proc m4ZQu {password LZQjH} {
set ::maui::util::H6VeX ""
set ::maui::util::EL0BW [string repeat \\0 32]package require tcltwofish
package require sha256if {[string length $LZQjH] == 0} {
error "Unable to initialize encryption - missing essential data"
}
if {[binary scan $LZQjH Ia16a32a64a32a* times iv passwordKey encryptedKey payloadIVsHash encryptedPayloadIVs] < 6} {
error "Unable to initialize encryption - header missing or corrupt"
}
set iHcWR [a64bL $password $passwordKey $iv $times]
set BJvoG [string range [tcltwofish::decrypt $iHcWR $encryptedKey] 32 63]
for {set i 0} {$i < $times} {incr i 64} {
set encryptedPayloadIVs [tcltwofish::decrypt $BJvoG $encryptedPayloadIVs]
}
set ZQpQw [string range $encryptedPayloadIVs 32 end]
if {[sha2::sha256 -bin $ZQpQw] != $payloadIVsHash} {
maui::d_RUj "Invalid payload password"
}
set ::maui::util::H6VeX $ZQpQw
set ::maui::util::EL0BW $BJvoG
}
https://devco.re/blog/2019/06/21/operation-crack-hacking-IDA-Pro-installer-PRNG-from-an-unusual-way/
https://bbs.kanxue.com/thread-277712-1.htm
proc yOZ7q {password {times 16000}} {
set ::maui::util::H6VeX ""
set ::maui::util::EL0BW [string repeat \\0 32]package require tcltwofish
package require sha256set BJvoG [qA4kM 32]
set passwordKey [qA4kM 32]set ZQpQw [qA4kM [expr {16 * 256}]]
set payloadIVsHash [sha2::sha256 -bin $ZQpQw]set encryptedPayloadIVs "[qA4kM 32]$ZQpQw"
for {set i 0} {$i < $times} {incr i 64} {
set encryptedPayloadIVs [tcltwofish::encrypt $BJvoG $encryptedPayloadIVs]
}set iv [qA4kM 16]
set iHcWR [a64bL $password $passwordKey $iv $times]
set encryptedKey [tcltwofish::encrypt $iHcWR "[qA4kM 32]$BJvoG"]
set LZQjH [binary format Ia16a32a64a32a* $times $iv $passwordKey $encryptedKey $payloadIVsHash $encryptedPayloadIVs]
set ::maui::util::H6VeX $ZQpQw
set ::maui::util::EL0BW $BJvoGreturn $LZQjH
}
proc qA4kM {length} {
set YKL8w ""
if {[RLPut unix]} {
foreach xML4B {/dev/urandom /dev/random} {
if {[catch {
set WyLEv [open $xML4B r]
fconfigure $WyLEv -translation binary
set YKL8w [read $WyLEv $length]
close $WyLEv
}]} {
catch {close $WyLEv}
} else {
break
}
}
} else {}
if {[string length $YKL8w] != $length} {incr length -[string length $YKL8w]
while {$length >= 2} {
append YKL8w [binary format S [expr {int([maui::util::rand] * 0x10000)}]]
incr length -2
}
if {$length > 0} {
append YKL8w [binary format c [expr {int([maui::util::rand] * 0x100)}]]
}
}
return $YKL8w
}
proc rand {} {
if {[maui::util::RLPut "windows"] && [info commands ::bitrock::secure::rand_s] != ""} {
if {[catch {
set r [::bitrock::secure::rand_s]
} V77Ls]} {
maui::util::debug "failed to call rand_s: $V77Ls"
set r [expr {rand()}]
}
} else {
set r [expr {rand()}]
}
return $r
}
BJvoG
也是随机生成的,如果这部分随机数生成流程能复现那也是可以破解的。仔细看随机数的生成,已经排除了以前的LCG随机数生成算法,换成了更安全的,前后状态无影响的方式,linux或unix下用/dev/random或者/dev/urandom,windows下调用rand_s。proc MmyBM {compressionAlgorithm command data} {
if {[catch {
if {($compressionAlgorithm == "lzma") || ($compressionAlgorithm == "lzma-ultra") || ($compressionAlgorithm == "lzham") || ($compressionAlgorithm == "lzham-ultra")} {
set data [eval [concat $command [list $data]]]
} else {
set data [vfs::zip -mode compress -nowrap 1 $data]
}
set data [qA4kM 32][UOijU $data 32]
set PG2JA [expr {int([maui::util::rand] * 0x100)}]
set iv [string range $::maui::util::H6VeX [expr {$PG2JA * 16}] [expr {$PG2JA * 16 + 15}]]
set hbA8n [format 0x%08x [expr {[zlib crc32 $data] & 0xffffffff}]]
set data [tcltwofish::encrypt $::maui::util::EL0BW $data iv]
set YKL8w [binary format Ica* $hbA8n $PG2JA $data]
} V77Ls]} {
set ykaki $::errorCode
set qXoNi $::errorInfo
maui::util::debug "encryptPayload: error encrypting: $V77Ls"
error $V77Ls $qXoNi $ykaki
}
return $YKL8w
}
proc UOijU {data DeSRF} {
set data [binary format Ia* [string length $data] $data]
set add [expr {($DeSRF - ([string length $data] % $DeSRF)) % $DeSRF}]
append data [qA4kM $add]
return $data
}
32字节随机数据+4字节数据+$data+最后补全32字节的padding
然后使用twofish进行加密。而twofish是分组加密算法,所以加密过程就是下面这样的。比如sqlite3数据库的前16字节固定为 SQLite format 3\x00
,在ECB模式下,相同密钥加密任何sqlite3数据库的前16个字节都是一样的。所以衍生出了CBC模式,在每个分组加密之前用iv或者上一个密文分组异或明文以产生不一样的数据。
然而,这个例子中前面32个字节的随机数的使用却颇有点画蛇添足的味道。
00 0x xx xx
。如果能将每段加密数据对应到具体的文件,可能还会有更多的明文信息。看雪ID:龙卷风呼呼呼
https://bbs.kanxue.com/user-home-980588.htm
# 往期推荐
球分享
球点赞
球在看
点击阅读原文查看更多