【逆向】Base64編碼解碼及逆向識別

序言

 Base64編碼解碼原理相關內容，可以參考之前寫的文章。

示例代碼

注意：該示例代碼僅為Base64編碼實現的其中一種，實際分析樣本的Base64編碼實現並不一定與此代碼相同，讀者應重點理解其原理部分，而忽略其實現形式的不同。

// Base64.cpp : 定義控制台應用程序的入口點。
//

#include "stdafx.h"
#include <stdio.h>
#include "string.h"   
#include "stdlib.h"

static char find_pos(char ch);
char *base64_encode(const char* data, int data_len, int *len);
char *base64_decode(const char* data, int data_len, int *len);
const char base[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";

//======獲取BASE64編碼索引
static char find_pos(char ch)
{
    //the last position (the only) in base[] 
    char *ptr = (char*)strrchr(base, ch);
    return (ptr - base);
}

//======BASE64編碼
char *base64_encode(const char* data, int data_len, int *len)
{
    int prepare = 0;
    int ret_len;
    *len = 0;
    int temp = 0;

    int nCount = 0;
    char chArr[4];

    char *pRet = NULL;
    char *pTmp = NULL;
    
    //計算編碼后字符長度
    ret_len = data_len / 3;
    temp = data_len % 3;
    if (temp > 0)
    {
        ret_len += 1;
    }

    //申請返回數據緩沖區
    ret_len = ret_len * 4 + 1;
    pRet = (char *)malloc(ret_len);
    if (pRet == NULL)
    {
        printf("No enough memory");
        exit(0);
    }
    memset(pRet, 0, ret_len);
    pTmp = pRet;

    //處理所有待編碼數據
    while (nCount < data_len) 
    {
        temp = 0;
        prepare = 0;
        memset(chArr, 0, 4);

        //3個字節一組，保存每個字節二進制位
        while (temp < 3)    
        {
            if (nCount >= data_len)
            {
                break;
            }
            prepare = ((prepare << 8) | (data[nCount] & 0xFF));
            nCount++;
            temp++;
        }
        //確保每個字節數據以24比特位排列
        prepare = (prepare << ((3 - temp) * 8));

        //獲取base表索引及編碼字符
        for (int i = 0; i < 4; i++)
        {
            //最后一位或兩位用'='填充 
            if (temp < i)
            {
                chArr[i] = 0x40;    
            }
            else
            {
                //獲取base表索引
                chArr[i] = (prepare >> ((3 - i) * 6)) & 0x3F;
            }
            //通過索引獲取對應編碼字符
            *pTmp = base[chArr[i]];
            pTmp++;
            (*len)++;
        }
    }

    *pTmp = 0x00;
    return pRet;
}

//======BASE64解碼
char *base64_decode(const char *data, int data_len, int *len)
{
    *len = 0;
    char need[3];
    int temp = 0;
    int nCount = 0;
    int prepare = 0;
    int equal_count = 0;
    int ret_len = (data_len / 4) * 3 + 1;

    char *pRet = NULL;
    char *pTmp = NULL;

    //判斷結尾有多少個通配符‘=’
    if (*(data + data_len - 1) == '=')
    {
        equal_count += 1;
    }
    if (*(data + data_len - 2) == '=')
    {
        equal_count += 1;
    }

    //申請緩沖區
    pRet = (char *)malloc(ret_len);
    if (pRet == NULL)
    {
        printf("No enough memory.n");
        exit(0);
    }
    memset(pRet, 0, ret_len);
    pTmp = pRet;

    //解碼數據（‘=’除外）
    while (nCount < (data_len - equal_count))
    {
        temp = 0;
        prepare = 0;
        memset(need, 0, 4);

        //4個字節一組，獲取每個字符在base表中的下標索引(‘=’除外)
        while (temp < 4)
        {
            if (nCount >= (data_len - equal_count))
            {
                break;
            }
            prepare = (prepare << 6) | (find_pos(data[nCount]));
            temp++;
            nCount++;
        }
        //將每個索引按24比特位進行排列
        prepare = prepare << ((4 - temp) * 6);

        //獲取編碼前字符
        for (int i = 0; i<3; i++)
        {
            if (i == temp)
            {
                break;
            }
            *pTmp = (char)((prepare >> ((2 - i) * 8)) & 0xFF);
            pTmp++;
            (*len)++;
        }
    }
    *pTmp = 0x00;
    if (data[data_len - 1] == '=')
    {
        (*len)--;
    }

    return pRet;
}

//======Main
int _tmain(int argc, _TCHAR* argv[])
{
    int len1, len2, len3;
    char *former = "A";
    len3 = strlen(former);

    //編碼
    char *after = base64_encode(former, len3, &len1);
    printf("enCode=%s    nLen=%d\n", after,len1);

    //解碼
    former = base64_decode(after, len1, &len2);
    printf("enCode=%s    nLen=%d\n", former, len2);

    return 0;
}

逆向識別

1、編碼識別

2、解碼識別

總結

1、識別代碼中的“=”通配符
2、識別Base編碼表，靜態編碼表可以在IDA“string”窗口查看，有些動態拼接的則需要手動識別
3、識別代碼中對數據的左移右移操作
4、最主要的是理解編碼解碼原理，比如編碼時通常都會用3個字節一組來處理比特位數據，這些特征都可以用來分析識別

參考

https://www.52pojie.cn/thread-793420-1-1.html