CN114390012A - West trust application data evidence obtaining method based on reverse analysis - Google Patents

West trust application data evidence obtaining method based on reverse analysis Download PDF

Info

Publication number
CN114390012A
CN114390012A CN202111533548.9A CN202111533548A CN114390012A CN 114390012 A CN114390012 A CN 114390012A CN 202111533548 A CN202111533548 A CN 202111533548A CN 114390012 A CN114390012 A CN 114390012A
Authority
CN
China
Prior art keywords
decryption
encryption
key
data
local
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202111533548.9A
Other languages
Chinese (zh)
Inventor
石玉
张文政
吉庆兵
杜承宇
倪绿林
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
CETC 30 Research Institute
Original Assignee
CETC 30 Research Institute
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by CETC 30 Research Institute filed Critical CETC 30 Research Institute
Priority to CN202111533548.9A priority Critical patent/CN114390012A/en
Publication of CN114390012A publication Critical patent/CN114390012A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L51/00User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
    • H04L51/04Real-time or near real-time messaging, e.g. instant messaging [IM]
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/06Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04MTELEPHONIC COMMUNICATION
    • H04M1/00Substation equipment, e.g. for use by subscribers
    • H04M1/72Mobile telephones; Cordless telephones, i.e. devices for establishing wireless links to base stations without route selection
    • H04M1/724User interfaces specially adapted for cordless or mobile telephones
    • H04M1/72403User interfaces specially adapted for cordless or mobile telephones with means for local support of applications that increase the functionality
    • H04M1/72406User interfaces specially adapted for cordless or mobile telephones with means for local support of applications that increase the functionality by software upgrading or downloading
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/26Testing cryptographic entity, e.g. testing integrity of encryption key or encryption algorithm

Abstract

The invention provides a method for obtaining evidence of Wangxin application data based on reverse analysis, which comprises the following steps: step 1, decompiling an Wangxin APK file to obtain a machine code; step 2, performing static analysis on the machine code, positioning an encryption and decryption function, analyzing an encryption and decryption principle, and restoring an encryption and decryption process; step 3, performing binary instrumentation on the key generation related function through a dynamic binary instrumentation technology; running a wayside program, and acquiring a decryption key in the running process; and 4, decrypting the local ciphertext data by using an encryption and decryption principle and a decryption key to restore plaintext data. The scheme provided by the invention can completely restore the encryption and decryption process of the West-West local database and accurately analyze the decryption key of the local ciphertext database, thereby avoiding the need of brute force cracking due to the failure to obtain an accurate key; meanwhile, the method can effectively restore the West news local database to obtain the user communication relation and the local chat record, and provides a new idea for obtaining evidence of the smart phone.

Description

West trust application data evidence obtaining method based on reverse analysis
Technical Field
The invention relates to the field of data analysis, in particular to a method for obtaining evidence of Wangxin application data based on reverse analysis.
Background
With the development of the internet, people have higher and higher requirements for information exchange, and instant messaging software is produced. The main popular instant messaging software in China includes instant messaging products such as WeChat, QQ, nailing and Wenxin, and foreign whatsa app, telegram and signal. The instant messaging software is mainly used for daily communication and contact keeping, and is widely applied to the office field, such as question discussion, work schedule negotiation and the like; due to the influence of new crown epidemic situations, a plurality of instant messaging applications oriented to enterprise needs appear at present, which bring convenience for enterprise personnel to cooperate, manage resources and manage customer relations, and most instant messaging software integrates functions such as file transmission, voice and video communication, news subscription and the like. Instant messaging software has not only been a simple tool for everyday communication, but it has also gradually become an important component of internet information platforms.
Due to the popularization of instant messaging software, more and more criminal suspects can use the novel tool to communicate, so that data forensics become more important, and criminal clues or evidences can be found out through the data forensics. Noora Al Mutawa et Al carry out evidence-taking research on FaceBook, Twitter and MySpace3 instant messaging software on blackberry, iPhone and Android platforms, and analyze that the blackberry mobile phone cannot recover memory data, and the iPhone and Android mobile phone can recover; neha S Thakur et al studied data extraction and analysis in the Android platform by Whatsapp, and provided a new idea for evidence collection of instant messaging software; the study of the moon and the like designs a WeChat application data evidence obtaining model based on an Android platform; zhao Kai researches a forensics method for database recovery based on an Android system; the marmon pen introduces how to recover WeChat deleted data on the iOS system; WeChat interaction protocol and encryption mode based on reverse analysis were studied by Wanyuanchun et al.
At present, the following problems mainly exist in evidence obtaining analysis of instant messaging software:
(1) in order to meet the public demand, the instant messaging software needs to meet different mobile phone models and operating systems, and a uniform evidence obtaining analysis method cannot be provided based on different mobile phone models and operating systems;
(2) the formats of various instant messaging protocols are different, instant messaging software companies privatize the protocols in consideration of own interests, and a forensics analysis method suitable for all instant messaging software cannot be provided due to the undisclosed nature and the non-uniform nature of the protocols;
(3) the instant messaging software mostly adopts an encrypted communication protocol for protecting the privacy data of the user, local data are encrypted and stored, and decryption keys are stored in different memories or physical blocks in a segmented mode, so that the evidence obtaining analysis difficulty of an evidence obtaining engineer is increased.
Disclosure of Invention
Aiming at the problems in the prior art, the method for obtaining evidence of the Wangxin application data based on the reverse analysis is provided, and the method is used for analyzing and restoring the data encryption and decryption implementation process and the key generation principle by performing the reverse analysis on the Wangxin APK file, and finally decrypting and restoring the local chatting data.
The technical scheme adopted by the invention is as follows: a Wangxin application data evidence obtaining method based on reverse analysis comprises the following processes:
step 1, decompiling an Wangxin APK file to obtain a machine code;
step 2, performing static analysis on the machine code, positioning an encryption and decryption function, analyzing an encryption and decryption principle, and restoring an encryption and decryption process;
step 3, performing binary instrumentation on the key generation related function through a dynamic binary instrumentation technology; running a waken program, and acquiring a decryption key in the program running process;
and 4, decrypting the local ciphertext data by using an encryption and decryption principle and a decryption key to restore plaintext data.
Further, in step 3, the decryption key is obtained by using a hook technique.
Further, the process of obtaining the decryption key by using the hook technology comprises the following steps: confirming a hook point, wherein the hook point needs to meet the condition that an object to which a function belongs is static and needs to be an object created by a system; the function is executed outside the system.
Further, in the step 3, frida is used as a hook tool to extract the key.
Further, the specific process of step 3 includes:
step 3.1, installing frida modules at a mobile phone end and a PC end respectively, wherein a server program is installed at the mobile phone end;
step 3.2, writing a script based on python and javascript according to the encryption and decryption functions determined in the step 2 for communication;
and 3.3, executing frida at the mobile phone end, then executing the trust application program, and simultaneously operating the python script file at the PC end, namely acquiring the decryption key of the local database in the program operation process.
Further, the specific process of step 4 includes: extracting a ciphertext database of the Wangxin application, wherein the specific path of a database file stored in an internal folder of the mobile phone end is '/data/data/com.alibaba.mobileim/database', the ciphertext database file is named as 'random number wx 4', and the ciphertext database file is extracted to the PC end in an adb mode; secondly, realizing a ciphertext data decryption and restoration process by using the encryption and decryption principle obtained in the step two; and finally, restoring the user communication relation and the local chatting record data of the user with the strong message through the process and the decryption key.
Compared with the prior art, the beneficial effects of adopting the technical scheme are as follows:
(1) the method provided by the invention can completely restore the encryption and decryption process of the West-West local database;
(2) the method provided by the invention can accurately analyze the decryption key of the local ciphertext database, and avoids the need of brute force cracking caused by the failure to obtain the accurate key;
(3) the evidence obtaining method provided by the invention can effectively restore the West news local database to obtain the user communication relation and the local chat record, and provides a new idea for obtaining evidence of the smart phone.
Drawings
Fig. 1 is a flowchart of a method for forensics of wayside application data based on reverse analysis according to the present invention.
Fig. 2 is a flow chart of the data encryption principle.
Fig. 3 is a flowchart of decryption key extraction according to an embodiment of the invention.
Detailed Description
The invention is further described below with reference to the accompanying drawings.
The warrior application of the present embodiment is transaction communication software developed by the Alibara group specifically for individual consumers. The functions of login, chat record intercommunication, logistics message lookup, Aliwang group chat and the like simultaneously with computer version Aliwang can be supported. As a strategic derivation of Aliwang in a mobile terminal of an Alibara group product, the Alibara group product mainly provides more convenient service for buyers and sellers of online shopping in the transaction process. But are sometimes used by lawbreakers as tools for communicating with each other.
In the using process of the Wanxin, the user account information can be stored on the mobile phone, the receiving address and the contact information of the user can be stored, and the chat information between the current user and other users can also be stored locally. However, the private encryption protocol is used by the public, a large amount of data is stored locally by encryption, and the encryption key is stored in different memories in segments. This makes it impossible for the ordinary method to obtain user data
For the characteristics of the wayside application, as shown in fig. 1, the embodiment provides a wayside application data forensics method based on reverse analysis, and the method analyzes and restores the wayside protocol implementation process through technologies such as reverse analysis and dynamic binary instrumentation, and decrypts and restores local chat data. The specific scheme is as follows;
step one, decompiling an Wangxin APK file to obtain a machine code
The APK is an application package file format which can be identified by an Android system and is formed by compiling and packaging source codes of Android applications, and the APK file comprises a compiled code file, file resources, a native resource file, a certificate and a manifest file. To analyze the execution code of the original program, the APK file must be decompiled. In this embodiment, a decompilation tool such as Apktool is used to convert the code file in the APK file, i.e., the dex file, into Smail language, which is a register language of the Dalvik virtual machine.
Step two, performing static analysis on the machine code, positioning an encryption and decryption function, analyzing an encryption and decryption principle, and restoring an encryption and decryption process
And analyzing the Smail code of the WANXIN APK obtained in the first step to determine that the WANXIN application program mainly adopts an AES algorithm to encrypt the user chatting data. The AES algorithm is a block cipher algorithm, that is, plaintext data is divided into data groups of equal length during encryption, and each time a group of data is encrypted until the whole plaintext is completely encrypted. The packet length of AES is only 128 bits, but the key length may be 128 bits, 192 bits or 256 bits, and the encryption round number is different according to the key length.
As shown in fig. 2, the data encryption and decryption process of the wayside application program includes:
the method includes the steps that a trust application program stores data of user chat days in a database form, a com, alibaba, sqlcryptto, sqlitedatabase class is called to encrypt the data, functions in the class call a libdatabase _ sqlcryptto, so that an encryption function is realized through NDK, an sqlit3 related function is mainly used in the dynamic library to realize the encryption function, namely, an sqlit3 codeattach () function is called in an sqlit 3_ open () function, and the sqlit3 codeattach () function calls an AES _ cryptypt () function to mainly encrypt the data, wherein an AES-128-ecb algorithm is used in the AES _ encypt () function.
Because AES is a symmetric cryptographic algorithm, that is, a decryption key and an encryption key of the algorithm are the same, the decryption implementation process also calls libdatabase _ sqlcryptto. so as to implement a decryption function through NDK, and differently, an AES _ decryption () function is called in an sqlit3 codeattach () function to complete decryption processing on data.
Through analysis, in addition to the encryption and decryption functions, functions aes _ encrypt _ key128() and aes _ decrypt _ key128() are called in the sqlit3 codeattach () function.
Performing binary instrumentation on the key correlation function through a dynamic binary instrumentation technology; running the program and obtaining the decryption key in the running process
The second analysis shows that the key generation function is packaged in the libdatabase _ sqlcrypto.so dynamic library, and the key cannot be accurately obtained by using a static analysis method, so that dynamic debugging analysis needs to be performed on the waken application program, and the key is obtained from the program running process by using a dynamic binary instrumentation technology.
Dynamic binary instrumentation refers to injecting additional code into a program to collect runtime information, and is mainly classified into two types: source code instrumentation and binary instrumentation. In the embodiment, a binary pile inserting technology is mainly adopted, and the most key point in the binary pile inserting technology is that a hook technology is used; hook is also called Hook function, the main principle means that before the system does not call the function, the Hook program can capture the message first, the Hook function obtains control right first, and at this time, the Hook function can process or change the execution behavior of the function, can obtain the parameter information of the function, and can even force to end the transfer of the message. The Hook function is mainly realized in two steps: firstly, a hook point, namely a method requiring a hook, needs to be found, the hook point needs to satisfy the condition that the object to which the function belongs needs to be static and the object which needs to be created by the system needs to be used, and secondly, the hook method needs to be placed outside the system for execution.
As shown in fig. 3, in this embodiment, frida is used as a hook tool to extract a key, and the specific process is as follows:
(1) installing frida modules at a mobile phone end and a PC end respectively, wherein a server program is installed at the mobile phone end, hijacking of an application function is realized in a process injection mode, and the PC end is mainly used for communication;
(2) analyzing a function needing binary instrumentation, namely an aes _ encrypt _ key128() function and an aes _ decrypt _ key128() function obtained by static analysis in the step two;
(3) and writing a script based on python and javascript for the function to communicate, wherein the pseudo code comprises the following components:
Figure BDA0003412304550000051
the python language mainly sends a javascript code to equipment, wherein a function in the javascript code is a hook core code and comprises an acquisition parameter and a return value or a modification parameter and a return value and the like;
(4) frida is executed at the mobile phone end, then the Wangxin application program is executed, and meanwhile, a python script file needs to be operated at the PC end, so that a local database decryption key can be obtained in the program operation process.
And fourthly, decrypting the local ciphertext data by using an encryption and decryption principle and a decryption key to restore plaintext data.
In order to decrypt and restore a local plaintext database, firstly, a ciphertext database of a West telecom application is extracted, wherein a specific path of a database file stored in an internal folder of a mobile phone end is'/data/data/com. Secondly, realizing a ciphertext data decryption and reduction process by an encryption and decryption principle separated by the steps; and finally, the data such as the user communication relation, the local chat records and the like of the user with the strong letter are restored through the decryption of the flow and the decryption key.
The method provided by the invention can completely restore the encryption and decryption process of the West-West local database; the decryption key of the local ciphertext database is accurately analyzed, so that violent cracking caused by the fact that the accurate key cannot be obtained is avoided; meanwhile, the method can effectively restore the West news local database to obtain the user communication relation and the local chat record, and provides a new idea for obtaining evidence of the smart phone.
The invention is not limited to the foregoing embodiments. The invention extends to any novel feature or any novel combination of features disclosed in this specification and any novel method or process steps or any novel combination of features disclosed. Those skilled in the art to which the invention pertains will appreciate that insubstantial changes or modifications can be made without departing from the spirit of the invention as defined by the appended claims.
All of the features disclosed in this specification, or all of the steps in any method or process so disclosed, may be combined in any combination, except combinations of features and/or steps that are mutually exclusive.
Any feature disclosed in this specification may be replaced by alternative features serving equivalent or similar purposes, unless expressly stated otherwise. That is, unless expressly stated otherwise, each feature is only an example of a generic series of equivalent or similar features.

Claims (6)

1. A Wangxin application data evidence obtaining method based on reverse analysis is characterized by comprising the following processes:
step 1, decompiling an Wangxin APK file to obtain a machine code;
step 2, performing static analysis on the machine code, positioning an encryption and decryption function, and analyzing an encryption and decryption principle;
step 3, performing binary instrumentation on the key generation related function through a dynamic binary instrumentation technology; running a waken program, and acquiring a decryption key in the program running process;
and 4, decrypting the local ciphertext data by using an encryption and decryption principle and a decryption key to restore plaintext data.
2. The method for forensics of trust application data based on reverse analysis according to claim 1, wherein in the step 3, the decryption key is obtained by using hook technology.
3. The method for forensics of trust application data based on reverse analysis according to claim 2, wherein the process of obtaining the decryption key by using hook technology comprises: confirming a hook point, wherein the hook point needs to meet the condition that an object to which a function belongs is static and needs to be an object created by a system; the function is executed outside the system.
4. The method for forensics of trust application data based on reverse analysis according to claim 2 or 3, wherein in the step 3, frida is used as a hook tool to extract the key.
5. The method for forensics of trust application data based on reverse analysis according to claim 4, wherein the specific process of the step 3 comprises:
step 3.1, installing frida modules at a mobile phone end and a PC end respectively, wherein a server program is installed at the mobile phone end;
step 3.2, writing a script based on python and javascript according to the encryption and decryption functions determined in the step 2 for communication;
and 3.3, executing frida at the mobile phone end, then executing the trust application program, and simultaneously operating the python script file at the PC end, namely acquiring the decryption key of the local database in the program operation process.
6. The method for forensics of trust application data based on reverse analysis according to claim 1, wherein the specific process of the step 4 includes: extracting a ciphertext database of the Wangxin application, wherein the specific path of a database file stored in an internal folder of the mobile phone end is '/data/data/com.alibaba.mobileim/database', the ciphertext database file is named as 'random number wx 4', and the ciphertext database file is extracted to the PC end in an adb mode; secondly, realizing a ciphertext data decryption and restoration process by using the encryption and decryption principle obtained in the step two; and finally, restoring the user communication relation and the local chatting record data of the user with the strong message through the process and the decryption key.
CN202111533548.9A 2021-12-15 2021-12-15 West trust application data evidence obtaining method based on reverse analysis Pending CN114390012A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202111533548.9A CN114390012A (en) 2021-12-15 2021-12-15 West trust application data evidence obtaining method based on reverse analysis

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202111533548.9A CN114390012A (en) 2021-12-15 2021-12-15 West trust application data evidence obtaining method based on reverse analysis

Publications (1)

Publication Number Publication Date
CN114390012A true CN114390012A (en) 2022-04-22

Family

ID=81197128

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202111533548.9A Pending CN114390012A (en) 2021-12-15 2021-12-15 West trust application data evidence obtaining method based on reverse analysis

Country Status (1)

Country Link
CN (1) CN114390012A (en)

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104182541A (en) * 2014-09-05 2014-12-03 四川效率源信息安全技术有限责任公司 Method for showing smart phone data information
CN110096433A (en) * 2019-03-26 2019-08-06 北京邮电大学 The method of encryption data is obtained on a kind of iOS platform
CN110858249A (en) * 2018-08-24 2020-03-03 中移(杭州)信息技术有限公司 Database file encryption method, database file decryption method and related devices
CN111596926A (en) * 2020-04-14 2020-08-28 中国人民解放军战略支援部队信息工程大学 Data evidence obtaining analysis method and device and electronic equipment
CN112580101A (en) * 2020-12-29 2021-03-30 厦门市美亚柏科信息股份有限公司 Data decryption method and terminal
CN112948822A (en) * 2021-03-04 2021-06-11 中电鹰硕(深圳)智慧互联有限公司 Big data audit scene analysis method and system applied to intelligent education system
CN113726945A (en) * 2021-08-03 2021-11-30 贵州电子商务云运营有限责任公司 Cell phone app data automatic acquisition method based on frida framework

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104182541A (en) * 2014-09-05 2014-12-03 四川效率源信息安全技术有限责任公司 Method for showing smart phone data information
CN110858249A (en) * 2018-08-24 2020-03-03 中移(杭州)信息技术有限公司 Database file encryption method, database file decryption method and related devices
CN110096433A (en) * 2019-03-26 2019-08-06 北京邮电大学 The method of encryption data is obtained on a kind of iOS platform
CN111596926A (en) * 2020-04-14 2020-08-28 中国人民解放军战略支援部队信息工程大学 Data evidence obtaining analysis method and device and electronic equipment
CN112580101A (en) * 2020-12-29 2021-03-30 厦门市美亚柏科信息股份有限公司 Data decryption method and terminal
CN112948822A (en) * 2021-03-04 2021-06-11 中电鹰硕(深圳)智慧互联有限公司 Big data audit scene analysis method and system applied to intelligent education system
CN113726945A (en) * 2021-08-03 2021-11-30 贵州电子商务云运营有限责任公司 Cell phone app data automatic acquisition method based on frida framework

Similar Documents

Publication Publication Date Title
Anglano et al. Forensic analysis of the ChatSecure instant messaging application on android smartphones
CN106788995B (en) File encryption method and device
CN101051904B (en) Method for landing by account number cipher for protecting network application sequence
CN112929172A (en) System, method and device for dynamically encrypting data based on key bank
CN104602238A (en) Wireless network connecting method, device and system
CN108809936B (en) Intelligent mobile terminal identity verification method based on hybrid encryption algorithm and implementation system thereof
CN110933063B (en) Data encryption method, data decryption method and equipment
CN111131416A (en) Business service providing method and device, storage medium and electronic device
CN104199657A (en) Call method and device for open platform
CN103414727A (en) Encryption protection system for input password input box and using method thereof
CN105208028A (en) Data transmission method and related device and equipment
CN110061967A (en) Business datum providing method, device, equipment and computer readable storage medium
CN115422570B (en) Data processing method and system for distributed storage
CN110740038A (en) Block chain and communication method, gateway, communication system and storage medium thereof
CN112653556A (en) TOKEN-based micro-service security authentication method, device and storage medium
CN103237011B (en) Digital content encryption transmission method and server end
CN116662941A (en) Information encryption method, device, computer equipment and storage medium
CN111224958A (en) Data transmission method and system
CN114221927A (en) Mail encryption service system and method based on national encryption algorithm
CN113014572A (en) Message communication system, method and device
CN102739719A (en) User information synchronization method and system thereof
CN114390012A (en) West trust application data evidence obtaining method based on reverse analysis
CN116361833A (en) Verification method and device and terminal equipment
KR101329789B1 (en) Encryption Method of Database of Mobile Communication Device
CN109344947A (en) Digital content generation method, two-dimensional code generation method and the recognition methods of two dimensional code

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination