aes-find.c File Reference

#include <rz_search.h>
#include <rz_crypto/rz_aes.h>

Go to the source code of this file.

Macros
#define	AES128_SEARCH_LENGTH   24
#define	AES192_SEARCH_LENGTH   32
#define	AES256_SEARCH_LENGTH   40
#define	AES128_KEY_LENGTH   16
#define	AES192_KEY_LENGTH   24
#define	AES256_KEY_LENGTH   32

Functions
static bool	aes256_key_test (const unsigned char *buf)
static bool	aes192_key_test (const unsigned char *buf)
static bool	aes128_key_test (const unsigned char *buf)
RZ_API int	rz_search_aes_update (RzSearch *s, ut64 from, const ut8 *buf, int len)

Macro Definition Documentation

AES128_KEY_LENGTH

#define AES128_KEY_LENGTH   16

Definition at line 21 of file aes-find.c.

AES128_SEARCH_LENGTH

#define AES128_SEARCH_LENGTH   24

Definition at line 18 of file aes-find.c.

AES192_KEY_LENGTH

#define AES192_KEY_LENGTH   24

Definition at line 22 of file aes-find.c.

AES192_SEARCH_LENGTH

#define AES192_SEARCH_LENGTH   32

Definition at line 19 of file aes-find.c.

AES256_KEY_LENGTH

#define AES256_KEY_LENGTH   32

Definition at line 23 of file aes-find.c.

AES256_SEARCH_LENGTH

#define AES256_SEARCH_LENGTH   40

Definition at line 20 of file aes-find.c.

Function Documentation

aes128_key_test()

static bool aes128_key_test ( const unsigned char *  buf )

static

Definition at line 37 of file aes-find.c.

                                                      {
    bool word1 = buf[16] == (buf[0] ^ Sbox[buf[13]] ^ 1) && buf[17] == (buf[1] ^ Sbox[buf[14]]) && buf[18] == (buf[2] ^ Sbox[buf[15]]) && buf[19] == (buf[3] ^ Sbox[buf[12]]);
    bool word2 = buf[20] == (buf[4] ^ buf[16]) && buf[21] == (buf[5] ^ buf[17]) && buf[22] == (buf[6] ^ buf[18]) && buf[23] == (buf[7] ^ buf[19]);
    return word1 && word2;
}

References Sbox.

Referenced by rz_search_aes_update().

aes192_key_test()

static bool aes192_key_test ( const unsigned char *  buf )

static

Definition at line 31 of file aes-find.c.

                                                      {
    bool word1 = buf[24] == (buf[0] ^ Sbox[buf[21]] ^ 1) && buf[25] == (buf[1] ^ Sbox[buf[22]]) && buf[26] == (buf[2] ^ Sbox[buf[23]]) && buf[27] == (buf[3] ^ Sbox[buf[20]]);
    bool word2 = buf[28] == (buf[4] ^ buf[24]) && buf[29] == (buf[5] ^ buf[25]) && buf[30] == (buf[6] ^ buf[26]) && buf[31] == (buf[7] ^ buf[27]);
    return word1 && word2;
}

References Sbox.

Referenced by rz_search_aes_update().

aes256_key_test()

static bool aes256_key_test ( const unsigned char *  buf )

static

Definition at line 25 of file aes-find.c.

                                                      {
    bool word1 = buf[32] == (buf[0] ^ Sbox[buf[29]] ^ 1) && buf[33] == (buf[1] ^ Sbox[buf[30]]) && buf[34] == (buf[2] ^ Sbox[buf[31]]) && buf[35] == (buf[3] ^ Sbox[buf[28]]);
    bool word2 = (buf[36] == (buf[4] ^ buf[32]) && buf[37] == (buf[5] ^ buf[33]) && buf[38] == (buf[6] ^ buf[34]) && buf[39] == (buf[7] ^ buf[35]));
    return word1 && word2;
}

References Sbox.

Referenced by rz_search_aes_update().

rz_search_aes_update()

RZ_API int rz_search_aes_update	(	RzSearch *	s,
		ut64	from,
		const ut8 *	buf,
		int	len
	)

Definition at line 43 of file aes-find.c.

                                                                                 {
    int i, t, last = len - AES128_SEARCH_LENGTH;
    RzListIter *iter;
    RzSearchKeyword *kw;
    const int old_nhits = s->nhits;
 
    rz_list_foreach (s->kws, iter, kw) {
        if (last >= 0) {
            for (i = 0; i < last; i++) {
                if (aes128_key_test(buf + i)) {
                    kw->keyword_length = AES128_KEY_LENGTH;
                    t = rz_search_hit_new(s, kw, from + i);
                    if (!t) {
                        return -1;
                    }
                    if (t > 1) {
                        return s->nhits - old_nhits;
                    }
                    i += AES128_SEARCH_LENGTH;
                }
                if (len - i - AES192_SEARCH_LENGTH >= 0 && aes192_key_test(buf + i)) {
                    kw->keyword_length = AES192_KEY_LENGTH;
                    t = rz_search_hit_new(s, kw, from + i);
                    if (!t) {
                        return -1;
                    }
                    if (t > 1) {
                        return s->nhits - old_nhits;
                    }
                    i = i + AES192_SEARCH_LENGTH;
                }
                if (len - i - AES256_SEARCH_LENGTH >= 0 && aes256_key_test(buf + i)) {
                    kw->keyword_length = AES256_KEY_LENGTH;
                    t = rz_search_hit_new(s, kw, from + i);
                    if (!t) {
                        return -1;
                    }
                    if (t > 1) {
                        return s->nhits - old_nhits;
                    }
                    i = i + AES256_SEARCH_LENGTH;
                }
            }
        }
    }
    return -1;
}

References AES128_KEY_LENGTH, aes128_key_test(), AES128_SEARCH_LENGTH, AES192_KEY_LENGTH, aes192_key_test(), AES192_SEARCH_LENGTH, AES256_KEY_LENGTH, aes256_key_test(), AES256_SEARCH_LENGTH, from, i, rz_search_keyword_t::keyword_length, len, rz_search_hit_new(), and s.

Referenced by rz_search_set_mode().