0
0

flutter 加密安全

前言：数据安全
  1.     数据的**加密解密操**作在 日常网络交互中经常会用到，**现在密码的安全主要在于**** 秘钥的安全****，如论 DES 3DES  AES 还是 RSA, 秘钥的算法（****计算秘钥不固定****） 和 保存，都决定了你的数据安全；但是常见的逆向操作 ** 比如 **hook 加密算法**都很容易拿到 秘钥； 这个时候我们可以 **回溯到 之前的 古典密码学**（**依赖算法本身**），基本思路 ** 置换 移位 编码** 等等手段 来配合 **加密算法一起使用，提高我们应用的安全**；

密码学概论_在传统的密码学中,加解密基础操作包括移位置换替换编码-CSDN博客文章浏览阅读201次。密码学基础_在传统的密码学中,加解密基础操作包括移位置换替换编码https://blog.csdn.net/nicepainkiller/article/details/132978492?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522170902384916777224453245%2522%252C%2522scm%2522%253A%252220140713.130102334.pc%255Fblog.%2522%257D&request_id=170902384916777224453245&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~blog~first_rank_ecpm_v1~rank_v31_ecpm-1-132978492-null-null.nonecase&utm_term=%E5%AF%86%E7%A0%81&spm=1018.2226.3001.4450

android frida 逆向 自吐加密算法_frida 自吐算法 教程-CSDN博客文章浏览阅读1.8k次。frida hook android Android 逆向神器_frida 自吐算法 教程https://blog.csdn.net/nicepainkiller/article/details/132554698?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522170902437216800182198144%2522%252C%2522scm%2522%253A%252220140713.130102334.pc%255Fblog.%2522%257D&request_id=170902437216800182198144&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~blog~first_rank_ecpm_v1~rank_v31_ecpm-1-132554698-null-null.nonecase&utm_term=hook&spm=1018.2226.3001.4450

flutter 数据加密

如果是 android 原生应用，可以 hook 系统加密代码，来获取加密秘钥，而在 flutter 中，dart 是被直接编译为 .so 文件，也就是汇编，对于低级汇编语言 可读性大大降低。当然也是可以下断点动态调试的；但是相对于难度 大大增加，我们可以结合 古典密码学 主要特点 数据安全基于算法的保密，算法不公开， 设计繁琐的算法过程，增加汇编可读性难度；

有个业务需求是：相当于是一个签到功能，每天可以领取，这里防止脚本调用使用两层 基于算法加密 和 AES加密 相结合的方式；（当然还用到了第三方的的安全软件）

以下是我上个版本加密算法设计：整体思路就是：

  • 按照规则 移动字符 替换字符
  • 阶段一主要是 按规则打乱字符（密文）位置
  • 阶段二主要是 指定位置（密文）插入无关字符

match_request_data.dart

  1. import 'dart:convert';
  2. import 'package:crypto/crypto.dart';
  3. import 'package:encrypt/encrypt.dart' as encrypt;
  5. ///匹配接口加密工具类
  6. ///整体加密思路：按照规则 移动字符 替换字符
  7. ///阶段一主要是 按规则打乱字符位置
  8. ///阶段二主要是 指定位置插入无关字符
  9. class MatchRequestData {
  10.   final String gameId;
  11.   final String chatSign;
  12.   final String nickName;
  13.   late List<int> _gameIdSort;
  14.   MatchRequestData(
  15.       {required this.gameId, required this.chatSign, required this.nickName});
  17.   String generateCode(String datum) {
  18.     String idStr = '${int.parse(gameId)}';
  19.     List<int> searchKeywords =
  20.         List<int>.generate(idStr.length, (index) => int.parse(idStr[index]));
  21.     searchKeywords.sort();
  22.     _gameIdSort = searchKeywords;
  24.     String base64 = _encodeBase64(datum);
  25.     String base64Step0 =
  26.         base64.substring(0, _gameIdSort[_gameIdSort.length - 1]) +
  27.             _stepOne((base64.substring(
  28.                 _gameIdSort[_gameIdSort.length - 1],
  29.                 base64.length -
  30.                     _gameIdSort[3] -
  31.                     _gameIdSort[_gameIdSort.length - 1]))) +
  32.             base64.substring(base64.length -
  33.                 _gameIdSort[3] -
  34.                 _gameIdSort[_gameIdSort.length - 1]);
  36.     String _strHex = _strToHex(base64Step0);
  37.     final key = encrypt.Key.fromUtf8(_generateMd5(chatSign + nickName));
  38.     final iv = encrypt.IV.fromUtf8(_ivStepOne().substring(4, 20).toUpperCase());
  39.     final encrypter =
  40.         encrypt.Encrypter(encrypt.AES(key, mode: encrypt.AESMode.cbc));
  41.     final encrypted = encrypter.encrypt(_strHex, iv: iv);
  42.     final encryptCode = _stepTwo(encrypted.base64);
  43.     idStr = _strHex = base64 = base64Step0 = '';
  44.     return encryptCode;
  45.   }
  47.   String _stepOne(String str) {
  48.     String res = '';
  49.     str = _inverse(str);
  50.     int lastPosition = _gameIdSort[_gameIdSort.length - 1];
  51.     int count = 0;
  52.     if (lastPosition % 2 == 0) {
  53.       count = _gameIdSort[_gameIdSort.length - 2];
  54.     } else {
  55.       count = _gameIdSort[_gameIdSort.length - 3];
  56.     }
  57.     if (count == 0) {
  58.       count = lastPosition;
  59.     }
  60.     int step = str.length ~/ count;
  61.     List<String> base64Parts = [];
  62.     for (int i = 0; i < count; i++) {
  63.       if (i % 2 == 1) {
  64.         base64Parts.add(_inverse(str.substring(step * i, step * (i + 1))));
  65.       } else {
  66.         base64Parts.add(str.substring(step * i, step * (i + 1)));
  67.       }
  68.     }
  69.     if (step * count < str.length) {
  70.       if (lastPosition % 2 == 0) {
  71.         base64Parts.insert(0, str.substring(step * count));
  72.       } else {
  73.         base64Parts.insert(base64Parts.length, str.substring(step * count));
  74.       }
  75.     }
  76.     if (lastPosition % 2 == 1) {
  77.       for (int i = 0; i < base64Parts.length; i++) {
  78.         res = res + base64Parts[i];
  79.       }
  80.     } else {
  81.       for (int i = base64Parts.length - 1; i >= 0; i--) {
  82.         res = res + base64Parts[i];
  83.       }
  84.     }
  85.     str = '';
  86.     lastPosition = count = step = -1;
  87.     return res;
  88.   }
  90.   String _stepTwo(String data) {
  91.     String res = "";
  92.     String _strHex = _strToHex(data);
  93.     String _code = _inverse(_strHex);
  94.     final key = encrypt.Key.fromUtf8(_generateMd5(gameId + chatSign));
  95.     final iv = encrypt.IV.fromUtf8(_ivStepTwo().substring(14, 30));
  96.     final encrypter =
  97.         encrypt.Encrypter(encrypt.AES(key, mode: encrypt.AESMode.cbc));
  98.     final encrypted = encrypter.encrypt(_code, iv: iv);
  99.     res = encrypted.base64;
  100.     int maxLength = res.length;
  102.     int indexSub = 0;
  103.     int insertPos = 0;
  104.     String insertStr = '';
  105.     for (int i = 1; i < _gameIdSort.length; i++) {
  106.       indexSub = _gameIdSort[i] + 1;
  107.       insertPos = _magic(indexSub + i) + i * 11 + i - 1;
  108.       // insertStr = chatSign.substring(1,indexSub);
  109.       insertStr = chatSign[indexSub];
  110.       //前面插入
  111.       if (insertPos > res.length) {
  112.         insertPos = maxLength;
  113.       }
  114.       res =
  115.           '${res.substring(0, insertPos)}$insertStr${res.substring(insertPos)}';
  116.     }
  117.     _strHex = _code = '';
  118.     return res;
  119.   }
  121.   String _stepThree(String str) {
  122.     return str;
  123.   }
  125.   String _inverse(String tag) {
  126.     String res = '';
  127.     List<String> searchKeywords =
  128.         List<String>.generate(tag.length, (index) => tag[index]);
  129.     Iterable<String> array = searchKeywords.reversed;
  130.     for (var e in array) {
  131.       res = '$res$e';
  132.     }
  133.     return res;
  134.   }
  136.   String _ivStepOne() {
  137.     String res = '';
  138.     String map = _generateMd5(chatSign) + _generateMd5(nickName);
  139.     int index = _gameIdSort[_gameIdSort.length - 2];
  140.     while (res.length < 50) {
  141.       res += map[index];
  142.       index++;
  143.     }
  144.     index = 0;
  145.     return res;
  146.   }
  148.   String _ivStepTwo() {
  149.     String res = '';
  150.     String map = _generateMd5(_inverse(chatSign)) + _generateMd5(chatSign);
  151.     int index = _gameIdSort[_gameIdSort.length - 1];
  152.     while (res.length < 50) {
  153.       res += map[index];
  154.       index++;
  155.     }
  156.     index = 0;
  157.     return _inverse(res);
  158.   }
  160.   /// 字符串转 十六进制
  161.   String _strToHex(String str) {
  162.     List<int> charCodes = str.runes.toList();
  163.     return charCodes.map((code) => code.toRadixString(16)).join('');
  164.   }
  166.   /// 字符串转 base64
  167.   String _encodeBase64(String data) {
  168.     return base64Encode(utf8.encode(data));
  169.   }
  171.   /// base64转 普通字符
  172.   String _decodeBase64(String data) {
  173.     return String.fromCharCodes(base64Decode(data));
  174.   }
  176.   String _generateMd5(String str) {
  177.     return md5.convert(utf8.encode(str)).toString();
  178.   }
  180.   int _magic(int num) {
  181.     if (num < 3) {
  182.       return 1;
  183.     } else {
  184.       return _magic(num - 1) + _magic(num - 2);
  185.     }
  186.   }
  187. }

调用的地方：

  1. MatchRequestData data = MatchRequestData (
  2.   gameId: userArray[i]['gameID'],
  3.   chatSign: userArray[i]['chatSign'],
  4.   nickName: userArray[i]['nickName'],
  5. );
  7. //需要传递给后台的 内容
  8. Map datum = {
  9.   'inTrust': 'TRUE',
  10.   'time': DateTime.now().millisecondsSinceEpoch,
  11.   'GameID': userArray[i]['gameID'],
  12.   'nickName': userArray[i]['nickName'],
  13.   'MachineCode':
  14.       md5.convert(utf8.encode(userArray[i]['gameID'])).toString(),
  15.   'sign': md5
  16.       .convert(
  17.           utf8.encode(userArray[i]['gameID'] + userArray[i]['chatSign']))
  18.       .toString(),
  19. };
  22. String res = data.generateCode(jsonEncode(datum));
  23.
服务端的数据解密：

服务端为 .net 框架：

对应于加密算法写的解密算法：

  1. using System;
  2. using System.Collections.Generic;
  3. using System.Security.Cryptography;
  4. using System.Text;
  6. namespace ToMatch
  7. {
  8.     public class MatchEncrypt
  9.     {
  10.         private string gameID;
  11.         private string chatSign;
  12.         private string nickName;
  13.         private List<int> idSort;
  15.         /// <summary>
  16.         /// 匹配构造函数
  17.         /// </summary>
  18.         /// <param name="gameId">GameID</param>
  19.         /// <param name="chatSign">签名</param>
  20.         /// <param name="nickName">昵称</param>
  21.         public MatchEncrypt(string gameId, string chatSign, string nickName) {
  22.             this.gameID = gameId;
  23.             this.chatSign = chatSign;
  24.             this.nickName = nickName;
  26.             this.idSort = new List<int>();
  27.             string idStr = int.Parse(this.gameID).ToString();
  28.             for (int i = 0; i < idStr.Length; i++)
  29.             {
  30.                 this.idSort.Add((int)Char.GetNumericValue(idStr[i]));
  31.             }
  32.             this.idSort.Sort();
  33.         }
  38.         private String IvStepOne {
  39.             get {
  40.                 String res = "";
  41.                 String map = Md5Hash(chatSign) + Md5Hash(nickName);
  42.                 int index = idSort[idSort.Count - 2];
  43.                 while (res.Length < 50)
  44.                 {
  45.                     res += map[index];
  46.                     index++;
  47.                 }
  48.                 return res;
  49.             }
  50.         }
  52.         private String IvStepTwo
  53.         {
  54.             get
  55.             {
  56.                 String res = "";
  57.                 String map = Md5Hash(AESHelper.Inverse(chatSign),false) + Md5Hash(chatSign,false);
  58.                 int index = idSort[idSort.Count - 1];
  59.                 while (res.Length < 50)
  60.                 {
  61.                     res += map[index];
  62.                     index++;
  63.                 }
  64.                 return AESHelper.Inverse(res);
  65.             }
  66.         }
  69.         /// <summary>
  70.         /// 解密客户端内容
  71.         /// </summary>
  72.         /// <param name="code">密文</param>
  73.         /// <returns></returns>
  74.         public string Resolver(string code) {
  76.             //第一阶段解密内容
  77.             string resStepOne = StepOne(code);
  79.             if (resStepOne.Length > 0)
  80.             {
  81.                 //Console.WriteLine("第一解密 result:" + resStepOne);
  82.                 //第二阶段解密
  83.                 string resSteptwo = Steptwo(resStepOne);
  84.                 //Console.WriteLine("第二解密 result:" + resSteptwo);
  85.                 //Console.WriteLine(AESHelper.FromBase64(resSteptwo));
  86.                 if (resSteptwo.Length > 0)
  87.                 {
  88.                     return AESHelper.FromBase64(resSteptwo);
  89.                 }
  90.                 else 
  91.                 {
  92.                     return "解密失败——请记录日志.Step-2";
  93.                 }       
  94.             }
  95.             else {
  96.                 return "解密失败——请记录日志.Step-1";
  97.             }            
  98.         }
  101.         private string StepOne(string code)
  102.         {
  103.             // 1.先移除插入的字符
  104.             // 2.再进行解密操作
  105.             int maxlength = code.Length - idSort.Count - 1;
  106.             int indexSub = 0;
  107.             int insertPos = 0;
  108.    
  109.             for (int i = 1; i < idSort.Count; i++)
  110.             {
  111.                 indexSub = idSort[i] + 1;
  112.                 insertPos = magic(indexSub + i) + i * 11;    
  113.                 //前面插入
  114.                 //Console.WriteLine("前面    索引:" + i);
  115.                 //Console.WriteLine("前面插入位置:" + insertPos);
  116.                 //Console.WriteLine("前面插入字符:" + insertStr + "");
  117.   
  118.                 if (insertPos > code.Length) {
  119.                     //Console.WriteLine("修正Length:" + code.Length);
  120.                     Console.WriteLine("修正insertPos:" + insertPos);
  121.                     //Console.WriteLine("----code.Length:" + (code.Length -maxlength  ));
  122.                     //Console.WriteLine("----code.Length:" + (  idSort.Count-1 - i));
  123.                     //Console.WriteLine("----code.Length:" + ((code.Length - maxlength - (idSort.Count - 1 - i))+1));
  124.                     insertPos = maxlength -4;
  125.                     insertPos = maxlength - ((code.Length - maxlength - (idSort.Count - 1 - i)) + 1);
  126.                     //Console.WriteLine("*******code.Length:" + ((code.Length - maxlength - (idSort.Count - 1 - i)) + 1));
  127.                     //Console.WriteLine("*******code.Length:" + (code.Length - maxlength - (idSort.Count - i)) );
  128.                     //Console.WriteLine("*******code.Length:" + (code.Length - maxlength - idSort.Count  - i ));
  129.                     //Console.WriteLine("code.Length:" + code.Length);
  130.                     //Console.WriteLine("maxlength:" + maxlength);
  131.                     //Console.WriteLine("idSort.Count:" + idSort.Count);
  132.                     //Console.WriteLine("idSort.Count - i:" + (idSort.Count - i));
  133.                     //Console.WriteLine("修正插入位置i:" + i);
  134.                     //Console.WriteLine("修正插入位置:" + insertPos);
  135.                     insertPos = maxlength - ((code.Length - maxlength - (idSort.Count - 1 - i)) + 1);
  136.                 }              
  137.                 code = code.Substring(0, insertPos) + code.Substring(insertPos + 1);
  138.             }
  140.             //Console.WriteLine("整理后的:" + code);
  141.             //Console.WriteLine("整理后的Length:" + code.Length);
  142.             string key = Md5Hash(this.gameID + this.chatSign, false);
  143.             string iv = IvStepTwo.Substring(14, 16);
  145.             //第一次解密是 16进制字符串
  146.             string result = AESHelper.Decrypt(code, key, iv);
  147.             return AESHelper.HexStringToString(AESHelper.Inverse(result), Encoding.UTF8);
  148.         }
  150.         private string Steptwo(string code) {
  152.             string key = Md5Hash(this.chatSign + this.nickName, false);
  153.             string iv = IvStepOne.Substring(4, 16);
  155.       
  157.             string base64 = AESHelper.HexStringToString(AESHelper.Decrypt(code, key, iv), Encoding.UTF8);
  158.             
  159.             string source = base64.Substring(0, idSort[idSort.Count - 1]) + generateMid(base64.Substring(idSort[idSort.Count - 1], base64.Length - idSort[3] - idSort[idSort.Count - 1] * 2)) + base64.Substring(base64.Length - idSort[3] - idSort[idSort.Count - 1]);
  161.             //第二次解密是 base64
  162.             return source ;
  163.         }
  166.         private string generateMid(string str) {
  168.             string res = "";
  169.             List<String> base64Parts = new List<string>();
  170.             int lastPosition = this.idSort[this.idSort.Count - 1];
  171.             string subBefore = "";
  172.             int count = 0;
  173.             if (lastPosition % 2 == 0)
  174.             {
  175.                 count = idSort[idSort.Count - 2];
  176.             }
  177.             else
  178.             {
  179.                 count = idSort[idSort.Count - 3];
  180.             }
  181.             if (count == 0) {
  182.                 count = lastPosition;
  183.             }
  184.             int step = str.Length / count;
  186.             int subLength = str.Length - step * count;
  188.             if (lastPosition % 2 == 0)
  189.             {
  190.                 for (int i = 0; i < count; i++)
  191.                 {
  192.                     if (i % 2 == 1)
  193.                     {
  194.                         base64Parts.Add(AESHelper.Inverse(str.Substring(step * (count - i - 1), step)));
  195.                     }
  196.                     else
  197.                     {
  198.                         //base64Parts.Add(v.Substring(step * i, step));
  199.                         //Console.WriteLine(i + "不需要翻转原始：" + str.Substring(step * (count - i - 1), step));
  200.                         base64Parts.Add(str.Substring(step * (count - i - 1), step));
  201.                     }
  202.                 }
  204.                 for (int i = 0; i < base64Parts.Count; i++)
  205.                 {
  206.                     //Console.WriteLine("偶数项目：" + i + " " + base64Parts[i]);
  207.                     res = res + base64Parts[i];
  208.                 }
  209.                 subBefore = str.Substring(step * count);
  210.                 res += subBefore;
  211.             }
  212.             else
  213.             {
  214.                 for (int i = 0; i < count; i++)
  215.                 {
  216.                     if (i % 2 == 1)
  217.                     {
  218.                         base64Parts.Add(AESHelper.Inverse(str.Substring(step * i, step)));          
  219.                     }
  220.                     else
  221.                     {
  222.                         base64Parts.Add(str.Substring(step * i, step));
  223.                     }
  224.                 }
  225.                 subBefore = str.Substring(step * count);
  226.                 base64Parts.Add(subBefore);
  227.                 for (int i = 0; i < base64Parts.Count; i++)
  228.                 {
  229.                     //Console.WriteLine("奇数项目：" + i + " " + base64Parts[i]);
  230.                     res = res + base64Parts[i];
  231.                 }
  232.             }
  234.             return AESHelper.Inverse(res);
  235.         }
  237.         private static int magic(int num)
  238.         {
  240.             if (num < 3)
  241.             {
  242.                 return 1;
  243.             }
  244.             else
  245.             {
  246.                 return magic(num - 1) + magic(num - 2);
  247.             }
  248.         }
  250.         private string Md5Hash(string sourceText, bool toUpper = true)
  251.         {
  252.             StringBuilder result = new StringBuilder();
  253.             using (MD5 md5 = new MD5CryptoServiceProvider())
  254.             {
  255.                 byte[] data = md5.ComputeHash(Encoding.UTF8.GetBytes(sourceText));
  256.                 if (toUpper)
  257.                     for (int i = 0; i < data.Length; i++)
  258.                         result.Append(data[i].ToString("X2"));
  259.                 else
  260.                     for (int i = 0; i < data.Length; i++)
  261.                         result.Append(data[i].ToString("x2"));
  262.             }
  263.             return result.ToString();
  264.         }
  265.     }
  266. }
总结

数据安全不是绝对的，只能说我们多设置些障碍，对于逆向的难度对增大，你挖的坑多远。逆向时候就越困难，当然也可以借助一些第三方安全软件来增加我们数据的安全性。在数据安全的道路上 始终是此消彼长的状态

标签： 安全 flutter 数据安全
本文转载自: https://blog.csdn.net/nicepainkiller/article/details/136326876
版权归原作者 坎大哈 所有， 如有侵权，请联系我们删除。
登录后发布评论

“flutter 加密安全”的评论:

还没有评论
关于作者
...
overfit同步小助手
文章同步
相关阅读

网络安全法-网络运行安全

使用selenium/drissionpage时如何阻止chrome自动跳转http到https

docker desktop 里部署的Open WebUI 管理员密码忘记了的处理方法

在ubuntu20.04中搭建onsite比赛运行环境

利用开源的低代码表单设计器FcDesigner高效管理和渲染复杂表单结构

Kafka学习笔记

【前端】浏览器输入url到页面呈现发生了什么？

文章导航
没有找到文章内容分段。。。