某样本算法分析

Security Classification: 【C-1】 | Publish Time:2024-02-23 | Category:Test Notes | Edit
Old Version | Diff |
Expiry Notice: The article was published three months ago. Please independently assess the validity of the technical methods and code mentioned within. :)

AI Summary: 本文详细分析了一个样本sign值的产生算法，主要分为静态分析、模拟执行和算法复盘三个部分。 1. **静态分析**：分析了Java函数`Java_com_yuanrenxue_match2022_fragment_challenge_ChallengeTwoFragment_sign`的实现。该函数首先对输入进行PKCS#7填充，然后使用AES S-Box进行处理，生成16字节的输出。Python实现与汇编结果一致，验证了算法的正确性。 2. **模拟执行**：使用unidbg进行断点调试，确认了算法的执行流程和内存布局。发现输入经过几轮变换和操作后，最终得到的值会作为下一步的输入。执行循环的过程中，明文输入与填充内容结合，更新栈上值，导致输出结果的变化。 3. **sub_C8C分析**：该函数涉及到3字节为一组的处理，并且使用标准Base64编码。通过对照unidbg的模拟结果，确认了Base64编码的正确性。最后，算法复盘总结了整个流程，包括明文填充、生成自定义hash、合并填充内容与hash，最后进行Base64编码。整体分析保证了对sign值产生算法的全面理解。 --- (From Model:gpt-4o-mini-2024-07-18)

## 背景

样本sign值的产生算法。

## 静态分析

找到静态绑定的函数

`Java_com_yuanrenxue_match2022_fragment_challenge_ChallengeTwoFragment_sign`

![](https://img.meituan.net/imgupload/e643706141f0a53952316c6c0cf561cd146939.png)

入参进入sub_AE0(v4, &v7);

```
padLength = strlen(a1);                       // 获取入参长度
  v5 = (int8x16_t *)malloc((int)padLength + 16);// 开辟长度+16的空间
  v6 = v5;
  if ( padLength )                              // 存在v4
    memcpy(v5, a1, padLength);                  // 把入参拷贝至v5
  if ( (padLength & 0xF) != 16 )                // 对16取余，是否有值，有值就开始填充
  {
    memset((char *)v6 + padLength, 16 - (padLength & 0xF), 16 - (padLength & 0xF));// PKCS7 填充
    padLength = padLength - (padLength & 0xF) + 16;// 填充后长度
  }
```
函数以16为单位进行分组，然后根据余数进行填充，填充方式 PKCS#7。

填充完毕进入一个循环逻辑，用到了aes的sbox。

```
  if ( padLength )
  {
    count1 = 0LL;
    v8 = 0;
    message = (char *)v6;
    do
    {
      for ( i = 0LL; i != 16; ++i )
      {
        v8 = *((_BYTE *)&v27 + i) ^ byte_E73[(unsigned __int8)(message[i] ^ v8)];
        *((_BYTE *)&v27 + i) = v8;
      }
      v11 = count1++ == (unsigned __int64)(padLength - 1) >> 4;
      message += 16;
    }
    while ( !v11 );                             // 分组大循环
    v12 = v27;
    v13 = v28;
    v14 = BYTE1(v28);
    v15 = BYTE2(v28);
    v16 = BYTE3(v28);
  }
```
总结方法：
1、v8进行循环变化，不断影响v27中的值
2、v27的值最终只和最后一个分组的值+当时的v8有关

根据伪代码写出python代码：

```python
from Crypto.Util.Padding import pad
from Crypto.Cipher import AES
import binascii

def apply_pkcs7_padding(input_string, block_size=16):
    # Ensure the input is in bytes
    if isinstance(input_string, str):
        input_string = input_string.encode('utf-8')

# Apply PKCS#7 padding
    padded_data = pad(input_string, block_size, style='pkcs7')

return padded_data

# Example usage
input_string = "1:17070096491:17070096491:1707009649"
block_size = 16  # Block size for AES (128 bits)
padded_string = apply_pkcs7_padding(input_string, block_size)

# Convert to a hex representation for display purposes
padded_hex = binascii.hexlify(padded_string)

byte_E73 = [
    0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,
    0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,
    0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,
    0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,
    0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,
    0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,
    0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8,
    0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2,
    0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,
    0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB,
    0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79,
    0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,
    0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,
    0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E,
    0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,
    0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16
]

paddingLength = len(padded_string);
count1 = 0
v8 = 0
v27 = [0] * 16
message_index = 0
while True:
    for i in range(16):
        v8 = v27[i] ^ byte_E73[padded_string[message_index+i] ^ v8]
        v27[i] = v8
    message_index += 16
    v11 = count1 == (paddingLength - 1) >> 4
    print(v11)
    count1 += 1
    if v11:
        break
hex_string = ''.join(format(byte, '02X') for byte in v27)
```
入参：1:17070096491:17070096491:1707009649
结果：C6E5B898303AD28762F97DAB99E2389C

## 模拟执行

用unidbg进行断点调试，模拟执行。

![](https://img.meituan.net/imgupload/c23dab6e1f8fdc75a671549895f37c66111228.png)

v27在这个位置赋值给v12，看一下指令：

![](https://img.meituan.net/imgupload/14c3b417e7a1717e26e631a248d8c36f77331.png)

0xbbc这个位置做了ldr操作，赋值给d0寄存器。

unidbg添加代码：

```
        emulator.attach().addBreakPoint(module.base+0xbbc);
        emulator.traceCode(module.base,module.base+module.size);
```
在这个偏移位置进行断点，并打印tracecode。

![](https://img.meituan.net/imgupload/59cb092ac89f8a6b38dfac7b1ede081e50015.png)

在这个位置取值ldr，m0xbffff668查看他的值。

![](https://img.meituan.net/imgupload/1dd80ddabd16e01c827e0db755c2350633640.png)

发现hex一致。说明上面的算法没问题。

接着分析算法

![](https://img.meituan.net/imgupload/fd3654436949e8204df4a91946760a4532070.png)

看着很奇怪，查看汇编

![](https://img.meituan.net/imgupload/626e894c50fa780b6835db606c1b77fa55221.png)

![](https://img.meituan.net/imgupload/af71b034e1aed9e169aea229b30b883b5893.png)

```
.text:0000000000000BBC                 LDR             D0, [SP,#40]
.text:0000000000000BC0                 LDRB            W11, [SP,#48]
.text:0000000000000BC4                 LDRB            W10, [SP,#49]
.text:0000000000000BC8                 LDRB            W9, [SP,#50]
.text:0000000000000BCC                 LDRB            W8, [SP,#51]
```
 将SP,#40开始取8个字节存入d0寄存器，ldrb是取一个字节，分别取9、10、11、12字节。分别存入w8-w11寄存器。

![](https://img.meituan.net/imgupload/2e14cc211987705cbbcb208e129e7a6450599.png)

后续让v17 为v6数据的地址，分别把8、9、10、11字节赋值为前面保存的值。也就是取加密后结果的9-12个字节。

后面byte456以及hibyte继续拿13-16字节，就不赘述了。

![](https://img.meituan.net/imgupload/9267fbac51772d21f87ae2c21260c251208900.png)

把d0 strb进去（前8字节），后续依次strb前面13-16字节的值。此时x12寄存器会保存加密结果的地址。

![](https://img.meituan.net/imgupload/954e51cbb077b798cb1fc6cfa46245b9217799.png)

查看内存布局：

![](https://img.meituan.net/imgupload/50cb4e37b0901d9b37649c1bf0ed432127630.png)

反复改变输入发现布局均为如下规律：

明文输入+pkcs#7填充+校验hash（16字节）

继续进入循环，首先做了分组长度计算：

![](https://img.meituan.net/imgupload/f61f79680d1af21154650faa3106bc4e18106.png)

padlength是之前的填充后的字节长度，想以16字节为一组向上取整，所以对padlength+了15并做了右移四位的操作。由于前面计算存在hash校验位，所以再对结果+了1。

![](https://img.meituan.net/imgupload/4abbb95deb17a32f1abcd8ce4138b48f9318.png)

从 X20 寄存器指向的内存地址加载128位（16字节）的数据到 Q0 寄存器。Q0 是一个向量寄存器，常用于浮点数和 SIMD（单指令多数据）操作。
加载操作完成后，自动将 X20 寄存器的值增加16（即0x10）。

后续将q0寄存器的值装载到sp指针上，并且将x1、x0、x2寄存器分别保存sp、sp+24、sp+24的地址，作为函数入参进入sub_A40。

![](https://img.meituan.net/imgupload/d03f00c46eb9f70de3dc054b09766c0611072.png)

这里开辟了48字节大小的空间，分成三部分：
第一部分是参数1的值
第二部分是参数2的值
第三部分是参数1和参数2异或之后的值。

之后进入do while+for的循环嵌套：

![](https://img.meituan.net/imgupload/496e9d15ae4cb4ee8c3edbf3525d69ec12361.png)

写出对应的python脚本：

```
byte_E73 = [0x63,0x7c,0x77,0x7b,0xf2,0x6b,0x6f,0xc5,0x30,0x01,0x67,0x2b,0xfe,0xd7,0xab,0x76,0xca,0x82,0xc9,0x7d,0xfa,0x59,0x47,0xf0,0xad,0xd4,0xa2,0xaf,0x9c,0xa4,0x72,0xc0,0xb7,0xfd,0x93,0x26,0x36,0x3f,0xf7,0xcc,0x34,0xa5,0xe5,0xf1,0x71,0xd8,0x31,0x15,0x04,0xc7,0x23,0xc3,0x18,0x96,0x05,0x9a,0x07,0x12,0x80,0xe2,0xeb,0x27,0xb2,0x75,0x09,0x83,0x2c,0x1a,0x1b,0x6e,0x5a,0xa0,0x52,0x3b,0xd6,0xb3,0x29,0xe3,0x2f,0x84,0x53,0xd1,0x00,0xed,0x20,0xfc,0xb1,0x5b,0x6a,0xcb,0xbe,0x39,0x4a,0x4c,0x58,0xcf,0xd0,0xef,0xaa,0xfb,0x43,0x4d,0x33,0x85,0x45,0xf9,0x02,0x7f,0x50,0x3c,0x9f,0xa8,0x51,0xa3,0x40,0x8f,0x92,0x9d,0x38,0xf5,0xbc,0xb6,0xda,0x21,0x10,0xff,0xf3,0xd2,0xcd,0x0c,0x13,0xec,0x5f,0x97,0x44,0x17,0xc4,0xa7,0x7e,0x3d,0x64,0x5d,0x19,0x73,0x60,0x81,0x4f,0xdc,0x22,0x2a,0x90,0x88,0x46,0xee,0xb8,0x14,0xde,0x5e,0x0b,0xdb,0xe0,0x32,0x3a,0x0a,0x49,0x06,0x24,0x5c,0xc2,0xd3,0xac,0x62,0x91,0x95,0xe4,0x79,0xe7,0xc8,0x37,0x6d,0x8d,0xd5,0x4e,0xa9,0x6c,0x56,0xf4,0xea,0x65,0x7a,0xae,0x08,0xba,0x78,0x25,0x2e,0x1c,0xa6,0xb4,0xc6,0xe8,0xdd,0x74,0x1f,0x4b,0xbd,0x8b,0x8a,0x70,0x3e,0xb5,0x66,0x48,0x03,0xf6,0x0e,0x61,0x35,0x57,0xb9,0x86,0xc1,0x1d,0x9e,0xe1,0xf8,0x98,0x11,0x69,0xd9,0x8e,0x94,0x9b,0x1e,0x87,0xe9,0xce,0x55,0x28,0xdf,0x8c,0xa1,0x89,0x0d,0xbf,0xe6,0x42,0x68,0x41,0x99,0x2d,0x0f,0xb0,0x54,0xbb,0x16] 
v6 = [0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x31,0x3a,0x31,0x37,0x30,0x37,0x30,0x30,0x39,0x36,0x34,0x39,0x31,0x31,0x3a,0x31,0x31,0x3a,0x31,0x37,0x30,0x37,0x30,0x30,0x39,0x36,0x34,0x39,0x31,0x31,0x3a,0x31]  
v7 = 0
v8 = 0  # 初始化v8，具体值取决于上下文

# 执行循环操作
while v7 != 20:
    for i in range(0,48):
        v8 = v8 & 0xff
        v8 = v6[i] ^ byte_E73[v8]
        v6[i] = v8
    v8 += v7
    v7 += 1
print(bytearray(v6).hex()[:32])
```

结果如下：

```
d37cc271b9de69c5ea59734d6632f350
```
使用unidbg进行验证，因为第一次进入循环 v6为16字节0，第一组明文，0与第一组明文异或结果还是第一组明文。最后得到的值取16字节长度。

![](https://img.meituan.net/imgupload/55de215bafe57cfb09a108287d679b4215715.png)

![](https://img.meituan.net/imgupload/a01a4a3434a4d39971562e8bed1b4b8074633.png)

小端序，结果一致。

此时获取的内容，会作为前置函数新的入参。我们可以看看ae0函数每次的入参来看：

![](https://img.meituan.net/imgupload/bf0480a7abf492d5644510135de0cf1522563.png)

结果正好是之前的入参，抽象概括就是栈上某个位置存在16字节内容，根据填充内容、以及循环变换不断更新。

1、明文输入+pkcs#7填充+校验hash（16字节）
2、分组进入循环，更改栈上值

写出对应代码并比对结果：

![](https://img.meituan.net/imgupload/0cdfb3656beb309a746b2b3c1564637132067.png)

![](https://img.meituan.net/imgupload/0f0cbc4c01f63ef0c2298b9aa88af63a25268.png)

随机抽两个分组都对上了，改变入参也一致，算法至此没有问题。

最后一个结果不会进入循环函数，但是会作为新的函数入参

![](https://img.meituan.net/imgupload/41c4bde2f0e09461369db743e9d618b25520.png)

将结果赋值给入参2，入参2作为c8c函数入参。

![](https://img.meituan.net/imgupload/a0f3cf20d39be5288bd075b53728f95b10269.png)

用unidbg对照发现一致。

![](https://img.meituan.net/imgupload/51f4b7cdad93e5325e8999dc38ffc0cf31039.png)

## sub_C8C

![](https://img.meituan.net/imgupload/1bf18f0ca56ff7f4cb1dcffef5bd1b0769366.png)

三个特征

1、出现了3个字节为一组，最终拓展成4字节长度，并向后追加

![](https://img.meituan.net/imgupload/2285e6724e151a25d7ad0ced225ab37927537.png)

2、码表是标准base64码表

![](https://img.meituan.net/imgupload/8a49aab2c3d1e505a5a4cf5af732635627469.png)

3、末尾某些场景下追加等号

![](https://img.meituan.net/imgupload/fe49e93fd19da6d2054c8bfbb95d6c7422392.png)

可以合理怀疑他是一个base64算法，直接用cyberchef验证

![](https://img.meituan.net/imgupload/759858d13e506dc8dfccf70617f7a88038765.png)

去除断点，查看unidbg模拟结果

![](https://img.meituan.net/imgupload/cf93467a4a1ccc21ab07e1250cb839686846.png)

完全一致

## 算法复盘

1、明文进行pkcs#7填充
2、自定义hash算法，获取填充后内容hash，并且算法用到了aes的sbox
3、合并填充后的内容与hash
4、进入自定义hash算法2，获取16字节长度hash
5、使用base64进行编码

Web3 Info

The ownership of the data in this article is secured by blockchain encryption technology and smart contracts, and is solely owned by the creator.

Comment List

Comment

© Copyright: This article is an original work and the copyright belongs to the Depy's docs unless marked as Reproduced

Please contact the blogger for authorization to reprint

某样本算法分析

© Copyright: This article is an original work and the copyright belongs to the Depy's docs unless marked as ReproducedPlease contact the blogger for authorization to reprint

© Copyright: This article is an original work and the copyright belongs to the Depy's docs unless marked as Reproduced

Please contact the blogger for authorization to reprint