 20  @@ ..@.@....
005D8E98  00 00 40 00 00 40 00 20 00 00 00 20 10 40 00 00  ..@..@. ... @..
005D8EA8  10 00 00 20 10 40 40 20 00 40 40 00 00 00 40 20  .. @@ .@@...@
005D8EB8  10 40 40 00 00 40 40 20 00 00 00 00 10 00 40 20  @@..@@ .....@
005D8EC8  10 00 00 00 00 40 00 00 00 00 40 20 10 40 40 00  ....@....@ @@.
005D8ED8  00 40 00 00 10 00 40 00 10 40 00 20 00 00 00 00  .@...@.@. ....
005D8EE8  00 40 40 20 00 00 00 20 10 00 40 00 10 40 00 20  .@@ ... .@.@.
005D8EF8  00 00 20 00 02 00 20 04 02 08 00 04 00 00 00 00  .. .. .....
005D8F08  00 08 00 00 02 08 00 04 02 08 20 00 00 08 20 04  .... .. 
005D8F18  02 08 20 04 00 00 20 00 00 00 00 00 02 00 00 04   .. .......
005D8F28  02 00 00 00 00 00 00 04 02 00 20 04 02 08 00 00  ....... ..
005D8F38  00 08 00 04 02 08 20 00 02 00 20 00 00 08 00 04  .. .. ...
005D8F48  02 00 00 04 00 00 20 04 00 08 20 04 02 00 20 00  .... . . .
005D8F58  00 00 20 04 00 08 00 00 02 08 00 00 02 08 20 04  .. ..... 
005D8F68  00 08 20 00 02 00 00 00 00 00 00 04 00 08 20 00  . ........ .
005D8F78  00 00 00 04 00 08 20 00 00 00 20 00 02 08 00 04  .... ... ..
005D8F88  02 08 00 04 02 00 20 04 02 00 20 04 02 00 00 00  .. . ...
005D8F98  02 00 20 00 00 00 00 04 00 08 00 04 00 00 20 00  . ........ .
005D8FA8  00 08 20 04 02 08 00 00 02 08 20 00 00 08 20 04  . .. .. 
005D8FB8  02 08 00 00 02 00 00 04 02 08 20 04 00 00 20 04  .... .. 
005D8FC8  00 08 20 00 00 00 00 00 02 00 00 00 02 08 20 04  . ........ 
005D8FD8  00 00 00 00 02 08 20 00 00 00 20 04 00 08 00 00  .... ... ...
005D8FE8  02 00 00 04 00 08 00 04 00 08 00 00 02 00 20 00  ........ .
005D8FF8  40 10 00 10 00 10 00 00 00 00 04 00 40 10 04 10  @.......@
005D9008  00 00 00 10 40 10 00 10 40 00 00 00 00 00 00 10  ...@.@......
005D9018  40 00 04 00 00 00 04 10 40 10 04 10 00 10 04 00  @....@..
005D9028  00 10 04 10 40 10 04 00 00 10 00 00 40 00 00 00  .@....@...
005D9038  00 00 04 10 40 00 00 10 00 10 00 10 40 10 00 00  ..@....@..
005D9048  00 10 04 00 40 00 04 00 40 00 04 10 00 10 04 10  ..@..@..
005D9058  40 10 00 00 00 00 00 00 00 00 00 00 40 00 04 10  @..........@.
005D9068  40 00 00 10 00 10 00 10 40 10 04 00 00 00 04 00  @....@....
005D9078  40 10 04 00 00 00 04 00 00 10 04 10 00 10 00 00  @........
005D9088  40 00 00 00 40 00 04 10 00 10 00 00 40 10 04 00  @...@....@.
005D9098  00 10 00 10 40 00 00 00 40 00 00 10 00 00 04 10  ..@...@....
005D90A8  40 00 04 10 00 00 00 10 00 00 04 00 40 10 00 10  @.......@.
005D90B8  00 00 00 00 40 10 04 10 40 00 04 00 40 00 00 10  ....@@..@..
005D90C8  00 00 04 10 00 10 00 10 40 10 00 10 00 00 00 00  ....@.....
005D90D8  40 10 04 10 00 10 04 00 00 10 04 00 40 10 00 00  @....@..
005D90E8  40 10 00 00 40 00 04 00 00 00 00 10 00 10 04 10  @..@......
005D90F8  00 00 00 00 01 00 00 00 00 01 00 00 01 01 00 00  ............
005D9108  00 00 01 00 01 00 01 00 00 01 01 00 01 01 01 00  ........
005D9118  00 00 00 01 01 00 00 01 00 01 00 01 01 01 00 01  ........
005D9128  00 00 01 01 01 00 01 01 00 01 01 01 01 01 01 01  ....
005D9138  00 00 00 00 00 00 00 01 00 00 01 00 00 00 01 01  ............
005D9148  00 01 00 00 00 01 00 01 00 01 01 00 00 01 01 01  ........
005D9158  01 00 00 00 01 00 00 01 01 00 01 00 01 00 01 01  ........
005D9168  01 01 00 00 01 01 00 01 01 01 01 00 01 01 01 01  ....

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课

#加密算法

上传的附件：

算法.rar （11.12kb，36次下载）

收藏・1

免费・0

支持

最新回复 (7)
forgot 雪币： 6075 活跃值： (2236) 能力值： (RANK：1060 ) 在线值：发帖 155 回帖 3771 粉丝 16 关注私信	forgot 26 2 楼直觉告诉我是DES 2008-10-27 01:41 0
kafly 雪币： 200 活跃值： (46) 能力值： ( LV2，RANK：10 ) 在线值：发帖 13 回帖 77 粉丝 0 关注私信	kafly 3 楼解密过程为什么是8位一次呢? DES不是应该64位一次么? 2008-11-3 23:01 0
kafly 雪币： 200 活跃值： (46) 能力值： ( LV2，RANK：10 ) 在线值：发帖 13 回帖 77 粉丝 0 关注私信	kafly 4 楼还是DES,,上面的数据表是S盒子... 咋找到算密钥的地方呢。16次迭代,,,,你在哪呢。... 2008-11-4 02:29 0
aaa2520 雪币： 156 活跃值： (48) 能力值： ( LV4，RANK：50 ) 在线值：发帖 107 回帖 401 粉丝 1 关注私信	aaa2520 1 5 楼在进入这个函数的上几行看看,有没有可以利用的信息 2008-11-4 08:41 0
ccfer 雪币： 8209 活跃值： (4518) 能力值： ( LV15，RANK：2473 ) 在线值：发帖 84 回帖 1529 粉丝 106 关注私信	ccfer 16 6 楼 8个字节啊,不就是64位吗 2008-11-4 09:28 0
kafly 雪币： 200 活跃值： (46) 能力值： ( LV2，RANK：10 ) 在线值：发帖 13 回帖 77 粉丝 0 关注私信	kafly 7 楼我断在读密文file的openfile函数上跟进去，眼都看花了。尝试了内存断点，可不知道在哪个断到哪个区块，现在只知道S盒的内存地址，在那一断就把KEY给丢了，也没找到KEY的内存地址。。 KEY计算过程有没有特征码？ 2008-11-4 10:48 0
Isaiah 雪币： 331 活跃值： (56) 能力值： ( LV13，RANK：410 ) 在线值：发帖 68 回帖 1293 粉丝 2 关注私信	Isaiah 10 8 楼 DES用KEY初始化SBOX.找初始化SBOX的函数。参数就是KEY 2008-11-4 12:33 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复

kafly

发帖

回帖

RANK

关注

私信

他的文章

关于我们

联系我们

企业服务

看雪公众号

最新回复 (7)
forgot 雪币： 6075 活跃值： (2236) 能力值： (RANK：1060 ) 在线值：发帖 155 回帖 3771 粉丝 16 关注私信	forgot 26 2 楼直觉告诉我是DES 2008-10-27 01:41 0
kafly 雪币： 200 活跃值： (46) 能力值： ( LV2，RANK：10 ) 在线值：发帖 13 回帖 77 粉丝 0 关注私信	kafly 3 楼解密过程为什么是8位一次呢? DES不是应该64位一次么? 2008-11-3 23:01 0
kafly 雪币： 200 活跃值： (46) 能力值： ( LV2，RANK：10 ) 在线值：发帖 13 回帖 77 粉丝 0 关注私信	kafly 4 楼还是DES,,上面的数据表是S盒子... 咋找到算密钥的地方呢。16次迭代,,,,你在哪呢。... 2008-11-4 02:29 0
aaa2520 雪币： 156 活跃值： (48) 能力值： ( LV4，RANK：50 ) 在线值：发帖 107 回帖 401 粉丝 1 关注私信	aaa2520 1 5 楼在进入这个函数的上几行看看,有没有可以利用的信息 2008-11-4 08:41 0
ccfer 雪币： 8209 活跃值： (4518) 能力值： ( LV15，RANK：2473 ) 在线值：发帖 84 回帖 1529 粉丝 106 关注私信	ccfer 16 6 楼 8个字节啊,不就是64位吗 2008-11-4 09:28 0
kafly 雪币： 200 活跃值： (46) 能力值： ( LV2，RANK：10 ) 在线值：发帖 13 回帖 77 粉丝 0 关注私信	kafly 7 楼我断在读密文file的openfile函数上跟进去，眼都看花了。尝试了内存断点，可不知道在哪个断到哪个区块，现在只知道S盒的内存地址，在那一断就把KEY给丢了，也没找到KEY的内存地址。。 KEY计算过程有没有特征码？ 2008-11-4 10:48 0
Isaiah 雪币： 331 活跃值： (56) 能力值： ( LV13，RANK：410 ) 在线值：发帖 68 回帖 1293 粉丝 2 关注私信	Isaiah 10 8 楼 DES用KEY初始化SBOX.找初始化SBOX的函数。参数就是KEY 2008-11-4 12:33 0
	游客登录 \| 注册方可回帖回帖表情雪币赚取及消费高级回复