\u672c\u6587\u4ec5\u7528\u4e8e\u6280\u672f\u5b66\u4e60\u4e0e\u5b89\u5168\u7814\u7a76\u4ea4\u6d41，\u6587\u4e2d\u6d89\u53ca\u7684\u5206\u6790\u65b9\u6cd5\u3001\u8fd8\u539f\u4ee3\u7801\u53ca\u76f8\u5173\u6570\u636e\u5747\u57fa\u4e8e\u516c\u5f00\u53ef\u83b7\u53d6\u7684APK\u6837\u672c\u9006\u5411\u6240\u5f97，\u4e0d\u6d89\u53ca\u672a\u6388\u6743\u8bbf\u95ee\u670d\u52a1\u5668\u6216\u975e\u6cd5\u83b7\u53d6\u7528\u6237\u6570\u636e\u3002\u8bf7\u52ff\u5c06\u672c\u6587\u5185\u5bb9\u7528\u4e8e\u4efb\u4f55\u4fb5\u72af\u7528\u6237\u9690\u79c1\u3001\u7834\u574f\u7cfb\u7edf\u5b89\u5168\u6216\u5176\u4ed6\u8fdd\u53cd\u6cd5\u5f8b\u6cd5\u89c4\u7684\u7528\u9014，\u7531\u6b64\u4ea7\u751f\u7684\u4e00\u5207\u540e\u679c\u4e0e\u4f5c\u8005\u65e0\u5173\u3002\u5982\u76f8\u5173\u65b9\u8ba4\u4e3a\u672c\u6587\u5185\u5bb9\u5b58\u5728\u4e0d\u5f53\u4e4b\u5904，\u8bf7\u8054\u7cfb\u4f5c\u8005，\u5c06\u7b2c\u4e00\u65f6\u95f4\u914d\u5408\u5904\u7406\u6216\u4e0b\u67b6\u3002<\/p>\n
\u6700\u8fd1\u62bd\u7a7a\u770b\u4e86\u4e0bQIMEI SDK\u7684\u6700\u65b0\u7248\u672c，\u672c\u6765\u662f\u60f3\u5feb\u901f\u8fc7\u4e00\u904d\u6709\u6ca1\u6709\u65b0\u53d8\u5316，\u7ed3\u679c\u6253\u5f00IDA\u4e4b\u540e\u5c31\u50bb\u773c\u4e86\u2014\u2014\u6838\u5fc3\u51fd\u6570\u7ecf\u8fc7\u4e86\u6df7\u6dc6\u5904\u7406，\u4f53\u79ef\u5f02\u5e38\u5e9e\u5927，\u53cd\u7f16\u8bd1\u51fa\u6765\u7684\u4f2a\u4ee3\u7801\u770b\u7740\u5bc6\u5bc6\u9ebb\u9ebb\u4e00\u5927\u5768，IDA\u5206\u6790\u7684\u65f6\u5019\u660e\u663e\u80fd\u611f\u89c9\u5230\u5361\u987f，\u8df3\u8f6c\u3001\u67e5\u770b\u4ea4\u53c9\u5f15\u7528\u8fd9\u4e9b\u57fa\u672c\u64cd\u4f5c\u90fd\u53d8\u5f97\u5f88\u8fdf\u949d\u3002<\/p>\n
\u786c\u5543\u80af\u5b9a\u662f\u4e0d\u73b0\u5b9e\u7684，\u4e0e\u5176\u5728\u8fd9\u4e2a\u6df7\u6dc6\u8fc7\u7684"\u5e9e\u7136\u5927\u7269"\u91cc\u6b7b\u78d5，\u4e0d\u5982\u6362\u4e2a\u601d\u8def：\u65e2\u7136\u662f\u540c\u4e00\u5957SDK，\u65e9\u671f\u7248\u672c\u5f88\u53ef\u80fd\u8fd8\u6ca1\u4e0a\u8fd9\u4e48\u91cd\u7684\u6df7\u6dc6，\u6838\u5fc3\u903b\u8f91\u8bf4\u4e0d\u5b9a\u66f4\u6e05\u6670\u3001\u66f4\u5bb9\u6613\u770b\u61c2\u3002\u4e8e\u662f\u51b3\u5b9a\u5f80\u56de\u7ffb，\u627e\u627e\u8fd9\u4e2a\u53c2\u6570\u6700\u65e9\u662f\u4ece\u54ea\u4e2a\u7248\u672c\u5f00\u59cb\u51fa\u73b0\u7684，\u5148\u628a\u6700\u539f\u59cb\u7684\u5b9e\u73b0\u903b\u8f91\u770b\u61c2\u2014\u2014\u4e00\u65b9\u9762\u770b\u770b\u8fd9\u5957\u7b97\u6cd5\u80fd\u4e0d\u80fd\u590d\u7528，\u53e6\u4e00\u65b9\u9762\u4e5f\u60f3\u501f\u52a9\u5206\u6790\u8001\u7248\u672c\u79ef\u7d2f\u7684\u7ecf\u9a8c，\u53cd\u8fc7\u6765\u5e2e\u52a9\u786e\u5b9a\u6700\u65b0\u7248\u672c\u5230\u5e95\u91c7\u96c6\u4e86\u54ea\u4e9b\u53c2\u6570\u3002<\/p>\n
\u786e\u5b9a\u4e86\u5f80\u8001\u7248\u672c\u56de\u6eaf\u7684\u601d\u8def\u540e，\u63a5\u4e0b\u6765\u7684\u95ee\u9898\u662f：\u4ece\u54ea\u4e2a\u7248\u672c\u5f00\u59cb\u7ffb\u8d77，\u7ffb\u5230\u54ea\u4e2a\u7248\u672c\u4e3a\u6b62\u3002<\/p>\n
\u56e0\u4e3a\u8fd9\u4e2a\u53c2\u6570\u7684\u7279\u70b9\u662f"\u4e00\u540c\u610f\u9690\u79c1\u534f\u8bae\u5c31\u89e6\u53d1\u91c7\u96c6"，\u884c\u4e3a\u6bd4\u8f83\u660e\u663e\u3001\u597d\u5224\u65ad，\u6240\u4ee5\u627e\u6700\u65e9\u51fa\u73b0\u8fd9\u4e2a\u53c2\u6570\u7684\u7248\u672c\u53cd\u800c\u4e0d\u7b97\u96be\u2014\u2014\u53ea\u8981\u88c5\u4e0a\u3001\u70b9\u540c\u610f\u3001\u6293\u5305\u770b\u6709\u6ca1\u6709\u5bf9\u5e94\u8bf7\u6c42\u5c31\u884c，\u4e0d\u9700\u8981\u9010\u884c\u770b\u4ee3\u7801\u53bb\u786e\u8ba4\u3002<\/p>\n
\u5177\u4f53\u64cd\u4f5c\u662f\u53bb\u8c4c\u8c46\u835a\u8fd9\u7c7b\u5e94\u7528\u5546\u5e97\u627e\u5386\u53f2\u7248\u672c\u5b89\u88c5\u5305，\u4e5f\u53ef\u4ee5\u627e\u90a3\u79cd\u4fdd\u5b58\u4e86\u8fd1\u51e0\u5e74QQ\u6240\u6709\u5386\u53f2\u7248\u672c\u7684\u6e20\u9053\/\u9891\u9053，\u628a\u7248\u672c\u5305\u6536\u96c6\u9f50\u3002\u7136\u540e\u6309\u5927\u7248\u672c\u5f80\u524d\u7ffb，\u5148\u5b9a\u4f4d\u52309.0.x\u8fd9\u4e2a\u5927\u7248\u672c\u533a\u95f4，\u518d\u5f80\u524d\u51e0\u4e2a\u7248\u672c\u88c5\u4e0a\u8bd5\u2014\u2014\u53d1\u73b0\u518d\u5f80\u524d\u5c31\u6ca1\u6709\u8fd9\u4e2a\u53c2\u6570\u4e86，\u8fd9\u6837\u5c31\u80fd\u786e\u5b9a\u662f9.0.x\u91cc\u7684\u67d0\u4e2a\u5177\u4f53\u7248\u672c\u521a\u52a0\u4e0a\u7684\u8fd9\u4e2a\u91c7\u96c6\u903b\u8f91\u3002<\/p>\n
\u4f46\u7ffb\u8fd9\u51e0\u4e2a\u7248\u672c\u7684\u8fc7\u7a0b\u4e2d\u53d1\u73b0，\u6700\u65e9\u52a0\u4e0a\u8fd9\u4e2a\u53c2\u6570\u7684\u90a3\u51e0\u4e2a\u7248\u672c，\u5f00\u53d1\u4e0a\u597d\u50cf\u8fd8\u6ca1\u505a\u5b8c\u5584：App\u521a\u88c5\u4e0a\u3001\u4e00\u70b9\u8fdb\u53bb，\u8fd8\u6ca1\u8d70\u5230\u7528\u6237\u70b9\u540c\u610f\u9690\u79c1\u534f\u8bae\u8fd9\u4e00\u6b65，\u8bf7\u6c42\u5c31\u5df2\u7ecf\u53d1\u51fa\u53bb\u4e86\u3002\u8fd9\u79cd\u884c\u4e3a\u4e0d\u7b26\u5408\u6b63\u5e38\u9884\u671f（\u6b63\u5e38\u5e94\u8be5\u662f\u8981\u7b49\u540c\u610f\u4e4b\u540e\u624d\u91c7\u96c6），\u62ff\u6765\u505a\u5206\u6790\u8d77\u70b9\u4e0d\u592a\u5408\u9002\u3002<\/p>\n
\u7ee7\u7eed\u5f80\u540e\u7ffb，\u627e\u52309.0.20\u2014\u2014\u8fd9\u4e2a\u7248\u672c\u7684\u884c\u4e3a\u5c31\u6b63\u5e38\u4e86：\u88c5\u4e0a\u4e4b\u540e\u4e0d\u4f1a\u7acb\u523b\u53d1\u8bf7\u6c42，\u9700\u8981\u70b9\u51fb\u540c\u610f\u9690\u79c1\u534f\u8bae\u540e\u624d\u4f1a\u89e6\u53d1\u3002\u800c\u4e14\u8fd9\u4e2a\u7248\u672c\u65e0\u8bba\u662fspawn\u65b9\u5f0f\u542f\u52a8hook，\u8fd8\u662f\u5148attach\u4e0a\u518d\u624b\u52a8\u70b9\u540c\u610f，\u90fd\u80fd\u6b63\u5e38\u590d\u73b0\u8bf7\u6c42，\u8c03\u8bd5\u8d77\u6765\u5f88\u65b9\u4fbf\u3002\u6240\u4ee5\u6700\u7ec8\u9009\u5b9a9.0.20\u4f5c\u4e3a\u5206\u6790\u7684\u8d77\u70b9\u3002<\/p>\n
\u7248\u672c\u5b9a\u4e0b\u6765\u4e4b\u540e，\u5148\u4e0d\u6025\u7740\u6252so，\u7b2c\u4e00\u6b65\u662f\u628a\u5916\u90e8\u884c\u4e3a\u548c\u4ee3\u7801\u5165\u53e3\u5bf9\u4e0a\u2014\u2014\u76ee\u7684\u5f88\u660e\u786e，\u5c31\u662f\u8981\u9006\u8fd9\u4e2a\u91c7\u96c6\u53c2\u6570（qimei）\u3002<\/p>\n
\u65e2\u7136\u76ee\u6807\u660e\u786e，\u76f4\u63a5\u4ece\u5305\u540d\u5e26qimei\u7684\u7c7b\u627e\u8d77，\u5f88\u5feb\u5728com.tencent.qimei.*\u5305\u4e0b\u9762\u7ffb\u5230\u4e00\u4e2aURL：snowflake.qq.com\u3002\u6293\u5305\u6838\u5bf9\u4e86\u4e00\u4e0b，\u786e\u5b9e\u80fd\u770b\u5230\u8bf7\u6c42\u6253\u5230\u4e86\u8fd9\u4e2a\u57df\u540d，\u8bf4\u660e\u627e\u7684\u65b9\u5411\u662f\u5bf9\u7684\u3002<\/p>\n
\u4f46\u9759\u6001\u770b\u8fd9\u4e2aURL\u5e38\u91cf\u7684\u4ea4\u53c9\u5f15\u7528，\u5374\u6ca1\u627e\u5230\u6709\u4ee3\u7801\u5728\u76f4\u63a5\u8c03\u7528\u5b83\u2014\u2014\u8bf4\u660e\u6784\u9020\/\u53d1\u8d77\u8bf7\u6c42\u8fd9\u5757\u903b\u8f91\u4e0d\u662f\u7b80\u5355\u7684Java\u5c42\u5b57\u7b26\u4e32\u62fc\u63a5\u8c03\u7528，\u53ef\u80fd\u662f\u8d70\u4e86\u53cd\u5c04，\u6216\u8005\u5e72\u8106\u4e0b\u6c89\u5230\u4e86native\u5c42\u3002\u8fd9\u79cd\u60c5\u51b5\u4e0b，\u9759\u6001\u5206\u6790\u5f88\u5bb9\u6613\u5361\u5728\u8fd9\u4e00\u6b65\u3002<\/p>\n
\u4e8e\u662f\u6362\u6210\u52a8\u6001\u624b\u6bb5，\u7528Frida hook\u76f8\u5173\u65b9\u6cd5，\u5728\u8bf7\u6c42\u53d1\u51fa\u7684\u65f6\u673a\u6253\u5370\u8c03\u7528\u6808（stack trace）\u3002\u6808\u56de\u6eaf\u51fa\u6765\u4e4b\u540e，\u80fd\u770b\u5230\u8fd9\u4e2a\u8bf7\u6c42\u5b9e\u9645\u4e0a\u662f\u4ececom.tencent.qimei.uin.U.r\u8fd9\u4e2a\u65b9\u6cd5\u89e6\u53d1\u7684\u2014\u2014\u800c\u8fd9\u4e2a\u65b9\u6cd5\u672c\u8eab\u5c31\u662f\u4e00\u4e2anative\u65b9\u6cd5，\u5bf9\u5e94\u5230so\u91cc\u7684\u67d0\u4e2a\u51fd\u6570\u3002<\/p>\n
\u8fd9\u6837\u4e00\u6765，\u65b9\u5411\u5c31\u6e05\u695a\u4e86：Java\u5c42\u80fd\u505a\u7684\u9759\u6001\u5206\u6790\u5df2\u7ecf\u5230\u5934\u4e86，\u63a5\u4e0b\u6765\u8981\u771f\u6b63\u5b9a\u4f4d\u53c2\u6570\u662f\u600e\u4e48\u751f\u6210\u7684，\u5c31\u5f97\u8fdbso\u91cc\u9762\u53bb\u770b\u4e86\u3002<\/p>\n
\u5b9a\u4f4d\u5230com.tencent.qimei.uin.U.r\u662f\u4e2anative\u65b9\u6cd5\u4e4b\u540e，\u4e0b\u4e00\u6b65\u5c31\u662f\u8fdb\u5230so\u91cc\u9762\u53bb\u770b\u8fd9\u4e2a\u51fd\u6570\u5230\u5e95\u5e72\u4e86\u4ec0\u4e48\u3002<\/p>\n
\u5148\u6ca1\u6709\u76f4\u63a5\u4e0aIDA\u5543\u4f2a\u4ee3\u7801，\u800c\u662f\u5148\u7528Frida\u5728Java\u5c42\u8fd9\u4e2anative\u65b9\u6cd5\u4e0a\u6302\u4e86\u4e2ahook，\u89c2\u5bdf\u5b83\u5728\u4e00\u6b21\u5b8c\u6574\u6d41\u7a0b（\u6253\u5f00App\u5230\u70b9\u540c\u610f）\u91cc\u5230\u5e95\u88ab\u8c03\u7528\u4e86\u51e0\u6b21\u3001\u6bcf\u6b21\u8c03\u7528\u65f6\u7684\u53c2\u6570\u957f\u4ec0\u4e48\u6837，\u5fc3\u91cc\u5148\u6709\u4e2a\u6570\u3002<\/p>\n
\u8fdb\u5165so\u9759\u6001\u770b\u7684\u65f6\u5019，\u53d1\u73b0\u65e2\u6ca1\u6709init\u51fd\u6570，\u4e5f\u6ca1\u6709init_array，\u90a3\u5c31\u76f4\u63a5\u4eceJNI_OnLoad\u770b\u8d77\u3002\u5728RegisterNatives\u8c03\u7528\u4e4b\u524d，\u6709\u4e00\u4e2a\u51fd\u6570\u4f1a\u6267\u884c\u4e00\u6b21\u5f88\u5927\u5185\u5bb9\u7684memcpy\u64cd\u4f5c，memcpy\u5b8c\u4e4b\u540e\u628a\u8fd9\u6bb5\u5185\u5b58\u7684\u5730\u5740\u5b58\u8fdb\u4e86\u4e00\u4e2a\u5168\u5c40\u53d8\u91cf\u3002\u987a\u7740\u8fd9\u4e2a\u5168\u5c40\u53d8\u91cf\u505a\u4ea4\u53c9\u5f15\u7528，\u627e\u5230\u4e86\u4f7f\u7528\u5b83\u7684\u51fd\u6570，\u7ed3\u5408\u8c03\u7528\u70b9\u7684\u4e0a\u4e0b\u6587\u770b\u4e0b\u6765，\u80fd\u786e\u5b9a\u8fd9\u5c31\u662f\u4e00\u4e2a\u5b57\u7b26\u4e32\u89e3\u5bc6\u51fd\u6570\u2014\u2014\u90a3\u4e00\u5927\u6bb5memcpy\u8fdb\u6765\u7684\u5185\u5bb9，\u5c31\u662f\u52a0\u5bc6\u540e\u7684\u5b57\u7b26\u4e32\u6570\u636e\u3002<\/p>\n
\u8fd9\u4e2a\u89e3\u5bc6\u51fd\u6570\u8c03\u7528\u7684\u65f6\u5019\u9700\u8981\u4f20\u5165\u4e24\u4e2a\u6570\u5b57\u53c2\u6570，\u9759\u6001\u53bb\u63a8\u8fd9\u4e24\u4e2a\u6570\u5b57\u5bf9\u5e94\u54ea\u4e2a\u5b57\u7b26\u4e32\u3001\u89e3\u51fa\u6765\u662f\u4ec0\u4e48，\u641e\u8d77\u6765\u6bd4\u8f83\u9ebb\u70e6\u3002\u4e8e\u662f\u6362\u6210\u52a8\u6001\u65b9\u5f0f，\u5199\u4e86\u4e2aFrida\u811a\u672c\u6302\u5728\u8fd9\u4e2a\u89e3\u5bc6\u51fd\u6570\u7684\u8fd4\u56de\u70b9\u4e0a，\u628aso\u8fd0\u884c\u8fc7\u7a0b\u4e2d\u6240\u6709\u88ab\u89e3\u5bc6\u51fa\u6765\u7684\u5b57\u7b26\u4e32\u90fd\u6279\u91cf\u6253\u5370\u51fa\u6765\u3002<\/p>\n
\u6253\u5370\u51fa\u6765\u7684\u8fd9\u6279\u5b57\u7b26\u4e32\u91cc，\u4e00\u773c\u80fd\u770b\u51fa\u4e00\u5806\u6587\u4ef6\u8def\u5f84，\u8fd8\u6709\u4e00\u4e9b\u6682\u65f6\u770b\u4e0d\u51fa\u7528\u9014\u7684\u5185\u5bb9\u3002\u63a5\u4e0b\u6765\u5c31\u662f\u987a\u7740\u8fd9\u4e9b\u5b57\u7b26\u4e32\u505a\u4ea4\u53c9\u5f15\u7528，\u770b\u5b83\u4eec\u5206\u522b\u88ab\u4f20\u5230\u4e86\u54ea\u4e9b\u51fd\u6570\u91cc\u4f7f\u7528，\u901a\u8fc7\u4f7f\u7528\u573a\u666f\u6765\u53cd\u63a8\u8fd9\u4e9b\u5b57\u7b26\u4e32\u5b9e\u9645\u7684\u7528\u9014，\u4e3a\u540e\u9762\u6df1\u5165\u5206\u6790\u52a0\u5bc6\u903b\u8f91\u505a\u94fa\u57ab\u3002<\/p>\n
\u5b57\u7b26\u4e32\u8fd9\u6761\u7ebf\u7d22\u7406\u6e05\u695a\u4e4b\u540e，\u4e0b\u4e00\u6b65\u81ea\u7136\u662f\u8981\u987a\u85e4\u6478\u74dc\u627e\u5230\u52a0\u5bc6\u903b\u8f91\u5728\u54ea\u2014\u2014\u6bd5\u7adf\u6700\u7ec8\u53d1\u51fa\u53bb\u7684\u8bf7\u6c42\u53c2\u6570，\u80af\u5b9a\u662f\u7ecf\u8fc7\u52a0\u5bc6\u5904\u7406\u7684\u3002<\/p>\n
\u4e00\u5f00\u59cb\u8fd8\u662f\u60f3\u8d70Java\u5c42\u8fd9\u6761\u8def，\u5e0c\u671b\u80fd\u50cf\u524d\u9762\u627e\u8bf7\u6c42\u53d1\u8d77\u70b9\u90a3\u6837，\u987a\u7740\u8c03\u7528\u94fe\u4e00\u8def\u8ddf\u5230\u52a0\u5bc6\u7684\u5730\u65b9\u3002\u4f46\u8fd9\u6b21\u6ca1\u90a3\u4e48\u987a\u5229：\u8ddf\u4e0b\u53bb\u53d1\u73b0，\u4eceJava\u5c42\u80fd\u770b\u5230\u7684\u8c03\u7528\u94fe\u5230\u67d0\u4e00\u6b65\u5c31\u65ad\u4e86，\u518d\u5f80\u4e0b\u5df2\u7ecf\u770b\u4e0d\u5230\u660e\u663e\u7684\u52a0\u5bc6\u76f8\u5173\u8c03\u7528\u4e86\u2014\u2014\u903b\u8f91\u5927\u6982\u7387\u662f\u6574\u4e2a\u4e0b\u6c89\u5230native\u5c42\u91cc\u5b8c\u6210\u7684，Java\u5c42\u8fd9\u8fb9\u53ea\u662f\u7b80\u5355\u4f20\u4e86\u4e2a\u53c2\u6570\u8fdb\u53bb，\u5177\u4f53\u600e\u4e48\u5904\u7406\u5b8c\u5168\u770b\u4e0d\u51fa\u6765\u3002<\/p>\n
\u8fd9\u6837\u4e00\u6765，\u5355\u7eaf\u4eceJava\u5c42\u5f80\u4e0b\u8ddf\u8fd9\u6761\u8def\u8d70\u4e0d\u901a\u4e86，\u5f97\u6362\u4e2a\u601d\u8def，\u76f4\u63a5\u4ecenative\u5c42\u5165\u624b\u53bb\u627e\u52a0\u5bc6\u903b\u8f91\u7684\u4f4d\u7f6e\u3002<\/p>\n
Java\u5c42\u8fd9\u6761\u8def\u8d70\u4e0d\u901a\u4e4b\u540e，\u601d\u8def\u6362\u6210\u4e86"\u7ed3\u679c\u5bfc\u5411"：\u65e2\u7136\u4e0d\u77e5\u9053\u52a0\u5bc6\u903b\u8f91\u5177\u4f53\u5728\u54ea\u4e2a\u51fd\u6570\u91cc，\u90a3\u5c31\u4e0d\u7528\u7ba1\u8c03\u7528\u94fe，\u76f4\u63a5\u5728so\u91cc\u627e\u52a0\u5bc6\u7b97\u6cd5\u672c\u8eab\u7559\u4e0b\u7684\u75d5\u8ff9\u3002<\/p>\n
\u5e38\u89c1\u7684\u52a0\u5bc6\u7b97\u6cd5\u5728\u5b9e\u73b0\u7684\u65f6\u5019，\u901a\u5e38\u4f1a\u7528\u5230\u4e00\u4e9b\u56fa\u5b9a\u7684\u7279\u5f81\u5e38\u91cf，\u6bd4\u5982AES\u7684S-box\u66ff\u6362\u8868\u8fd9\u7c7b\u521d\u59cb\u5316\u6570\u636e，\u8fd9\u4e9b\u5e38\u91cf\u5728\u4e8c\u8fdb\u5236\u6587\u4ef6\u91cc\u57fa\u672c\u662f\u4e0d\u53d8\u7684，\u53ef\u4ee5\u76f4\u63a5\u641c\u3002\u4e8e\u662f\u7528\u4e86IDA\u7684findcrypt\u63d2\u4ef6\u5bf9so\u626b\u4e86\u4e00\u904d，\u641c\u51fa\u6765\u547d\u4e2d\u4e86MD5\u548cAES\u76f8\u5173\u7684\u5e38\u91cf\u3002<\/p>\n
\u5148\u987a\u7740AES\u7684\u5e38\u91cf\u5f80\u56de\u627e\u5f15\u7528，\u627e\u5230\u4e00\u4e2asub_F200\u51fd\u6570，\u91cc\u9762\u6709\u4e00\u5904\u5728\u5224\u65ad\u67d0\u4e2a\u5165\u53c2\u7684\u957f\u5ea6\u662f\u5426\u7b49\u4e8e16\u3002\u7ed3\u5408AES\u5e38\u89c1\u7684key\/iv\u957f\u5ea6\u5c31\u662f16\u5b57\u8282\u8fd9\u4e00\u70b9，\u5408\u7406\u6000\u7591\u8fd9\u91cc\u5c31\u662f\u5728\u6821\u9a8c\u4f20\u8fdb\u6765\u7684key\u548civ\u7684\u957f\u5ea6\u662f\u5426\u5408\u6cd5\u2014\u2014\u5982\u679c\u8fd9\u4e2a\u5224\u65ad\u6210\u7acb，\u90a3\u8fd9\u4e2a\u51fd\u6570\u9644\u8fd1\u5927\u6982\u7387\u5c31\u662fAES\u52a0\u5bc6\u771f\u6b63\u88ab\u8c03\u7528\u3001\u5904\u7406key\/iv\u7684\u5730\u65b9\u3002<\/p>\n
\u8fd9\u6837\u4e00\u6765，\u52a0\u5bc6\u903b\u8f91\u7684\u4f4d\u7f6e\u57fa\u672c\u9501\u5b9a\u4e86，\u4f46\u5177\u4f53\u662f\u4e0d\u662f\u5bf9\u5e94\u6293\u5305\u770b\u5230\u7684\u90a3\u4e2a\u8bf7\u6c42\u53c2\u6570，\u8fd8\u9700\u8981\u8fdb\u4e00\u6b65\u52a8\u6001\u9a8c\u8bc1\u3002<\/p>\n
\u9759\u6001\u5206\u6790\u5b9a\u4f4d\u5230\u7591\u4f3cAES\u52a0\u5bc6\u8c03\u7528\u7684\u4f4d\u7f6e\u4e4b\u540e，\u53ea\u80fd\u7b97\u662f"\u731c\u6d4b"，\u8fd8\u4e0d\u80fd\u767e\u5206\u767e\u786e\u5b9a\u8fd9\u91cc\u5c31\u662f\u6700\u7ec8\u8bf7\u6c42\u53c2\u6570\u7684\u52a0\u5bc6\u70b9\u3002\u8981\u9a8c\u8bc1\u8fd9\u4e2a\u731c\u6d4b，\u6700\u76f4\u63a5\u7684\u529e\u6cd5\u5c31\u662f\u52a8\u6001\u8dd1\u8d77\u6765，\u770b\u5b9e\u9645\u8f93\u51fa\u7684\u5bc6\u6587\u662f\u4e0d\u662f\u548c\u6293\u5305\u6293\u5230\u7684\u8bf7\u6c42\u5185\u5bb9\u5bf9\u5f97\u4e0a\u3002<\/p>\n
\u4e8e\u662f\u5728\u8fd9\u4e2a\u7591\u4f3c\u7684AES\u51fd\u6570\u4e0a\u6302\u4e86Frida hook，\u5148\u6253\u5370\u4e86\u4e00\u4e0b\u5165\u53c2\u5185\u5bb9\u3002\u770b\u4e86\u4e0b\u53d1\u73b0\u8fd9\u4e2a\u51fd\u6570\u5176\u5b9e\u662f\u52a0\u89e3\u5bc6\u590d\u7528\u7684\u2014\u2014\u662f\u52a0\u5bc6\u8fd8\u662f\u89e3\u5bc6，\u662f\u7531\u5165\u53c2\u91cc\u7684\u67d0\u4e2a\u6807\u5fd7\u4f4d\u6765\u63a7\u5236\u7684，\u5e76\u4e0d\u662f\u4e24\u4e2a\u72ec\u7acb\u7684\u51fd\u6570\u3002\u786e\u8ba4\u4e86\u8fd9\u4e00\u70b9\u4e4b\u540e，\u628ahook\u811a\u672c\u5b8c\u5584\u4e86\u4e00\u4e0b，\u628akey\u3001iv，\u4ee5\u53ca\u52a0\u89e3\u5bc6\u524d\u540e\u7684\u5185\u5bb9\u90fd\u6253\u5370\u51fa\u6765，\u65b9\u4fbf\u540e\u7eed\u5bf9\u7167\u3002<\/p>\n
\u8dd1\u8d77\u6765\u4e4b\u540e\u53d1\u73b0\u4e00\u4e2a\u7ec6\u8282：\u8fd9\u4e2aAES\u51fd\u6570\u5728\u4e00\u6b21\u6d41\u7a0b\u91cc\u88ab\u8c03\u7528\u4e86\u4e24\u6b21，\u4e5f\u5c31\u662f\u8bf4\u8bf7\u6c42\u53c2\u6570\u5b9e\u9645\u4e0a\u662f\u7ecf\u8fc7\u4e24\u6b21AES\u52a0\u5bc6\u5f97\u5230\u7684\u3002\u901a\u8fc7\u5bf9\u6bd4\u4e24\u6b21\u8c03\u7528\u524d\u540e\u7684\u6570\u636e\u53d8\u5316\u53ef\u4ee5\u770b\u51fa：\u7b2c\u4e00\u6b21\u52a0\u5bc6\u7684\u65f6\u5019，\u5165\u53c2\u8fd8\u662f\u80fd\u770b\u51fa\u660e\u663e\u7ed3\u6784\u7684\u660e\u6587；\u7b2c\u4e00\u6b21\u52a0\u5bc6\u7684\u7ed3\u679c\u51fa\u6765\u4e4b\u540e，\u4f1a\u5728\u524d\u9762\u62fc\u63a5\u4e0a\u4e00\u6bb5\u56fa\u5b9a\u5185\u5bb903000001，\u62fc\u63a5\u4e4b\u540e\u518d\u9001\u8fdb\u540c\u4e00\u4e2a\u51fd\u6570\u505a\u7b2c\u4e8c\u6b21\u52a0\u5bc6，\u8fd9\u624d\u662f\u6700\u7ec8\u53d1\u51fa\u53bb\u7684\u5bc6\u6587\u3002<\/p>\n
\u53e6\u5916\u591a\u8dd1\u4e86\u51e0\u6b21\u6d41\u7a0b\u53cd\u590d\u6d4b\u8bd5\u5bf9\u6bd4，\u8fd8\u53d1\u73b0\u4e00\u4e2a\u89c4\u5f8b：\u8fd9\u4e24\u6b21\u52a0\u5bc6\u7528\u5230\u7684key\u548civ\u5e76\u4e0d\u662f\u5b8c\u5168\u72ec\u7acb\u968f\u673a\u7684\u2014\u2014\u53ea\u6709\u7b2c\u4e8c\u6b21\u52a0\u5bc6\u7684key\u548civ\u662f\u6bcf\u6b21\u90fd\u4f1a\u53d8\u5316\u7684，\u7b2c\u4e00\u6b21\u52a0\u5bc6\u7684key\u548civ\u5219\u662f\u56fa\u5b9a\u4e0d\u53d8\u7684\u3002\u800c\u4e14\u8fd9\u4e2a\u56fa\u5b9a\u7684key\u548civ，\u76f4\u63a5\u62ff\u53bb\u524d\u9762\u6253\u5370\u51fa\u6765\u7684\u89e3\u5bc6\u5b57\u7b26\u4e32\u5217\u8868\u91cc\u641c\u7d22，\u5c31\u80fd\u641c\u5230\u2014\u2014\u8bf4\u660e\u7b2c\u4e00\u6b21\u52a0\u5bc6\u7528\u7684key\u548civ\u672c\u8eab\u5c31\u662f\u786c\u7f16\u7801\u5728so\u91cc\u3001\u4ee5\u52a0\u5bc6\u5b57\u7b26\u4e32\u7684\u5f62\u5f0f\u5b58\u5728\u7684，\u8fd0\u884c\u65f6\u89e3\u5bc6\u51fa\u6765\u76f4\u63a5\u7528\u3002<\/p>\n
\u628a\u6700\u7ec8\u7b2c\u4e8c\u6b21\u52a0\u5bc6\u7684\u7ed3\u679c\u505abase64\u7f16\u7801，\u548c\u6293\u5305\u91cc\u7684\u8bf7\u6c42\u53c2\u6570\u505a\u5bf9\u6bd4，\u662f\u80fd\u5bf9\u4e0a\u7684\u3002\u8fd9\u6837\u5c31\u786e\u8ba4\u4e86：\u524d\u9762\u5b9a\u4f4d\u5230\u7684\u8fd9\u4e2a\u51fd\u6570\u786e\u5b9e\u662f\u6807\u51c6\u7684AES\u52a0\u5bc6\u5b9e\u73b0，\u800c\u4e14\u662f\u5957\u4e86\u4e24\u5c42，\u7b2c\u4e00\u5c42key\/iv\u56fa\u5b9a\u3001\u7b2c\u4e8c\u5c42key\/iv\u6bcf\u6b21\u53d8\u5316\u3002<\/p>\n
\u63a5\u4e0b\u6765\u8981\u641e\u6e05\u695a\u7684\u5c31\u662f\u4e24\u5757\u5185\u5bb9：\u7b2c\u4e00\u6b21\u52a0\u5bc6\u7684\u660e\u6587\u5230\u5e95\u662f\u4ec0\u4e48\u3001\u600e\u4e48\u6765\u7684；\u4ee5\u53ca\u7b2c\u4e8c\u6b21\u52a0\u5bc6\u7528\u5230\u7684\u3001\u6bcf\u6b21\u90fd\u4f1a\u53d8\u5316\u7684key\u548civ\u662f\u600e\u4e48\u751f\u6210\u7684\u3002<\/p>\n
\u52a0\u5bc6\u70b9\u786e\u8ba4\u4e4b\u540e，\u7b2c\u4e00\u4ef6\u8981\u641e\u6e05\u695a\u7684\u4e8b\u5c31\u662f：\u7b2c\u4e00\u6b21AES\u52a0\u5bc6\u7684\u660e\u6587\u5230\u5e95\u662f\u4ec0\u4e48\u7ed3\u6784，\u53c8\u662f\u600e\u4e48\u62fc\u51fa\u6765\u7684\u3002<\/p>\n
PB\u7ed3\u6784\u4e0e\u6587\u4ef6\u4fe1\u606f<\/p>\n
\u5148\u770b\u660e\u6587\u672c\u8eab\u7684\u7279\u5f81\u3002\u6253\u5370\u51fa\u6765\u7684\u660e\u6587\u6570\u636e\u5f00\u5934\u662f0a，\u8fd9\u4e2a\u7279\u5f81\u5728protobuf\u5e8f\u5217\u5316\u6570\u636e\u91cc\u5f88\u5e38\u89c1\u2014\u2014protobuf\u7684\u5b57\u6bb5\u6807\u7b7e（tag）\u7531\u5b57\u6bb5\u53f7\u548cwire type\u7ec4\u6210，\u5f88\u591a\u5e38\u89c1\u7ed3\u6784\u7b2c\u4e00\u4e2a\u5b57\u6bb5\u7f16\u7801\u51fa\u6765\u5c31\u6b63\u597d\u662f0a\u5f00\u5934，\u6240\u4ee5\u7b2c\u4e00\u53cd\u5e94\u5c31\u662f"\u8fd9\u5927\u6982\u7387\u662f\u4e2aPB\u7ed3\u6784"\u3002\u76f4\u63a5\u4e22\u8fdbCyberChef，\u7528protobuf\u89e3\u7801\u529f\u80fd\u53cd\u5e8f\u5217\u5316\u4e86\u4e00\u4e0b，\u679c\u7136\u80fd\u89e3\u51fa\u7ed3\u6784\u5316\u7684\u5b57\u6bb5\u5185\u5bb9，\u5185\u5bb9\u6574\u4f53\u770b\u8d77\u6765\u6bd4\u8f83\u5e38\u89c4，\u5b57\u6bb5\u7c7b\u578b\u548c\u6570\u503c\u90fd\u8fd8\u7b97\u89c4\u6574，\u9a8c\u8bc1\u4e86\u8fd9\u4e2a\u731c\u6d4b\u3002<\/p>\n
[>>>] \u8fdb\u5165 sub_F200
\n arg0: 0x1
\n arg1 (Hexdump – 16 bytes): @ 0x6e75f81070
\n 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
\n6e75f81070 ff 80 20 03 f6 7f 55 be 8b 53 5a 97 b0 1b 45 9d .. …U..SZ…E.
\n arg2 (Hexdump – 16 bytes): @ 0x6e75f81080
\n 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
\n6e75f81080 b8 22 19 69 c2 7a 80 19 d5 33 b1 39 ad e7 1b cc .".i.z…3.9….
\n arg4 (Hexdump – Length: 2188): @ 0x6f05f81910
\n 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
\n6f05f81910 0a 73 08 01 12 10 42 30 45 39 46 34 45 35 37 34 .s….B0E9F4E574
\n6f05f81920 43 43 46 32 36 39 22 10 30 53 32 30 30 4d 4e 4a CCF269".0S200MNJ
\n6f05f81930 54 38 30 37 56 33 47 45 2a 0b 32 2e 31 2e 32 2e T807V3GE*.2.1.2.
\n6f05f81940 31 30 33 2e 34 32 0b 39 2e 30 2e 32 30 2e 35 38 103.42.9.0.20.58
\n6f05f81950 34 34 3a 13 41 6e 64 72 6f 69 64 20 31 32 2c 6c 44:.Android 12,l
\n6f05f81960 65 76 65 6c 20 33 31 5a 14 63 6f 6d 2e 74 65 6e evel 31Z.com.ten
\n6f05f81970 63 65 6e 74 2e 6d 6f 62 69 6c 65 71 71 62 04 77 cent.mobileqqb.w
\n6f05f81980 69 66 69 68 03 12 94 10 0a 04 32 30 30 38 12 02 ifih……2008..
\n6f05f81990 33 31 1a 02 7b 7d 22 06 67 6f 6f 67 6c 65 2a c4 31..{}".google*.
\n6f05f819a0 0b 6b 31 3a 32 30 32 36 2d 30 33 2d 32 30 32 32 .k1:2026-03-2022
\n6f05f819b0 31 35 33 38 2e 36 38 31 30 30 30 30 32 33 2b 30 1538.681000023+0
\n6f05f819c0 38 30 30 3b 6b 32 3a 32 30 32 36 2d 30 33 2d 32 800;k2:2026-03-2
\n6f05f819d0 30 32 32 31 36 30 35 2e 33 39 37 36 36 39 33 35 0221605.39766935
\n6f05f819e0 32 2b 30 38 30 30 3b 6b 33 3a 30 30 30 30 30 30 2+0800;k3:000000
\n6f05f819f0 30 30 30 30 30 30 30 30 30 30 3b 6b 34 3a 64 62 0000000000;k4:db
\n6f05f81a00 38 65 66 62 64 39 62 39 63 32 63 35 38 61 3b 6b 8efbd9b9c2c58a;k
\n6f05f81a10 35 3a 31 33 35 32 32 34 32 37 3b 6b 36 3a 31 33 5:13522427;k6:13
\n6f05f81a20 31 39 35 37 37 36 3b 6b 37 3a 32 31 33 35 38 38 195776;k7:213588
\n6f05f81a30 3b 6b 38 3a 32 38 30 30 3b 6b 39 3a 63 35 65 36 ;k8:2800;k9:c5e6
\n6f05f81a40 39 38 37 31 2d 35 39 61 31 2d 34 63 66 33 2d 39 9871-59a1-4cf3-9
\n6f05f81a50 61 65 64 2d 65 34 35 38 66 38 32 37 30 61 30 31 aed-e458f8270a01
\n6f05f81a60 3b 6b 31 31 3a 31 37 31 3b 6b 31 32 3a 34 44 65 ;k11:171;k12:4De
\n6f05f81a70 76 69 63 65 74 79 70 65 30 2c 30 3b 6b 31 33 3a vicetype0,0;k13:
\n6f05f81a80 32 30 32 36 2d 30 33 2d 32 30 32 32 31 36 30 35 2026-03-20221605
\n6f05f81a90 2e 33 39 37 36 36 39 33 35 32 2b 30 38 30 30 3b .397669352+0800;
\n6f05f81aa0 6b 31 34 3a 32 30 32 36 2d 30 34 2d 32 38 31 34 k14:2026-04-2814
\n6f05f81ab0 30 31 31 33 2e 37 30 33 30 31 30 34 34 34 2b 30 0113.703010444+0
\n6f05f81ac0 38 30 30 3b 6b 31 35 3a 32 38 33 31 3b 6b 31 36 800;k15:2831;k16
\n6f05f81ad0 3a 31 38 44 65 76 69 63 65 74 79 70 65 30 2c 30 :18Devicetype0,0
\n6f05f81ae0 3b 6b 31 37 3a 32 30 32 36 2d 30 34 2d 33 30 31 ;k17:2026-04-301
\n6f05f81af0 31 32 38 34 39 2e 33 36 37 36 30 30 37 39 34 2b 12849.367600794+
\n6f05f81b00 30 38 30 30 3b 6b 31 38 3a 32 30 32 36 2d 30 34 0800;k18:2026-04
\n6f05f81b10 2d 33 30 31 31 32 38 34 39 2e 33 37 30 39 33 34 -30112849.370934
\n6f05f81b20 31 32 37 2b 30 38 30 30 3b 6b 31 39 3a 38 30 37 127+0800;k19:807
\n6f05f81b30 36 39 31 3b 6b 32 30 3a 34 44 65 76 69 63 65 74 691;k20:4Devicet
\n6f05f81b40 79 70 65 30 2c 30 3b 6b 32 31 3a 32 30 32 36 2d ype0,0;k21:2026-
\n6f05f81b50 30 34 2d 33 30 31 31 32 38 34 39 2e 33 37 30 39 04-30112849.3709
\n6f05f81b60 33 34 31 32 37 2b 30 38 30 30 3b 6b 32 32 3a 32 34127+0800;k22:2
\n6f05f81b70 30 32 36 2d 30 34 2d 33 30 31 31 32 38 34 39 2e 026-04-30112849.
\n6f05f81b80 33 36 37 36 30 30 37 39 34 2b 30 38 30 30 3b 6b 367600794+0800;k
\n6f05f81b90 32 33 3a 38 30 37 36 39 32 3b 6b 32 34 3a 32 44 23:807692;k24:2D
\n6f05f81ba0 65 76 69 63 65 74 79 70 65 30 2c 30 3b 6b 32 35 evicetype0,0;k25
\n6f05f81bb0 3a 31 39 37 34 2d 31 30 2d 30 38 31 31 30 36 32 :1974-10-0811062
\n6f05f81bc0 39 2e 30 33 33 33 33 33 39 38 34 2b 30 38 30 30 9.033333984+0800
\n6f05f81bd0 3b 6b 32 36 3a 31 39 37 34 2d 31 30 2d 30 38 31 ;k26:1974-10-081
\n6f05f81be0 31 30 36 32 39 2e 30 33 36 36 36 37 33 31 37 2b 10629.036667317+
\n6f05f81bf0 30 38 30 30 3b 6b 32 37 3a 32 33 33 36 33 3b 6b 0800;k27:23363;k
\n6f05f81c00 32 38 3a 31 35 44 65 76 69 63 65 74 79 70 65 30 28:15Devicetype0
\n6f05f81c10 2c 30 3b 6b 32 39 3a 3b 6b 33 30 3a 3b 6b 33 31 ,0;k29:;k30:;k31
\n6f05f81c20 3a 3b 6b 33 32 3a 3b 6b 33 33 3a 32 30 32 36 2d :;k32:;k33:2026-
\n6f05f81c30 30 33 2d 32 30 32 32 31 36 30 35 2e 39 34 31 30 03-20221605.9410
\n6f05f81c40 30 32 37 33 39 2b 30 38 30 30 3b 6b 33 34 3a 32 02739+0800;k34:2
\n6f05f81c50 30 32 36 2d 30 34 2d 33 30 31 31 32 30 32 33 2e 026-04-30112023.
\n6f05f81c60 38 32 37 35 35 30 34 33 33 2b 30 38 30 30 3b 6b 827550433+0800;k
\n6f05f81c70 33 35 3a 32 37 34 33 3b 6b 33 36 3a 35 33 44 65 35:2743;k36:53De
\n6f05f81c80 76 69 63 65 74 79 70 65 30 2c 30 3b 6b 33 37 3a vicetype0,0;k37:
\n6f05f81c90 32 30 32 36 2d 30 33 2d 32 30 32 32 31 36 30 35 2026-03-20221605
\n6f05f81ca0 2e 39 34 31 30 30 32 37 33 39 2b 30 38 30 30 3b .941002739+0800;
\n6f05f81cb0 6b 33 38 3a 32 30 32 36 2d 30 33 2d 32 30 32 32 k38:2026-03-2022
\n6f05f81cc0 31 36 30 35 2e 39 34 31 30 30 32 37 33 39 2b 30 1605.941002739+0
\n6f05f81cd0 38 30 30 3b 6b 33 39 3a 32 37 39 36 3b 6b 34 30 800;k39:2796;k40
\n6f05f81ce0 3a 35 44 65 76 69 63 65 74 79 70 65 30 2c 30 3b :5Devicetype0,0;
\n6f05f81cf0 6b 34 31 3a 3b 6b 34 32 3a 3b 6b 34 33 3a 3b 6b k41:;k42:;k43:;k
\n6f05f81d00 34 34 3a 3b 6b 34 35 3a 32 30 32 36 2d 30 33 2d 44:;k45:2026-03-
\n6f05f81d10 32 30 32 32 31 36 30 30 2e 36 35 31 30 30 32 32 20221600.6510022
\n6f05f81d20 31 32 2b 30 38 30 30 3b 6b 34 36 3a 32 34 38 36 12+0800;k46:2486
\n6f05f81d30 3b 6b 34 37 3a 32 30 32 36 2d 30 33 2d 32 30 32 ;k47:2026-03-202
\n6f05f81d40 32 31 35 33 38 2e 35 39 34 33 33 33 33 34 38 2b 21538.594333348+
\n6f05f81d50 30 38 30 30 3b 6b 34 38 3a 32 30 32 36 2d 30 33 0800;k48:2026-03
\n6f05f81d60 2d 32 30 32 32 31 35 34 30 2e 32 35 37 36 36 36 -20221540.257666
\n6f05f81d70 38 34 37 2b 30 38 30 30 3b 6b 34 39 3a 32 30 32 847+0800;k49:202
\n6f05f81d80 36 2d 30 33 2d 32 30 32 32 31 36 30 30 2e 37 32 6-03-20221600.72
\n6f05f81d90 37 36 36 38 38 38 36 2b 30 38 30 30 3b 6b 35 30 7668886+0800;k50
\n6f05f81da0 3a 32 34 39 32 3b 6b 35 31 3a 3b 6b 35 32 3a 3b :2492;k51:;k52:;
\n6f05f81db0 6b 35 33 3a 3b 6b 35 34 3a 32 30 32 36 2d 30 33 k53:;k54:2026-03
\n6f05f81dc0 2d 32 30 32 32 31 35 33 38 2e 35 39 31 30 30 30 -20221538.591000
\n6f05f81dd0 30 31 34 2b 30 38 30 30 3b 6b 35 35 3a 39 39 3b 014+0800;k55:99;
\n6f05f81de0 6b 35 36 3a 32 34 37 39 3b 6b 35 37 3a 32 34 39 k56:2479;k57:249
\n6f05f81df0 31 3b 6b 35 38 3a 32 30 32 36 2d 30 33 2d 32 30 1;k58:2026-03-20
\n6f05f81e00 32 32 31 35 35 30 2e 37 39 34 33 33 34 35 36 33 221550.794334563
\n6f05f81e10 2b 30 38 30 30 3b 6b 35 39 3a 32 30 32 36 2d 30 +0800;k59:2026-0
\n6f05f81e20 33 2d 32 30 32 32 31 35 35 30 2e 37 39 34 33 33 3-20221550.79433
\n6f05f81e30 34 35 36 33 2b 30 38 30 30 3b 6b 36 30 3a 31 37 4563+0800;k60:17
\n6f05f81e40 35 36 3b 6b 36 31 3a 35 35 39 31 3b 6b 36 32 3a 56;k61:5591;k62:
\n6f05f81e50 32 30 32 36 2d 30 33 2d 32 30 32 32 31 36 30 31 2026-03-20221601
\n6f05f81e60 2e 30 30 37 36 36 38 39 31 34 2b 30 38 30 30 3b .007668914+0800;
\n6f05f81e70 6b 36 33 3a 32 35 31 32 3b 6b 36 34 3a 32 30 32 k63:2512;k64:202
\n6f05f81e80 36 2d 30 33 2d 32 30 32 32 31 36 30 30 2e 33 30 6-03-20221600.30
\n6f05f81e90 37 36 36 38 38 34 34 2b 30 38 30 30 3b 6b 36 35 7668844+0800;k65
\n6f05f81ea0 3a 32 34 38 35 3b 6b 36 36 3a 31 37 31 3b 6b 36 :2485;k66:171;k6
\n6f05f81eb0 37 3a 32 30 32 36 2d 30 33 2d 32 30 32 32 31 35 7:2026-03-202215
\n6f05f81ec0 34 33 2e 32 37 37 36 36 37 31 34 38 2b 30 38 30 43.277667148+080
\n6f05f81ed0 30 3b 6b 36 38 3a 33 35 36 3b 6b 36 39 3a 3b 6b 0;k68:356;k69:;k
\n6f05f81ee0 37 30 3a 31 31 33 3b 6b 37 31 3a 32 30 32 36 2d 70:113;k71:2026-
\n6f05f81ef0 30 33 2d 32 30 32 32 31 35 33 38 2e 35 39 34 33 03-20221538.5943
\n6f05f81f00 33 33 33 34 38 2b 30 38 30 30 3b 6b 37 32 3a 31 33348+0800;k72:1
\n6f05f81f10 31 34 3b 6b 37 33 3a 32 30 32 36 2d 30 33 2d 32 14;k73:2026-03-2
\n6f05f81f20 30 32 32 31 35 33 38 2e 35 39 34 33 33 33 33 34 0221538.59433334
\n6f05f81f30 38 2b 30 38 30 30 3b 6b 37 34 3a 32 30 32 36 2d 8+0800;k74:2026-
\n6f05f81f40 30 33 2d 32 30 32 32 31 35 34 33 2e 33 39 37 36 03-20221543.3976
\n6f05f81f50 36 37 31 36 30 2b 30 38 30 30 3b 6b 37 35 3a 3b 67160+0800;k75:;
\n6f05f81f60 6b 31 30 3a 31 62 b7 03 7b 22 68 61 72 6d 6f 6e k10:1b..{"harmon
\n6f05f81f70 79 22 3a 22 30 22 2c 22 63 6c 6f 6e 65 22 3a 22 y":"0","clone":"
\n6f05f81f80 30 22 2c 22 63 6f 6e 74 61 69 6e 65 22 3a 22 22 0","containe":""
\n6f05f81f90 2c 22 6f 7a 22 3a 22 45 67 75 34 64 45 59 6e 61 ,"oz":"Egu4dEYna
\n6f05f81fa0 70 51 4a 6c 78 38 4e 35 52 47 4e 55 42 43 49 51 pQJlx8N5RGNUBCIQ
\n6f05f81fb0 78 4d 49 45 67 45 33 4c 39 5c 2f 6f 76 59 67 53 xMIEgE3L9\\\\\/ovYgS
\n6f05f81fc0 50 52 51 3d 22 2c 22 6f 6f 22 3a 22 78 34 6d 52 PRQ=","oo":"x4mR
\n6f05f81fd0 39 6e 4b 33 63 65 5c 2f 2b 30 43 6d 57 48 49 62 9nK3ce\\\\\/+0CmWHIb
\n6f05f81fe0 66 4e 67 3d 3d 22 2c 22 6b 65 6c 6f 6e 67 22 3a fNg==","kelong":
\n6f05f81ff0 22 30 22 2c 22 69 70 22 3a 22 31 39 32 2e 31 36 "0","ip":"192.16
\n6f05f82000 38 2e 31 30 30 2e 34 33 22 2c 22 6d 75 6c 74 69 8.100.43","multi
\n6f05f82010 55 73 65 72 22 3a 22 30 22 2c 22 62 6f 64 22 3a User":"0","bod":
\n6f05f82020 22 62 6c 75 65 6c 69 6e 65 22 2c 22 62 72 64 22 "blueline","brd"
\n6f05f82030 3a 22 67 6f 6f 67 6c 65 22 2c 22 64 76 22 3a 22 :"google","dv":"
\n6f05f82040 62 6c 75 65 6c 69 6e 65 22 2c 22 66 69 72 73 74 blueline","first
\n6f05f82050 4c 65 76 65 6c 22 3a 22 32 38 22 2c 22 6d 61 6e Level":"28","man
\n6f05f82060 75 66 61 63 74 22 3a 22 47 6f 6f 67 6c 65 22 2c ufact":"Google",
\n6f05f82070 22 6e 61 6d 65 22 3a 22 62 6c 75 65 6c 69 6e 65 "name":"blueline
\n6f05f82080 22 2c 22 68 6f 73 74 22 3a 22 61 62 66 61 72 6d ","host":"abfarm
\n6f05f82090 2d 72 65 6c 65 61 73 65 2d 72 62 65 2d 36 34 2d -release-rbe-64-
\n6f05f820a0 30 30 30 32 33 22 2c 22 6b 65 72 6e 65 6c 22 3a 00023","kernel":
\n6f05f820b0 22 4c 69 6e 75 78 20 6c 6f 63 61 6c 68 6f 73 74 "Linux localhost
\n6f05f820c0 20 34 2e 39 2e 32 37 30 2d 67 38 36 32 66 35 31 4.9.270-g862f51
\n6f05f820d0 62 61 63 39 30 30 2d 61 62 37 36 31 33 36 32 35 bac900-ab7613625
\n6f05f820e0 20 23 30 20 53 4d 50 20 50 52 45 45 4d 50 54 20 #0 SMP PREEMPT
\n6f05f820f0 54 68 75 20 41 75 67 20 35 20 30 37 3a 30 34 3a Thu Aug 5 07:04:
\n6f05f82100 34 32 20 55 54 43 20 32 30 32 31 20 61 61 72 63 42 UTC 2021 aarc
\n6f05f82110 68 36 34 22 2c 22 70 72 65 22 3a 22 30 22 7d 72 h64","pre":"0"}r
\n6f05f82120 05 50 68 6f 6e 65 7a 0a 31 37 37 37 34 35 36 35 .Phonez.17774565
\n6f05f82130 32 35 82 01 24 63 35 65 36 39 38 37 31 2d 35 39 25..$c5e69871-59
\n6f05f82140 61 31 2d 34 63 66 33 2d 39 61 65 64 2d 65 34 35 a1-4cf3-9aed-e45
\n6f05f82150 38 66 38 32 37 30 61 30 31 8a 01 40 34 34 42 35 8f8270a01..@44B5
\n6f05f82160 37 39 46 44 35 38 35 30 31 30 45 33 34 43 46 32 79FD585010E34CF2
\n6f05f82170 31 41 46 44 46 44 32 43 42 35 41 34 34 34 34 34 1AFDFD2CB5A44444
\n6f05f82180 45 33 38 42 37 39 42 43 42 43 38 42 38 42 34 34 E38B79BCBC8B8B44
\n6f05f82190 36 45 38 35 34 34 32 44 42 43 45 34 6E85442DBCE4<\/p>\n
\u89e3\u51fa\u6765\u7684\u5b57\u6bb5\u91cc，\u6709\u51e0\u4e2a\u5b57\u6bb5\u7684\u5185\u5bb9\u683c\u5f0f\u662f\u8fd9\u6837\u7684：<\/p>\n
2026-03-20221538.681000023+0800;<\/p>\n
\u4e00\u770b\u8fd9\u4e2a\u683c\u5f0f\u5c31\u5f88\u50cf\u662fstat\u51fa\u6587\u4ef6\u7684\u65f6\u95f4\u4fe1\u606f\u2014\u2014\u5e74\u6708\u65e5\u3001\u65f6\u5206\u79d2\u3001\u7eb3\u79d2\u7ea7\u7684\u5c0f\u6570\u90e8\u5206，\u5916\u52a0\u65f6\u533a\u504f\u79fb，\u62fc\u8d77\u6765\u5e26\u4e2a\u5206\u53f7\u7ed3\u5c3e\u3002\u5355\u7eaf\u770bPB\u5185\u5bb9\u731c\u4e0d\u51fa\u8fd9\u4e9b\u65f6\u95f4\u662f\u54ea\u4e2a\u6587\u4ef6\u7684；\u4f46\u7ed3\u5408\u524d\u9762\u7b2c4\u8282\u91cc，\u5b57\u7b26\u4e32\u89e3\u5bc6\u6253\u51fa\u6765\u7684\u90a3\u6279\u5b57\u7b26\u4e32\u91cc\u672c\u6765\u5c31\u6709\u4e00\u5806\u6587\u4ef6\u8def\u5f84，\u4e24\u8fb9\u4e00\u8054\u60f3，\u57fa\u672c\u53ef\u4ee5\u786e\u5b9a：\u8fd9\u4e9b\u5b57\u6bb5\u5c31\u662f\u5bf9\u5e94\u6587\u4ef6\u7684\u65f6\u95f4\u4fe1\u606f，\u8bf4\u660e\u8fd9\u4e2aPB\u7ed3\u6784\u91cc\u6253\u5305\u7684\u6838\u5fc3\u5185\u5bb9\u4e4b\u4e00，\u5c31\u662f\u8bbe\u5907\u4e0a\u67d0\u4e9b\u6587\u4ef6\u7684\u65f6\u95f4\u4fe1\u606f\u3002<\/p>\n
\u65b9\u5411\u786e\u5b9a\u4e4b\u540e，\u5c31\u8981\u641e\u6e05\u695a\u8fd9\u4e9b\u6587\u4ef6\u4fe1\u606f\u5177\u4f53\u662f\u600e\u4e48\u83b7\u53d6\u5230\u7684\u3002\u505a\u6cd5\u662f\u56de\u5230\u5b57\u7b26\u4e32\u89e3\u5bc6\u51fd\u6570\u7684\u8c03\u7528\u70b9，\u4e00\u4e2a\u4e2a\u53bb\u770b\u6bcf\u6b21\u89e3\u5bc6\u8c03\u7528\u8fd4\u56de\u7684\u662f\u4ec0\u4e48\u5185\u5bb9\u2014\u2014\u627e\u5230\u4e86\u5176\u4e2d\u89e3\u5bc6\u51fa\u6587\u4ef6\u8def\u5f84\u5b57\u7b26\u4e32\u7684\u90a3\u6b21\u8c03\u7528，\u987a\u7740\u8fd9\u4e2a\u8c03\u7528\u5f80\u4e0b\u8ddf\u5b83\u7684\u8fd4\u56de\u503c\u88ab\u4f20\u5230\u4e86\u54ea\u4e2a\u51fd\u6570\u91cc，\u8ddf\u7740\u8ddf\u7740\u5c31\u627e\u5230\u4e86\u5b9e\u9645\u8bfb\u53d6\u6587\u4ef6\u4fe1\u606f\u7684\u5730\u65b9：\u8fd9\u91cc\u6ca1\u6709\u7528\u5e38\u89c4\u7684stat\u4e4b\u7c7b\u7684\u7cfb\u7edf\u8c03\u7528，\u800c\u662f\u7528popen\u6267\u884c\u4e86\u4e00\u6761\u547d\u4ee4，\u518d\u7528fgets\u4e00\u884c\u884c\u8bfb\u53d6\u547d\u4ee4\u8f93\u51fa，\u628a\u9700\u8981\u7684\u6587\u4ef6\u4fe1\u606f\u4ece\u8f93\u51fa\u5185\u5bb9\u91cc\u89e3\u6790\u51fa\u6765\u3002<\/p>\n
\u4e3a\u4e86\u786e\u8ba4\u8fd9\u4e2a\u5224\u65ad，\u76f4\u63a5\u5728popen\u548cfgets\u8fd9\u4e24\u4e2a\u51fd\u6570\u4e0a\u6302\u4e86hook，\u628a\u8c03\u7528\u65f6\u4f20\u5165\u7684\u547d\u4ee4\u5b57\u7b26\u4e32\u3001\u4ee5\u53ca\u8bfb\u53d6\u5230\u7684\u8f93\u51fa\u5185\u5bb9\u90fd\u6253\u5370\u51fa\u6765，\u8ddfPB\u91cc\u89e3\u51fa\u6765\u7684\u6587\u4ef6\u65f6\u95f4\u5b57\u6bb5\u5bf9\u4e0a\u53f7，\u5c31\u5b8c\u7f8e\u786e\u8ba4\u4e86\u8fd9\u6761\u83b7\u53d6\u6587\u4ef6\u4fe1\u606f\u7684\u94fe\u8def\u3002<\/p>\n
<!– \u56fe：popen+fgets hook\u6253\u5370\u547d\u4ee4\u4e0e\u8f93\u51fa\u5185\u5bb9\u7684\u622a\u56fe –><\/p>\n
\u672a\u77e5\u53c2\u6570\u7684\u8ba1\u7b97<\/p>\n
\u6587\u4ef6\u4fe1\u606f\u8fd9\u5757\u7406\u6e05\u695a\u4e4b\u540e，PB\u7ed3\u6784\u91cc\u8fd8\u5269\u4e00\u4e2a\u5b57\u6bb5\u4e00\u76f4\u6ca1\u641e\u660e\u767d\u662f\u4ec0\u4e48\u2014\u2014\u6570\u503c\u770b\u8d77\u6765\u5b8c\u5168\u6ca1\u6709\u89c4\u5f8b，\u6682\u4e14\u628a\u5b83\u53eb\u505a"\u672a\u77e5\u53c2\u6570"\u3002\u8fd9\u4e00\u5757\u4e5f\u662f\u6574\u4e2a\u5206\u6790\u8fc7\u7a0b\u91cc\u82b1\u65f6\u95f4\u6700\u4e45\u7684\u90e8\u5206\u3002<\/p>\n
\u627e\u8ba1\u7b97\u70b9<\/p>\n
\u601d\u8def\u662f\u4ece\u524d\u9762\u5df2\u7ecf\u786e\u8ba4\u7684\u6587\u4ef6\u4fe1\u606f\u5165\u624b：\u65e2\u7136\u91c7\u96c6\u5230\u7684\u6587\u4ef6\u4fe1\u606f\u6700\u7ec8\u4f1a\u5b58\u8fdb\u4e00\u4e2a\u5168\u5c40\u53d8\u91cf，\u90a3\u8fd9\u4e2a\u5168\u5c40\u53d8\u91cf\u5927\u6982\u7387\u662f\u4e3a\u4e86\u4fdd\u8bc1\u540e\u7eed\u591a\u5904\u4f7f\u7528\u65f6\u6570\u636e\u4e00\u81f4\u624d\u8fd9\u4e48\u505a\u7684\u3002\u987a\u7740\u8fd9\u4e2a\u5168\u5c40\u53d8\u91cf\u7684\u4f7f\u7528，\u627e\u5230\u4e00\u4e2a\u5728\u505astrcat\u5b57\u7b26\u4e32\u62fc\u63a5\u7684\u51fd\u6570，hook\u6253\u5370\u4e86\u4e00\u4e0b，\u53d1\u73b0\u662f\u628a\u4e00\u7cfb\u5217\u53c2\u6570\u4f9d\u6b21\u62fc\u63a5\u5230\u4e00\u8d77\u3002\u62fc\u63a5\u5b8c\u4e4b\u540e，\u7d27\u63a5\u7740\u8c03\u7528\u4e86\u53e6\u4e00\u4e2a\u51fd\u6570\u2014\u2014\u5728\u8fd9\u4e2a\u51fd\u6570\u7684\u5165\u53e3（onEnter）\u548c\u51fa\u53e3（onLeave）\u5206\u522b\u6253\u5370\u5165\u53c2\u548c\u8fd4\u56de\u503c，\u5bf9\u6bd4\u524d\u540e\u53d8\u5316，\u5c31\u80fd\u770b\u5230"\u672a\u77e5\u53c2\u6570"\u662f\u5728\u8fd9\u6b21\u8c03\u7528\u91cc\u751f\u6210\u7684，\u8fd9\u6837\u5c31\u628a\u8ba1\u7b97\u70b9\u7cbe\u786e\u5b9a\u4f4d\u5230\u4e86\u8fd9\u4e2a\u51fd\u6570\u3002<\/p>\n
IDA\u53cd\u7f16\u8bd1\u51fa\u6765\u8fd9\u4e2a\u51fd\u6570\u56e0\u4e3a\u6709\u4e00\u4e9b\u5e73\u5766\u5316（flatten）\u5904\u7406，\u770b\u7740\u6bd4\u8f83\u4e71，\u61d2\u5f97\u4e00\u70b9\u70b9\u8fd8\u539f\u63a7\u5236\u6d41，\u7d22\u6027\u8fd8\u662f\u8d70\u52a8\u6001\u5206\u6790：\u76f4\u63a5\u5728\u51fd\u6570\u5185\u90e8\u8c03\u7528\u7684\u51e0\u4e2a\u5b50\u51fd\u6570\u4e0a\u6302hook，\u6253\u5370\u8f93\u5165\u8f93\u51fa，\u770b\u5b83\u4eec\u5404\u81ea\u5728\u5e72\u4ec0\u4e48\u3002\u8fd9\u65f6\u5019\u53d1\u73b0\u4e00\u4e2a\u53ef\u7591\u70b9\u2014\u2014\u540c\u4e00\u4e2a\u5b50\u51fd\u6570\u88ab\u8c03\u7528\u4e86\u4e24\u6b21，\u8fd9\u57fa\u672c\u53ef\u4ee5\u786e\u5b9a，\u524d\u9762\u62fc\u63a5\u597d\u7684\u5b57\u7b26\u4e32\u5728\u8fd9\u91cc\u88ab\u62c6\u6210\u4e86\u4e24\u4efd\u5206\u522b\u5904\u7406\u3002<\/p>\n
\u7ee7\u7eed\u5728\u8fd9\u4e24\u6b21\u8c03\u7528\u524d\u540e\u6253\u5370\u5165\u53c2\u5185\u5bb9，\u4e00\u5f00\u59cb\u6ca1\u770b\u51fa\u89c4\u5f8b\u3002\u5bf9\u6bd4\u4e86\u4e24\u6b21\u8c03\u7528\u5404\u81ea\u62fc\u63a5\u7684\u56fa\u5b9a\u5b57\u7b26\u4e32，\u53d1\u73b0\u5185\u5bb9\u5206\u522b\u662fpzotrcm869\u548c\u53e6\u4e00\u6bb5\u2014\u2014IDA\u91cc\u80fd\u770b\u5230\u539f\u59cb\u5f62\u6001\u662fplzdontcrackme856c91\u3002\u770b\u5230\u8fd9\u4e2a\u5b57\u7b26\u4e32\u7684\u77ac\u95f4\u5c31\u53cd\u5e94\u8fc7\u6765\u4e86：\u8fd9\u5176\u5b9e\u662f\u63d0\u793a"\u5355\u53cc\u6570\u5206\u7ec4\u53d6\u503c"（plzdontcrackme\u2014\u2014\u5947\u5076\u95f4\u9694\u7740\u8bfb），\u5bf9\u5e94\u5230\u903b\u8f91\u4e0a\u5c31\u662f\u5b57\u7b26\u4e32\u88ab\u6309\u5947\u5076\u4f4d\u7f6e\u62c6\u6210\u4e86\u4e24\u7ec4，\u5404\u81ea\u5904\u7406\u65f6\u524d\u540e\u62fc\u63a5\u4e86\u4e0d\u540c\u7684\u56fa\u5b9a\u5185\u5bb9\u3002<\/p>\n
<!– \u56fe：plzdontcrackme856c91\u5b57\u7b26\u4e32\u5728IDA\u91cc\u51fa\u73b0\u7684\u622a\u56fe –><\/p>\n
\u786e\u8ba4\u9b54\u6539SHA2<\/p>\n
\u5206\u7ec4\u7684\u95ee\u9898\u641e\u6e05\u695a\u4e4b\u540e，\u5269\u4e0b\u7684\u5c31\u662f\u8fd9\u4e2a\u5b50\u51fd\u6570\u5185\u90e8\u5230\u5e95\u505a\u4e86\u4ec0\u4e48\u8fd0\u7b97\u3002\u8ddf\u8fdb\u53bb\u770b，\u5168\u662f\u5927\u91cf\u7684\u5f02\u6216\u3001\u5de6\u79fb\u53f3\u79fb\u64cd\u4f5c，\u4e00\u770b\u5c31\u662f\u54c8\u5e0c\u7c7b\u7b97\u6cd5\u7684\u5178\u578b\u5199\u6cd5\u3002\u641c\u4e86\u4e00\u4e0b\u5e38\u91cf，\u80fd\u5728\u91cc\u9762\u627e\u5230SHA2\u6807\u51c6\u7684\u90a3\u7ec4\u5e38\u91cf（\u6bd4\u59820x428A2F98\u8fd9\u7c7b），\u8bf4\u660e\u538b\u7f29\u51fd\u6570\u672c\u4f53\u5c31\u662f\u6807\u51c6SHA2；\u4f46\u662f\u770b\u51fd\u6570\u5f00\u5934\u53d6\u7684\u521d\u59cb\u5316\u503c，\u5374\u5bf9\u4e0d\u4e0a\u6807\u51c6SHA2\u76848\u4e2a\u521d\u59cb\u5316\u5e38\u91cf\u3002<\/p>\n
<!– \u56fe：IDA\u91cc0x428A2F98\u7b49SHA2\u6807\u51c6\u5e38\u91cf\u51fa\u73b0\u4f4d\u7f6e\u7684\u622a\u56fe –><\/p>\n
\u65e2\u7136\u538b\u7f29\u51fd\u6570\u7684\u5e38\u91cf\u8868\u90fd\u5728，\u53ea\u662f\u521d\u59cb\u5316\u503c\u4e0d\u4e00\u6837，\u7b2c\u4e00\u53cd\u5e94\u5c31\u662f"\u662f\u4e0d\u662f\u53ea\u6539\u4e86\u521d\u59cb\u5316\u5e38\u91cf"\u3002\u9a8c\u8bc1\u65b9\u6cd5\u662f\u5199\u4e2a\u811a\u672c，\u5728so\u88abdlopen\u52a0\u8f7d\u7684\u65f6\u5019\u628a\u8fd98\u4e2a\u521d\u59cb\u5316\u5e38\u91cfpatch\u6210\u6807\u51c6SHA2\u7684\u503c，\u518d\u6b63\u5e38\u8d70\u4e00\u904d\u8c03\u7528；\u540c\u65f6\u628a\u540c\u6837\u7684\u8f93\u5165\u4e22\u5230\u5e38\u89c4\u5de5\u5177\u91cc\u8dd1\u4e00\u904d\u6807\u51c6SHA2，\u4e24\u8fb9\u7ed3\u679c\u505a\u6bd4\u5bf9\u2014\u2014\u5b8c\u5168\u4e00\u81f4\u3002\u8fd9\u6837\u5c31\u786e\u8ba4\u4e86：\u8fd9\u4e2a\u54c8\u5e0c\u51fd\u6570\u9664\u4e86\u521d\u59cb\u5316\u5e38\u91cf\u4e4b\u5916，\u8ddf\u6807\u51c6SHA2\u6ca1\u6709\u4efb\u4f55\u533a\u522b\u3002<\/p>\n
\u8de8\u7ec4\u53d6\u503c<\/p>\n
\u73b0\u5728\u624b\u4e0a\u6709\u4e24\u7ec4\u5404\u81ea\u7684（\u9b54\u6539）SHA2\u7ed3\u679c，\u4f46\u76f4\u63a5\u770b\u8fd8\u662f\u548c\u6700\u7ec8\u7684"\u672a\u77e5\u53c2\u6570"\u5bf9\u4e0d\u4e0a\u3002\u56de\u53bb\u770b\u8fd9\u4e2a\u54c8\u5e0c\u51fd\u6570\u672c\u8eab，\u628a\u5165\u53c2\u91cd\u547d\u540d\u6210input\u3001length\u3001out\u65b9\u4fbf\u9605\u8bfb，\u7136\u540e\u5bf9out\u505a\u4ea4\u53c9\u5f15\u7528，\u627e\u5230\u4e86\u53d6\u503c\u7684\u5730\u65b9：\u7b2c\u4e00\u7ec4\u7684\u54c8\u5e0c\u7ed3\u679c\u4f1a\u6309\u5b57\u8282\u9010\u4e2a\u505a&0x1f\u8fd0\u7b97，\u5f97\u5230\u7684\u503c\u4f5c\u4e3a\u7d22\u5f15，\u53bb\u7b2c\u4e8c\u7ec4\u7684\u54c8\u5e0c\u7ed3\u679c\u91cc\u53d6\u5bf9\u5e94\u4f4d\u7f6e\u7684\u5b57\u8282\u3002\u9010\u4e2a\u6d4b\u8bd5\u6bd4\u5bf9\u4e4b\u540e，\u786e\u8ba4\u5c31\u662f\u8fd9\u6837\u8de8\u7ec4\u53d6\u503c\u3001\u62fc\u51fa32\u4f4d\u7ed3\u679c\u7684\u3002<\/p>\n
\u5230\u8fd9\u4e00\u6b65，"\u672a\u77e5\u53c2\u6570"\u7684\u6765\u6e90\u548c\u7b97\u6cd5\u5c31\u5b8c\u6574\u641e\u6e05\u695a\u4e86：\u6587\u4ef6\u4fe1\u606f\u7b49\u5185\u5bb9\u62fc\u63a5\u540e\u6309\u5947\u5076\u5206\u7ec4\u3001\u5206\u522b\u52a0\u4e0a\u4e0d\u540c\u56fa\u5b9a\u5b57\u7b26\u4e32\u3001\u5404\u81ea\u505a\u4e00\u6b21\u9b54\u6539SHA2（\u53ea\u6539\u4e86\u521d\u59cb\u5316\u5e38\u91cf），\u518d\u7528\u7b2c\u4e00\u7ec4\u7ed3\u679c\u7684&0x1f\u7d22\u5f15\u53bb\u7b2c\u4e8c\u7ec4\u7ed3\u679c\u91cc\u53d6\u503c\u62fc\u63a5\u800c\u6210\u3002<\/p>\n
\u4e3e\u4e2a\u6700\u7ec8\u8dd1\u51fa\u6765\u7684\u7ed3\u679c\u4f8b\u5b50（\u5177\u4f53\u62fc\u63a5\u987a\u5e8f\u548c\u5e38\u91cf\u7ec6\u8282\u8be6\u89c1\u540e\u7eed\u6b63\u6587）：<\/p>\n
44B579FD585010E34CF21AFDFD2CB5A44444E38B79BCBC8B8B446E85442DBCE<\/p>\n
\u81f3\u6b64，\u7b2c\u4e00\u6b21AES\u52a0\u5bc6\u7684\u660e\u6587\u2014\u2014PB\u7ed3\u6784\u91cc\u7684\u6587\u4ef6\u4fe1\u606f\u548c\u8fd9\u4e2a\u672a\u77e5\u53c2\u6570\u2014\u2014\u5c31\u90fd\u7406\u6e05\u695a\u4e86\u3002\u63a5\u4e0b\u6765\u8981\u8ffd\u7684\u662f\u7b2c\u4e8c\u6b21\u52a0\u5bc6\u7528\u5230\u7684\u3001\u6bcf\u6b21\u90fd\u4f1a\u53d8\u5316\u7684key\u548civ\u662f\u600e\u4e48\u751f\u6210\u7684\u3002<\/p>\n
\u524d\u9762\u786e\u8ba4\u8fc7，\u7b2c\u4e8c\u6b21AES\u52a0\u5bc6\u7528\u7684key\u548civ\u662f\u6bcf\u6b21\u90fd\u4f1a\u53d8\u5316\u7684（\u4e0d\u50cf\u7b2c\u4e00\u6b21\u90a3\u6837\u662f\u56fa\u5b9a\u503c）\u3002\u8ffd\u8fd9\u79cd"\u6bcf\u6b21\u90fd\u4e0d\u4e00\u6837"\u7684\u503c，\u6b63\u5e38\u987a\u7740\u8c03\u7528\u94fe\u53bb\u770b\u6570\u636e\u6d41\u4f1a\u6bd4\u8f83\u9ebb\u70e6\u2014\u2014\u56e0\u4e3a\u53ef\u80fd\u662f\u67d0\u79cd\u8fd0\u7b97\u7ed3\u679c，\u4e5f\u53ef\u80fd\u5c31\u662f\u7b80\u5355\u5730\u53d6\u4e86\u4e2a\u968f\u673a\u6570，\u6ca1\u6cd5\u4e00\u773c\u770b\u51fa\u6765\u662f\u54ea\u79cd\u3002<\/p>\n
\u5148\u731c\u4e86\u4e24\u79cd\u53ef\u80fd：\u4e00\u662f\u6709\u65f6\u95f4\u6233\u53c2\u4e0e\u8ba1\u7b97，\u4e8c\u662f\u5e72\u8106\u5c31\u662f\u76f4\u63a5\u751f\u6210\u7684\u968f\u673a\u503c\u3002\u5f80random\u76f8\u5173\u7684\u51fd\u6570\u540d\u53bb\u627e，\u5e76\u6ca1\u6709\u53d1\u73b0\u8c03\u7528\u4e86\u5e38\u89c1\u7684random\u7cfb\u5217\u51fd\u6570；\u4f46\u5728\u5b57\u7b26\u4e32\u5217\u8868\u91cc\u7ffb\u5230\/dev\/urandom\u548c\/dev\/random\u8fd9\u4e24\u4e2a\u8def\u5f84，\u800c\u4e14\u90fd\u662f\u5728\u540c\u4e00\u4e2a\u51fd\u6570\u91cc\u51fa\u73b0\u7684\u2014\u2014\u4e00\u4e2a\u4f5c\u4e3a\u4e3b\u8def\u5f84，\u53e6\u4e00\u4e2a\u5927\u6982\u7387\u662f\u4f5c\u4e3a\u5907\u7528\u3002<\/p>\n
\u786e\u8ba4\u601d\u8def\u548c\u4e4b\u524d\u4e00\u6837：\u76f4\u63a5\u5728\u8fd9\u4e2a\u51fd\u6570\u4e0ahook，\u628a\u5165\u53c2\u548c\u8fd4\u56de\u503c\u90fd\u6253\u5370\u51fa\u6765\u3002\u6253\u5370\u51fa\u6765\u770b，\u5165\u53c2\u662f\u8981\u8bfb\u53d6\u7684\u957f\u5ea6，\u8fd4\u56de\u503c\u5c31\u662f\u8bfb\u5230\u7684\u968f\u673a\u5b57\u8282\u7ed3\u679c\u3002\u591a\u8dd1\u51e0\u6b21，\u62ff\u8fd9\u4e9b\u7ed3\u679c\u8ddf\u5b9e\u9645\u7528\u5230\u7684key\u3001iv\u6570\u636e\u505a\u6bd4\u5bf9，\u5b8c\u7f8e\u5bf9\u5f97\u4e0a\u3002\u8fd9\u6837\u5c31\u786e\u8ba4\u4e86：\u7b2c\u4e8c\u6b21\u52a0\u5bc6\u7684key\u548civ，\u5c31\u662f\u76f4\u63a5\u4ece\/dev\/urandom（\u6216\u5907\u7528\u7684\/dev\/random）\u8bfb\u51fa\u6765\u7684\u968f\u673a\u5b57\u8282，\u5e76\u4e0d\u6d89\u53ca\u989d\u5916\u7684\u8fd0\u7b97\u3002<\/p>\n
call 0x32E1C arg0:0x10
\nnonce ==> 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
\n6df5f94b70 5c 9a f7 45 32 cd f4 2f 35 e3 51 7d d1 df fb 38 \\\\..E2..\/5.Q}…8
\ncall 0x32E1C arg0:0x10
\nnonce ==> 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
\n6df5f94b70 ef 70 fa a4 b7 09 46 4a f2 49 27 73 bf dd 43 f8 .p….FJ.I's..C.<\/p>\n
call 0x32E1C arg0:0x8
\nnonce ==> 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
\n6df5f7cf90 ed e7 e6 d3 06 79 98 d4 …..y..<\/p>\n
key\u548civ\u672c\u8eab\u7684\u6765\u6e90\u786e\u8ba4\u4e4b\u540e，\u8fd8\u5269\u4e00\u4e2a\u95ee\u9898：\u6293\u5305\u770b\u5230\u7684\u8bf7\u6c42\u91cc，\u8fd9\u4e24\u4e2a\u503c\u5e76\u4e0d\u662f\u76f4\u63a5\u660e\u6587\u4f20\u4e0a\u53bb\u7684，\u5f97\u770b\u770b\u5b83\u4eec\u6700\u7ec8\u662f\u600e\u4e48\u88ab\u5904\u7406\u3001\u653e\u8fdb\u8bf7\u6c42\u53c2\u6570\u91cc\u7684\u3002<\/p>\n
\u4e00\u5f00\u59cb\u6ce8\u610f\u5230\u4e00\u4e2a\u683c\u5f0f\u4e0a\u7684\u5dee\u5f02：\u524d\u9762hook AES\u51fd\u6570\u6253\u5370\u51fa\u6765\u7684\u52a0\u5bc6\u7ed3\u679c\u90fd\u662f16\u8fdb\u5236\u683c\u5f0f，\u800c\u6293\u5305\u91cc\u8bf7\u6c42\u643a\u5e26\u7684\u5bf9\u5e94\u5b57\u6bb5\u5374\u662fbase64\u683c\u5f0f\u3002\u8fd9\u8bf4\u660e\u4e2d\u95f4\u5fc5\u7136\u7ecf\u8fc7\u4e86\u4e00\u6b21\u7f16\u7801\u8f6c\u6362，\u4e8e\u662f\u53bb\u641cbase64\u76f8\u5173\u7684encode\u51fd\u6570，\u6839\u636e\u7f16\u7801\u8868\u7279\u5f81\u53cd\u5411\u786e\u8ba4\u4e86\u5bf9\u5e94\u7684decode\u51fd\u6570\u4f4d\u7f6e\u3002<\/p>\n
\u5728encode\u51fd\u6570\u4e0ahook\u4e4b\u540e，\u8bf7\u6c42\u53d1\u51fa\u7684\u65f6\u5019\u5c31\u80fd\u6253\u5370\u51fa\u5bf9\u5e94\u53c2\u6570（\u8fd9\u91cc\u5bf9\u5e94\u7684\u5c31\u662f\u53c2\u65701）\u7f16\u7801\u524d\u768416\u8fdb\u5236\u5185\u5bb9\u3002\u591a\u8dd1\u51e0\u6b21\u89c2\u5bdf\u4e0b\u6765，\u8fd9\u6bb5\u6570\u636e\u7684\u957f\u5ea6\u662f\u56fa\u5b9a\u7684256\u5b57\u8282\u3002<\/p>\n
\u987a\u7740\u8fd9\u4e2aencode\u51fd\u6570\u5f80\u56de\u770b\u8c03\u7528\u6808：\u80fd\u770b\u5230\u6709\u4e00\u4e2a\u51fd\u6570\u603b\u5171\u8c03\u7528\u4e866\u4e2a\u5b50\u51fd\u6570，\u5176\u4e2d\u4e24\u4e2a\u662ffree，\u4e00\u4e2a\u662f\u524d\u9762\u63d0\u7684encode，\u8fd8\u6709\u4e00\u4e2a\u662fdecode,\u8fd8\u6709\u4e00\u4e2a\u662f\u5b57\u7b26\u4e32\u89e3\u5bc6\u51fd\u6570，\u770b\u4e86\u4e0b\u7ed3\u679c\u5f88\u50cfRSA\u516c\u94a5\u3002\u8fd9\u6837\u4e00\u6392\u9664，\u5b9e\u9645\u53c2\u4e0e"\u751f\u6210\u8fd9\u6bb5256\u5b57\u8282\u6570\u636e"\u7684\u6765\u6e90\u51fd\u6570\u5c31\u53ea\u5269\u4e0b\u4e00\u4e2a\u4e86\u3002\u70b9\u8fdb\u8fd9\u4e2a\u51fd\u6570\u770b\u4e86\u4e00\u4e0b\u91cc\u9762\u7528\u5230\u7684\u5b57\u7b26\u4e32，\u5f88\u76f4\u63a5\u5c31\u80fd\u770b\u51fa\u662fRSA\u76f8\u5173\u7684\u5b9e\u73b0\u2014\u2014\u52a0\u4e0a\u524d\u9762\u89c2\u5bdf\u5230\u7684256\u5b57\u8282\u8fd9\u4e2a\u56fa\u5b9a\u957f\u5ea6，\u672c\u8eab\u4e5f\u662f2048\u4f4dRSA\u5178\u578b\u7684\u5bc6\u6587\u957f\u5ea6，\u8fdb\u4e00\u6b65\u5370\u8bc1\u4e86\u8fd9\u4e2a\u5224\u65ad\u3002<\/p>\n
[Base64_Decode] Entering sub_1AF08
\n[*] Input Base64 String: MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApLEpcsiHA\/PE4MKl7WS7r11RijhytmEQH8jaY3nKhvq\/KC29yEpJVAu+\/asRp9mpoxCAiaTxJynVZMw5amwe24ff0Eau\/MLCcfG9jFq8fp0LJwXmKtJuwha2hVr6zhW1+Q1h8f3T9hu+QMZTRxqQnIY1mjqDY1\/ARAK2hMzS+uoB+COosppWgFxOcQhzkjcM7Oa0RO+rSaatWsgBrKspVEXFMYfHS+awD8qGXZyyOVaiDNvXgLfPecJerKCOFdujwR3isgtEEe8yyRryUm1FZgdIi8e+t23Lp0XDDB6LCox7DWLKmRjQ5K\/5R7+HmSwNLANkw6yTUuLtYcoMY2nOUwIDAQAB
\n[*] Decoded Length: 294
\n[*] Decoded Data (Hexdump):
\n 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
\n6e95f63070 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0.."0…*.H…..
\n6e95f63080 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 ……..0…….
\n6e95f63090 00 a4 b1 29 72 c8 87 03 f3 c4 e0 c2 a5 ed 64 bb …)r………d.
\n6e95f630a0 af 5d 51 8a 38 72 b6 61 10 1f c8 da 63 79 ca 86 .]Q.8r.a….cy..
\n6e95f630b0 fa bf 28 2d bd c8 4a 49 54 0b be fd ab 11 a7 d9 ..(-..JIT…….
\n6e95f630c0 a9 a3 10 80 89 a4 f1 27 29 d5 64 cc 39 6a 6c 1e …….').d.9jl.
\n6e95f630d0 db 87 df d0 46 ae fc c2 c2 71 f1 bd 8c 5a bc 7e ….F….q…Z.~
\n6e95f630e0 9d 0b 27 05 e6 2a d2 6e c2 16 b6 85 5a fa ce 15 ..'..*.n….Z…
\n6e95f630f0 b5 f9 0d 61 f1 fd d3 f6 1b be 40 c6 53 47 1a 90 …a……@.SG..
\n6e95f63100 9c 86 35 9a 3a 83 63 5f c0 44 02 b6 84 cc d2 fa ..5.:.c_.D……
\n6e95f63110 ea 01 f8 23 a8 b2 9a 56 80 5c 4e 71 08 73 92 37 …#…V.\\\\Nq.s.7
\n6e95f63120 0c ec e6 b4 44 ef ab 49 a6 ad 5a c8 01 ac ab 29 ….D..I..Z….)
\n6e95f63130 54 45 c5 31 87 c7 4b e6 b0 0f ca 86 5d 9c b2 39 TE.1..K…..]..9
\n6e95f63140 56 a2 0c db d7 80 b7 cf 79 c2 5e ac a0 8e 15 db V…….y.^…..
\n6e95f63150 a3 c1 1d e2 b2 0b 44 11 ef 32 c9 1a f2 52 6d 45 ……D..2…RmE
\n6e95f63160 66 07 48 8b c7 be b7 6d cb a7 45 c3 0c 1e 8b 0a f.H….m..E…..
\n6e95f63170 8c 7b 0d 62 ca 99 18 d0 e4 af f9 47 bf 87 99 2c .{.b…….G…,
\n6e95f63180 0d 2c 03 64 c3 ac 93 52 e2 ed 61 ca 0c 63 69 ce .,.d…R..a..ci.
\n6e95f63190 53 02 03 01 00 01 S…..
\n[Base64_Decode] Leave sub_1AF08<\/p>\n
============================================================
\n[+] \u8fdb\u5165 sub_419A8 (RSA_Encrypt \u5305\u88c5\u51fd\u6570)
\n[*] \u516c\u94a5\u5730\u5740: 0x6e95f63070, \u957f\u5ea6: 294
\n[*] \u660e\u6587\u5730\u5740: 0x6d4cd80500, \u957f\u5ea6: 32
\n[*] \u5bc6\u6587\u8f93\u51fa\u5730\u5740: 0x6d4cd8047c
\n[*] RSA \u516c\u94a5 Dump (DER Format):
\n 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
\n6e95f63070 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0.."0…*.H…..
\n6e95f63080 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 ……..0…….
\n6e95f63090 00 a4 b1 29 72 c8 87 03 f3 c4 e0 c2 a5 ed 64 bb …)r………d.
\n6e95f630a0 af 5d 51 8a 38 72 b6 61 10 1f c8 da 63 79 ca 86 .]Q.8r.a….cy..
\n6e95f630b0 fa bf 28 2d bd c8 4a 49 54 0b be fd ab 11 a7 d9 ..(-..JIT…….
\n6e95f630c0 a9 a3 10 80 89 a4 f1 27 29 d5 64 cc 39 6a 6c 1e …….').d.9jl.
\n6e95f630d0 db 87 df d0 46 ae fc c2 c2 71 f1 bd 8c 5a bc 7e ….F….q…Z.~
\n6e95f630e0 9d 0b 27 05 e6 2a d2 6e c2 16 b6 85 5a fa ce 15 ..'..*.n….Z…
\n6e95f630f0 b5 f9 0d 61 f1 fd d3 f6 1b be 40 c6 53 47 1a 90 …a……@.SG..
\n6e95f63100 9c 86 35 9a 3a 83 63 5f c0 44 02 b6 84 cc d2 fa ..5.:.c_.D……
\n6e95f63110 ea 01 f8 23 a8 b2 9a 56 80 5c 4e 71 08 73 92 37 …#…V.\\\\Nq.s.7
\n6e95f63120 0c ec e6 b4 44 ef ab 49 a6 ad 5a c8 01 ac ab 29 ….D..I..Z….)
\n6e95f63130 54 45 c5 31 87 c7 4b e6 b0 0f ca 86 5d 9c b2 39 TE.1..K…..]..9
\n6e95f63140 56 a2 0c db d7 80 b7 cf 79 c2 5e ac a0 8e 15 db V…….y.^…..
\n6e95f63150 a3 c1 1d e2 b2 0b 44 11 ef 32 c9 1a f2 52 6d 45 ……D..2…RmE
\n6e95f63160 66 07 48 8b c7 be b7 6d cb a7 45 c3 0c 1e 8b 0a f.H….m..E…..
\n6e95f63170 8c 7b 0d 62 ca 99 18 d0 e4 af f9 47 bf 87 99 2c .{.b…….G…,
\n6e95f63180 0d 2c 03 64 c3 ac 93 52 e2 ed 61 ca 0c 63 69 ce .,.d…R..a..ci.
\n6e95f63190 53 02 03 01 00 01 S…..
\n[*] \u5f85\u52a0\u5bc6\u660e\u6587 Dump:
\n 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
\n6d4cd80500 5c 9a f7 45 32 cd f4 2f 35 e3 51 7d d1 df fb 38 \\\\..E2..\/5.Q}…8
\n6d4cd80510 ef 70 fa a4 b7 09 46 4a f2 49 27 73 bf dd 43 f8 .p….FJ.I's..C.<\/p>\n
[Base64] =========================================
\n[*] Entering sub_1A950
\n[*] Input Length: 256
\n[*] Input Data:
\n 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
\n6e85f58af0 18 1b a2 71 46 2d ef 02 75 71 ab a9 40 90 59 43 …qF-..uq..@.YC
\n6e85f58b00 30 b7 07 60 52 3b 48 a0 b5 69 91 72 29 14 6e df 0..`R;H..i.r).n.
\n6e85f58b10 af 74 a6 b6 38 6e 10 02 3a 5f 4c c6 02 4e 73 6f .t..8n..:_L..Nso
\n6e85f58b20 a1 10 58 8c 73 30 b3 b8 c5 28 c2 11 88 c4 c8 30 ..X.s0…(…..0
\n[*] Result String: GBuicUYt7wJ1caupQJBZQzC3B2BSO0igtWmRcikUbt+vdKa2OG4QAjpfTMYCTnNvoRBYjHMws7jFKMIRiMTIMM5aTLcZ3\/FXTJQprOUkYc1VW42NIZAyqWdOM51Rtjy6l3SK1Gufti4jmT4lXMth00Weec5VlLeHTm0ocslm7lG0aJir+OBBlw+59TjNdArYkHZxSZLYtWxQrTFQs+5XkClpp+TbMWvR1810mXwCvF0iSs0aV3wTB0lZFQbUrc2Wz8zTt31U\/s9tU9YqAYFE8kB\/qLckEW8TO9+1FvrbBI6RSubm4zk\/VnvocrpA9edd4P3e2gOvhvha7JZxMI2AtQ==
\n[*] Encoded Length: 344
\n[Base64] Leave sub_1A950<\/p>\n
\u8fd9\u91cc\u6709\u4e2a\u6bd4\u8f83\u5173\u952e\u7684\u53d1\u73b0：\u8fd9\u4e2aRSA\u7684\u5b9e\u73b0\u5176\u5b9e\u6709\u4e24\u5957\u65b9\u6848\u2014\u2014\u4e00\u5957\u662f\u8d70native\u5c42libcrypto\u7684RSA\u5b9e\u73b0，\u53e6\u4e00\u5957\u662f\u8d70Java\u5c42（\u8c03\u7528Java\u6807\u51c6\u5e93\u7684RSA API）\u6765\u505a\u3002\u800c\u5f53\u524d\u5206\u6790\u7684\u8fd9\u6b21\u8c03\u7528，\u547d\u4e2d\u7684\u662fJava\u5c42\u8fd9\u4e00\u5957\u3002\u8fd9\u4e2a\u70b9\u5f88\u5173\u952e，\u56e0\u4e3a\u540e\u7eed\u518d\u53bb\u5206\u6790\u5176\u4ed6\u7248\u672c\u7684\u65f6\u5019，\u5982\u679c\u53d1\u73b0\u8d70\u7684\u662f\u53e6\u4e00\u5957（libcrypto）\u5b9e\u73b0，\u4e5f\u4e0d\u5fc5\u610f\u5916\u2014\u2014\u4e24\u5957\u65b9\u6848\u5e94\u8be5\u662f\u5171\u5b58\u7684，\u5177\u4f53\u8d70\u54ea\u4e00\u5957\u53ef\u80fd\u8ddf\u7248\u672c\u3001\u8bbe\u5907\u73af\u5883\u6216\u8005\u5185\u90e8\u7684\u964d\u7ea7\/\u517c\u5bb9\u7b56\u7565\u6709\u5173，\u5206\u6790\u7684\u65f6\u5019\u5f97\u7559\u610f\u533a\u5206\u6e05\u695a，\u522b\u628a\u4e24\u5957\u5b9e\u73b0\u7684\u7ec6\u8282\u641e\u6df7\u3002<\/p>\n
\u7efc\u5408\u8d77\u6765，\u53c2\u65701\u7684\u751f\u6210\u903b\u8f91\u5c31\u662f：\u5148\u628a\u5185\u7f6e\u7684\u516c\u94a5\u505abase64\u89e3\u7801，\u8fd8\u539f\u51fa\u771f\u6b63\u7684\u516c\u94a5\u6570\u636e；\u7136\u540e\u628a\u524d\u9762\u786e\u8ba4\u7684key\u548civ\u76f4\u63a5\u62fc\u63a5\u5728\u4e00\u8d77，\u4f5c\u4e3a\u660e\u6587，\u7528\u8fd9\u4e2a\u516c\u94a5\u505aRSA\u52a0\u5bc6（\u672c\u6b21\u547d\u4e2d\u7684\u662fJava\u5c42\u5b9e\u73b0），\u5f97\u5230\u56fa\u5b9a256\u5b57\u8282\u7684\u7ed3\u679c，\u518d\u6574\u4f53\u505a\u4e00\u6b21base64\u7f16\u7801，\u653e\u8fdb\u8bf7\u6c42\u53c2\u6570\u91cc\u3002<\/p>\n
\u516c\u94a5\u672c\u8eab\u5176\u5b9e\u524d\u9762\u5728\u6279\u91cf\u6253\u5370\u5b57\u7b26\u4e32\u89e3\u5bc6\u7ed3\u679c\u7684\u65f6\u5019\u5c31\u5df2\u7ecf\u51fa\u73b0\u8fc7\u4e86，\u53ea\u662f\u5f53\u65f6\u90a3\u6279\u89e3\u5bc6\u51fa\u6765\u7684\u5b57\u7b26\u4e32\u91cc\u6709\u597d\u51e0\u4e2a\u90fd\u662f\u7c7b\u4f3c\u957f\u5ea6\u8f83\u957f\u7684\u5185\u5bb9，\u4e00\u5f00\u59cb\u6ca1\u6cd5\u4e00\u4e0b\u5b50\u786e\u5b9a\u54ea\u4e2a\u624d\u662f\u516c\u94a5，\u8fd9\u6b21\u7ed3\u5408RSA\u7684\u5206\u6790\u56de\u8fc7\u5934\u770b\u624d\u5bf9\u4e0a\u53f7\u3002<\/p>\n
\u5b9a\u4f4dSN\u8ba1\u7b97\u70b9<\/p>\n
\u5728\u901a\u8fc7sub_33288\u7b97\u51faky（\u4e5f\u5c31\u662f\u524d\u9762\u63d0\u5230\u7684\u968f\u673akey）\u4e4b\u540e，\u987a\u7740\u8fd9\u4e2a\u8fd4\u56de\u503c\u7ee7\u7eed\u5f80\u4e0b\u8ddf，\u53d1\u73b0\u88ab\u4f20\u8fdb\u4e86sub_126F8\u2014\u2014\u4ece\u884c\u4e3a\u4e0a\u770b\u5f88\u50cf\u662f\u5728\u505a\u7c7b\u4f3cstrcat\u7684\u5b57\u7b26\u4e32\u62fc\u63a5\u64cd\u4f5c\u3002hook\u6253\u5370\u4e86\u4e00\u4e0b\u62fc\u63a5\u8fc7\u7a0b，\u80fd\u770b\u5230\u62fc\u8fdb\u53bb\u7684\u5185\u5bb9\u4f9d\u6b21\u662fcpt\u3001ky\u3001pms，\u8fd9\u51e0\u4e2a\u5b57\u6bb5\u540d\u8ddf\u524d\u9762\u65e5\u5fd7\u91cc\u51fa\u73b0\u7684\u53d8\u91cf\u5bf9\u5f97\u4e0a\u3002<\/p>\n
\u62fc\u63a5\u5b8c\u4e4b\u540e，\u7d27\u63a5\u7740\u8c03\u7528\u4e86sub_15144，\u8fd9\u4e2a\u51fd\u6570\u7684\u8fd4\u56de\u503c\u53c8\u88ab\u4f20\u56desub_126F8\u7ee7\u7eed\u62fc\u63a5\u2014\u2014\u5c31\u662f\u5728\u8fd9\u4e00\u6b65\u7684\u6253\u5370\u7ed3\u679c\u91cc，\u7b2c\u4e00\u6b21\u770b\u5230\u4e86sn\u8fd9\u4e2a\u5b57\u6bb5\u7684\u8eab\u5f71，\u7531\u6b64\u53ef\u4ee5\u786e\u5b9a：sn\u5c31\u662fsub_15144\u7b97\u51fa\u6765\u7684\u3002<\/p>\n
\u987a\u7740sub_15144\u7684\u8fd4\u56de\u503c\u7ee7\u7eed\u5f80\u4e0a\u627e\u8c03\u7528\u6765\u6e90，\u627e\u5230sub_18880，\u800csub_18880\u5185\u90e8\u53c8\u8c03\u7528\u4e86sub_18258\u2014\u2014\u8fd9\u4e2asub_18258\u624d\u662f\u771f\u6b63\u5b9e\u73b0SN\u8ba1\u7b97\u903b\u8f91\u7684\u51fd\u6570\u3002<\/p>\n
sub_18258\u56e0\u4e3a\u7ecf\u8fc7\u4e86\u5e73\u5766\u5316\u5904\u7406，\u63a7\u5236\u6d41\u770b\u8d77\u6765\u5f88\u4e71，\u52a0\u4e0a\u91cc\u9762\u6709\u4e0d\u5c11\u5355\u5b57\u8282\u53d6\u503c\u548c\u5f02\u6216\u64cd\u4f5c，\u8fd9\u79cd\u7ec6\u7c92\u5ea6\u7684\u4f4d\u8fd0\u7b97\u903b\u8f91，\u5149\u770b\u9759\u6001\u53cd\u7f16\u8bd1\u5f88\u5bb9\u6613\u770b\u6f0f\u6216\u8005\u641e\u6df7\u6267\u884c\u987a\u5e8f，\u8fd9\u5757\u6700\u540e\u662f\u7528IDA\u6302\u4e0a\u52a8\u6001\u8c03\u8bd5，\u5355\u6b65\u8ddf\u7740\u8d70\u4e00\u904d\u5b9e\u9645\u7684\u6267\u884c\u6d41\u7a0b，\u914d\u5408\u5bc4\u5b58\u5668\u548c\u5185\u5b58\u91cc\u7684\u5b9e\u65f6\u6570\u636e，\u624d\u628a\u6574\u4e2a\u7b97\u6cd5\u94fe\u8def\u5b8c\u6574\u8fd8\u539f\u51fa\u6765\u7684\u3002<\/p>\n
\u7b2c\u4e00\u6b65：\u5bf9\u62fc\u63a5\u5b57\u6bb5\u505aMD5<\/p>\n
\u628acpt\u3001ky\u3001pms\u3001\u65f6\u95f4\u6233tm\u3001\u968f\u673a\u6570nn\u8fd9\u51e0\u4e2a\u5b57\u6bb5\u6309\u56fa\u5b9a\u987a\u5e8f\u62fc\u63a5\u6210\u4e00\u4e2a\u5b57\u7b26\u4e32，\u505a\u4e00\u6b21MD5，\u5f97\u523016\u5b57\u8282\u7ed3\u679c，\u8bb0\u4f5cmd5_bytes\u3002<\/p>\n
[>>>] \u8fdb\u5165\u51fd\u6570 0xEBC0
\n[*] \u53c2\u65701 (\u6e90\u6570\u636e): 0x6f2603c0f0
\n[*] \u53c2\u65702 (\u957f\u5ea6): 3318 (0xcf6)
\n[*] \u53c2\u65703 (\u8f93\u51fa\u7f13\u51b2\u533a): 0x6d4cd80350
\n[*] \u8f93\u5165 Hexdump:
\n 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
\n6f2603c0f0 31 47 42 75 69 63 55 59 74 37 77 4a 31 63 61 75 1GBuicUYt7wJ1cau
\n6f2603c100 70 51 4a 42 5a 51 7a 43 33 42 32 42 53 4f 30 69 pQJBZQzC3B2BSO0i
\n6f2603c110 67 74 57 6d 52 63 69 6b 55 62 74 2b 76 64 4b 61 gtWmRcikUbt+vdKa
\n6f2603c120 32 4f 47 34 51 41 6a 70 66 54 4d 59 43 54 6e 4e 2OG4QAjpfTMYCTnN
\n6f2603c130 76 6f 52 42 59 6a 48 4d 77 73 37 6a 46 4b 4d 49 voRBYjHMws7jFKMI
\n6f2603c140 52 69 4d 54 49 4d 4d 35 61 54 4c 63 5a 33 2f 46 RiMTIMM5aTLcZ3\/F
\n6f2603c150 58 54 4a 51 70 72 4f 55 6b 59 63 31 56 57 34 32 XTJQprOUkYc1VW42
\n6f2603c160 4e 49 5a 41 79 71 57 64 4f 4d 35 31 52 74 6a 79 NIZAyqWdOM51Rtjy
\n6f2603c170 36 6c 33 53 4b 31 47 75 66 74 69 34 6a 6d 54 34 6l3SK1Gufti4jmT4
\n6f2603c180 6c 58 4d 74 68 30 30 57 65 65 63 35 56 6c 4c 65 lXMth00Weec5VlLe
\n6f2603c190 48 54 6d 30 6f 63 73 6c 6d 37 6c 47 30 61 4a 69 HTm0ocslm7lG0aJi
\n6f2603c1a0 72 2b 4f 42 42 6c 77 2b 35 39 54 6a 4e 64 41 72 r+OBBlw+59TjNdAr
\n6f2603c1b0 59 6b 48 5a 78 53 5a 4c 59 74 57 78 51 72 54 46 YkHZxSZLYtWxQrTF
\n6f2603c1c0 51 73 2b 35 58 6b 43 6c 70 70 2b 54 62 4d 57 76 Qs+5XkClpp+TbMWv
\n6f2603c1d0 52 31 38 31 30 6d 58 77 43 76 46 30 69 53 73 30 R1810mXwCvF0iSs0
\n6f2603c1e0 61 56 33 77 54 42 30 6c 5a 46 51 62 55 72 63 32 aV3wTB0lZFQbUrc2
\n6f2603c1f0 57 7a 38 7a 54 74 33 31 55 2f 73 39 74 55 39 59 Wz8zTt31U\/s9tU9Y
\n6f2603c200 71 41 59 46 45 38 6b 42 2f 71 4c 63 6b 45 57 38 qAYFE8kB\/qLckEW8
\n6f2603c210 54 4f 39 2b 31 46 76 72 62 42 49 36 52 53 75 62 TO9+1FvrbBI6RSub
\n6f2603c220 6d 34 7a 6b 2f 56 6e 76 6f 63 72 70 41 39 65 64 m4zk\/VnvocrpA9ed
\n6f2603c230 64 34 50 33 65 32 67 4f 76 68 76 68 61 37 4a 5a d4P3e2gOvhvha7JZ
\n6f2603c240 78 4d 49 32 41 74 51 3d 3d 63 68 35 45 2b 57 64 xMI2AtQ==ch5E+Wd
\n6f2603c250 30 57 49 6e 4f 78 6e 34 6f 75 58 6b 62 38 75 76 0WInOxn4ouXkb8uv
\n6f2603c260 5a 74 38 38 42 4b 73 32 46 45 59 4e 6e 30 62 6d Zt88BKs2FEYNn0bm
\n6f2603c270 6e 6a 54 4b 79 35 76 2f 68 4c 4c 48 2b 32 75 7a njTKy5v\/hLLH+2uz
\n6f2603c280 55 4d 68 6d 36 61 67 61 2b 6c 59 43 46 4b 65 77 UMhm6aga+lYCFKew
\n6f2603c290 74 2f 35 70 66 39 42 31 77 6e 4d 59 46 67 53 39 t\/5pf9B1wnMYFgS9
\n6f2603c2a0 2b 34 36 4c 39 43 36 66 56 70 5a 30 65 79 75 4e +46L9C6fVpZ0eyuN
\n6f2603c2b0 39 73 75 54 6e 37 37 63 48 50 71 4c 4b 48 71 41 9suTn77cHPqLKHqA
\n6f2603c2c0 73 72 45 61 43 41 64 63 4b 41 67 45 4b 7a 61 59 srEaCAdcKAgEKzaY
\n6f2603c2d0 75 50 30 4f 58 75 4c 77 73 58 35 78 46 6b 4c 64 uP0OXuLwsX5xFkLd
\n6f2603c2e0 55 76 6c 32 54 43 37 63 68 58 72 4a 34 6a 64 6d Uvl2TC7chXrJ4jdm
\n6f2603c2f0 49 47 2b 53 66 31 47 30 78 57 69 52 79 2f 4a 47 IG+Sf1G0xWiRy\/JG
\n6f2603c300 4b 2f 79 33 33 6b 35 48 62 74 4f 71 6b 79 58 38 K\/y33k5HbtOqkyX8
\n6f2603c310 51 78 58 57 30 50 69 6a 2b 46 59 71 78 42 30 78 QxXW0Pij+FYqxB0x
\n6f2603c320 51 54 6c 76 31 59 4f 72 4b 58 58 6a 73 42 6c 68 QTlv1YOrKXXjsBlh
\n6f2603c330 62 52 47 72 67 76 75 6c 56 47 41 38 48 69 31 38 bRGrgvulVGA8Hi18
\n6f2603c340 61 76 76 45 34 6c 6e 33 79 4b 37 47 33 7a 44 45 avvE4ln3yK7G3zDE
\n6f2603c350 45 44 65 67 4c 4c 52 56 6c 77 38 64 34 57 6a 58 EDegLLRVlw8d4WjX
\n6f2603c360 6b 36 71 32 65 49 33 65 6d 75 67 62 32 62 73 6e k6q2eI3emugb2bsn
\n6f2603c370 6c 6e 6b 54 4d 69 39 63 49 57 66 64 36 76 45 53 lnkTMi9cIWfd6vES
\n6f2603c380 4a 46 35 2b 6f 62 4c 70 74 53 61 55 75 4a 36 65 JF5+obLptSaUuJ6e
\n6f2603c390 77 5a 66 75 43 41 6d 42 41 47 58 36 47 6f 79 31 wZfuCAmBAGX6Goy1
\n6f2603c3a0 39 2b 4e 67 57 70 44 65 32 4d 6a 39 64 5a 68 41 9+NgWpDe2Mj9dZhA
\n6f2603c3b0 62 76 6f 53 68 6b 6b 58 6d 39 6e 63 51 6f 39 5a bvoShkkXm9ncQo9Z
\n6f2603c3c0 54 78 51 58 69 69 70 6f 6e 6f 75 71 4a 4f 34 31 TxQXiiponouqJO41
\n6f2603c3d0 6f 6f 4b 37 5a 51 38 2b 77 59 47 59 69 38 78 70 ooK7ZQ8+wYGYi8xp
\n6f2603c3e0 5a 57 61 32 41 6c 33 36 58 47 65 45 2b 63 65 64 ZWa2Al36XGeE+ced
\n6f2603c3f0 63 78 6b 6e 74 4f 30 30 31 33 4c 2f 32 58 70 74 cxkntO0013L\/2Xpt
\n6f2603c400 6d 33 49 47 61 34 56 62 55 77 78 6a 74 71 35 54 m3IGa4VbUwxjtq5T
\n6f2603c410 73 64 64 51 51 42 75 6e 6c 76 44 67 4f 33 6b 53 sddQQBunlvDgO3kS
\n6f2603c420 54 73 73 30 49 30 79 6c 31 61 4e 77 47 75 59 53 Tss0I0yl1aNwGuYS
\n6f2603c430 4a 4f 6d 77 46 70 6d 4e 56 74 78 73 67 69 33 64 JOmwFpmNVtxsgi3d
\n6f2603c440 77 75 64 54 51 77 5a 6c 41 4a 48 71 64 31 7a 56 wudTQwZlAJHqd1zV
\n6f2603c450 68 74 50 4b 56 76 36 69 68 5a 2f 50 4f 7a 61 52 htPKVv6ihZ\/POzaR
\n6f2603c460 36 71 49 42 37 6f 36 4f 44 65 63 6b 45 38 5a 47 6qIB7o6ODeckE8ZG
\n6f2603c470 77 48 45 33 45 49 35 50 42 4b 41 66 53 72 51 30 wHE3EI5PBKAfSrQ0
\n6f2603c480 4f 71 65 71 44 46 68 6c 6b 39 4a 47 50 55 39 6f OqeqDFhlk9JGPU9o
\n6f2603c490 30 66 41 6c 7a 74 55 46 39 67 30 51 49 64 4e 77 0fAlztUF9g0QIdNw
\n6f2603c4a0 68 44 58 75 73 55 4a 77 53 4d 69 49 30 36 7a 34 hDXusUJwSMiI06z4
\n6f2603c4b0 30 63 58 59 47 4f 41 4d 76 64 43 32 68 35 41 4c 0cXYGOAMvdC2h5AL
\n6f2603c4c0 79 49 74 58 62 33 57 57 51 6d 63 36 31 54 6e 4c yItXb3WWQmc61TnL
\n6f2603c4d0 53 54 68 58 45 6f 46 4d 49 54 76 74 4e 4f 67 5a SThXEoFMITvtNOgZ
\n6f2603c4e0 79 33 42 69 30 32 30 65 49 6e 52 70 7a 47 32 64 y3Bi020eInRpzG2d
\n6f2603c4f0 68 59 4a 78 75 46 56 6d 39 4d 59 64 44 74 44 42 hYJxuFVm9MYdDtDB
\n6f2603c500 67 6f 4f 71 49 4a 75 73 46 78 62 52 65 6f 54 64 goOqIJusFxbReoTd
\n6f2603c510 66 6f 6e 71 44 43 66 2f 76 6b 74 74 48 2b 4c 48 fonqDCf\/vkttH+LH
\n6f2603c520 61 35 45 58 54 47 57 6d 38 51 43 2f 38 58 45 47 a5EXTGWm8QC\/8XEG
\n6f2603c530 2b 50 64 35 6b 50 46 37 67 32 2b 4d 79 53 66 69 +Pd5kPF7g2+MySfi
\n6f2603c540 77 63 51 68 58 4e 34 62 31 33 46 52 70 32 54 6f wcQhXN4b13FRp2To
\n6f2603c550 39 42 4a 77 59 54 6f 34 2f 6c 6b 66 32 46 38 69 9BJwYTo4\/lkf2F8i
\n6f2603c560 37 54 67 41 53 37 34 68 54 50 66 31 6c 70 67 58 7TgAS74hTPf1lpgX
\n6f2603c570 79 66 4b 6a 56 39 5a 76 4f 52 55 6c 65 35 39 4c yfKjV9ZvORUle59L
\n6f2603c580 77 43 53 52 47 55 30 68 64 51 48 67 56 6a 34 42 wCSRGU0hdQHgVj4B
\n6f2603c590 30 79 73 6c 51 67 38 5a 41 46 4b 38 69 44 45 53 0yslQg8ZAFK8iDES
\n6f2603c5a0 67 5a 42 30 5a 4e 66 74 50 75 73 4c 41 47 6e 6f gZB0ZNftPusLAGno
\n6f2603c5b0 45 6c 57 77 31 69 6a 58 50 6c 54 48 74 56 46 57 ElWw1ijXPlTHtVFW
\n6f2603c5c0 68 7a 47 76 36 56 5a 77 47 36 58 6f 6e 51 39 63 hzGv6VZwG6XonQ9c
\n6f2603c5d0 6e 54 6f 53 48 39 62 51 44 4b 76 6c 39 59 54 50 nToSH9bQDKvl9YTP
\n6f2603c5e0 35 79 6a 44 6d 75 56 32 72 71 35 77 70 55 48 4c 5yjDmuV2rq5wpUHL
\n6f2603c5f0 54 33 70 49 6b 79 33 50 30 42 32 35 54 70 42 64 T3pIky3P0B25TpBd
\n6f2603c600 43 57 4b 32 6e 4b 36 58 51 63 4b 39 6a 50 73 74 CWK2nK6XQcK9jPst
\n6f2603c610 66 48 58 63 4f 78 6a 52 77 31 57 46 42 50 42 69 fHXcOxjRw1WFBPBi
\n6f2603c620 68 37 64 4f 4a 36 75 79 6a 62 61 55 6a 62 76 68 h7dOJ6uyjbaUjbvh
\n6f2603c630 49 57 52 4f 4b 48 74 44 68 51 59 74 68 47 6a 4a IWROKHtDhQYthGjJ
\n6f2603c640 7a 65 52 35 58 6a 59 4b 65 4b 50 56 6d 75 34 78 zeR5XjYKeKPVmu4x
\n6f2603c650 49 57 4f 48 53 55 36 48 31 38 64 2f 42 6a 75 2b IWOHSU6H18d\/Bju+
\n6f2603c660 75 43 66 57 75 52 50 38 6d 56 37 65 4d 42 47 6c uCfWuRP8mV7eMBGl
\n6f2603c670 4e 71 33 37 67 52 59 32 66 54 75 4a 58 62 75 47 Nq37gRY2fTuJXbuG
\n6f2603c680 6b 49 69 77 34 4f 54 72 31 32 4f 69 33 75 53 6b kIiw4OTr12Oi3uSk
\n6f2603c690 48 79 79 50 52 45 2f 6e 58 67 42 31 68 4e 6d 45 HyyPRE\/nXgB1hNmE
\n6f2603c6a0 68 79 4d 58 53 62 37 38 35 68 4e 39 79 74 50 49 hyMXSb785hN9ytPI
\n6f2603c6b0 78 4f 59 38 74 30 58 79 41 59 4e 58 61 6f 69 48 xOY8t0XyAYNXaoiH
\n6f2603c6c0 31 57 2f 62 32 71 63 38 35 67 35 47 36 50 73 78 1W\/b2qc85g5G6Psx
\n6f2603c6d0 32 4e 56 4c 6b 4f 57 36 30 58 67 71 55 74 68 50 2NVLkOW60XgqUthP
\n6f2603c6e0 4b 48 78 43 47 67 4c 6f 75 49 79 5a 42 74 36 58 KHxCGgLouIyZBt6X
\n6f2603c6f0 30 37 41 43 5a 34 47 47 54 66 37 57 2b 45 4a 47 07ACZ4GGTf7W+EJG
\n6f2603c700 32 67 51 4c 4f 42 4b 73 4c 68 53 34 7a 74 74 4b 2gQLOBKsLhS4zttK
\n6f2603c710 46 6a 6e 45 51 66 66 67 45 46 35 45 63 39 2b 46 FjnEQffgEF5Ec9+F
\n6f2603c720 64 4c 70 2f 49 33 42 39 2b 62 37 44 4d 48 4f 4a dLp\/I3B9+b7DMHOJ
\n6f2603c730 50 58 4e 6d 44 68 6b 48 76 2f 4b 78 75 65 78 31 PXNmDhkHv\/Kxuex1
\n6f2603c740 5a 63 74 30 54 30 2f 46 56 72 52 67 74 51 44 2f Zct0T0\/FVrRgtQD\/
\n6f2603c750 66 78 65 37 32 76 73 37 58 50 70 63 6a 4f 79 78 fxe72vs7XPpcjOyx
\n6f2603c760 42 6d 63 45 41 51 68 6c 38 50 45 32 74 2f 2f 30 BmcEAQhl8PE2t\/\/0
\n6f2603c770 6a 35 76 6b 48 6b 36 45 63 47 55 70 4e 45 70 42 j5vkHk6EcGUpNEpB
\n6f2603c780 61 39 75 70 7a 68 69 32 63 75 51 37 49 36 79 53 a9upzhi2cuQ7I6yS
\n6f2603c790 75 7a 66 45 72 53 77 51 54 36 42 6c 49 4f 45 50 uzfErSwQT6BlIOEP
\n6f2603c7a0 33 42 33 53 73 78 46 50 76 6b 35 61 6f 5a 59 34 3B3SsxFPvk5aoZY4
\n6f2603c7b0 62 31 56 6f 52 75 55 4f 52 43 5a 2b 4c 45 56 6f b1VoRuUORCZ+LEVo
\n6f2603c7c0 4c 6a 46 70 68 56 51 56 41 6b 68 6c 2f 31 2b 53 LjFphVQVAkhl\/1+S
\n6f2603c7d0 65 6d 78 6a 62 5a 2b 79 72 31 6a 4b 56 47 58 58 emxjbZ+yr1jKVGXX
\n6f2603c7e0 38 41 6a 69 31 30 2b 58 51 70 6b 70 4e 55 64 63 8Aji10+XQpkpNUdc
\n6f2603c7f0 6f 35 66 39 4f 59 63 6e 4a 69 78 72 5a 74 67 30 o5f9OYcnJixrZtg0
\n6f2603c800 2f 2b 51 6a 77 35 73 50 52 34 5a 4c 7a 56 38 64 \/+Qjw5sPR4ZLzV8d
\n6f2603c810 59 77 57 50 59 4d 6a 75 53 38 44 63 39 76 58 51 YwWPYMjuS8Dc9vXQ
\n6f2603c820 70 6a 62 35 57 69 65 57 43 33 38 4f 35 46 58 76 pjb5WieWC38O5FXv
\n6f2603c830 6c 51 78 6d 44 4f 34 63 35 39 74 53 63 55 51 47 lQxmDO4c59tScUQG
\n6f2603c840 77 33 72 39 6e 45 2b 51 79 68 69 53 34 32 51 4e w3r9nE+QyhiS42QN
\n6f2603c850 39 6a 58 37 47 64 68 4a 6a 4c 65 51 6a 39 4d 4f 9jX7GdhJjLeQj9MO
\n6f2603c860 63 33 4b 35 44 57 73 6b 6f 45 68 7a 54 38 44 58 c3K5DWskoEhzT8DX
\n6f2603c870 72 38 79 4a 31 6c 36 31 78 31 35 57 56 62 4c 52 r8yJ1l61x15WVbLR
\n6f2603c880 6b 68 45 51 56 46 2f 4b 32 39 34 75 6b 52 6e 47 khEQVF\/K294ukRnG
\n6f2603c890 4c 5a 75 64 56 34 71 64 67 4f 37 47 6a 45 4d 67 LZudV4qdgO7GjEMg
\n6f2603c8a0 33 55 6e 32 33 38 67 5a 62 6f 71 31 55 42 32 71 3Un238gZboq1UB2q
\n6f2603c8b0 76 39 6f 57 79 2b 2b 67 66 57 75 57 6d 37 54 4f v9oWy++gfWuWm7TO
\n6f2603c8c0 62 4b 7a 67 51 6f 72 44 78 7a 4c 4c 65 61 53 44 bKzgQorDxzLLeaSD
\n6f2603c8d0 38 50 51 68 48 61 47 76 69 72 52 41 44 53 37 35 8PQhHaGvirRADS75
\n6f2603c8e0 43 6d 47 39 6e 50 53 37 6b 67 38 6a 6e 30 31 31 CmG9nPS7kg8jn011
\n6f2603c8f0 63 33 43 49 71 4f 51 35 74 61 66 33 4d 5a 4a 32 c3CIqOQ5taf3MZJ2
\n6f2603c900 49 35 72 38 79 44 54 79 4e 4c 4d 4a 36 68 63 52 I5r8yDTyNLMJ6hcR
\n6f2603c910 67 36 52 63 6f 38 33 71 71 4e 74 72 58 54 2b 6f g6Rco83qqNtrXT+o
\n6f2603c920 56 55 4c 4c 57 4f 79 59 2f 70 6d 70 57 46 74 45 VULLWOyY\/pmpWFtE
\n6f2603c930 6b 68 58 35 45 4a 43 56 53 49 5a 37 74 59 2b 62 khX5EJCVSIZ7tY+b
\n6f2603c940 67 6e 72 2b 70 53 76 51 42 50 69 4d 30 63 62 51 gnr+pSvQBPiM0cbQ
\n6f2603c950 2b 31 36 66 4b 49 52 55 44 33 4d 76 6b 43 72 45 +16fKIRUD3MvkCrE
\n6f2603c960 4e 54 30 45 41 2f 51 4e 4a 4e 37 50 2b 42 46 59 NT0EA\/QNJN7P+BFY
\n6f2603c970 7a 30 78 58 65 49 76 64 70 47 31 79 6e 4d 70 4b z0xXeIvdpG1ynMpK
\n6f2603c980 36 70 66 72 69 71 51 33 71 6c 38 50 31 61 36 57 6pfriqQ3ql8P1a6W
\n6f2603c990 68 67 52 39 71 6d 78 55 43 62 58 65 47 4d 38 78 hgR9qmxUCbXeGM8x
\n6f2603c9a0 59 2b 44 57 7a 37 57 61 2f 2b 44 76 68 58 75 33 Y+DWz7Wa\/+DvhXu3
\n6f2603c9b0 69 6d 59 68 79 66 4e 51 4c 6d 54 6f 77 38 69 73 imYhyfNQLmTow8is
\n6f2603c9c0 57 78 51 53 74 6d 49 53 64 77 30 4f 6a 74 64 37 WxQStmISdw0Ojtd7
\n6f2603c9d0 32 74 6b 50 44 55 74 45 68 4b 50 4c 75 66 49 6a 2tkPDUtEhKPLufIj
\n6f2603c9e0 62 6f 61 45 76 53 68 48 35 77 73 76 68 68 41 52 boaEvShH5wsvhhAR
\n6f2603c9f0 74 5a 4c 73 45 6b 73 39 34 77 68 37 78 4f 36 4d tZLsEks94wh7xO6M
\n6f2603ca00 47 72 69 6a 68 6d 78 69 38 33 56 4f 7a 73 46 56 Grijhmxi83VOzsFV
\n6f2603ca10 64 75 6f 71 53 4c 4d 46 56 7a 6a 6d 32 34 53 6c duoqSLMFVzjm24Sl
\n6f2603ca20 77 66 31 6a 56 2b 48 34 52 79 2f 72 75 44 54 39 wf1jV+H4Ry\/ruDT9
\n6f2603ca30 70 6d 30 48 62 49 7a 4f 57 76 2b 30 68 31 59 4b pm0HbIzOWv+0h1YK
\n6f2603ca40 37 55 45 57 6b 34 47 4b 55 62 39 52 7a 2f 6e 31 7UEWk4GKUb9Rz\/n1
\n6f2603ca50 72 34 64 4b 68 74 50 6f 2b 70 61 38 4d 50 79 73 r4dKhtPo+pa8MPys
\n6f2603ca60 35 62 75 44 79 55 41 62 4f 6c 74 74 37 2b 69 48 5buDyUAbOltt7+iH
\n6f2603ca70 61 4f 49 56 79 39 65 5a 53 64 51 36 57 70 7a 6a aOIVy9eZSdQ6Wpzj
\n6f2603ca80 4c 56 43 69 55 6a 4a 7a 77 45 6c 47 44 71 2b 78 LVCiUjJzwElGDq+x
\n6f2603ca90 4d 5a 58 62 71 32 44 65 6e 32 46 32 31 49 4c 4b MZXbq2Den2F21ILK
\n6f2603caa0 39 47 69 4f 33 4d 38 33 74 44 61 37 35 41 6a 5a 9GiO3M83tDa75AjZ
\n6f2603cab0 59 45 38 50 73 6f 41 68 54 78 41 59 38 4c 6e 79 YE8PsoAhTxAY8Lny
\n6f2603cac0 41 77 58 57 6d 33 4e 58 6b 33 39 43 79 45 62 6d AwXWm3NXk39CyEbm
\n6f2603cad0 39 32 65 6d 38 35 6c 45 6a 6d 43 30 52 30 4e 6c 92em85lEjmC0R0Nl
\n6f2603cae0 62 37 36 6d 61 48 71 54 54 4f 33 4d 6d 39 30 57 b76maHqTTO3Mm90W
\n6f2603caf0 38 6e 56 77 65 4a 52 54 6f 38 50 41 70 2b 56 70 8nVweJRTo8PAp+Vp
\n6f2603cb00 65 2b 44 58 32 75 72 74 39 5a 71 4c 70 62 58 36 e+DX2urt9ZqLpbX6
\n6f2603cb10 62 6f 30 45 43 56 31 2b 61 39 58 59 7a 56 35 64 bo0ECV1+a9XYzV5d
\n6f2603cb20 49 61 61 36 73 69 46 66 64 33 69 68 74 4f 49 72 Iaa6siFfd3ihtOIr
\n6f2603cb30 67 73 6d 54 6d 78 36 56 56 7a 70 52 73 61 37 36 gsmTmx6VVzpRsa76
\n6f2603cb40 69 75 68 75 41 4a 77 43 76 4e 64 4a 6a 4e 64 69 iuhuAJwCvNdJjNdi
\n6f2603cb50 30 78 66 4e 52 72 44 73 67 48 45 75 4f 42 6d 56 0xfNRrDsgHEuOBmV
\n6f2603cb60 5a 4c 52 46 58 4f 4e 37 2f 7a 6e 41 4f 35 45 76 ZLRFXON7\/znAO5Ev
\n6f2603cb70 6c 44 67 70 46 52 62 49 74 4a 71 64 43 2f 51 79 lDgpFRbItJqdC\/Qy
\n6f2603cb80 41 30 42 50 4e 33 66 46 62 2f 67 69 2b 56 47 35 A0BPN3fFb\/gi+VG5
\n6f2603cb90 34 2f 37 72 49 5a 32 74 71 75 6f 68 67 70 4a 4f 4\/7rIZ2tquohgpJO
\n6f2603cba0 38 6d 6a 79 32 31 33 42 48 2f 70 41 42 52 2b 70 8mjy213BH\/pABR+p
\n6f2603cbb0 6a 59 71 77 54 43 64 46 51 78 7a 78 51 4c 73 38 jYqwTCdFQxzxQLs8
\n6f2603cbc0 4b 63 79 49 63 49 74 76 31 31 5a 76 4d 6a 64 4c KcyIcItv11ZvMjdL
\n6f2603cbd0 69 44 79 62 4f 71 6c 2b 37 75 4e 6d 52 50 31 42 iDybOql+7uNmRP1B
\n6f2603cbe0 37 76 34 58 4d 59 5a 69 7a 72 78 70 35 6e 46 75 7v4XMYZizrxp5nFu
\n6f2603cbf0 54 63 54 63 38 37 75 7a 76 49 58 61 36 31 72 4c TcTc87uzvIXa61rL
\n6f2603cc00 62 4d 68 6b 57 62 79 59 79 52 53 51 6b 48 49 32 bMhkWbyYyRSQkHI2
\n6f2603cc10 34 43 44 79 75 71 70 77 5a 59 58 64 54 4c 7a 68 4CDyuqpwZYXdTLzh
\n6f2603cc20 55 35 4c 54 4f 52 2b 67 56 63 4c 37 4d 70 49 2f U5LTOR+gVcL7MpI\/
\n6f2603cc30 6c 57 65 70 54 52 6b 64 2f 46 31 33 39 5a 71 6d lWepTRkd\/F139Zqm
\n6f2603cc40 2b 42 76 30 2b 43 31 4c 37 37 79 69 56 78 36 47 +Bv0+C1L77yiVx6G
\n6f2603cc50 33 54 61 4d 68 37 2b 4c 77 6f 54 72 38 42 62 57 3TaMh7+LwoTr8BbW
\n6f2603cc60 33 77 74 56 70 4d 79 64 58 37 49 49 64 68 52 52 3wtVpMydX7IIdhRR
\n6f2603cc70 66 4d 32 31 79 48 37 71 31 74 4e 52 42 56 70 50 fM21yH7q1tNRBVpP
\n6f2603cc80 6e 70 44 56 33 6a 64 49 31 45 48 53 7a 63 64 66 npDV3jdI1EHSzcdf
\n6f2603cc90 35 73 69 79 75 39 46 4a 70 76 4f 6b 4a 4a 70 46 5siyu9FJpvOkJJpF
\n6f2603cca0 6b 54 4e 32 74 64 39 68 6f 4e 6a 30 54 4a 54 31 kTN2td9hoNj0TJT1
\n6f2603ccb0 50 66 55 4f 34 6e 6f 50 4c 30 39 64 72 6c 4d 31 PfUO4noPL09drlM1
\n6f2603ccc0 2b 2b 55 78 2b 36 46 32 6d 45 75 32 61 4a 48 72 ++Ux+6F2mEu2aJHr
\n6f2603ccd0 34 38 75 4c 37 41 55 58 66 57 6d 4a 34 78 32 63 48uL7AUXfWmJ4x2c
\n6f2603cce0 74 48 30 76 34 63 63 64 76 43 55 57 35 61 36 74 tH0v4ccdvCUW5a6t
\n6f2603ccf0 6e 49 51 70 76 43 65 66 36 72 4c 4f 51 2b 54 33 nIQpvCef6rLOQ+T3
\n6f2603cd00 32 4f 37 77 39 73 31 71 42 7a 67 54 71 61 2b 4d 2O7w9s1qBzgTqa+M
\n6f2603cd10 6d 2b 45 35 4e 74 65 66 34 6d 47 75 2b 4a 6d 64 m+E5Ntef4mGu+Jmd
\n6f2603cd20 6c 65 55 64 35 46 77 76 45 4c 35 6d 71 76 38 34 leUd5FwvEL5mqv84
\n6f2603cd30 59 49 65 53 55 37 48 6e 41 66 4f 71 56 34 2b 63 YIeSU7HnAfOqV4+c
\n6f2603cd40 4e 41 4f 61 4e 58 2f 6b 55 67 77 41 63 30 73 53 NAOaNX\/kUgwAc0sS
\n6f2603cd50 6e 6e 38 6a 36 68 73 75 79 55 41 65 61 4d 50 4a nn8j6hsuyUAeaMPJ
\n6f2603cd60 53 57 59 4d 7a 58 56 46 36 38 4a 63 31 4c 76 79 SWYMzXVF68Jc1Lvy
\n6f2603cd70 55 47 38 69 35 48 6e 37 67 77 34 42 77 2b 2f 51 UG8i5Hn7gw4Bw+\/Q
\n6f2603cd80 61 49 65 62 2b 73 38 72 31 70 4b 72 6a 31 63 58 aIeb+s8r1pKrj1cX
\n6f2603cd90 39 37 34 30 33 75 35 75 34 66 4d 78 38 4a 63 6e 97403u5u4fMx8Jcn
\n6f2603cda0 4a 55 41 76 37 45 61 69 41 30 4a 77 70 7a 4f 43 JUAv7EaiA0JwpzOC
\n6f2603cdb0 54 67 57 54 4f 65 78 41 62 2f 4c 44 70 58 6c 63 TgWTOexAb\/LDpXlc
\n6f2603cdc0 46 78 49 31 6d 4c 42 50 53 31 37 37 37 35 31 39 FxI1mLBPS1777519
\n6f2603cdd0 37 33 33 39 37 35 45 44 45 37 45 36 44 33 30 36 733975EDE7E6D306
\n6f2603cde0 37 39 39 38 44 34 7998D4
\n[<<<] \u51fd\u6570 0xEBC0 \u8fd4\u56de
\n[*] \u8f93\u51fa (arg2) Hexdump:
\n 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
\n6d4cd80350 13 11 49 8f 59 b3 6c 34 dd 18 22 c8 20 30 85 42 ..I.Y.l4..". 0.B
\n——————————————<\/p>\n
\u7b2c\u4e8c\u6b65：ChaCha20<\/p>\n
ChaCha20\u7684key\u5e76\u4e0d\u662f\u56fa\u5b9a\u503c，\u800c\u662f\u53d6\u81ea\u5f53\u524d\u65f6\u95f4\u6233\u2014\u2014\u53d6\u65f6\u95f4\u6233\u7684\u4f4e4\u5b57\u8282，\u4f5c\u4e3akey\u7684\u539f\u59cb\u5185\u5bb9\u3002\u8981\u6ce8\u610f\u7684\u662f，\u5728Python\u91cc\u590d\u73b0\u8fd9\u4e00\u6b65\u7684\u65f6\u5019，\u9700\u8981\u5148\u628a\u8fd94\u5b57\u8282\u53cd\u8f6c\u5b57\u8282\u5e8f，\u518d\u5728\u53f3\u8fb9\u88650\u8865\u523032\u5b57\u8282，\u624d\u80fd\u5f97\u5230\u8ddfso\u91cc\u5b9e\u9645\u4f7f\u7528\u7684key\u4e00\u81f4\u7684\u7ed3\u679c；nonce\u5219\u662f\u53e6\u4e00\u4e2a\u5185\u7f6e\u7684\u56fa\u5b9a8\u5b57\u8282\u503c\u3002\u7528\u8fd9\u7ec4key\/nonce，\u628a\u7b2c\u4e00\u6b65\u7684md5_bytes（16\u5b57\u8282）\u4f5c\u4e3a"\u660e\u6587"\u8dd1\u4e00\u6b21ChaCha20，\u5f97\u523016\u5b57\u8282\u7684chacha20_bytes\u3002<\/p>\n
[+] sub_3C618 (GetTimestampMs) \u8fd4\u56de\u503c: 0x19ddc6eacd8<\/p>\n
============================================================
\n[+] Entering sub_1BDBC (Key\/IV Component Derivation)
\n[*] Seed (Arg2): 0x65a4e57fef44a2a3
\n[*] Output Buffer (Arg3): 0x6d4cd80350, Length (Arg4): 16
\n[*] Arg0 Hexdump (Len: 4):
\n 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
\n6d4cd802e8 d8 ac 6e dc ..n.
\n[*] Arg3 Hexdump (Generated Result, Len: 16):
\n 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
\n6d4cd80350 13 11 49 8f 59 b3 6c 34 dd 18 22 c8 20 30 85 42 ..I.Y.l4..". 0.B
\n[*] Return Value (Pointer: 0x6de5f52370) Hexdump (Len: 16):
\n 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
\n6de5f52370 4d 89 41 f7 cf 79 0d 7c d7 73 95 59 50 00 15 0c M.A..y.|.s.YP…
\n[+] sub_1BDBC Return Value (Raw): 0x6de5f52370
\n============================================================<\/p>\n
\u7b2c\u4e09\u6b65：\u6784\u9020\u7b2c\u4e8c\u6b21MD5\u7684\u8f93\u5165\u5e76\u8ba1\u7b97<\/p>\n
\u7b2c\u4e8c\u6b21MD5\u768424\u5b57\u8282\u8f93\u5165，\u662f\u56fa\u5b9a\u524d\u7f00+\u4e24\u4e2a\u52a8\u6001\u5b57\u8282+\u56fa\u5b9a\u586b\u5145\u62fc\u51fa\u6765\u7684：<\/p>\n
\u62fc\u621024\u5b57\u8282\u540e，\u5bf9\u5b83\u6574\u4f53\u505a\u4e00\u6b21MD5，\u5f97\u5230md5_bytes2\u3002<\/p>\n
[>>>] \u8fdb\u5165\u51fd\u6570 0xEBC0
\n[*] \u53c2\u65701 (\u6e90\u6570\u636e): 0x6df5fbc2f0
\n[*] \u53c2\u65702 (\u957f\u5ea6): 24 (0x18)
\n[*] \u53c2\u65703 (\u8f93\u51fa\u7f13\u51b2\u533a): 0x6d4cd80350
\n[*] \u8f93\u5165 Hexdump:
\n 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
\n6df5fbc2f0 6d b5 79 08 3f fb 21 1c 7c 8d 91 74 94 fc 45 61 m.y.?.!.|..t..Ea
\n6df5fbc300 28 79 47 2b 59 2c 4c 4b (yG+Y,LK
\n[<<<] \u51fd\u6570 0xEBC0 \u8fd4\u56de
\n[*] \u8f93\u51fa (arg2) Hexdump:
\n 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
\n6d4cd80350 8f 4d c0 ab f0 2c cd c7 66 86 86 89 5f f1 eb c0 .M…,..f…_…
\n——————————————<\/p>\n
\u7b2c\u56db\u6b65：\u7b2c\u4e00\u8f6e\u5f02\u6216<\/p>\n
\u628amd5_bytes2\u548c\u4e0a\u4e00\u6b6524\u5b57\u8282\u8f93\u5165\u7684\u6700\u540e8\u5b57\u8282\u505a\u5f02\u6216\u2014\u2014\u8fd9\u6700\u540e8\u5b57\u8282\u572816\u5b57\u8282\u957f\u5ea6\u4e0a\u91cd\u590d\u4f7f\u7528\u4e24\u904d，\u5f97\u5230first_xor\u3002<\/p>\n
8f 4d c0 ab f0 2c cd c7 66 86 86 89 5f f1 eb c0
\n28 79 47 2b 59 2c 4c 4b 28 79 47 2b 59 2c 4c 4b
\n\u4e0a\u9762\u4e24\u884c\u4e0a\u4e0bxor\u5f97\u5230\u4e0b\u9762
\na7 34 87 80 a9 00 81 8c 4e ff c1 a2 06 dd a7 8b<\/p>\n
\u7b2c\u4e94\u6b65：\u62fc\u51fa\u7b2c\u4e8c\u4e2a\u5f02\u6216\u5bf9\u8c61<\/p>\n
\u7b2c\u4e8c\u8f6e\u8981\u5f02\u6216\u7684\u53e6\u4e00\u8def16\u5b57\u8282\u6570\u636e，\u662f\u8fd9\u6837\u62fc\u51fa\u6765\u7684：<\/p>\n
a7 34 87 80 a9 00 81 8c 4e ff c1 a2 06 dd a7 8b
\n13 11 49 8f dc 00 00 00 89 41 f7 cf 78 56 34 12
\n\u4e0a\u9762\u4e24\u884c\u4e0a\u4e0bxor\u5f97\u5230\u4e0b\u9762
\nb4 25 ce 0f 75 00 81 8c c7 be 36 6d 7e 8b 93 99<\/p>\n
\u7b2c\u516d\u6b65：\u7b2c\u4e8c\u8f6e\u5f02\u6216，\u62fc\u51fa\u6700\u7ec8\u7ed3\u679c<\/p>\n
\u628afirst_xor\u548c\u4e0a\u4e00\u6b65\u62fc\u51fa\u768416\u5b57\u8282\u505a\u5f02\u6216，\u5f97\u5230final_xor\u3002<\/p>\n
\u6700\u7ec8\u7684\u53c2\u65703，\u662f\u628a\u8fd9\u51e0\u90e8\u5206\u4f9d\u6b21\u62fc\u63a5：\u56fa\u5b9a4\u5b57\u8282\u524d\u7f004c438510 + \u7b2c\u4e00\u6b65MD5\u7b2c5\u5b57\u8282（1\u5b57\u8282）+ \u7b2c\u4e8c\u6b65ChaCha20\u7b2c6\u5b57\u8282（1\u5b57\u8282）+ \u7b2c\u4e8c\u6b65\u91cc\u7528\u5230\u7684\u90a3\u4e2a\u65f6\u95f4\u6233\u4f4e4\u5b57\u8282（\u539f\u59cb\u987a\u5e8f，\u672a\u53cd\u8f6c）+ final_xor（16\u5b57\u8282），\u4e00\u517126\u5b57\u8282，\u540e\u9762\u88650\u8865\u523034\u5b57\u8282，\u5c31\u662f\u6700\u7ec8\u53d1\u51fa\u53bb\u7684\u53c2\u65703\u3002<\/p>\n
[+] — sub_E3DC Called —
\n[*] Data Length: 34
\n[*] Input Binary (HexDump):
\n 0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
\n6e05fb3d90 4c 43 85 10 59 79 dc 6e ac d8 b4 25 ce 0f 75 00 LC..Yy.n…%..u.
\n6e05fb3da0 81 8c c7 be 36 6d 7e 8b 93 99 00 00 00 00 00 00 ….6m~………
\n6e05fb3db0 00 00 ..
\n[*] Output HexString: 4C4385105979DC6EACD8B425CE0F7500818CC7BE366D7E8B93990000000000000000
\n[+] ————————<\/p>\n
\u56e0\u4e3aQIMEI\u8fd9\u4e2aSDK\u4e0d\u6392\u9664\u6bcf\u6b21\u66f4\u65b0\u90fd\u4f1a\u52a0\u65b0\u53c2\u6570，\u6240\u4ee5\u5373\u4fbf\u8fd9\u6b21\u76849.0.20\u5206\u6790\u5b8c\u4e86，\u540e\u7eed\u7248\u672c\u66f4\u65b0\u65f6\u8fd8\u662f\u5f97\u6bcf\u6b21\u62ff\u65b0\u7248\u672c\u68c0\u67e5\u4e00\u904d\u6709\u6ca1\u6709\u53d8\u5316\u3002\u4e0d\u8fc7\u597d\u5728\u6838\u5fc3\u7b97\u6cd5（RSA + \u6807\u51c6AES）\u8fd9\u6b21\u5df2\u7ecf\u6478\u900f\u4e86，\u540e\u7eed\u7248\u672c\u518d\u9047\u5230\u65b0\u7684\u3001\u88ab\u91cd\u5ea6\u6df7\u6dc6\u7684\u5927\u51fd\u6570，\u4e0d\u9700\u8981\u518d\u4ece\u5934\u4e00\u6b65\u6b65\u786c\u5543，\u800c\u662f\u53ef\u4ee5\u76f4\u63a5\u5229\u7528\u5df2\u77e5\u7684\u7b97\u6cd5\u7279\u5f81\u53bb\u5b9a\u4f4d\u5173\u952e\u70b9，\u6548\u7387\u4e0a\u4f1a\u5feb\u5f88\u591a\u3002<\/p>\n
\u601d\u8def：\u76f4\u63a5\u627eRSA\u52a0\u5bc6\u70b9，\u53cd\u63a8AES\u7684key\/iv<\/p>\n
\u56e0\u4e3aAES\u7684key\u548civ\u672c\u8eab\u662f\u901a\u8fc7RSA\u516c\u94a5\u52a0\u5bc6\u4e0a\u4f20\u7684，\u516c\u94a5\u52a0\u5bc6\u5929\u7136\u6ca1\u6cd5\u53cd\u5411\u89e3\u5bc6，\u6240\u4ee5\u6ca1\u529e\u6cd5\u4ece"\u5bc6\u6587\u5012\u63a8\u660e\u6587"\u8fd9\u6761\u8def\u53bb\u62ffkey\u548civ\u3002\u4f46\u53cd\u8fc7\u6765\u60f3，\u65e2\u7136key\u548civ\u662f\u5728\u88ab\u9001\u53bb\u505aRSA\u52a0\u5bc6\u4e4b\u524d\u7528\u660e\u6587\u5f62\u5f0f\u5b58\u5728\u8fc7，\u90a3\u53ea\u8981\u80fd\u5728\u65b0\u7248\u672c\u91cc\u5b9a\u4f4d\u5230RSA\u52a0\u5bc6\u8c03\u7528\u7684\u4f4d\u7f6e，\u5728\u8c03\u7528\u4e4b\u524dhook\u4e00\u4e0b，\u5c31\u80fd\u76f4\u63a5\u62ff\u5230\u8fd8\u6ca1\u52a0\u5bc6\u7684key\u548civ\u539f\u59cb\u503c\u3002<\/p>\n
\u6240\u4ee5\u540e\u7eed\u7248\u672c\u7684\u5206\u6790\u601d\u8def\u53ef\u4ee5\u7b80\u5316\u6210：\u4e0d\u7528\u518d\u7ba1\u52a0\u5bc6\u51fd\u6570\u672c\u8eab\u662f\u4e0d\u662f\u88ab\u5957\u4e86\u65b0\u7684\u6df7\u6dc6\u6216\u5e73\u5766\u5316，\u76f4\u63a5\u5728so\u91cc\u641cRSA\u76f8\u5173\u7279\u5f81（\u6bd4\u5982\u5e38\u89c1\u7684RSA\u7b97\u6cd5\u5b57\u7b26\u4e32\u3001\u6216\u8005\u7ee7\u7eed\u7528findcrypt\u641c\u5e38\u91cf），\u5b9a\u4f4d\u5230RSA\u52a0\u5bc6\u8c03\u7528\u70b9，\u5728\u8fd9\u4e2a\u70b9\u4e0ahook，\u6253\u5370\u8fdb\u53bb\u52a0\u5bc6\u4e4b\u524d\u7684\u8f93\u5165\u5185\u5bb9，\u5c31\u662fkey\u548civ\u3002<\/p>\n
\u65b0\u7248\u672c\u91ccRSA\u53ea\u5269Java\u5c42\u8fd9\u4e00\u5957<\/p>\n
\u4e4b\u524d\u5206\u67909.0.20\u7684\u65f6\u5019\u63d0\u5230\u8fc7，RSA\u8fd9\u5757\u672c\u6765\u662f\u6709\u4e24\u5957\u5b9e\u73b0\u7684：\u4e00\u5957\u8d70native\u5c42libcrypto，\u4e00\u5957\u8d70Java\u5c42\u3002\u5230\u4e86\u540e\u7eed\u7248\u672c，\u53d1\u73b0libcrypto\u90a3\u4e00\u5957\u65b9\u6848\u76f4\u63a5\u88ab\u5220\u6389\u4e86，\u53ea\u4fdd\u7559\u4e86Java\u5c42\u8fd9\u4e00\u5957\u3002\u4e5f\u5c31\u662f\u8bf4，\u73b0\u5728\u518d\u5206\u6790\u65b0\u7248\u672c，\u4e0d\u7528\u518d\u53bb\u8d39\u52b2\u627enative RSA\u7684\u75d5\u8ff9，\u76f4\u63a5\u9501\u5b9aJava\u5c42\u7684RSA\u5b9e\u73b0\u5c31\u884c，\u8303\u56f4\u53cd\u800c\u66f4\u5c0f\u66f4\u597d\u5b9a\u4f4d\u4e86\u3002<\/p>\n
\u5177\u4f53hook\u4f4d\u7f6e：ByteArray\u6784\u9020\u5904<\/p>\n
\u8d70Java\u5c42RSA\u4e4b\u524d，\u901a\u5e38\u4f1a\u5148NewByteArray，\u7136\u540e\u7528SetByteArrayRegion（\u6216\u8005\u5bf9\u5e94\u7684\u5b57\u8282\u6570\u7ec4\u586b\u5145\u64cd\u4f5c）\u628akey\u548civ\u7684\u5185\u5bb9\u586b\u5145\u8fdb\u53bb，\u586b\u5b8c\u4e4b\u540e\u8fd9\u4e2a\u6570\u7ec4\u624d\u4f1a\u88ab\u4f20\u7ed9RSA\u52a0\u5bc6\u7684\u65b9\u6cd5\u3002\u6240\u4ee5\u6700\u76f4\u63a5\u7684hook\u70b9，\u5c31\u662f\u8fd9\u4e2a"\u521b\u5efa\u597d\u6570\u7ec4\u3001\u5f00\u59cbSetByte\u586b\u5145"\u7684\u4f4d\u7f6e\u2014\u2014\u76f4\u63a5hook\u8fd9\u91cc，\u628a\u6bcf\u6b21SetByte\u586b\u5165\u7684\u503c\u6536\u96c6\u8d77\u6765，\u5c31\u80fd\u5b8c\u6574\u62ff\u5230key\u548civ\u7684\u539f\u59cb\u5185\u5bb9，\u4e0d\u7528\u518d\u53bb\u8d39\u52b2\u8ffd\u8e2a\u51fd\u6570\u5185\u90e8\u5177\u4f53\u662f\u600e\u4e48\u7b97\u51fa\u6765\u3001\u600e\u4e48\u8d70\u7684\u3002<\/p>\n
\u62ff\u5230key\/iv\u4e4b\u540e：\u4e24\u5c42AES\u89e3\u5bc6<\/p>\n
\u6709\u4e86\u8fd9\u7ec4\u968f\u673a\u7684key\u548civ\u4e4b\u540e，\u5269\u4e0b\u7684\u89e3\u5bc6\u5c31\u548c\u4e4b\u524d\u5206\u6790\u7684\u5b8c\u5168\u4e00\u81f4：<\/p>\n
\u4e3a\u4ec0\u4e48\u8981\u88ab\u8feb\u8d70\u8fd9\u79cd"\u76f4\u63a5\u5b9a\u4f4d\u5173\u952e\u70b9"\u7684\u65b9\u5f0f<\/p>\n
\u4e4b\u6240\u4ee5\u540e\u7eed\u7248\u672c\u8981\u9760\u8fd9\u79cd"\u76f4\u63a5\u6293\u5173\u952e\u51fd\u6570"\u7684\u65b9\u5f0f\u800c\u4e0d\u662f\u4ece\u5934\u4e00\u6b65\u6b65\u5206\u6790，\u662f\u56e0\u4e3a\u65b0\u7248\u672c\u7684\u6838\u5fc3\u51fd\u6570\u666e\u904d\u5b58\u5728\u5e73\u5766\u5316\u5904\u7406\u3001\u800c\u4e14\u51fd\u6570\u4f53\u672c\u8eab\u53d8\u5f97\u975e\u5e38\u5e9e\u5927，\u5982\u679c\u8fd8\u6309\u8001\u529e\u6cd5\u4e00\u70b9\u70b9\u8ddf\u63a7\u5236\u6d41\u3001\u9010\u53e5\u53cd\u7f16\u8bd1\u53bb\u770b，\u6548\u7387\u4f1a\u5f88\u4f4e\u3001\u4e5f\u5bb9\u6613\u770b\u9519\u3002\u4e0e\u5176\u6b7b\u78d5\u63a7\u5236\u6d41，\u4e0d\u5982\u76f4\u63a5\u5229\u7528"RSA\/AES\u8fd9\u4e9b\u5bc6\u7801\u5b66\u64cd\u4f5c\u5728\u51fd\u6570\u91cc\u6709\u56fa\u5b9a\u7279\u5f81"\u8fd9\u4e00\u70b9，\u76f4\u63a5\u5b9a\u4f4d\u5230\u5173\u952e\u8c03\u7528\u70b9，\u628a\u8f93\u5165\u8f93\u51fahook\u51fa\u6765，\u53cd\u800c\u66f4\u5feb\u66f4\u7a33\u3002<\/p>\n
\u91c7\u96c6\u53c2\u6570\u672c\u8eab\u76f8\u5bf9\u7a33\u5b9a<\/p>\n
\u53e6\u5916\u4ece\u76ee\u524d\u89c2\u5bdf\u4e0b\u6765，\u5404\u7248\u672c\u91c7\u96c6\u7684\u5177\u4f53\u53c2\u6570\u5185\u5bb9\u53d8\u5316\u4e0d\u5927，\u57fa\u672c\u8fd8\u662f\u8d70popen\u83b7\u53d6\u6587\u4ef6\u4fe1\u606f\u8fd9\u4e00\u5957，\u6ca1\u6709\u53d1\u73b0\u6362\u6210\u522b\u7684\u91c7\u96c6\u65b9\u5f0f\u6216\u8005\u52a0\u522b\u7684\u65b0\u5b57\u6bb5\u3002\u6240\u4ee5\u9664\u975e\u4ee5\u540e\u817e\u8baf\u628a\u6574\u4e2a\u52a0\u5bc6\u7b97\u6cd5\u4f53\u7cfb\u6362\u6389（\u6bd4\u5982AES\u6362\u6210\u522b\u7684\u3001\u6216\u8005RSA\u6362\u6210\u522b\u7684\u975e\u5bf9\u79f0\u7b97\u6cd5），\u4e0d\u7136\u8fd9\u5957"\u5b9a\u4f4dRSA\u70b9\u2192hook\u62ffkey\/iv\u2192\u4e24\u5c42AES\u89e3\u5bc6"\u7684\u5206\u6790\u6d41\u7a0b，\u5bf9\u540e\u7eed\u7248\u672c\u5e94\u8be5\u662f\u53ef\u4ee5\u590d\u7528\u3001\u901a\u7528\u7684\u3002<\/p>\n
\u8fd9\u5957QIMEI\u91c7\u96c6\u65b9\u6848\u5e76\u4e0d\u662fQQ\u72ec\u6709\u7684，\u5b9e\u9645\u4e0a\u5728\u817e\u8baf\u7cfb\u5176\u4ed6App\u91cc\u4e5f\u6709\u590d\u7528\u3002\u6240\u4ee5\u5206\u6790\u5b8c\u8fd9\u4e00\u5957\u4e4b\u540e，\u5176\u5b9e\u591a\u4e86\u4e00\u4e2a\u989d\u5916\u7684\u6536\u83b7：\u4ee5\u540e\u9047\u5230\u522b\u7684\u817e\u8baf\u7cfbApp，\u4e0d\u7528\u6bcf\u6b21\u90fd\u91cd\u65b0\u53bb\u6478\u7d22"\u8fd9\u4e2a\u53c2\u6570\u662f\u600e\u4e48\u6765\u7684"，\u800c\u662f\u53ef\u4ee5\u5148\u9760\u6293\u5305\u5224\u65ad\u2014\u2014\u53ea\u8981\u8bf7\u6c42\u91cc\u80fd\u770b\u5230\u7c7b\u4f3c\u8fd9\u6837\u7684\u5185\u5bb9：<\/p>\n
KlR0TnGOrnxDl4eae4SWYw==<\/p>\n
\u8fd9\u79cd\u7279\u5f81\u503c\u51fa\u73b0，\u57fa\u672c\u5c31\u80fd\u5224\u65ad\u5bf9\u65b9\u590d\u7528\u7684\u662f\u540c\u4e00\u5957\u65b9\u6848，\u53ef\u4ee5\u5c1d\u8bd5\u628a\u8fd9\u6b21\u5206\u6790\u51fa\u6765\u7684\u7b97\u6cd5\u6d41\u7a0b\u642c\u8fc7\u53bb\u590d\u73b0，\u4e0d\u7528\u518d\u4ece\u5934\u9006\u4e00\u904d\u3002<\/p>\n
\u8fd9\u6b21\u5206\u6790\u4e0b\u6765，\u5176\u5b9e\u6700\u5927\u7684\u7ecf\u9a8c\u5c31\u662f\u5f00\u5934\u90a3\u4e00\u6b65：\u9047\u5230\u65b0\u7248\u672c\u6df7\u6dc6\u592a\u91cd\u3001\u5e73\u5766\u5316\u592a\u72e0\u3001\u51fd\u6570\u4f53\u5927\u5230IDA\u90fd\u5361\u7684\u65f6\u5019，\u4e0d\u7528\u975e\u5f97\u6b7b\u78d5\u5f53\u524d\u7248\u672c，\u53ef\u4ee5\u5148\u56de\u5934\u627e\u627e\u8001\u7248\u672c\u3002\u540c\u4e00\u5957SDK\u65e9\u671f\u5b9e\u73b0\u5f80\u5f80\u66f4\u5e72\u51c0，\u628a\u6838\u5fc3\u903b\u8f91\u5403\u900f\u4e4b\u540e，\u518d\u56de\u5934\u770b\u65b0\u7248\u672c\u4f1a\u8f7b\u677e\u5f88\u591a，\u751a\u81f3\u53ef\u4ee5\u76f4\u63a5\u9760\u7b97\u6cd5\u7279\u5f81\u53bb\u53cd\u63a8\u5173\u952e\u4f4d\u7f6e，\u4e0d\u7528\u518d\u4ece\u5934\u987a\u63a7\u5236\u6d41\u3002<\/p>\n
\u5177\u4f53\u6765\u8bf4，\u8fd9\u6b21\u53cd\u590d\u7528\u5230\u7684\u51e0\u4e2a\u5957\u8def：<\/p>\n
\u672c\u6587\u4ec5\u7528\u4e8e\u6280\u672f\u5b66\u4e60\u4e0e\u5b89\u5168\u7814\u7a76\u4ea4\u6d41，\u6587\u4e2d\u6d89\u53ca\u7684\u5206\u6790\u65b9\u6cd5\u3001\u8fd8\u539f\u4ee3\u7801\u53ca\u76f8\u5173\u6570\u636e\u5747\u57fa\u4e8e\u516c\u5f00\u53ef\u83b7\u53d6\u7684APK\u6837\u672c\u9006\u5411\u6240\u5f97，\u4e0d\u6d89\u53ca\u672a\u6388\u6743\u8bbf\u95ee\u670d\u52a1\u5668\u6216\u975e\u6cd5\u83b7\u53d6\u7528\u6237\u6570\u636e\u3002\u8bf7\u52ff\u5c06\u672c\u6587\u5185\u5bb9\u7528\u4e8e\u4efb\u4f55\u4fb5\u72af\u7528\u6237\u9690\u79c1\u3001\u7834\u574f\u7cfb\u7edf\u5b89\u5168\u6216\u5176\u4ed6\u8fdd\u53cd\u6cd5\u5f8b\u6cd5\u89c4\u7684\u7528\u9014，\u7531\u6b64\u4ea7\u751f\u7684\u4e00\u5207\u540e\u679c\u4e0e\u4f5c\u8005\u65e0\u5173\u3002\u5982\u76f8\u5173\u65b9\u8ba4\u4e3a\u672c\u6587\u5185\u5bb9\u5b58\u5728\u4e0d\u5f53\u4e4b\u5904，\u8bf7\u8054\u7cfb\u4f5c\u8005，\u5c06\u7b2c\u4e00\u65f6\u95f4\u914d\u5408\u5904\u7406\u6216\u4e0b\u67b6\u30021. \u524d\u8a00\/\u7f18\u8d77\u6700\u8fd1\u62bd\u7a7a\u770b\u4e86\u4e0bQIMEI SDK\u7684\u6700\u65b0\u7248\u672c，\u672c\u6765\u662f\u60f3<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[10187,7364],"topic":[],"class_list":["post-91803","post","type-post","status-publish","format-standard","hentry","category-server","tag-codingplan","tag-7364"],"yoast_head":"\n