某手rsa分析未完成

最新推荐文章于 2025-11-11 10:10:40 发布

原创最新推荐文章于 2025-11-11 10:10:40 发布 · 776 阅读

CC 4.0 BY-SA版权

 v16 = objc_msgSend(v15, "objectForKey:", CFSTR("private"));
      v17 = objc_retainAutoreleasedReturnValue(v16);
      v19 = (void *)objc_retainAutorelease(v17, v18);
      v20 = v19;
      v21 = (const char *)objc_msgSend(v19, "bytes");// 把密钥转换为字节流  0000000100BCE3C0
      v23 = sub_100BCDFF4(v21, 1);              // 处理密钥    0000000100BCE3C8
      if ( v23 )
      {
        v24 = (void *)objc_retainAutorelease(v8, v22);
        v25 = objc_msgSend(v24, "bytes");
        v26 = objc_msgSend(v24, "length");
        CC_SHA256(v25, v26, &v42);              // 输入raw    0000000100BCE404
        memset(&v41, 0, 0x100uLL);
        v40 = 0;
        if ( (unsigned int)sub_10159CC80(672, (__int64)&v42, 0x20, (__int64)&v41, &v40, v23) )// v41指向的值是输出的关键十六进制值   v40应该是长度   v23key
        {                                       //  0000000100BCE434
          v27 = objc_msgSend(&OBJC_CLASS___NSData, "dataWithBytes:length:", &v41, v40);
          v28 = (KSApiDotGifShowHTTPClient *)objc_retainAutoreleasedReturnValue(v27);

这段代码很奇怪，很像rsa但又好像不是。v21跟踪了很多次，都是私钥的字节流形式，不会变化如下：

//v25和v26
1515638170601

//cc_sha256加密后
25 c8 2c 78 b6 a1 57 e3 35 8c a5 9b 53 6e a8 eb
a5 da c9 62 c3 1e 8c b5 30 11 24 2f 27 c6 6f 92
//sub_10159CC80(672, (__int64)&v42, 0x20, (__int64)&v41, &v40, v23) v42指向256出来的结果如上，v23 = sub_100BCDFF4(v21, 1); 把密钥处理后成了个莫名其妙的结构。
0x162b88160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0x162b88170: 90 18 ad 02 01 00 00 00 00 00 00 00 00 00 00 00  ..?.............
0x162b88180: 40 a2 73 60 01 00 00 00 70 97 69 60 01 00 00 00  @?s`....p.i`....
0x162b88190: 30 c7 fd 60 01 00 00 00 c0 e4 40 60 01 00 00 00  0??`....??@`....
0x162b881a0: f0 af 7d 60 01 00 00 00 c0 6d 60 60 01 00 00 00  ?}`....?m``....
0x162b881b0: 90 69 6e 60 01 00 00 00 00 c7 03 60 01 00 00 00  .in`.....?.`....
0x162b881c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0x162b881d0: 02 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00  ................
0x162b881e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0x162b881f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0x162b88200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0b 00  ................
0x162b88210: e5 50 a3 02 a1 05 00 00 01 00 00 00 0b 00 00 00  ?P?.?...........
0x162b88220: 01 00 00 00 00 00 00 00 00 00 00 04 56 7a 4b 40  ............VzK@
0x162b88230: 06 00 00 00 02 00 00 00 b8 0b 00 00 00 00 00 00  ........?.......
0x162b88240: 06 00 00 00 00 00 00 00 b0 09 8f 60 01 00 00 00  ........?..`....
0x162b88250: f0 7f 75 60 01 00 00 00 50 00 00 00 00 00 00 00  ?.u`....P.......
//这段数据完全不明白

//  执行完sub_10159CC80函数，v40指向如下字符串：
5e277cc38848b0ea22c2fc08743f2f611c0b98c4c0ec8e69d8d9dc92624435026de79f33fa18053161b5dd769bf851ec24b1bf711a2fffdb514289d1c719d1585edbc4de59b20e32a8e2a310e0c3d21ab714d644fd477ff56692cb3d53d535acb18235d0a3b77e7721d49763cfd53abbd3824420ad119b2bea796115ce72d5e0af0660c645dbf641b32778aa60b78c5a48493f7a5a81e2bc8b5b330d180eb7535a72a51658cbb44fb4211a2b2b5a8c2065bd08df8578e146c264c02ca1d745d9a55b4a74e1efea14908ea4ed350ecd823ff5446e5c3a7d3df21160b00bf3e5734aefa8d7fec93873af869694caaab8ba3201f7995e1c0c95057ac7a5fec8937e

//经过Base64得到字节流如下：

5869643877346849734f6f6977767749644438765952774c6d4d544137493570324e6e636b6d4a454e514a743535387a2b6867464d574731335861622b4648734a4c472f63526f762f397452516f6e5278786e5257463762784e355a73673479714f4b6a454f444430687133464e5a452f55642f39576153797a31543154577373594931304b4f33666e6368314a646a7a39553675394f4352434374455a7372366e6c684663357931654376426d44475264763251624d6e654b70677434786153456b2f656c71423472794c577a4d4e474136335531707970525a5979375250744345614b7974616a43426c76516a6668586a6852734a6b774379683130585a7056744b644f4876366853516a7154744e51374e676a2f31524735634f6e3039386846677341767a35584e4b37366a582f736b3463362b476c70544b717269364d6748336d563463444a55466573656c2f73695466673d3d

//转换成文本
Xid8w4hIsOoiwvwIdD8vYRwLmMTA7I5p2NnckmJENQJt558z+hgFMWG13Xab+FHsJLG/cRov/9tRQonRxxnRWF7bxN5Zsg4yqOKjEODD0hq3FNZE/Ud/9WaSyz1T1TWssYI10KO3fnch1Jdjz9U6u9OCRCCtEZsr6nlhFc5y1eCvBmDGRdv2QbMneKpgt4xaSEk/elqB4ryLWzMNGA63U1pypRZYy7RPtCEaKytajCBlvQjfhXjhRsJkwCyh10XZpVtKdOHv6hSQjqTtNQ7Ngj/1RG5cOn098hFgsAvz5XNK76jX/sk4c6+GlpTKqri6MgH3mV4cDJUFesel/siTfg==