1.分析#

Flutter#

依旧是blutter恢复符号找到关键的函数一大坨不过可以看出是从另一个so获取key，然后setkeys 不过关于密码的逻辑不必关心，因为他会把key赋值给一个成员变量，我们后面可以直接读取到继续往后看显然这里肯定会传一个类似实例的东西，借助blutter自带的frida脚本

1
function onLibappLoaded() {
2
    const fn_addr = 0x28c6a8;
3
    Interceptor.attach(libapp.add(fn_addr), {
4
        onEnter: function () {
5
            init(this.context);
6
            let objPtr = getArg(this.context, 1);
7
            const [tptr, cls, values] = getTaggedObjectValue(objPtr);
8
            console.log(
9
                `${cls.name}@${tptr.toString().slice(2)} =`,
10
                JSON.stringify(values, null, 2)
11
            );
12
        },
13
    });
14
}

可以直接读到key和mode 不过试了一下，标准的aes ecb并不能产生相同结果继续往下看 aesEncryptBlock这个函数是加密的主函数可以看出addRoundKey和mixColumns的顺序调换了但是还是不能得到正确结果继续往里翻发现，subBytes， mixColumns， _ltable均有这种赋值操作，正好256个，疑似sbox 我们将这些值均除以2（flutter的整数貌似都是*2存储的）测试下来，subBytes这里的是真正的sbox

1
typedef struct
2
{
3
  uint32_t eK[44], dK[44]; // encKey, decKey
4
  int Nr;                  // 10 rounds
5
} AesKey;
6

7
#define BLOCKSIZE 16 // AES-128分组长度为16字节
8

9
// uint8_t y[4] -> uint32_t x
10
#define LOAD32H(x, y)                                                             \
11
  do                                                                              \
12
  {                                                                               \
13
    (x) = ((uint32_t)((y)[0] & 0xff) << 24) | ((uint32_t)((y)[1] & 0xff) << 16) | \
14
          ((uint32_t)((y)[2] & 0xff) << 8) | ((uint32_t)((y)[3] & 0xff));         \
15
  } while (0)
16

17
// uint32_t x -> uint8_t y[4]
18
#define STORE32H(x, y)                      \
19
  do                                        \
20
  {                                         \
21
    (y)[0] = (uint8_t)(((x) >> 24) & 0xff); \
22
    (y)[1] = (uint8_t)(((x) >> 16) & 0xff); \
23
    (y)[2] = (uint8_t)(((x) >> 8) & 0xff);  \
24
    (y)[3] = (uint8_t)((x) & 0xff);         \
25
  } while (0)
26

27
// 从uint32_t x中提取从低位开始的第n个字节
28
#define BYTE(x, n) (((x) >> (8 * (n))) & 0xff)
29

30
// 密钥扩展中的SubWord(RotWord(temp),字节替换然后循环左移1位
31
#define MIX(x) (((S[BYTE(x, 2)] << 24) & 0xff000000) ^ ((S[BYTE(x, 1)] << 16) & 0xff0000) ^ \
32
                ((S[BYTE(x, 0)] << 8) & 0xff00) ^ (S[BYTE(x, 3)] & 0xff))
33

34
// uint32_t x循环左移n位
35
#define ROF32(x, n) (((x) << (n)) | ((x) >> (32 - (n))))
36
// uint32_t x循环右移n位
37
#define ROR32(x, n) (((x) >> (n)) | ((x) << (32 - (n))))
38

39
// AES-128轮常量,无符号长整型
40
static const uint32_t rcon[10] = {
41
    0x01000000UL, 0x02000000UL, 0x04000000UL, 0x08000000UL, 0x10000000UL,
42
    0x20000000UL, 0x40000000UL, 0x80000000UL, 0x1B000000UL, 0x36000000UL};
43
// S盒
44
unsigned char S[256] = {32, 123, 24, 167, 66, 68, 215, 74, 205, 50, 209, 236, 243, 129, 165, 137, 14, 145, 75, 240, 233, 93, 141, 245, 70, 252, 49, 54, 182, 172, 155, 185, 38, 9, 230, 64, 212, 176, 81, 79, 156, 62, 231, 121, 48, 136, 177, 60, 122, 92, 211, 20, 90, 171, 86, 192, 4, 41, 208, 59, 31, 249, 163, 87, 0, 138, 132, 22, 244, 26, 234, 100, 166, 214, 46, 190, 47, 23, 196, 224, 30, 2, 58, 34, 143, 159, 203, 168, 44, 103, 52, 37, 213, 255, 239, 246, 226, 170, 217, 114, 254, 206, 161, 120, 133, 150, 42, 119, 202, 193, 55, 116, 162, 94, 108, 253, 184, 77, 125, 112, 179, 221, 207, 113, 115, 97, 248, 25, 72, 227, 99, 51, 61, 21, 174, 152, 229, 128, 189, 188, 130, 198, 148, 1, 228, 222, 6, 80, 149, 223, 71, 247, 144, 139, 69, 154, 110, 7, 173, 28, 53, 131, 104, 3, 111, 91, 183, 251, 29, 197, 16, 124, 216, 106, 204, 105, 142, 36, 76, 57, 180, 160, 11, 82, 232, 169, 178, 140, 10, 191, 40, 134, 109, 175, 218, 65, 250, 117, 181, 67, 195, 96, 98, 43, 85, 242, 158, 45, 18, 35, 13, 219, 107, 199, 56, 127, 95, 151, 8, 237, 225, 187, 238, 157, 210, 146, 73, 63, 220, 88, 135, 194, 186, 153, 201, 78, 241, 33, 235, 19, 101, 89, 118, 12, 200, 5, 164, 84, 147, 27, 102, 17, 39, 83, 126, 15};
45

46
// 逆S盒
47
unsigned char inv_S[256] = {64, 143, 81, 163, 56, 245, 146, 157, 218, 33, 188, 182, 243, 210, 16, 255, 170, 251, 208, 239, 51, 133, 67, 77, 2, 127, 69, 249, 159, 168, 80, 60, 0, 237, 83, 209, 177, 91, 32, 252, 190, 57, 106, 203, 88, 207, 74, 76, 44, 26, 9, 131, 90, 160, 27, 110, 214, 179, 82, 59, 47, 132, 41, 227, 35, 195, 4, 199, 5, 154, 24, 150, 128, 226, 7, 18, 178, 117, 235, 39, 147, 38, 183, 253, 247, 204, 54, 63, 229, 241, 52, 165, 49, 21, 113, 216, 201, 125, 202, 130, 71, 240, 250, 89, 162, 175, 173, 212, 114, 192, 156, 164, 119, 123, 99, 124, 111, 197, 242, 107, 103, 43, 48, 1, 171, 118, 254, 215, 137, 13, 140, 161, 66, 104, 191, 230, 45, 15, 65, 153, 187, 22, 176, 84, 152, 17, 225, 248, 142, 148, 105, 217, 135, 233, 155, 30, 40, 223, 206, 85, 181, 102, 112, 62, 246, 14, 72, 3, 87, 185, 97, 53, 29, 158, 134, 193, 37, 46, 186, 120, 180, 198, 28, 166, 116, 31, 232, 221, 139, 138, 75, 189, 55, 109, 231, 200, 78, 169, 141, 213, 244, 234, 108, 86, 174, 8, 101, 122, 58, 10, 224, 50, 36, 92, 73, 6, 172, 98, 194, 211, 228, 121, 145, 149, 79, 220, 96, 129, 144, 136, 34, 42, 184, 20, 70, 238, 11, 219, 222, 94, 19, 236, 205, 12, 68, 23, 95, 151, 126, 61, 196, 167, 25, 115, 100, 93};
48

49
/* copy in[16] to state[4][4] */
50
int loadStateArray(uint8_t (*state)[4], const uint8_t *in)
51
{
52
  for (int i = 0; i < 4; ++i)
53
  {
54
    for (int j = 0; j < 4; ++j)
55
    {
56
      state[j][i] = *in++;
57
    }
58
  }
59
  return 0;
60
}
61

62
/* copy state[4][4] to out[16] */
63
int storeStateArray(uint8_t (*state)[4], uint8_t *out)
64
{
65
  for (int i = 0; i < 4; ++i)
66
  {
67
    for (int j = 0; j < 4; ++j)
68
    {
69
      *out++ = state[j][i];
70
    }
71
  }
72
  return 0;
73
}
74

75
// 密钥扩展，只接受16字初始密钥
76
int keyExpansion(const uint8_t *key, uint32_t keyLen, AesKey *aesKey)
77
{
78

79
  if (NULL == key || NULL == aesKey)
80
  {
81
    printf("keyExpansion param is NULL\n");
82
    return -1;
83
  }
84

85
  if (keyLen != 16)
86
  {
87
    printf("keyExpansion keyLen = %d, Not support.\n", keyLen);
88
    return -1;
89
  }
90

91
  uint32_t *w = aesKey->eK; // 加密密钥
92
  uint32_t *v = aesKey->dK; // 解密密钥
93

94
  // 扩展密钥长度44=4*(10+1)个字,原始密钥128位，4个32位字，Nb*(Nr+1)
95

96
  /* W[0-3],前4个字为原始密钥 */
97
  for (int i = 0; i < 4; ++i)
98
  {
99
    LOAD32H(w[i], key + 4 * i);
100
  }
101

102
  /* W[4-43] */
103
  // temp=w[i-1];tmp=SubWord(RotWord(temp))xor Rcon[i/4] xor w[i-Nk]
104
  for (int i = 0; i < 10; ++i)
105
  {
106
    w[4] = w[0] ^ MIX(w[3]) ^ rcon[i];
107
    w[5] = w[1] ^ w[4];
108
    w[6] = w[2] ^ w[5];
109
    w[7] = w[3] ^ w[6];
110
    w += 4;
111
  }
112

113
  w = aesKey->eK + 44 - 4;
114
  // 解密密钥矩阵为加密密钥矩阵的倒序，方便使用，把ek的11个矩阵倒序排列分配给dk作为解密密钥
115
  // 即dk[0-3]=ek[41-44], dk[4-7]=ek[37-40]... dk[41-44]=ek[0-3]
116
  for (int j = 0; j < 11; ++j)
117
  {
118
    for (int i = 0; i < 4; ++i)
119
    {
120
      v[i] = w[i];
121
    }
122
    w -= 4;
123
    v += 4;
124
  }
125

126
  return 0;
127
}
128

129
// 轮密钥加
130
int addRoundKey(uint8_t (*state)[4], const uint32_t *key)
131
{
132
  uint8_t k[4][4];
133

134
  /* i: row, j: col */
135
  for (int i = 0; i < 4; ++i)
136
  {
137
    for (int j = 0; j < 4; ++j)
138
    {
139
      k[i][j] = (uint8_t)BYTE(key[j], 3 - i); /* 把 uint32 key[4] 先转换为矩阵 uint8 k[4][4] */
140
      state[i][j] ^= k[i][j];
141
    }
142
  }
143

144
  return 0;
145
}
146

147
// 字节替换
148
int subBytes(uint8_t (*state)[4])
149
{
150
  /* i: row, j: col */
151
  for (int i = 0; i < 4; ++i)
152
  {
153
    for (int j = 0; j < 4; ++j)
154
    {
155
      state[i][j] = S[state[i][j]]; // 直接使用原始字节作为S盒数据下标
156
    }
157
  }
158

159
  return 0;
160
}
161

162
// 逆字节替换
163
int invSubBytes(uint8_t (*state)[4])
164
{
165
  /* i: row, j: col */
166
  for (int i = 0; i < 4; ++i)
167
  {
168
    for (int j = 0; j < 4; ++j)
169
    {
170
      state[i][j] = inv_S[state[i][j]];
171
    }
172
  }
173
  return 0;
174
}
175

176
// 行移位
177
int shiftRows(uint8_t (*state)[4])
178
{
179
  uint32_t block[4] = {0};
180

181
  /* i: row */
182
  for (int i = 0; i < 4; ++i)
183
  {
184
    // 便于行循环移位，先把一行4字节拼成uint_32结构，移位后再转成独立的4个字节uint8_t
185
    LOAD32H(block[i], state[i]);
186
    block[i] = ROF32(block[i], 8 * i); // block[i]循环左移8*i位，如第0行左移0位
187
    STORE32H(block[i], state[i]);
188
  }
189
  return 0;
190
}
191

192
// 逆行移位
193
int invShiftRows(uint8_t (*state)[4])
194
{
195
  uint32_t block[4] = {0};
196

197
  /* i: row */
198
  for (int i = 0; i < 4; ++i)
199
  {
200
    LOAD32H(block[i], state[i]);
201
    block[i] = ROR32(block[i], 8 * i);
202
    STORE32H(block[i], state[i]);
203
  }
204

205
  return 0;
206
}
207

208
/* Galois Field (256) Multiplication of two Bytes */
209
// 两字节的伽罗华域乘法运算
210
uint8_t GMul(uint8_t u, uint8_t v)
211
{
212
  uint8_t p = 0;
213

214
  for (int i = 0; i < 8; ++i)
215
  {
216
    if (u & 0x01)
217
    {
218
      p ^= v;
219
    }
220

221
    int flag = (v & 0x80);
222
    v <<= 1;
223
    if (flag)
224
    {
225
      v ^= 0x1B;
226
    }
227

228
    u >>= 1;
229
  }
230

231
  return p;
232
}
233

234
// 列混合
235
int mixColumns(uint8_t (*state)[4])
236
{
237
  uint8_t tmp[4][4];
238
  uint8_t M[4][4] = {{0x02, 0x03, 0x01, 0x01},
239
                     {0x01, 0x02, 0x03, 0x01},
240
                     {0x01, 0x01, 0x02, 0x03},
241
                     {0x03, 0x01, 0x01, 0x02}};
242

243
  /* copy state[4][4] to tmp[4][4] */
244
  for (int i = 0; i < 4; ++i)
245
  {
246
    for (int j = 0; j < 4; ++j)
247
    {
248
      tmp[i][j] = state[i][j];
249
    }
250
  }
251

252
  for (int i = 0; i < 4; ++i)
253
  {
254
    for (int j = 0; j < 4; ++j)
255
    { // 伽罗华域加法和乘法
256
      state[i][j] = GMul(M[i][0], tmp[0][j]) ^ GMul(M[i][1], tmp[1][j]) ^ GMul(M[i][2], tmp[2][j]) ^ GMul(M[i][3], tmp[3][j]);
257
    }
258
  }
259

260
  return 0;
261
}
262

263
// 逆列混合
264
int invMixColumns(uint8_t (*state)[4])
265
{
266
  uint8_t tmp[4][4];
267
  uint8_t M[4][4] = {{0x0E, 0x0B, 0x0D, 0x09},
268
                     {0x09, 0x0E, 0x0B, 0x0D},
269
                     {0x0D, 0x09, 0x0E, 0x0B},
270
                     {0x0B, 0x0D, 0x09, 0x0E}}; // 使用列混合矩阵的逆矩阵
271

272
  /* copy state[4][4] to tmp[4][4] */
273
  for (int i = 0; i < 4; ++i)
274
  {
275
    for (int j = 0; j < 4; ++j)
276
    {
277
      tmp[i][j] = state[i][j];
278
    }
279
  }
280

281
  for (int i = 0; i < 4; ++i)
282
  {
283
    for (int j = 0; j < 4; ++j)
284
    {
285
      state[i][j] = GMul(M[i][0], tmp[0][j]) ^ GMul(M[i][1], tmp[1][j]) ^ GMul(M[i][2], tmp[2][j]) ^ GMul(M[i][3], tmp[3][j]);
286
    }
287
  }
288

289
  return 0;
290
}
291

292
// AES-128加密接口，输入key应为16字节长度，输入长度应该是16字节整倍数，
293
// 这样输出长度与输入长度相同，函数调用外部为输出数据分配内存
294
int aesEncrypt(const uint8_t *key, uint32_t keyLen, const uint8_t *pt, uint8_t *ct, uint32_t len)
295
{
296
  AesKey aesKey;
297
  uint8_t *pos = ct;
298
  const uint32_t *rk = aesKey.eK; // 加密密钥指针
299
  uint8_t out[BLOCKSIZE] = {0};
300
  uint8_t actualKey[16] = {0};
301
  uint8_t state[4][4] = {0};
302

303
  if (NULL == key || NULL == pt || NULL == ct)
304
  {
305
    printf("param err.\n");
306
    return -1;
307
  }
308

309
  if (keyLen > 16)
310
  {
311
    printf("keyLen must be 16.\n");
312
    return -1;
313
  }
314

315
  if (len % BLOCKSIZE)
316
  {
317
    printf("inLen is invalid.\n");
318
    return -1;
319
  }
320

321
  memcpy(actualKey, key, keyLen);
322
  keyExpansion(actualKey, 16, &aesKey); // 密钥扩展
323

324
  // 使用ECB模式循环加密多个分组长度的数据
325
  for (int i = 0; i < len; i += BLOCKSIZE)
326
  {
327
    // 把16字节的明文转换为4x4状态矩阵来进行处理
328
    loadStateArray(state, pt);
329
    // 轮密钥加
330
    addRoundKey(state, rk);
331

332
    for (int j = 1; j < 10; ++j)
333
    {
334
      rk += 4;
335
      subBytes(state);        // 字节替换
336
      shiftRows(state);       // 行移位
337
      addRoundKey(state, rk); // 轮密钥加
338
      mixColumns(state);      // 列混合
339
    }
340

341
    subBytes(state);  // 字节替换
342
    shiftRows(state); // 行移位
343
    // 此处不进行列混合
344
    addRoundKey(state, rk + 4); // 轮密钥加
345

346
    // 把4x4状态矩阵转换为uint8_t一维数组输出保存
347
    storeStateArray(state, pos);
348

349
    pos += BLOCKSIZE; // 加密数据内存指针移动到下一个分组
350
    pt += BLOCKSIZE;  // 明文数据指针移动到下一个分组
351
    rk = aesKey.eK;   // 恢复rk指针到秘钥初始位置
352
  }
353
  return 0;
354
}
355

356
// AES128解密， 参数要求同加密
357
int aesDecrypt(const uint8_t *key, uint32_t keyLen, const uint8_t *ct, uint8_t *pt, uint32_t len)
358
{
359
  AesKey aesKey;
360
  uint8_t *pos = pt;
361
  const uint32_t *rk = aesKey.dK; // 解密密钥指针
362
  uint8_t out[BLOCKSIZE] = {0};
363
  uint8_t actualKey[16] = {0};
364
  uint8_t state[4][4] = {0};
365

366
  if (NULL == key || NULL == ct || NULL == pt)
367
  {
368
    printf("param err.\n");
369
    return -1;
370
  }
371

372
  if (keyLen > 16)
373
  {
374
    printf("keyLen must be 16.\n");
375
    return -1;
376
  }
377

378
  if (len % BLOCKSIZE)
379
  {
380
    printf("inLen is invalid.\n");
381
    return -1;
382
  }
383

384
  memcpy(actualKey, key, keyLen);
385
  keyExpansion(actualKey, 16, &aesKey); // 密钥扩展，同加密
386

387
  for (int i = 0; i < len; i += BLOCKSIZE)
388
  {
389
    // 把16字节的密文转换为4x4状态矩阵来进行处理
390
    loadStateArray(state, ct);
391
    // 轮密钥加，同加密
392
    addRoundKey(state, rk);
393

394
    for (int j = 1; j < 10; ++j)
395
    {
396
      rk += 4;
397
      invShiftRows(state);    // 逆行移位
398
      invSubBytes(state);     // 逆字节替换，这两步顺序可以颠倒
399
      invMixColumns(state);   // 逆列混合
400
      addRoundKey(state, rk); // 轮密钥加，同加密
401
    }
402

403
    invShiftRows(state); // 逆行移位
404
    invSubBytes(state);  // 逆字节替换
405
    // 此处没有逆列混合
406
    addRoundKey(state, rk + 4); // 轮密钥加，同加密
407

408
    storeStateArray(state, pos); // 保存明文数据
409
    pos += BLOCKSIZE;            // 输出数据内存指针移位分组长度
410
    ct += BLOCKSIZE;             // 输入数据内存指针移位分组长度
411
    rk = aesKey.dK;              // 恢复rk指针到秘钥初始位置
412
  }
413
  return 0;
414
}

xxtea#

看起来是标准的xxtea，不过测试的时候死活对不上，猜测可能是被改掉/被hook了然后发现libnative_add.so在init_proc中进行了一些操作，而且字符串均被加密了 hook恢复出来显然是对DoCall这个函数进行hook 不过回调函数在哪呢？？既然回调函数要被执行，那他的地址就必然会被写入这些跳板指令中 sub_1A51C正是hook的回调函数通过调试，我们发现他匹配了fixkey和Tobytearray这两个函数在进入fixkey函数时，获取修改了一些东西，通过调试，我们发现v3正是指向字节码的指针，修改了几个字节码，我们把它改回去那执行到Tobytearray的时候发生了什么？ xmmword_41F60保存了原始的字节码，在执行Tobytearray时会把字节码写回去，所以如果要去dump的话，时机要求还是挺高的

1
#define DELTA 1640531527
2
#define MX (((z >> 5 ^ y >> 2) + (y >> 3 ^ z >> 4)) ^ ((sum ^ y) + (key[(p & 3) ^ e] ^ z)))
3

4
void btea(uint32_t *v, int n, uint32_t const key[4])
5
{
6
  uint32_t y, z, sum;
7
  unsigned p, rounds, e;
8
  if (n > 1) /* Coding Part */
9
  {
10
    rounds = 6 + 52 * n;
11
    sum = 0;
12
    z = v[n - 1];
13
    do
14
    {
15
      sum -= DELTA;
16
      e = (sum >> 2) & 3;
17
      for (p = 0; p < n - 1; p++)
18
      {
19
        y = v[p + 1];
20
        z = v[p] += MX;
21
      }
22
      y = v[0];
23
      z = v[n - 1] += MX;
24
    } while (--rounds);
25
  }
26
  else if (n < -1) /* Decoding Part */
27
  {
28
    n = -n;
29
    rounds = 6 + 52 * n;
30
    sum = rounds * (~DELTA + 1);
31
    y = v[0];
32
    do
33
    {
34
      e = (sum >> 2) & 3;
35
      for (p = n - 1; p > 0; p--)
36
      {
37
        z = v[p - 1];
38
        y = v[p] -= MX;
39
      }
40
      z = v[n - 1];
41
      y = v[0] -= MX;
42
      sum += DELTA;
43
    } while (--rounds);
44
  }
45
}

密文？？？#

没找到密文check的地方，只找到了一个类似密文的东西，最后发现确实就是他

2.解密#

1
#include <stdio.h>
2
#include <stdint.h>
3
#include <string.h>
4
#define DELTA 1640531527
5
#define MX (((z >> 5 ^ y >> 2) + (y >> 3 ^ z >> 4)) ^ ((sum ^ y) + (key[(p & 3) ^ e] ^ z)))
6

7
void btea(uint32_t *v, int n, uint32_t const key[4])
8
{
9
  uint32_t y, z, sum;
10
  unsigned p, rounds, e;
11
  if (n > 1) /* Coding Part */
12
  {
13
    rounds = 6 + 52 * n;
14
    sum = 0;
15
    z = v[n - 1];
16
    do
17
    {
18
      sum -= DELTA;
19
      e = (sum >> 2) & 3;
20
      for (p = 0; p < n - 1; p++)
21
      {
22
        y = v[p + 1];
23
        z = v[p] += MX;
24
      }
25
      y = v[0];
26
      z = v[n - 1] += MX;
27
    } while (--rounds);
28
  }
29
  else if (n < -1) /* Decoding Part */
30
  {
31
    n = -n;
32
    rounds = 6 + 52 * n;
33
    sum = rounds * (~DELTA + 1);
34
    y = v[0];
35
    do
36
    {
37
      e = (sum >> 2) & 3;
38
      for (p = n - 1; p > 0; p--)
39
      {
40
        z = v[p - 1];
41
        y = v[p] -= MX;
42
      }
43
      z = v[n - 1];
44
      y = v[0] -= MX;
45
      sum += DELTA;
46
    } while (--rounds);
47
  }
48
}
49

50
typedef struct
51
{
52
  uint32_t eK[44], dK[44]; // encKey, decKey
53
  int Nr;                  // 10 rounds
54
} AesKey;
55

56
#define BLOCKSIZE 16 // AES-128分组长度为16字节
57

58
// uint8_t y[4] -> uint32_t x
59
#define LOAD32H(x, y)                                                             \
60
  do                                                                              \
61
  {                                                                               \
62
    (x) = ((uint32_t)((y)[0] & 0xff) << 24) | ((uint32_t)((y)[1] & 0xff) << 16) | \
63
          ((uint32_t)((y)[2] & 0xff) << 8) | ((uint32_t)((y)[3] & 0xff));         \
64
  } while (0)
65

66
// uint32_t x -> uint8_t y[4]
67
#define STORE32H(x, y)                      \
68
  do                                        \
69
  {                                         \
70
    (y)[0] = (uint8_t)(((x) >> 24) & 0xff); \
71
    (y)[1] = (uint8_t)(((x) >> 16) & 0xff); \
72
    (y)[2] = (uint8_t)(((x) >> 8) & 0xff);  \
73
    (y)[3] = (uint8_t)((x) & 0xff);         \
74
  } while (0)
75

76
// 从uint32_t x中提取从低位开始的第n个字节
77
#define BYTE(x, n) (((x) >> (8 * (n))) & 0xff)
78

79
// 密钥扩展中的SubWord(RotWord(temp),字节替换然后循环左移1位
80
#define MIX(x) (((S[BYTE(x, 2)] << 24) & 0xff000000) ^ ((S[BYTE(x, 1)] << 16) & 0xff0000) ^ \
81
                ((S[BYTE(x, 0)] << 8) & 0xff00) ^ (S[BYTE(x, 3)] & 0xff))
82

83
// uint32_t x循环左移n位
84
#define ROF32(x, n) (((x) << (n)) | ((x) >> (32 - (n))))
85
// uint32_t x循环右移n位
86
#define ROR32(x, n) (((x) >> (n)) | ((x) << (32 - (n))))
87

88
// AES-128轮常量,无符号长整型
89
static const uint32_t rcon[10] = {
90
    0x01000000UL, 0x02000000UL, 0x04000000UL, 0x08000000UL, 0x10000000UL,
91
    0x20000000UL, 0x40000000UL, 0x80000000UL, 0x1B000000UL, 0x36000000UL};
92
// S盒
93
unsigned char S[256] = {32, 123, 24, 167, 66, 68, 215, 74, 205, 50, 209, 236, 243, 129, 165, 137, 14, 145, 75, 240, 233, 93, 141, 245, 70, 252, 49, 54, 182, 172, 155, 185, 38, 9, 230, 64, 212, 176, 81, 79, 156, 62, 231, 121, 48, 136, 177, 60, 122, 92, 211, 20, 90, 171, 86, 192, 4, 41, 208, 59, 31, 249, 163, 87, 0, 138, 132, 22, 244, 26, 234, 100, 166, 214, 46, 190, 47, 23, 196, 224, 30, 2, 58, 34, 143, 159, 203, 168, 44, 103, 52, 37, 213, 255, 239, 246, 226, 170, 217, 114, 254, 206, 161, 120, 133, 150, 42, 119, 202, 193, 55, 116, 162, 94, 108, 253, 184, 77, 125, 112, 179, 221, 207, 113, 115, 97, 248, 25, 72, 227, 99, 51, 61, 21, 174, 152, 229, 128, 189, 188, 130, 198, 148, 1, 228, 222, 6, 80, 149, 223, 71, 247, 144, 139, 69, 154, 110, 7, 173, 28, 53, 131, 104, 3, 111, 91, 183, 251, 29, 197, 16, 124, 216, 106, 204, 105, 142, 36, 76, 57, 180, 160, 11, 82, 232, 169, 178, 140, 10, 191, 40, 134, 109, 175, 218, 65, 250, 117, 181, 67, 195, 96, 98, 43, 85, 242, 158, 45, 18, 35, 13, 219, 107, 199, 56, 127, 95, 151, 8, 237, 225, 187, 238, 157, 210, 146, 73, 63, 220, 88, 135, 194, 186, 153, 201, 78, 241, 33, 235, 19, 101, 89, 118, 12, 200, 5, 164, 84, 147, 27, 102, 17, 39, 83, 126, 15};
94

95
// 逆S盒
96
unsigned char inv_S[256] = {64, 143, 81, 163, 56, 245, 146, 157, 218, 33, 188, 182, 243, 210, 16, 255, 170, 251, 208, 239, 51, 133, 67, 77, 2, 127, 69, 249, 159, 168, 80, 60, 0, 237, 83, 209, 177, 91, 32, 252, 190, 57, 106, 203, 88, 207, 74, 76, 44, 26, 9, 131, 90, 160, 27, 110, 214, 179, 82, 59, 47, 132, 41, 227, 35, 195, 4, 199, 5, 154, 24, 150, 128, 226, 7, 18, 178, 117, 235, 39, 147, 38, 183, 253, 247, 204, 54, 63, 229, 241, 52, 165, 49, 21, 113, 216, 201, 125, 202, 130, 71, 240, 250, 89, 162, 175, 173, 212, 114, 192, 156, 164, 119, 123, 99, 124, 111, 197, 242, 107, 103, 43, 48, 1, 171, 118, 254, 215, 137, 13, 140, 161, 66, 104, 191, 230, 45, 15, 65, 153, 187, 22, 176, 84, 152, 17, 225, 248, 142, 148, 105, 217, 135, 233, 155, 30, 40, 223, 206, 85, 181, 102, 112, 62, 246, 14, 72, 3, 87, 185, 97, 53, 29, 158, 134, 193, 37, 46, 186, 120, 180, 198, 28, 166, 116, 31, 232, 221, 139, 138, 75, 189, 55, 109, 231, 200, 78, 169, 141, 213, 244, 234, 108, 86, 174, 8, 101, 122, 58, 10, 224, 50, 36, 92, 73, 6, 172, 98, 194, 211, 228, 121, 145, 149, 79, 220, 96, 129, 144, 136, 34, 42, 184, 20, 70, 238, 11, 219, 222, 94, 19, 236, 205, 12, 68, 23, 95, 151, 126, 61, 196, 167, 25, 115, 100, 93};
97

98
/* copy in[16] to state[4][4] */
99
int loadStateArray(uint8_t (*state)[4], const uint8_t *in)
100
{
101
  for (int i = 0; i < 4; ++i)
102
  {
103
    for (int j = 0; j < 4; ++j)
104
    {
105
      state[j][i] = *in++;
106
    }
107
  }
108
  return 0;
109
}
110

111
/* copy state[4][4] to out[16] */
112
int storeStateArray(uint8_t (*state)[4], uint8_t *out)
113
{
114
  for (int i = 0; i < 4; ++i)
115
  {
116
    for (int j = 0; j < 4; ++j)
117
    {
118
      *out++ = state[j][i];
119
    }
120
  }
121
  return 0;
122
}
123

124
// 密钥扩展，只接受16字初始密钥
125
int keyExpansion(const uint8_t *key, uint32_t keyLen, AesKey *aesKey)
126
{
127

128
  if (NULL == key || NULL == aesKey)
129
  {
130
    printf("keyExpansion param is NULL\n");
131
    return -1;
132
  }
133

134
  if (keyLen != 16)
135
  {
136
    printf("keyExpansion keyLen = %d, Not support.\n", keyLen);
137
    return -1;
138
  }
139

140
  uint32_t *w = aesKey->eK; // 加密密钥
141
  uint32_t *v = aesKey->dK; // 解密密钥
142

143
  // 扩展密钥长度44=4*(10+1)个字,原始密钥128位，4个32位字，Nb*(Nr+1)
144

145
  /* W[0-3],前4个字为原始密钥 */
146
  for (int i = 0; i < 4; ++i)
147
  {
148
    LOAD32H(w[i], key + 4 * i);
149
  }
150

151
  /* W[4-43] */
152
  // temp=w[i-1];tmp=SubWord(RotWord(temp))xor Rcon[i/4] xor w[i-Nk]
153
  for (int i = 0; i < 10; ++i)
154
  {
155
    w[4] = w[0] ^ MIX(w[3]) ^ rcon[i];
156
    w[5] = w[1] ^ w[4];
157
    w[6] = w[2] ^ w[5];
158
    w[7] = w[3] ^ w[6];
159
    w += 4;
160
  }
161

162
  w = aesKey->eK + 44 - 4;
163
  // 解密密钥矩阵为加密密钥矩阵的倒序，方便使用，把ek的11个矩阵倒序排列分配给dk作为解密密钥
164
  // 即dk[0-3]=ek[41-44], dk[4-7]=ek[37-40]... dk[41-44]=ek[0-3]
165
  for (int j = 0; j < 11; ++j)
166
  {
167
    for (int i = 0; i < 4; ++i)
168
    {
169
      v[i] = w[i];
170
    }
171
    w -= 4;
172
    v += 4;
173
  }
174

175
  return 0;
176
}
177

178
// 轮密钥加
179
int addRoundKey(uint8_t (*state)[4], const uint32_t *key)
180
{
181
  uint8_t k[4][4];
182

183
  /* i: row, j: col */
184
  for (int i = 0; i < 4; ++i)
185
  {
186
    for (int j = 0; j < 4; ++j)
187
    {
188
      k[i][j] = (uint8_t)BYTE(key[j], 3 - i); /* 把 uint32 key[4] 先转换为矩阵 uint8 k[4][4] */
189
      state[i][j] ^= k[i][j];
190
    }
191
  }
192

193
  return 0;
194
}
195

196
// 字节替换
197
int subBytes(uint8_t (*state)[4])
198
{
199
  /* i: row, j: col */
200
  for (int i = 0; i < 4; ++i)
201
  {
202
    for (int j = 0; j < 4; ++j)
203
    {
204
      state[i][j] = S[state[i][j]]; // 直接使用原始字节作为S盒数据下标
205
    }
206
  }
207

208
  return 0;
209
}
210

211
// 逆字节替换
212
int invSubBytes(uint8_t (*state)[4])
213
{
214
  /* i: row, j: col */
215
  for (int i = 0; i < 4; ++i)
216
  {
217
    for (int j = 0; j < 4; ++j)
218
    {
219
      state[i][j] = inv_S[state[i][j]];
220
    }
221
  }
222
  return 0;
223
}
224

225
// 行移位
226
int shiftRows(uint8_t (*state)[4])
227
{
228
  uint32_t block[4] = {0};
229

230
  /* i: row */
231
  for (int i = 0; i < 4; ++i)
232
  {
233
    // 便于行循环移位，先把一行4字节拼成uint_32结构，移位后再转成独立的4个字节uint8_t
234
    LOAD32H(block[i], state[i]);
235
    block[i] = ROF32(block[i], 8 * i); // block[i]循环左移8*i位，如第0行左移0位
236
    STORE32H(block[i], state[i]);
237
  }
238
  return 0;
239
}
240

241
// 逆行移位
242
int invShiftRows(uint8_t (*state)[4])
243
{
244
  uint32_t block[4] = {0};
245

246
  /* i: row */
247
  for (int i = 0; i < 4; ++i)
248
  {
249
    LOAD32H(block[i], state[i]);
250
    block[i] = ROR32(block[i], 8 * i);
251
    STORE32H(block[i], state[i]);
252
  }
253

254
  return 0;
255
}
256

257
/* Galois Field (256) Multiplication of two Bytes */
258
// 两字节的伽罗华域乘法运算
259
uint8_t GMul(uint8_t u, uint8_t v)
260
{
261
  uint8_t p = 0;
262

263
  for (int i = 0; i < 8; ++i)
264
  {
265
    if (u & 0x01)
266
    {
267
      p ^= v;
268
    }
269

270
    int flag = (v & 0x80);
271
    v <<= 1;
272
    if (flag)
273
    {
274
      v ^= 0x1B;
275
    }
276

277
    u >>= 1;
278
  }
279

280
  return p;
281
}
282

283
// 列混合
284
int mixColumns(uint8_t (*state)[4])
285
{
286
  uint8_t tmp[4][4];
287
  uint8_t M[4][4] = {{0x02, 0x03, 0x01, 0x01},
288
                     {0x01, 0x02, 0x03, 0x01},
289
                     {0x01, 0x01, 0x02, 0x03},
290
                     {0x03, 0x01, 0x01, 0x02}};
291

292
  /* copy state[4][4] to tmp[4][4] */
293
  for (int i = 0; i < 4; ++i)
294
  {
295
    for (int j = 0; j < 4; ++j)
296
    {
297
      tmp[i][j] = state[i][j];
298
    }
299
  }
300

301
  for (int i = 0; i < 4; ++i)
302
  {
303
    for (int j = 0; j < 4; ++j)
304
    { // 伽罗华域加法和乘法
305
      state[i][j] = GMul(M[i][0], tmp[0][j]) ^ GMul(M[i][1], tmp[1][j]) ^ GMul(M[i][2], tmp[2][j]) ^ GMul(M[i][3], tmp[3][j]);
306
    }
307
  }
308

309
  return 0;
310
}
311

312
// 逆列混合
313
int invMixColumns(uint8_t (*state)[4])
314
{
315
  uint8_t tmp[4][4];
316
  uint8_t M[4][4] = {{0x0E, 0x0B, 0x0D, 0x09},
317
                     {0x09, 0x0E, 0x0B, 0x0D},
318
                     {0x0D, 0x09, 0x0E, 0x0B},
319
                     {0x0B, 0x0D, 0x09, 0x0E}}; // 使用列混合矩阵的逆矩阵
320

321
  /* copy state[4][4] to tmp[4][4] */
322
  for (int i = 0; i < 4; ++i)
323
  {
324
    for (int j = 0; j < 4; ++j)
325
    {
326
      tmp[i][j] = state[i][j];
327
    }
328
  }
329

330
  for (int i = 0; i < 4; ++i)
331
  {
332
    for (int j = 0; j < 4; ++j)
333
    {
334
      state[i][j] = GMul(M[i][0], tmp[0][j]) ^ GMul(M[i][1], tmp[1][j]) ^ GMul(M[i][2], tmp[2][j]) ^ GMul(M[i][3], tmp[3][j]);
335
    }
336
  }
337

338
  return 0;
339
}
340

341
// AES-128加密接口，输入key应为16字节长度，输入长度应该是16字节整倍数，
342
// 这样输出长度与输入长度相同，函数调用外部为输出数据分配内存
343
int aesEncrypt(const uint8_t *key, uint32_t keyLen, const uint8_t *pt, uint8_t *ct, uint32_t len)
344
{
345
  AesKey aesKey;
346
  uint8_t *pos = ct;
347
  const uint32_t *rk = aesKey.eK; // 加密密钥指针
348
  uint8_t out[BLOCKSIZE] = {0};
349
  uint8_t actualKey[16] = {0};
350
  uint8_t state[4][4] = {0};
351

352
  if (NULL == key || NULL == pt || NULL == ct)
353
  {
354
    printf("param err.\n");
355
    return -1;
356
  }
357

358
  if (keyLen > 16)
359
  {
360
    printf("keyLen must be 16.\n");
361
    return -1;
362
  }
363

364
  if (len % BLOCKSIZE)
365
  {
366
    printf("inLen is invalid.\n");
367
    return -1;
368
  }
369

370
  memcpy(actualKey, key, keyLen);
371
  keyExpansion(actualKey, 16, &aesKey); // 密钥扩展
372

373
  // 使用ECB模式循环加密多个分组长度的数据
374
  for (int i = 0; i < len; i += BLOCKSIZE)
375
  {
376
    // 把16字节的明文转换为4x4状态矩阵来进行处理
377
    loadStateArray(state, pt);
378
    // 轮密钥加
379
    addRoundKey(state, rk);
380

381
    for (int j = 1; j < 10; ++j)
382
    {
383
      rk += 4;
384
      subBytes(state);        // 字节替换
385
      shiftRows(state);       // 行移位
386
      addRoundKey(state, rk); // 轮密钥加
387
      mixColumns(state);      // 列混合
388
    }
389

390
    subBytes(state);  // 字节替换
391
    shiftRows(state); // 行移位
392
    // 此处不进行列混合
393
    addRoundKey(state, rk + 4); // 轮密钥加
394

395
    // 把4x4状态矩阵转换为uint8_t一维数组输出保存
396
    storeStateArray(state, pos);
397

398
    pos += BLOCKSIZE; // 加密数据内存指针移动到下一个分组
399
    pt += BLOCKSIZE;  // 明文数据指针移动到下一个分组
400
    rk = aesKey.eK;   // 恢复rk指针到秘钥初始位置
401
  }
402
  return 0;
403
}
404

405
// AES128解密， 参数要求同加密
406
int aesDecrypt(const uint8_t *key, uint32_t keyLen, const uint8_t *ct, uint8_t *pt, uint32_t len)
407
{
408
  AesKey aesKey;
409
  uint8_t *pos = pt;
410
  const uint32_t *rk = aesKey.dK; // 解密密钥指针
411
  uint8_t out[BLOCKSIZE] = {0};
412
  uint8_t actualKey[16] = {0};
413
  uint8_t state[4][4] = {0};
414

415
  if (NULL == key || NULL == ct || NULL == pt)
416
  {
417
    printf("param err.\n");
418
    return -1;
419
  }
420

421
  if (keyLen > 16)
422
  {
423
    printf("keyLen must be 16.\n");
424
    return -1;
425
  }
426

427
  if (len % BLOCKSIZE)
428
  {
429
    printf("inLen is invalid.\n");
430
    return -1;
431
  }
432

433
  memcpy(actualKey, key, keyLen);
434
  keyExpansion(actualKey, 16, &aesKey); // 密钥扩展，同加密
435

436
  for (int i = 0; i < len; i += BLOCKSIZE)
437
  {
438
    // 把16字节的密文转换为4x4状态矩阵来进行处理
439
    loadStateArray(state, ct);
440
    // 轮密钥加，同加密
441
    addRoundKey(state, rk);
442

443
    for (int j = 1; j < 10; ++j)
444
    {
445
      rk += 4;
446
      invShiftRows(state);    // 逆行移位
447
      invSubBytes(state);     // 逆字节替换，这两步顺序可以颠倒
448
      invMixColumns(state);   // 逆列混合
449
      addRoundKey(state, rk); // 轮密钥加，同加密
450
    }
451

452
    invShiftRows(state); // 逆行移位
453
    invSubBytes(state);  // 逆字节替换
454
    // 此处没有逆列混合
455
    addRoundKey(state, rk + 4); // 轮密钥加，同加密
456

457
    storeStateArray(state, pos); // 保存明文数据
458
    pos += BLOCKSIZE;            // 输出数据内存指针移位分组长度
459
    ct += BLOCKSIZE;             // 输入数据内存指针移位分组长度
460
    rk = aesKey.dK;              // 恢复rk指针到秘钥初始位置
461
  }
462
  return 0;
463
}
464

465
int main()
466
{
467

468
  unsigned char enc[] = {0xf2, 0xc0, 0x05, 0x5f, 0x8e, 0x73, 0x4f, 0xbb, 0x9c, 0xd2, 0xf4, 0x94, 0xc8, 0x53, 0x4d, 0x97, 0x2d, 0x61, 0xfd, 0xde, 0x73, 0x4e, 0xdf, 0x3d, 0xb5, 0x5d, 0xe4, 0x71, 0x5a, 0xf9, 0x3f, 0x99, 0xfb, 0x95, 0x12, 0x8f, 0xc9, 0x8b, 0x71, 0x83, 0x7d, 0x73, 0x60, 0xd0, 0x76, 0x94, 0xf5, 0x74, 0x73, 0x99, 0xdf, 0xff, 0x1d, 0xbf, 0x20, 0xaf, 0x78, 0x5d, 0x5f, 0x54, 0x7e, 0xcf, 0x57, 0x7d, 0xa0, 0xc6, 0xe4, 0x85, 0xf1, 0x32, 0x56, 0x72, 0xf9, 0x9d, 0xa7, 0x13, 0xe6, 0x59, 0x44, 0x50, 0x52, 0xa4, 0xca, 0x0a, 0xcd, 0x05, 0xdf, 0x52, 0xad, 0x93, 0x4a, 0x32, 0x49, 0x7d, 0x0c, 0x55, 0x0};
469
  uint32_t v[] = {1650877538, 875968049, 842479969, 1714696806, 862139446, 1667380838, 912679474, 1631019828};
470
  uint32_t k[4] = {842610225, 57, 0, 0};
471
  int n = 24;
472
  n = 24;
473
  btea((uint32_t *)enc, -n, k);
474
  printf("xxtea -> %s\n", enc);
475
  unsigned char encrypted[] = {0xb0, 0xca, 0x9f, 0xa0, 0xa3, 0xee, 0x7e, 0x58, 0x1c, 0x46, 0xc8, 0xca, 0x69, 0x2f, 0xc9, 0xb1, 0x2a, 0xd4, 0x33, 0xf8, 0xa3, 0x23, 0x2c, 0xb6, 0xd7, 0x3b, 0x54, 0xcf, 0x82, 0xe8, 0x0c, 0x71, 0x53, 0xba, 0x9b, 0xb1, 0xb2, 0xda, 0x3e, 0x43, 0xbe, 0x66, 0x7d, 0x65, 0xdc, 0x10, 0xe5, 0xd5, 0x0};
476
  unsigned char key[] = {0x7a, 0x25, 0xc5, 0x24, 0xc6, 0x33, 0x4c, 0x30, 0xf3, 0x62, 0xaf, 0xac, 0x3f, 0x23, 0x03, 0xd5};
477
  unsigned char decrypted[16] = {0};
478
  aesDecrypt(key, 16, encrypted, decrypted, 48);
479
  printf("aes ecb -> %s", decrypted);
480
  return 0;
481
}

WMCTF{I_R4@11y_w@n7_70 _84c0m4_@_m@gic@1_Gir1}