TEA加密逆向

IDA伪代码

 do{if ( v15 )v17 = v38;                              // x12=0x0->0x79168ba790， 输入字符串经过check1处理后字符串elsev17 = v40;v18 = (unsigned int *)&v17[v16];          // 0x78cbbd47fc    add     x12, x12, x8    ; x12=0x79168ba790->0x79168ba798，每次取8个字符v20 = *v18;                               // 0x78cbbd4800    ldp     w16, w14, [x12] ; x14=0x79168ba790->0x78777675, x16=0x78cbbf9eb8->0x74737271，8个字符分别给到v20 和 v19v19 = v18[1];v21 = 32;v22 = 0x9E3779B9;                         // TEA加密算法的常数DELTA值do{v20 += (DWORD1(k) + (v19 >> 5)) ^ (k + 16 * v19) ^ (v19 + v22);// k 的值是 0x42, 0x37, 0x2C,  0x21 ， 是在JNI_OnLoad 赋值--v21;v19 += (DWORD2(k) + 16 * v20) ^ (v22 + v20) ^ (HIDWORD(k) + (v20 >> 5));v22 -= 0x61C88647;                      }while ( v21 );                            // 循环加密32轮*v18 = v20;                               // 加密后的数据再给到v18 ，就是加密后字符串再写回内存v18[1] = v19;v16 += 8LL;                               // 取下一个 8个字符if ( (v37 & 1) != 0 )v23 = v39;                              // v23 = 0x20elsev23 = (unsigned __int64)v37 >> 1;v15 = (v37 & 1) == 0;                     // v15 = 0}while ( v23 > v16 );                        // 循环条件是 v16 < 32 , 32就是待加密的字符串长度，v16是递增8，就是每次取待加密的字符串8位

核心代码标识

1、TEA加密算法的常数DELTA值 0x9E3779B9 和 0x61C88647
2、4个key值
3、左移4位、右移5位、2个异或

v22 = 0x9E3779B9;                         // TEA加密算法的常数DELTA值do{v20 += (DWORD1(k) + (v19 >> 5)) ^ (k + 16 * v19) ^ (v19 + v22);// k 的值是 0x42, 0x37, 0x2C,  0x21 ， 是在JNI_OnLoad 赋值--v21;v19 += (DWORD2(k) + 16 * v20) ^ (v22 + v20) ^ (HIDWORD(k) + (v20 >> 5));v22 -= 0x61C88647; }

arm指令

加解密代码

    private static final int DELTA = 0x9E3779B9;private  static int sum = 0xC6EF3720;public static void encrypt(int[] v, int[] key) {int v0 = v[0], v1 = v[1];int sum = 0;for (int i = 0; i < 32; i++) {v0 += ((v1 << 4) + key[0]) ^ (v1 + sum) ^ ((v1 >>> 5) + key[1]);v1 += ((v0 << 4) + key[2]) ^ (v0 + sum) ^ ((v0 >>> 5) + key[3]);sum += DELTA;}v[0] = v0;v[1] = v1;}public static void decrypt(int[] v, int[] key) {int v0 = v[0], v1 = v[1];for (int i = 0; i < 32; i++) {v1 -= ((v0 << 4) + key[2]) ^ (v0 + sum) ^ ((v0 >>> 5) + key[3]);v0 -= ((v1 << 4) + key[0]) ^ (v1 + sum) ^ ((v1 >>> 5) + key[1]);sum -= DELTA;}v[0] = v0;v[1] = v1;}public static void main(String[] args) {int[] key = {0x42, 0x37, 0x2c, 0x21}; // 128-bit keyint[] plaintext = new int[2]; // 64-bit plaintextplaintext[0] = 0x10e14834;plaintext[1] = 0x3d635efc;// Decryptdecrypt(plaintext, key);System.out.printf("Decrypted: %08X %08X%n", plaintext[0], plaintext[1]);}