CN105678174A

CN105678174A - Method for decrypting WeChat encrypted data based on binary system

Info

Publication number: CN105678174A
Application number: CN201511028797.7A
Authority: CN
Inventors: 黄旭; 赵飞; 朱星海; 张佳强
Original assignee: SICHUAN MWH INFORMATION SAFETY TECHNOLOGY Co Ltd
Current assignee: SICHUAN MWH INFORMATION SAFETY TECHNOLOGY Co Ltd
Priority date: 2015-12-31
Filing date: 2015-12-31
Publication date: 2016-06-15

Abstract

The invention discloses a method for decrypting WeChat encrypted data based on the binary system, and belongs to the field of electronic data evidence collection. The method comprises the following steps of 101 obtaining a unique exclusive imei number of the Android device and a WeChat uid, and calculating the secret key; 102 making a mirror image document of the Android device; 103 encrypting a file identification by means of a WeChat encryption algorithm, and generating a unique exclusive encrypted data characteristic; 104 searching the content which is consistent with the data characteristic generated in the step 103 in the clear area of the mirror image document made in the step 102 by means of the encrypted data characteristic, and obtaining the address of the content, if the content is found out, a step 105 needs to be executed, if the content is not found out, the steps are ended; and 105 decrypting data encrypted in the step 103 by means of the WeChat encryption algorithm. The method for decrypting WeChat encrypted data based on the binary system is advantaged in that the problem that the WeChat encrypted data cannot be decrypted is solved, and the method is a major breakthrough for electronic evidence collection work.

Description

A kind of method adding ciphertext data based on binary system deciphering wechat

Technical field

The present invention relates to electronic evidence-collecting field, particularly to a kind of method adding ciphertext data based on binary system deciphering wechat.

Background technology

Improving constantly and expanding along with the provided service level of mobile communication technology and type service, mobile phone has been increasingly becoming contact instrument indispensable in people's Working Life, but meanwhile, utilize mobile phone to carry out swindling, calumniate and the criminal activity such as forgery is also of common occurrence. Mobile Phone Forensics hits an effective means of this kind of crime just. In concept, Mobile Phone Forensics is exactly put storage card and Mobile Network Operator data base from SIM cards of mobile phones, mobile phone inside/outside to collect, save from damage and analyze relevant electronic evidence, and the process of evidence that final therefrom acquisition has act of law, can be admitted by court.

The criminal behavior involving mobile phone at present substantially has three kinds: one to be use mobile phone to serve as liaison instrument in the implementation process of criminal behavior; Two is the storage media that mobile phone is used as a kind of evidence of crime; Last a kind of mode is the implementation tool that mobile phone is taken as the novel mobile phone criminal activities such as the harassing and wrecking of short message fraud, note and bogusware propagation. These all fully show that the correlational study carrying out Mobile Phone Forensics technology has sufficient necessity and great urgency for maintaining social stability, ensureing people's rights and interests and the behavior of fighting crime.

The target data related in Mobile Phone Forensics encryption often, especially with the chat class application that number is more, wechat data use SQLCipherforAndroid encryption storage, once suspect is by wechat application unloading, or after being formatted by mobile phone, these encrypting databases are that the mode that can not use customary means file signature is recovered, then such issues that run into, evidence obtaining will be had reached an impasse, and there is presently no good way and solves this problem.

Summary of the invention

The present invention is directed to the deficiencies in the prior art, it is provided that a kind of method adding ciphertext data based on binary system deciphering wechat, it is possible to the problem effectively solving wechat encrypting database file.

For solving problem above, the technical solution used in the present invention is as follows: a kind of method adding ciphertext data based on binary system deciphering wechat, comprises the steps: unique exclusive No. imei and the wechat uid of 101 acquisition Android device computation key;102 make Android device image file; 103 use wechat AES encryption file identification to generate uniquely exclusive encryption data characteristics; The clear area of the image file that 104 use encryption data characteristicses make in 102 is retrieved the content consistent with the data characteristics that 103 produce and obtained its address, if any then performing 105, it does not have then terminate; 105 use the deciphering of wechat algorithm through the data of 103 encryptions.

As preferably, the concrete grammar of 101 is as follows: arrange unique exclusive No. imei that can directly obtain Android device by searching Android device, the uid of wechat can be directly obtained by two cfg files under the MicroMsg file of lookup wechat, two cfg files are systeminfo.cfg and compatibleinfo.cfg respectively, after obtaining No. imei and wechat uid, key is (imei+uid) and takes the first seven position of MD5 value.

As preferably, the file identification described in 103 is 0X53514C69746520666F726D6174203300.

As preferably, the wechat AES described in 103 is AES-256-CBC.

As preferably, described Android device includes Android mobile phone, Android flat board.

The method of the present invention can reach following effect: the present invention is by obtaining mobile phone imei, and wechat uid calculates key; Wechat AES AES-256-CBC is used to add ciphertext data; Image file is searched encryption Data Position; AES-256-CBC algorithm is finally used to decipher the data found. Said method can well solve wechat and add the problem that ciphertext data cannot be decrypted, becomes one of important breakthrough of electronic evidence-collecting work.

Accompanying drawing explanation

Fig. 1 is the schematic flow sheet of the present invention.

Detailed description of the invention

For making the purpose of the present invention, technical scheme and advantage clearly understand, develop simultaneously embodiment referring to accompanying drawing, the present invention is described in further details.

A kind of decipher the wechat method that adds ciphertext data based on binary system, for Android mobile phone:

101 unique exclusive No. imei and the wechat uid obtaining Android device, and computation key; 102 make Android device image file; 103 use wechat AES encryption file identification to generate uniquely exclusive data characteristics; The clear area of the image file that 104 use encryption data characteristicses make in 102 is retrieved the content consistent with the data characteristics that 103 produce and obtained its address, if any then performing 105, it does not have then terminate; 105 use the deciphering of wechat algorithm through the data of 103 encryptions.

The concrete grammar of 101 is as follows: arrange unique exclusive No. imei that can directly obtain mobile phone by searching mobile phone, the uid of wechat can be directly obtained by two cfg files under the MicroMsg file of lookup wechat, two cfg files are systeminfo.cfg and compatibleinfo.cfg respectively, after obtaining No. imei and wechat uid, key is (imei+uid) and takes the first seven position of MD5 value;

The concrete grammar of 102 is as follows: under the premise having root authority, by overall for mobile phone mirror image, lays the groundwork for searching encrypted feature data below in mirror image;

The concrete grammar of 103 is as follows: wechat uses AES-256-CBC algorithm, this algorithm is increased income, wechat data base uses sqlite3 data base, sqlite3 data base has a file signature mark, owing to No. imei of each mobile phone is different, so the key generated also is unique, the file identification of use AES-256-CBC algorithm for encryption is also all just uniquely exclusive encryption data characteristics;

104 specifically comprise the following steps that in the mirror image clear area using encryption data characteristics to make in 102 is retrieved the data shape consistent with this feature and is obtained its address, if any then performing 105, it does not have then terminate.

105 specifically comprise the following steps that the data by the data of 103 encrypted features retrieve in 104 are decrypted by AES-256-CBC, it is possible to decrypt the whole of some wechat data or fragment.

Claims

1. the method adding ciphertext data based on binary lookup wechat, it is characterised in that comprise the steps:

101 unique exclusive No. imei and the wechat uid obtaining Android device, and computation key; 102 make Android device image file; 103 use wechat AES encryption file identification to generate uniquely exclusive encryption data characteristics; The clear area of the image file that 104 use encryption data characteristicses make in 102 is retrieved the content consistent with the data characteristics that 103 produce and obtained its address, if any then performing 105, it does not have then terminate; 105 use the deciphering of wechat algorithm through the data of 103 encryptions.

2. a kind of method adding ciphertext data based on binary lookup wechat according to claim 1, it is characterized in that, the concrete grammar of 101 is as follows: arrange unique exclusive No. imei that can directly obtain Android device by searching Android device, the uid of wechat can be directly obtained by two cfg files under the MicroMsg file of lookup wechat, two cfg files are systeminfo.cfg and compatibleinfo.cfg respectively, after obtaining No. imei and wechat uid, key is (imei+uid) and takes the first seven position of MD5 value.

3. a kind of method adding ciphertext data based on binary lookup wechat according to claim 1 and 2, it is characterised in that the file identification described in 103 is 0X53514C69746520666F726D6174203300.

4. a kind of method adding ciphertext data based on binary lookup wechat according to claim 3, it is characterised in that the wechat AES described in 103 is AES-256-CBC.

5. a kind of method adding ciphertext data based on binary lookup wechat according to claim 1, it is characterised in that described Android device includes Android mobile phone, Android flat board.