{"id":21618,"date":"2020-12-25T15:57:10","date_gmt":"2020-12-25T07:57:10","guid":{"rendered":"https:\/\/www.daycode.net\/?p=21618"},"modified":"2020-12-25T15:57:10","modified_gmt":"2020-12-25T07:57:10","slug":"%e6%90%9c%e7%b4%a2%e7%bc%96%e7%a8%8b%e7%9a%84%e8%89%ba%e6%9c%af%e4%b9%8bc%e5%ae%9e%e7%8e%b0%e5%b0%8f%e7%a8%8b%e5%ba%8f%e5%8c%85%e8%a7%a3%e5%af%86%e7%ae%97%e6%b3%95","status":"publish","type":"post","link":"https:\/\/www.daycode.net\/21618.html","title":{"rendered":"\u641c\u7d22\u7f16\u7a0b\u7684\u827a\u672f\u4e4bC#\u5b9e\u73b0\u5c0f\u7a0b\u5e8f\u5305\u89e3\u5bc6\u7b97\u6cd5"},"content":{"rendered":"<p>\u6709\u70b9\u6807\u9898\u515a\u4e86\uff0c\u827a\u672f\u8c08\u4e0d\u4e0a\uff0c\u4f46\u5f88\u5b9e\u7528\uff0c\u81ea\u5df1\u4e00\u70b9\u70b9\u7f16\u7a0b\u7684\u7ecf\u9a8c\uff08\u81ea\u5b66\uff09\uff0c\u7b80\u5355\u7684\u8bed\u6cd5\u4e5f\u603b\u662f\u8bb0\u4e0d\u4f4f\uff0c\u4f46\u662f\u8981\u641e\u4e00\u4e9b\u5de5\u5177\u7528\u7684\u65f6\u5019\u600e\u4e48\u529e\uff1f\u7f51\u4e0a\u641c\u7d22\u4e5f\u4e0d\u4e00\u5b9a\u5b8c\u5168\u6709\uff0c\u5927\u591a\u65f6\u5019\u9700\u8981\u81ea\u5df1\u52a8\u624b\uff0c\u4e0b\u9762\u5c31\u662f\u6211\u7684\u4e00\u4e9b\u7ecf\u9a8c\uff1a\u901a\u8fc7\u641c\u7d22\u5f15\u64ce\u83b7\u5f97\u4ee3\u7801\u529f\u80fd\u7247\u6bb5\uff0c\u4fee\u6539\u52a0\u5de5\u4e3a\u5df1\u7528\uff0c\u201c\u6211\u4e4b\u6240\u4ee5\u80fd\u6210\u529f \uff0c\u662f\u56e0\u4e3a\u6211\u7ad9\u5728\u5de8\u4eba\u7684\u80a9\u4e0a\u201d\u2014\u2014\u725b\u987f\uff0c\u7fa4\u91cc\u4e5f\u5e38\u8bf4\uff1a\u95ee\u767e\u5ea6\u4e00\u5206\u949f\u89e3\u51b3\uff0c\u95ee\u7fa4\u91cc\u54392\u4e2a\u5c0f\u65f6\u725bB\uff01\u5584\u7528\u641c\u7d22\uff0c\u4e5f\u80fd\u6210\u4e3a\u522b\u4eba\u773c\u4e2d\u7684\u5927\u795e\uff08\u79bb\u771f\u5927\u795e\u8fd8\u6bd4\u8f83\u9065\u8fdc\uff09\u3002<br \/>\n\u524d\u63d0\uff1a\u7565\u5fae\u6709\u4e9b\u7f16\u7a0b\u57fa\u7840\u3002\u76ee\u7684\uff1aC#\u5b9e\u73b0<a href=\"https:\/\/www.daycode.net\/tag\/4804\" class=\"tag-tooltip\" data-toggle=\"tooltip\" title=\"\u67e5\u770b\u66f4\u591a\u5173\u4e8e \u5c0f\u7a0b\u5e8f\u5305 \u7684\u6587\u7ae0\" target=\"_blank\">\u5c0f\u7a0b\u5e8f\u5305<\/a><a href=\"https:\/\/www.daycode.net\/tag\/4805\" class=\"tag-tooltip\" data-toggle=\"tooltip\" title=\"\u67e5\u770b\u66f4\u591a\u5173\u4e8e wxapkg \u7684\u6587\u7ae0\" target=\"_blank\">wxapkg<\/a>\u6587\u4ef6\u89e3\u5bc6\u7b97\u6cd5\u3002<br \/>\n\u5de5\u5177\uff1avs2015+\u767e\u5ea6 .net\u7248\u672c\u9009\u62e92.0\uff08\u73af\u5883\u4f9d\u8d56\u4f4e\uff09<br \/>\n\u5907\u6ce8\uff1a\u70ed\u4e4e\u7684\uff0c\u6628\u665a\u521a\u5b8c\u6210\u3002\u5df2\u77e5\u6709python\u7248\u672c\uff0c\u6709\u70b9\u91cd\u590d\u9020\u8f6e\u5b50\u3002\u4f46exe\u7684\u4e0d\u7528\u5176\u5b83\u4f9d\u8d56\uff0c\u53cc\u51fb\u6253\u5f00\u5c31\u80fd\u7528\u5c82\u4e0d\u7f8e\u54c9\uff01<br \/>\n\u9996\u5148\u6211\u4eec\u901a\u8fc7GitHub\u5927\u795e\u83b7\u5f97<a href=\"https:\/\/www.daycode.net\/tag\/4804\" class=\"tag-tooltip\" data-toggle=\"tooltip\" title=\"\u67e5\u770b\u66f4\u591a\u5173\u4e8e \u5c0f\u7a0b\u5e8f\u5305 \u7684\u6587\u7ae0\" target=\"_blank\">\u5c0f\u7a0b\u5e8f\u5305<\/a>\u5df2\u77e5\u52a0\u5bc6\u7b97\u6cd5\uff1a<br \/>\n<div class=\"contextual-callout callout-info\"><h4><\/h4><p><br \/>\nPC\u7aef\u5fae\u4fe1\u628a<a href=\"https:\/\/www.daycode.net\/tag\/4805\" class=\"tag-tooltip\" data-toggle=\"tooltip\" title=\"\u67e5\u770b\u66f4\u591a\u5173\u4e8e wxapkg \u7684\u6587\u7ae0\" target=\"_blank\">wxapkg<\/a>\u7ed9\u52a0\u5bc6\uff0c\u52a0\u5bc6\u540e\u7684\u6587\u4ef6\u7684\u8d77\u59cb\u4e3aV1MMWX\u3002<br \/>\n\u52a0\u5bc6\u65b9\u6cd5\u4e3a\uff1a<br \/>\n1\u3001\u9996\u5148pbkdf2\u751f\u6210AES\u7684key\u3002\u5229\u7528\u5fae\u4fe1\u5c0f\u7a0b\u5e8fid\u5b57\u7b26\u4e32\u4e3apass\uff0csalt\u4e3asaltiest \u8fed\u4ee3\u6b21\u6570\u4e3a1000\u3002\u8c03\u7528pbkdf2\u751f\u6210\u4e00\u4e2a32\u4f4d\u7684key<br \/>\n2\u3001\u53d6\u539f\u59cb\u7684<a href=\"https:\/\/www.daycode.net\/tag\/4805\" class=\"tag-tooltip\" data-toggle=\"tooltip\" title=\"\u67e5\u770b\u66f4\u591a\u5173\u4e8e wxapkg \u7684\u6587\u7ae0\" target=\"_blank\">wxapkg<\/a>\u7684\u5305\u5f97\u524d1023\u4e2a\u5b57\u8282\u901a\u8fc7AES\u901a\u8fc71\u751f\u6210\u7684key\u548civ(the iv: 16 bytes),\u8fdb\u884c\u52a0\u5bc6<br \/>\n3\u3001\u63a5\u7740\u5229\u7528\u5fae\u4fe1\u5c0f\u7a0b\u5e8fid\u5b57\u7b26\u4e32\u7684\u5012\u6570\u7b2c2\u4e2a\u5b57\u7b26\u4e3axor key\uff0c\u4f9d\u6b21\u5f02\u62161023\u5b57\u8282\u540e\u7684\u6240\u6709\u6570\u636e\uff0c\u5982\u679c\u5fae\u4fe1\u5c0f\u7a0b\u5e8fid\u5c0f\u4e8e2\u4f4d\uff0c\u5219xorkey \u4e3a 0x66<br \/>\n4\u3001\u628aAES\u52a0\u5bc6\u540e\u7684\u6570\u636e\uff081024\u5b57\u8282\uff09\u548cxor\u540e\u7684\u6570\u636e\u4e00\u8d77\u5199\u5165\u6587\u4ef6\uff0c\u5e76\u5728\u6587\u4ef6\u5934\u90e8\u6dfb\u52a0V1MMWX\u6807\u8bc6<br \/>\n<\/p><\/div><br \/>\n\u901a\u8fc7\u52a0\u5bc6\u7b97\u6cd5\u5f97\u77e5<\/p>\n<ul>\u5df2\u77e5\u53c2\u6570\uff1a<\/ul>\n<li>\u5fae\u4fe1\u5c0f\u7a0b\u5e8fID<\/li>\n<li>salt\uff1asaltiest<\/li>\n<li>iv\uff1athe iv: 16 bytes<\/li>\n<p>\u5df2\u77e5\u52a0\u5bc6\/\u89e3\u5bc6\u65b9\u6cd5\uff1a<br \/>\npbkdf2<br \/>\nAES<br \/>\n\u5f02\u6216<br \/>\n\u64b8\u8d77\u8896\u5b50\u52a0\u6cb9\u5e72\uff1a<br \/>\n\u90a3\u6211\u4eec\u5728\u7535\u8111C:UsersAdministratorDocumentsWeChat FilesApplet\u76ee\u5f55\u968f\u4fbf\u627e\u4e00\u4e2a\u5fae\u4fe1<a href=\"https:\/\/www.daycode.net\/tag\/4804\" class=\"tag-tooltip\" data-toggle=\"tooltip\" title=\"\u67e5\u770b\u66f4\u591a\u5173\u4e8e \u5c0f\u7a0b\u5e8f\u5305 \u7684\u6587\u7ae0\" target=\"_blank\">\u5c0f\u7a0b\u5e8f\u5305<\/a>\uff1a<br \/>\n\u7136\u540evs\u91cc\u521b\u5efa\u4e2a\u9879\u76ee\uff0c\u753b\u4e00\u4e2a\u6309\u94ae\u548c\u4e00\u4e2a\u6587\u672c\u6846\u3002<br \/>\n<a href=\"https:\/\/pic.rmb.bdstatic.com\/bjh\/724d87333cfc2b08782a315e8d5e1735.jpeg\"><img decoding=\"async\" src=\"https:\/\/pic.rmb.bdstatic.com\/bjh\/724d87333cfc2b08782a315e8d5e1735.jpeg\" title=\"\u641c\u7d22\u7f16\u7a0b\u7684\u827a\u672f\u4e4bC#\u5b9e\u73b0\u5c0f\u7a0b\u5e8f\u5305\u89e3\u5bc6\u7b97\u6cd5\u63d2\u56fe\" alt=\"\u641c\u7d22\u7f16\u7a0b\u7684\u827a\u672f\u4e4bC#\u5b9e\u73b0\u5c0f\u7a0b\u5e8f\u5305\u89e3\u5bc6\u7b97\u6cd5\u63d2\u56fe\" \/><\/a><br \/>\n<a href=\"https:\/\/pic.rmb.bdstatic.com\/bjh\/956aa8e688cb6bbf80f777cf9724623a.jpeg\"><img decoding=\"async\" src=\"https:\/\/pic.rmb.bdstatic.com\/bjh\/956aa8e688cb6bbf80f777cf9724623a.jpeg\" title=\"\u641c\u7d22\u7f16\u7a0b\u7684\u827a\u672f\u4e4bC#\u5b9e\u73b0\u5c0f\u7a0b\u5e8f\u5305\u89e3\u5bc6\u7b97\u6cd5\u63d2\u56fe1\" alt=\"\u641c\u7d22\u7f16\u7a0b\u7684\u827a\u672f\u4e4bC#\u5b9e\u73b0\u5c0f\u7a0b\u5e8f\u5305\u89e3\u5bc6\u7b97\u6cd5\u63d2\u56fe1\" \/><\/a><\/p>\n<p>\u7136\u540e\u5b9a\u4e49\u5df2\u77e5\u53c2\u6570\uff1a<br \/>\nstring wid = \"wx94af8311484aa69a\";<br \/>\nbyte[] iv = Encoding.UTF8.GetBytes(\"the iv: 16 bytes\");<br \/>\nstring salts = \"saltiest\"<\/p>\n<p>\u901a\u8fc7\u641c\u7d22\u5f15\u64ce\u83b7\u53d6\u51e0\u4e2a\u9700\u8981\u7684\u51fd\u6570\uff08\u6838\u5fc3\u6280\u672f\uff09\uff1a<br \/>\n\u641c\u7d22\u5173\u952e\u8bcd\uff1a<br \/>\nc# PBKDF2<br \/>\nc# \u6587\u4ef6\u8bfb\u5199 byte<br \/>\nc# AES byte<\/p>\n<p>\u5f53\u7136\u5e76\u975e\u76f4\u63a5\u53ef\u7528\uff0c\u9700\u8981\u90e8\u5206\u4fee\u6539\u5b8c\u5584\u3002\u4f46\u57fa\u672c\u6539\u52a8\u4e0d\u5927\uff0c\u7701\u53bb\u5f88\u591a\u65f6\u95f4\uff0c\u8d77\u7801\u4e0d\u7528\u770bc#\u4ece\u5165\u95e8\u5230\u7cbe\u901a\u4e86\uff0c\u6574\u7406\u4fee\u6539\u5f97\u5230\u5982\u4e0b\u4ee3\u7801\uff1a<br \/>\npublic static byte[] AESDecrypt(byte[] inputdata, byte[] iv, byte[] strKey)<br \/>\n{<br \/>\n    SymmetricAlgorithm des = Rijndael.Create();<br \/>\n    des.Key = strKey;<br \/>\n    des.IV = iv;<br \/>\n    byte[] decryptBytes = new byte[inputdata.Length];<br \/>\n    using (MemoryStream ms = new MemoryStream(inputdata))<br \/>\n    {<br \/>\n        using (CryptoStream cs = new CryptoStream(ms, des.CreateDecryptor(), CryptoStreamMode.Read))<br \/>\n        {<br \/>\n            cs.Read(decryptBytes, 0, decryptBytes.Length);<br \/>\n            cs.Close();<br \/>\n            ms.Close();<br \/>\n        }<br \/>\n    }<br \/>\n    return decryptBytes;<br \/>\n}<br \/>\npublic byte[] PBKDF2(string wxid,string salts) {<br \/>\n    byte[] salt = Encoding.UTF8.GetBytes(salts);<br \/>\n    \/\/RNGCryptoServiceProvider cryptoProvider = new RNGCryptoServiceProvider();<br \/>\n    \/\/cryptoProvider.GetBytes(salt);<br \/>\n    Rfc2898DeriveBytes pbkdf2 = new Rfc2898DeriveBytes(wxid, salt, 1000);<br \/>\n    return pbkdf2.GetBytes(32); \/\/ \u6539\u4e3a32\u4f4d<br \/>\n}<br \/>\n\/\/\u8bfb\u53d6\u6587\u4ef6\u5230byte[]<br \/>\nprivate byte[] FileContent(string fileName)<br \/>\n{<br \/>\n    using (FileStream fs = new FileStream(fileName, FileMode.Open, FileAccess.Read))<br \/>\n    {<br \/>\n        try<br \/>\n        {<br \/>\n            byte[] buffur = new byte[fs.Length];<br \/>\n            fs.Read(buffur, 0, (int)fs.Length);<br \/>\n            return buffur;<br \/>\n        }<br \/>\n        catch (Exception ex)<br \/>\n        {<br \/>\n            throw ex;<br \/>\n        }<br \/>\n    }<br \/>\n}<\/p>\n<p>\/\/\u5229\u7528byte[]\u6570\u7ec4\u5199\u5165\u6587\u4ef6<br \/>\nprotected void writerFile(byte[] array,string fileName)<br \/>\n{<br \/>\n    \/\/\u521b\u5efa\u4e00\u4e2a\u6587\u4ef6\u6d41<br \/>\n    FileStream fs = new FileStream(fileName, FileMode.Create);<br \/>\n    \/\/\u5c06byte\u6570\u7ec4\u5199\u5165\u6587\u4ef6\u4e2d<br \/>\n    fs.Write(array, 0, array.Length);<br \/>\n    \/\/\u6240\u6709\u6d41\u7c7b\u578b\u90fd\u8981\u5173\u95ed\u6d41\uff0c\u5426\u5219\u4f1a\u51fa\u73b0\u5185\u5b58\u6cc4\u9732\u95ee\u9898<br \/>\n    fs.Close();<br \/>\n}<\/p>\n<p>\u6709\u4e86\u6838\u5fc3\u51fd\u6570\u65b9\u6cd5\u4e86\u6211\u4eec\u6765\u83b7\u53d6key\uff1a<br \/>\nbyte[] key = PBKDF2(wid, salts);<\/p>\n<p>\u7136\u540e\u89e3\u5bc6\u5934\u90e81023\u5b57\u8282\uff1a<br \/>\nbyte[] dataByte = FileContent(\"__APP__.<a href=\"https:\/\/www.daycode.net\/tag\/4805\" class=\"tag-tooltip\" data-toggle=\"tooltip\" title=\"\u67e5\u770b\u66f4\u591a\u5173\u4e8e wxapkg \u7684\u6587\u7ae0\" target=\"_blank\">wxapkg<\/a>\");<br \/>\nbyte[] originData = AESDecrypt(dataByte.Skip(6).Take(1024).ToArray(),iv,key); \/\/\u4ece\u7b2c7\u4e2a\u5b57\u8282\u5f00\u59cb\u83b7\u53d61024\u5b57\u8282\u7136\u540eAESDecrypt<\/p>\n<p>\u89e3\u5bc6\uff0c\u518d\u63d0\u53d6\u89e3\u5bc6\u540e\u7684\u524d1023\u5b57\u8282\uff0c\u81f3\u6b64\u5934\u90e8\u7684\u89e3\u5bc6\u5b8c\u6210\uff0c\u90a3\u4e48\u5bf9\u4e0d\u5bf9\u5462\uff0c\u6211\u4eec\u5df2\u77e5\u6709python\u7248\u7684\uff0c\u90a3\u4e48\u6211\u4eec\u5c31\u6253\u5370\u51fa\u6765key\u548c\u89e3\u5bc6\u540e\u7684base64\u7f16\u7801\uff08\u4e3a\u4e86\u65b9\u4fbf\u6bd4\u8f83\u7edf\u4e00\u7f16\u7801\uff09<br \/>\n<a href=\"https:\/\/pic.rmb.bdstatic.com\/bjh\/da6155948963383e520df920711b92b1.png\"><img decoding=\"async\" src=\"https:\/\/pic.rmb.bdstatic.com\/bjh\/da6155948963383e520df920711b92b1.png\" title=\"\u641c\u7d22\u7f16\u7a0b\u7684\u827a\u672f\u4e4bC#\u5b9e\u73b0\u5c0f\u7a0b\u5e8f\u5305\u89e3\u5bc6\u7b97\u6cd5\u63d2\u56fe2\" alt=\"\u641c\u7d22\u7f16\u7a0b\u7684\u827a\u672f\u4e4bC#\u5b9e\u73b0\u5c0f\u7a0b\u5e8f\u5305\u89e3\u5bc6\u7b97\u6cd5\u63d2\u56fe2\" \/><\/a><br \/>\n\u597d\u50cf\u6ca1\u4ec0\u4e48\u6bdb\u75c5\uff0c\u5269\u4e0b\u7684\u5c31\u662f\u628a1024\u5b57\u8282\u4ee5\u540e\u7684\u4e0exorkey\u5f02\u6216\u89e3\u5bc6\u52a0\u4e0a\u4e0a\u9762\u7684\u5934\u90e8\u5199\u5165\u5373\u53ef\u3002\u65b9\u6cd5\u5982\u4e0a\uff1a\u91cd\u590d\u641c\u7d22\u6574\u7406\uff0c\u76f8\u4fe1\u5927\u5bb6\u5df2\u7ecf\u638c\u63e1\uff01\u7531\u4e8e\u672c\u5e16\u7740\u91cd\u8ba8\u8bba\u65b9\u6cd5\u800c\u975e\u6e90\u7801\uff0c\u56e0\u6b64\u4e0d\u518d\u8d58\u8ff0\uff01<br \/>\n\u603b\u7ed3\uff1a<br \/>\n\u62d9\u89c1\uff1a\u7f16\u7a0b\u91cd\u5728\u89e3\u51b3\u95ee\u9898\u7684\u65b9\u6cd5\u548c\u601d\u8def\u800c\u975e\u7f16\u7a0b\u672c\u8eab\uff0c\u4e92\u8054\u7f51\u771f\u662f\u77e5\u8bc6\u7684\u6d77\u6d0b\uff0c\u5f53\u7136\u4e5f\u6709\u5751\uff01<br \/>\n\u4f18\u52bf\uff1a\u6709\u7f51\u80fd\u4e0a\u5929\u5165\u5730<br \/>\n\u7f3a\u9677\uff1a\u65ad\u7f51\u61f5\u903c<\/p>\n<p>\u6587\u4e2d\u4ee3\u7801\u53c2\u8003\u8d44\u6599\uff1a<br \/>\nhttps:\/\/www.cnblogs.com\/ldyblogs\/p\/Byte.html<br \/>\nhttps:\/\/bbs.csdn.net\/topics\/394385963<br \/>\nhttps:\/\/blog.csdn.net\/weixin_30794851\/article\/details\/98793268<br \/>\nhttps:\/\/github.com\/kksanyu\/pc_wxapkg_decrypt_python<br \/>\n<!-- [\u805a\u5408\u56fe\u5e8a\u67e5\u8be2: 3] --><\/p>\n","protected":false},"excerpt":{"rendered":"\u6709\u70b9\u6807\u9898\u515a\u4e86\uff0c\u827a\u672f\u8c08\u4e0d\u4e0a\uff0c\u4f46\u5f88\u5b9e\u7528\uff0c\u81ea\u5df1\u4e00\u70b9\u70b9\u7f16\u7a0b\u7684\u7ecf\u9a8c\uff08\u81ea\u5b66\uff09\uff0c\u7b80\u5355\u7684\u8bed\u6cd5\u4e5f\u603b\u662f\u8bb0\u4e0d\u4f4f\uff0c\u4f46\u662f\u8981\u641e\u4e00\u4e9b\u5de5\u5177\u7528\u7684\u65f6\u5019\u600e\u4e48\u529e\uff1f\u7f51\u4e0a\u641c\u7d22\u4e5f\u4e0d\u4e00\u5b9a\u5b8c\u5168\u6709\uff0c\u5927\u591a\u65f6\u5019\u9700\u8981\u81ea\u5df1\u52a8\u624b\uff0c\u4e0b\u9762\u5c31\u662f\u6211\u7684\u4e00\u4e9b\u7ecf\u9a8c\uff1a\u901a\u8fc7\u641c\u7d22\u5f15 \u00b7\u00b7\u00b7","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[455],"tags":[4805,4804],"class_list":["post-21618","post","type-post","status-publish","format-standard","hentry","category-jiaocheng","tag-wxapkg","tag-4804"],"views":497,"_links":{"self":[{"href":"https:\/\/www.daycode.net\/api\/wp\/v2\/posts\/21618"}],"collection":[{"href":"https:\/\/www.daycode.net\/api\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.daycode.net\/api\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.daycode.net\/api\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.daycode.net\/api\/wp\/v2\/comments?post=21618"}],"version-history":[{"count":0,"href":"https:\/\/www.daycode.net\/api\/wp\/v2\/posts\/21618\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.daycode.net\/api\/wp\/v2\/media?parent=21618"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.daycode.net\/api\/wp\/v2\/categories?post=21618"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.daycode.net\/api\/wp\/v2\/tags?post=21618"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}