某加密样本 Trace分析 - 2

Security Classification: 【C-1】 | Publish Time:2024-02-20 | Category:Test Notes | Edit

Expiry Notice: The article was published three months ago. Please independently assess the validity of the technical methods and code mentioned within. :)

AI摘要:该文章展示了如何从加密结果中找到明文入参。首先，通过分析加密过程，确定了明文的第一个分组m[0]为0xfeedfacf，并确认该值对应Mach-O文件的魔数头。文章提到了一条加载指令，显示该值从内存地址0x11f4ac000加载。接着，分析了该地址的数据装载过程，发现填充过程中有大量0填充，且最终确认0xfeedfacf为明文的前几个字节。通过正则匹配和使用CyberChef进行哈希，结果一致，证明md5算法未被修改。最终结论为该样本用于获取Mach-O文件的md5值。 --- (来自模型:gpt-4o-mini-2024-07-18)

© Copyright: This article is an original work and the copyright belongs to the  Depy's docs  unless marked as Reproduced

Please contact the blogger for authorization to reprint