遇到一个使用 RDO 连接的服务器列表,配置文件是序列化存储的二进制数据,密码是加密的,.NET 的程序,反混淆能找到硬编码的密钥生成参数,关键的加解密代码放在下面了。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
using System;
using System.Text;
using System.IO;
using System.Security.Cryptography;
namespace ConsoleApplication1
{
class Program
{
static void Main(string[] args)
{
String encryptedString = Program.Encrypt("Aa12345678");
String decryptedString = Program.Decrypt("55B958256F5F9A74EB947F5EDAE16D0FE4E247C2C829E9E39CB7E10586D2C591");
Console.Write(encryptedString + "\n" + decryptedString);
Console.Read();
}
public static byte[] smethod_0(byte[] byte_0, byte[] byte_1, byte[] byte_2)
{
MemoryStream memoryStream = new MemoryStream();
Rijndael rijndael = Rijndael.Create();
rijndael.Key = byte_1;
rijndael.IV = byte_2;
ICryptoTransform encryptor = rijndael.CreateEncryptor();
int num = 1;
CryptoStream cryptoStream = new CryptoStream((Stream)memoryStream, encryptor, (CryptoStreamMode)num);
byte[] buffer = byte_0;
int offset = 0;
int length = byte_0.Length;
cryptoStream.Write(buffer, offset, length);
cryptoStream.Close();
return memoryStream.ToArray();
}
public static string Encrypt(string string_0)
{
string strPassword = "swevA2t62We?5Cr+he4Tac?_E!redafa?re5+2huv*$rU9eS8Ub4?W!!R+s7uthU";
byte[] bytes = Encoding.Unicode.GetBytes(string_0);
byte[] rgbSalt = new byte[13] { 73, 118, 97, 110, 32, 77, 101, 100, 118, 101, 100, 101, 118 };
PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(strPassword, rgbSalt);
byte[] numArray = Program.smethod_0(bytes, passwordDeriveBytes.GetBytes(32), passwordDeriveBytes.GetBytes(16));
StringBuilder stringBuilder = new StringBuilder();
foreach (byte num in numArray) stringBuilder.AppendFormat("{0:X2}", (object)num);
return stringBuilder.ToString();
}
public static byte[] smethod_4(byte[] byte_0, byte[] byte_1, byte[] byte_2)
{
MemoryStream memoryStream = new MemoryStream();
Rijndael rijndael = Rijndael.Create();
rijndael.Key = byte_1;
rijndael.IV = byte_2;
ICryptoTransform decryptor = rijndael.CreateDecryptor();
int num = 1;
CryptoStream cryptoStream = new CryptoStream((Stream)memoryStream, decryptor, (CryptoStreamMode)num);
byte[] buffer = byte_0;
int offset = 0;
int length = byte_0.Length;
cryptoStream.Write(buffer, offset, length);
cryptoStream.Close();
return memoryStream.ToArray();
}
public static string Decrypt(string string_0)
{
string strPassword = "swevA2t62We?5Cr+he4Tac?_E!redafa?re5+2huv*$rU9eS8Ub4?W!!R+s7uthU";
byte[] byte_0 = new byte[string_0.Length / 2];
for (int index = 0; index < string_0.Length / 2; ++index)
{
int int32 = Convert.ToInt32(string_0.Substring(index * 2, 2), 16);
byte_0[index] = (byte)int32;
}
PasswordDeriveBytes passwordDeriveBytes = new PasswordDeriveBytes(strPassword, new byte[13] { 73, 118, 97, 110, 32, 77, 101, 100, 118, 101, 100, 101, 118 });
return Encoding.Unicode.GetString(Program.smethod_4(byte_0, passwordDeriveBytes.GetBytes(32), passwordDeriveBytes.GetBytes(16)));
}
}
}