最右Sign算法分析#

1
Logger.getLogger(DalvikVM64.class).setLevel(Level.DEBUG);

1
emulator.traceWrite(0x4041e2f0, 0x4041E312);

1
public void hookMemcpy() {
2
        Debugger debugger = emulator.attach();
3
        debugger.addBreakPoint(module.findSymbolByName("memcpy").getAddress(), (emulator, address) -> {
4
            RegisterContext context = emulator.getContext();
5
            UnidbgPointer arg0 = context.getPointerArg(0);
6
            UnidbgPointer arg1 = context.getPointerArg(1);
7
            int arg2 = context.getIntArg(2);
8
            Inspector.inspect(
9
                    arg1.getByteArray(0, arg2),
10
                    "memcpy" + " 写入地址 " + "0x" + Long.toHexString(arg0.peer) + " 读取地址 " + "0x" + Long.toHexString(arg1.peer)
11
            );
12
            return true;
13
        });
14
    }

1
emulator.traceWrite(0x4041e2c0, 0x4041e2e2);

1
void *__usercall sub_30C94@<X0>(unsigned __int8 *a1@<X0>, _QWORD *n1228256393@<X8>)
2
{
3
  void *n1228256393_1; // x0
4
  const void *v5; // x21
5
  void *v6; // x22
6
  int n1554935301; // w25
7
  int n1554935301_1; // w9
8
  signed __int64 v9; // x8
9
  int n1554935301_2; // w10
10
  bool v11; // zf
11
  signed __int64 v12; // x8
12
  size_t v13; // x23
13
  int n1466722806; // w27
14
  int n1466722806_1; // w9
15
  int n1466722806_2; // w8
16
  __int64 v17; // x8
17
  __int64 n32; // x9
18
  unsigned int v19; // t1
19
  __int64 v20; // x13
20
  __int64 v21; // x14
21

22
  _ReadStatusReg(TPIDR_EL0);
23
  n1228256393[4] = n1228256393;
24
  n1228256393[5] = n1228256393;
25
  n1228256393_1 = n1228256393;
26
  if ( (int)n1228256393 <= 1228256393 && (_DWORD)n1228256393 != 1059521444 )
27
    std::__stl_throw_length_error(&byte_9B5F4);
28
  *(_BYTE *)n1228256393 = 0;
29
  if ( n1228256393[4] - n1228256393[5] > 0x1Fu )
30
  {
31
    v5 = (const void *)n1228256393[4];
32
    v6 = (void *)(n1228256393[5] + 32LL);
33
    if ( v6 == v5 )
34
      n1554935301 = -1086414335;
35
    else
36
      n1554935301 = 1554935301;
37
    n1554935301_1 = -666440926;
38
    v9 = n1228256393[4];
39
    while ( 1 )
40
    {
41
      do
42
      {
43
        n1554935301_2 = n1554935301_1;
44
        v11 = n1554935301_1 == -666440926;
45
        n1554935301_1 = n1554935301;
46
      }
47
      while ( v11 );
48
      if ( n1554935301_2 == -1086414335 )
49
        break;
50
      if ( n1554935301_2 != 1554935301 )
51
      {
52
        while ( 1 )
53
          ;
54
      }
55
      v12 = v9 - (_QWORD)v5;
56
      v13 = v12 + 1;
57
      if ( v12 == -1 )
58
        n1466722806 = -2068670317;
59
      else
60
        n1466722806 = 1466722806;
61
      for ( n1466722806_1 = -2093236247; ; n1466722806_1 = -2068670317 )
62
      {
63
        do
64
        {
65
          n1466722806_2 = n1466722806_1;
66
          v11 = n1466722806_1 == -2093236247;
67
          n1466722806_1 = n1466722806;
68
        }
69
        while ( v11 );
70
        if ( n1466722806_2 != 1466722806 )
71
          break;
72
        n1228256393_1 = memmove(v6, v5, v13);
73
      }
74
      if ( n1466722806_2 != -2068670317 )
75
      {
76
        while ( 1 )
77
          ;
78
      }
79
      v9 = n1228256393[4] + (_BYTE *)v6 - (_BYTE *)v5;
80
      n1228256393[4] = v9;
81
      n1554935301_1 = -1086414335;
82
    }
83
  }
84
  else
85
  {
86
    n1228256393_1 = (void *)sub_311F4(
87
                              (int)n1228256393,
88
                              -669595639 - *((_DWORD *)n1228256393 + 8) + *((_DWORD *)n1228256393 + 10) + 669595671,
89
                              0);
90
  }
91
  v17 = 0;
92
  // 主要看这部分 a567def8901234a 是个表:
93
  // .rodata:000000000006D680 a567def8901234a DCB "567def8901234abc",0
94
  // =================================================
95
  for ( n32 = 0; n32 != 32; n32 += 2 )
96
  {
97
    v19 = *a1++;
98
    ++v17;
99
    *(_BYTE *)(n1228256393[5] + n32) = a567def8901234a[(unsigned __int64)v19 >> 4];
100
    v20 = n32 & 1;
101
    v21 = n32 ^ 1;
102
    *(_BYTE *)(n1228256393[5] + (v20 | v21)) = a567def8901234a[v19 & 0xF];
103
  }
104
  // =================================================
105
  _ReadStatusReg(TPIDR_EL0);
106
  return n1228256393_1;
107
}

1
emulator.attach().addBreakPoint(module.base + 0x30C94);

1
public static String byteHEX(byte ib) {
2
        /*char[] Digit = { '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f' };*/
3
        char[] Digit = "567def8901234abc".toCharArray();
4
        char[] ob = new char[2];
5
        ob[0] = Digit[(ib >>> 4) & 0X0F];
6
        ob[1] = Digit[ib & 0X0F];
7
        String s = new String(ob);
8
        return s;
9
    }

1
emulator.traceWrite(0xbffff5a8L, 0xbffff5c7L);

1
[12:56:55 035] Memory WRITE at 0xbffff5a8, data size = 8, data value = 0xae3e838fd856ea2f, PC=RX@0x40030c0c[libnet_crypto.so]0x30c0c, LR=RX@0x40030b68[libnet_crypto.so]0x30b68
2
[12:56:55 035] Memory WRITE at 0xbffff5b0, data size = 8, data value = 0x81a0a257f98afdb5, PC=RX@0x40030c0c[libnet_crypto.so]0x30c0c, LR=RX@0x40030b68[libnet_crypto.so]0x30b68
3
[12:56:55 038] Memory WRITE at 0xbffff5a8, data size = 8, data value = 0x0000000000000000, PC=RX@0x400194fc[libnet_crypto.so]0x194fc, LR=RX@0x40018ad8[libnet_crypto.so]0x18ad8
4
[12:56:55 038] Memory WRITE at 0xbffff5b0, data size = 8, data value = 0x00000000383e5149, PC=RX@0x40019500[libnet_crypto.so]0x19500, LR=RX@0x40018ad8[libnet_crypto.so]0x18ad8
5
[12:56:55 038] Memory WRITE at 0xbffff5b8, data size = 8, data value = 0x0000000000000000, PC=RX@0x40019500[libnet_crypto.so]0x19500, LR=RX@0x40018ad8[libnet_crypto.so]0x18ad8
6
[12:56:55 038] Memory WRITE at 0xbffff5c0, data size = 8, data value = 0x000000004041e190, PC=RX@0x40019504[libnet_crypto.so]0x19504, LR=RX@0x40018ad8[libnet_crypto.so]0x18ad8

1
void *__fastcall sub_30850(_OWORD *a1, char *a2)
2
{
3
  __int64 v2; // x8
4
  int v3; // w23
5
  char *v4; // x10
6
  int n16; // w8
7
  int v6; // w9
8
  unsigned __int8 *v7; // x10
9
  int v8; // w11
10
  int n1216331821; // w11
11
  int n14; // w10
12
  int v11; // w8
13
  unsigned __int8 *v12; // x14
14
  int v13; // w15
15
  int v14; // w17
16
  int v15; // w10
17
  int n1216331821_1; // w15
18
  unsigned __int8 *v17; // x8
19
  int n4; // w9
20
  int v19; // w10
21
  char *v23; // [xsp+10h] [xbp-80h]
22
  _DWORD *v24; // [xsp+18h] [xbp-78h]
23
  char *v25; // [xsp+20h] [xbp-70h]
24
  _QWORD *v26; // [xsp+28h] [xbp-68h]
25
  void *v27; // [xsp+30h] [xbp-60h]
26
  unsigned int n8; // [xsp+3Ch] [xbp-54h]
27

28
  v23 = a2 + 16;
29
  v24 = a2 + 16;
30
  v25 = a2 + 24;
31
  v2 = ((*((_DWORD *)a2 + 4) >> 3) ^ 0x1FFFFFC0u) & (*((_DWORD *)a2 + 4) >> 3);
32
  v26 = a2 + 24;
33
  v3 = -931151827;
34
  v4 = &a2[v2 + 24];
35
  v27 = v4 + 1;
36
  *v4 = 0x80;
37
  n8 = v2 ^ 0x3F;
38
  if ( n8 >= 8 )
39
  {
40
    memset(v27, 0, n8 - 8);
41
  }
42
  else
43
  {
44
    memset(v27, 0, n8);
45
    n16 = 16;
46
    v6 = -15;
47
    v7 = (unsigned __int8 *)v26 + 1;
48
    v8 = -931151827;
49
    while ( 1 )
50
    {
51
      n1216331821 = v8 & 0x7FFFFFFF;
52
      if ( n1216331821 != 1216331821 )
53
        break;
54
      --n16;
55
      if ( v6 )
56
        v8 = -931151827;
57
      else
58
        v8 = -1953395755;
59
      *(_DWORD *)(v7 - 1) = (*(v7 - 1) | (*v7 << 8)) ^ 0x3CB3DB4F ^ ((v7[1] | (v7[2] << 8)) << 16) ^ 0x3CB3DB4F;
60
      v7 += 4;
61
      ++v6;
62
    }
63
    if ( n1216331821 != 194087893 )
64
    {
65
      while ( 1 )
66
        ;
67
    }
68
    sub_2E08C(a2, v26);
69
    v26[5] = 0;
70
    v26[6] = 0;
71
    v26[3] = 0;
72
    v26[4] = 0;
73
    v26[1] = 0;
74
    v26[2] = 0;
75
    *v26 = 0;
76
  }
77
  n14 = 14;
78
  v11 = -13;
79
  v12 = (unsigned __int8 *)v26 + 1;
80
  v13 = -931151827;
81
  while ( 1 )
82
  {
83
    n1216331821_1 = v13 & 0x7FFFFFFF;
84
    if ( n1216331821_1 != 1216331821 )
85
      break;
86
    v15 = n14 + 1683802602;
87
    if ( v11 )
88
      v13 = -931151827;
89
    else
90
      v13 = -1953395755;
91
    n14 = v15 - 1683802603;
92
    v14 = (v12[1] | (v12[2] << 8)) << 16;
93
    *(_DWORD *)(v12 - 1) = (*v12 << 8) ^ 0xD8724FCC ^ *(v12 - 1) ^ 0xD8724FCC ^ 0x11287F8 ^ v14 ^ 0x11287F8
94
                         | ~((*v12 << 8) ^ 0xD8724FCC ^ ~(*(v12 - 1) ^ 0xD8724FCC) | ~v14);
95
    v12 += 4;
96
    ++v11;
97
  }
98
  if ( n1216331821_1 != 194087893 )
99
  {
100
    while ( 1 )
101
      ;
102
  }
103
  *((_DWORD *)v25 + 14) = *v24;
104
  *((_DWORD *)v25 + 15) = *((_DWORD *)v23 + 1);
105
  sub_2E08C(a2, v26);
106
  v17 = (unsigned __int8 *)(a2 + 1);
107
  n4 = 4;
108
  v19 = -3;
109
  while ( (v3 & 0x7FFFFFFF) == 0x487FC02D )
110
  {
111
    --n4;
112
    if ( v19 )
113
      v3 = -931151827;
114
    else
115
      v3 = -1953395755;
116
    *(_DWORD *)(v17 - 1) = (unsigned __int16)(*(v17 - 1) | (*v17 << 8))
117
                         | (((unsigned __int16)(v17[2] << 8) ^ 0x9DB8 ^ v17[1] ^ 0x9DB8) << 16);
118
    v17 += 4;
119
    ++v19;
120
  }
121
  if ( (v3 & 0x7FFFFFFF) != 0xB918BD5 )
122
  {
123
    while ( 1 )
124
      ;
125
  }
126
  *a1 = *(_OWORD *)a2;
127
  return memset(a2, 0, 0x58u);
128
}

1
  v319 = *a1;
2
  v315 = a1[3];
3
  v316 = a1[1];
4
  v317 = a1[2];
5
.................
6
    v24 = v319
7
      - 680876936
8
      + *a2
9
      + (v315 & (v315 ^ 0x1FE328B9 ^ ~(v317 ^ 0x1FE328B9) | ~v316)
10
       | ~(v315 ^ 0x1FE328B9 ^ ~(v317 ^ 0x1FE328B9) | ~v316) & ~v315);
11
  v25 = ((v24 << 7) ^ 0x87CDF640 ^ (v24 >> 25) ^ 0x87CDF640) + v316;
12
  v26 = v16 - 176418897 + v25;
13
  v27 = (v317 & (~v25 | ~(v317 ^ 0x1C9A5715 ^ v316 ^ 0x1C9A5715))
14
       | ~(~v25 | ~(v317 ^ 0x1C9A5715 ^ v316 ^ 0x1C9A5715)) & ~v317)
15
      - (-v8
16
       - (v315
17
        - 389564586));
18
..................

1
state[0] = 0x67552301L;
2
state[1] = 0xEDCDAB89L;
3
state[2] = 0x98BADEFEL;
4
state[3] = 0x16325476L;

1
package com.yuuki.zuiyou;
2

3
import com.github.unidbg.AndroidEmulator;
4
import com.github.unidbg.Emulator;
5
import com.github.unidbg.Module;
6
import com.github.unidbg.arm.backend.Unicorn2Factory;
7
import com.github.unidbg.arm.context.RegisterContext;
8
import com.github.unidbg.debugger.BreakPointCallback;
9
import com.github.unidbg.debugger.Debugger;
10
import com.github.unidbg.hook.hookzz.*;
11
import com.github.unidbg.linux.android.AndroidEmulatorBuilder;
12
import com.github.unidbg.linux.android.AndroidResolver;
13
import com.github.unidbg.linux.android.dvm.*;
14
import com.github.unidbg.memory.Memory;
15
import com.github.unidbg.pointer.UnidbgPointer;
16
import com.github.unidbg.utils.Inspector;
17
import com.github.unidbg.virtualmodule.android.AndroidModule;
18
import org.apache.log4j.Level;
19
import org.apache.log4j.Logger;
20

21
import java.io.File;
22
import java.io.PrintStream;
23
import java.nio.charset.StandardCharsets;
24
import java.nio.file.Files;
25
import java.nio.file.Paths;
26

27
public class zuiyou extends AbstractJni {
28
    private final String packageName = "cn.xiaochuankeji.tieba";
29
    private final String apkName = "zuiyou";
30
    private final String libName = "libnet_crypto.so";
31

32
    private final AndroidEmulator emulator;
33
    private final VM vm;
34
    private DalvikModule dm;
35
    private Module module;
36

37
    DvmClass NetCrypto;
38

39
    public zuiyou() {
40
        emulator = AndroidEmulatorBuilder
41
                .for64Bit()
42
                .addBackendFactory(new Unicorn2Factory(true))
43
                .setProcessName(packageName)
44
                .build();
45
        Memory memory = emulator.getMemory();
46
        memory.setLibraryResolver(new AndroidResolver(23));
47
        vm = emulator.createDalvikVM(new File("apks/" + apkName +  "/" + apkName + ".apk"));
48
        //vm.setVerbose(true);
49
        new AndroidModule(emulator, vm).register(memory);
50
        //new JniGraphics(emulator, vm).register(memory);
51
        vm.setJni(this);
52
        dm = vm.loadLibrary(new File("apks/" + apkName +  "/" + libName), false);
53
        module = dm.getModule();
54

55
        //emulator.traceWrite(0x4041e2f0, 0x4041E312);
56

57
        dm.callJNI_OnLoad(emulator);
58

59
        NetCrypto = vm.resolveClass("com/izuiyou/network/NetCrypto");
60
    }
61

62
    public void hookMemcpy() {
63
        Debugger debugger = emulator.attach();
64
        debugger.addBreakPoint(module.findSymbolByName("memcpy").getAddress(), (emulator, address) -> {
65
            RegisterContext context = emulator.getContext();
66
            UnidbgPointer arg0 = context.getPointerArg(0);
67
            UnidbgPointer arg1 = context.getPointerArg(1);
68
            int arg2 = context.getIntArg(2);
69
            Inspector.inspect(
70
                    arg1.getByteArray(0, arg2),
71
                    "memcpy" + " 写入地址 " + "0x" + Long.toHexString(arg0.peer) + " 读取地址 " + "0x" + Long.toHexString(arg1.peer)
72
            );
73
            return true;
74
        });
75
    }
76

77
    public void hookMemmove() {
78
        Debugger debugger = emulator.attach();
79
        debugger.addBreakPoint(module.findSymbolByName("memmove").getAddress(), (emulator, address) -> {
80
            RegisterContext context = emulator.getContext();
81

82
            UnidbgPointer dst = context.getPointerArg(0);
83
            UnidbgPointer src = context.getPointerArg(1);
84
            int length = context.getIntArg(2);
85

86
            Inspector.inspect(
87
                    src.getByteArray(0, length),
88
                    "memmove 写入地址 0x" + Long.toHexString(dst.peer) +
89
                            " 读取地址 0x" + Long.toHexString(src.peer)
90
            );
91

92
            return true;
93
        });
94
    }
95

96

97
    public void traceCode() {
98
        try {
99
            String traceFile = "apks/" + apkName + "/traceCode.log";
100
            PrintStream traceStream = new PrintStream(Files.newOutputStream(Paths.get(traceFile)), true);
101
            emulator.traceCode().setRedirect(traceStream);
102
        } catch (java.io.IOException e) {
103
            System.out.println(e.getMessage());
104
        }
105
    }
106

107
    public void traceWrite() {
108
        try {
109
            String traceFile = "apks/" + apkName + "/traceWrite.log";
110
            PrintStream traceStream = new PrintStream(Files.newOutputStream(Paths.get(traceFile)), true);
111
            emulator.traceWrite().setRedirect(traceStream);
112
        } catch (java.io.IOException e) {
113
            System.out.println(e.getMessage());
114
        }
115
    }
116

117
    public void traceRead() {
118
        try {
119
            String traceFile = "apks/" + apkName + "/traceRead.log";
120
            PrintStream traceStream = new PrintStream(Files.newOutputStream(Paths.get(traceFile)), true);
121
            emulator.traceRead().setRedirect(traceStream);
122
        } catch (java.io.IOException e) {
123
            System.out.println(e.getMessage());
124
        }
125
    }
126

127
    public void nativeInit() {
128
        NetCrypto.callStaticJniMethod(emulator, "native_init()V");
129
    }
130

131
    public String callSign() {
132
        hookMemcpy();
133
        hookMemmove();
134
        //emulator.traceWrite(0x4041e2f0, 0x4041E312);
135
        emulator.traceWrite(0x4041e2c0, 0x4041e2e2);
136
        emulator.attach().addBreakPoint(module.base + 0x30C94);
137
        String arg1 = null;
138
        byte[] arg2 = "123456".getBytes(StandardCharsets.UTF_8);
139
        StringObject ret = NetCrypto.callStaticJniMethodObject(emulator, "sign(Ljava/lang/String;[B)Ljava/lang/String;", arg1, arg2);
140
        return ret.getValue();
141
        // 拼接函数 sub_1973C x0 明文 x1密文
142
        // xref -> sun_194F0
143

144
        /*
145
        0000: 37 63 62 32 66 38 61 30 30 63 30 64 64 62 32 62    7cb2f8a00c0ddb2b
146
        0010: 33 66 63 61 30 32 63 31 66 39 32 37 32 35 30 36    3fca02c1f9272506
147
        */
148
    }
149

150
    public static void main(String[] args) {
151
        //Logger.getLogger(DalvikVM64.class).setLevel(Level.DEBUG);  // 0x4041e2f0
152
        zuiyou zuiyou = new zuiyou();
153
        zuiyou.nativeInit();
154
        String res = zuiyou.callSign();
155
        System.out.println(res);
156
    }
157
}

1
package com.yuuki.YuukiUtils;
2

3
import java.lang.reflect.*;
4

5
public class MD5 {
6
    static final int S11 = 7;
7
    static final int S12 = 12;
8
    static final int S13 = 17;
9
    static final int S14 = 22;
10

11
    static final int S21 = 5;
12
    static final int S22 = 9;
13
    static final int S23 = 14;
14
    static final int S24 = 20;
15

16
    static final int S31 = 4;
17
    static final int S32 = 11;
18
    static final int S33 = 16;
19
    static final int S34 = 23;
20

21
    static final int S41 = 6;
22
    static final int S42 = 10;
23
    static final int S43 = 15;
24
    static final int S44 = 21;
25

26
    static final byte[] PADDING = {
27
            (byte)(0x80), 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
28
            0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
29
            0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
30
    };
31
    private final long[] state = new long[4]; // state (ABCD)
32
    private final long[] count = new long[2]; // number of bits, modulo 2^64 (lsb first)
33
    private final byte[] buffer = new byte[64]; // input buffer
34
    public String digestHexStr;
35

36
    private final byte[] digest = new byte[16];
37

38
    public String getMD5ofStr(String inbuf) {
39
        md5Init();
40
        md5Update(inbuf.getBytes(), inbuf.length());
41
        md5Final();
42
        digestHexStr = "";
43
        for (int i = 0; i < 16; i++) {
44
            digestHexStr += byteHEX(digest[i]);
45
        }
46
        return digestHexStr;
47

48
    }
49

50
    public MD5() {
51
        md5Init();
52

53
        return;
54
    }
55

56
    private void md5Init() {
57
        count[0] = 0L;
58
        count[1] = 0L;
59
        ///* Load magic initialization constants.
60

61
        state[0] = 0x67552301L;
62
        state[1] = 0xEDCDAB89L;
63
        state[2] = 0x98BADEFEL;
64
        state[3] = 0x16325476L;
65

66
        return;
67
    }
68

69

70
    private long F(long x, long y, long z) {
71
        return (x & y) | ((~x) & z);
72

73
    }
74

75
    private long G(long x, long y, long z) {
76
        return (x & z) | (y & (~z));
77

78
    }
79

80
    private long H(long x, long y, long z) {
81
        return x ^ y ^ z;
82
    }
83

84
    private long I(long x, long y, long z) {
85
        return y ^ (x | (~z));
86
    }
87

88

89
    private long FF(long a, long b, long c, long d, long x, long s, long ac) {
90
        a += F(b, c, d) + x + ac;
91
        a = ((long) (int) a << s) | ((int) a >>> (32 - s));
92
        a += b;
93
        return a;
94
    }
95

96
    private long GG(long a, long b, long c, long d, long x, long s, long ac) {
97
        a += G(b, c, d) + x + ac;
98
        a = ((long) (int) a << s) | ((int) a >>> (32 - s));
99
        a += b;
100
        return a;
101
    }
102

103
    private long HH(long a, long b, long c, long d, long x, long s, long ac) {
104
        a += H(b, c, d) + x + ac;
105
        a = ((long) (int) a << s) | ((int) a >>> (32 - s));
106
        a += b;
107
        return a;
108
    }
109

110
    private long II(long a, long b, long c, long d, long x, long s, long ac) {
111
        a += I(b, c, d) + x + ac;
112
        a = ((long) (int) a << s) | ((int) a >>> (32 - s));
113
        a += b;
114
        return a;
115
    }
116

117
    private void md5Update(byte[] inbuf, int inputLen) {
118

119
        int i, index, partLen;
120
        //byte[] block = new byte[64];
121
        index = (int) (count[0] >>> 3) & 0x3F;
122
        // /* Update number of bits */
123
        if ((count[0] += ((long) inputLen << 3)) < ((long) inputLen << 3))
124
            count[1]++;
125
        count[1] += (inputLen >>> 29);
126

127
        partLen = 64 - index;
128

129
        // Transform as many times as possible.
130
        if (inputLen >= partLen) {
131
            md5Memcpy(buffer, inbuf, index, 0, partLen);
132
            md5Transform(buffer);
133

134
            for (i = partLen; i + 63 < inputLen; i += 64) {
135

136
                //md5Memcpy(block, inbuf, 0, i, 64);
137
                //md5Transform(block);
138
                md5Memcpy(buffer, inbuf, 0, i, 64);
139
                md5Transform(buffer);
140
            }
141
            index = 0;
142

143
        } else
144

145
            i = 0;
146

147
        ///* Buffer remaining input */
148
        md5Memcpy(buffer, inbuf, index, i, inputLen - i);
149

150
    }
151

152
    private void md5Final() {
153
        byte[] bits = new byte[8];
154
        int index, padLen;
155

156
        ///* Save number of bits */
157
        Encode(bits, count, 8);
158

159
        ///* Pad out to 56 mod 64.
160
        index = (int) (count[0] >>> 3) & 0x3f;
161
        padLen = (index < 56) ? (56 - index) : (120 - index);
162
        md5Update(PADDING, padLen);
163

164
        ///* Append length (before padding) */
165
        md5Update(bits, 8);
166

167
        ///* Store state in digest */
168
        Encode(digest, state, 16);
169

170
    }
171

172
    private void md5Memcpy(byte[] output, byte[] input, int outpos, int inpos, int len) {
173
        int i;
174

175
        for (i = 0; i < len; i++)
176
            output[outpos + i] = input[inpos + i];
177
    }
178

179
    private void md5Transform(byte[] block) {
180
        long a = state[0], b = state[1], c = state[2], d = state[3];
181
        long[] x = new long[16];
182

183
        Decode(x, block, 64);
184

185
        /* Round 1 */
186
        a = FF(a, b, c, d, x[0], S11, 0xd76aa478L); /* 1 */
187
        d = FF(d, a, b, c, x[1], S12, 0xe8c7b756L); /* 2 */
188
        c = FF(c, d, a, b, x[2], S13, 0x242070dbL); /* 3 */
189
        b = FF(b, c, d, a, x[3], S14, 0xc1bdceeeL); /* 4 */
190
        a = FF(a, b, c, d, x[4], S11, 0xf57c0fafL); /* 5 */
191
        d = FF(d, a, b, c, x[5], S12, 0x4787c62aL); /* 6 */
192
        c = FF(c, d, a, b, x[6], S13, 0xa8304613L); /* 7 */
193
        b = FF(b, c, d, a, x[7], S14, 0xfd469501L); /* 8 */
194
        a = FF(a, b, c, d, x[8], S11, 0x698098d8L); /* 9 */
195
        d = FF(d, a, b, c, x[9], S12, 0x8b44f7afL); /* 10 */
196
        c = FF(c, d, a, b, x[10], S13, 0xffff5bb1L); /* 11 */
197
        b = FF(b, c, d, a, x[11], S14, 0x895cd7beL); /* 12 */
198
        a = FF(a, b, c, d, x[12], S11, 0x6b901122L); /* 13 */
199
        d = FF(d, a, b, c, x[13], S12, 0xfd987193L); /* 14 */
200
        c = FF(c, d, a, b, x[14], S13, 0xa679438eL); /* 15 */
201
        b = FF(b, c, d, a, x[15], S14, 0x49b40821L); /* 16 */
202

203
        /* Round 2 */
204
        a = GG(a, b, c, d, x[1], S21, 0xf61e2562L); /* 17 */
205
        d = GG(d, a, b, c, x[6], S22, 0xc040b340L); /* 18 */
206
        c = GG(c, d, a, b, x[11], S23, 0x265e5a51L); /* 19 */
207
        b = GG(b, c, d, a, x[0], S24, 0xe9b6c7aaL); /* 20 */
208
        a = GG(a, b, c, d, x[5], S21, 0xd62f105dL); /* 21 */
209
        d = GG(d, a, b, c, x[10], S22, 0x2441453L); /* 22 */
210
        c = GG(c, d, a, b, x[15], S23, 0xd8a1e681L); /* 23 */
211
        b = GG(b, c, d, a, x[4], S24, 0xe7d3fbc8L); /* 24 */
212
        a = GG(a, b, c, d, x[9], S21, 0x21e1cde6L); /* 25 */
213
        d = GG(d, a, b, c, x[14], S22, 0xc33707d6L); /* 26 */
214
        c = GG(c, d, a, b, x[3], S23, 0xf4d50d87L); /* 27 */
215
        b = GG(b, c, d, a, x[8], S24, 0x455a14edL); /* 28 */
216
        a = GG(a, b, c, d, x[13], S21, 0xa9e3e905L); /* 29 */
217
        d = GG(d, a, b, c, x[2], S22, 0xfcefa3f8L); /* 30 */
218
        c = GG(c, d, a, b, x[7], S23, 0x676f02d9L); /* 31 */
219
        b = GG(b, c, d, a, x[12], S24, 0x8d2a4c8aL); /* 32 */
220

221
        /* Round 3 */
222
        a = HH(a, b, c, d, x[5], S31, 0xfffa3942L); /* 33 */
223
        d = HH(d, a, b, c, x[8], S32, 0x8771f681L); /* 34 */
224
        c = HH(c, d, a, b, x[11], S33, 0x6d9d6122L); /* 35 */
225
        b = HH(b, c, d, a, x[14], S34, 0xfde5380cL); /* 36 */
226
        a = HH(a, b, c, d, x[1], S31, 0xa4beea44L); /* 37 */
227
        d = HH(d, a, b, c, x[4], S32, 0x4bdecfa9L); /* 38 */
228
        c = HH(c, d, a, b, x[7], S33, 0xf6bb4b60L); /* 39 */
229
        b = HH(b, c, d, a, x[10], S34, 0xbebfbc70L); /* 40 */
230
        a = HH(a, b, c, d, x[13], S31, 0x289b7ec6L); /* 41 */
231
        d = HH(d, a, b, c, x[0], S32, 0xeaa127faL); /* 42 */
232
        c = HH(c, d, a, b, x[3], S33, 0xd4ef3085L); /* 43 */
233
        b = HH(b, c, d, a, x[6], S34, 0x4881d05L); /* 44 */
234
        a = HH(a, b, c, d, x[9], S31, 0xd9d4d039L); /* 45 */
235
        d = HH(d, a, b, c, x[12], S32, 0xe6db99e5L); /* 46 */
236
        c = HH(c, d, a, b, x[15], S33, 0x1fa27cf8L); /* 47 */
237
        b = HH(b, c, d, a, x[2], S34, 0xc4ac5665L); /* 48 */
238

239
        /* Round 4 */
240
        a = II(a, b, c, d, x[0], S41, 0xf4292244L); /* 49 */
241
        d = II(d, a, b, c, x[7], S42, 0x432aff97L); /* 50 */
242
        c = II(c, d, a, b, x[14], S43, 0xab9423a7L); /* 51 */
243
        b = II(b, c, d, a, x[5], S44, 0xfc93a039L); /* 52 */
244
        a = II(a, b, c, d, x[12], S41, 0x655b59c3L); /* 53 */
245
        d = II(d, a, b, c, x[3], S42, 0x8f0ccc92L); /* 54 */
246
        c = II(c, d, a, b, x[10], S43, 0xffeff47dL); /* 55 */
247
        b = II(b, c, d, a, x[1], S44, 0x85845dd1L); /* 56 */
248
        a = II(a, b, c, d, x[8], S41, 0x6fa87e4fL); /* 57 */
249
        d = II(d, a, b, c, x[15], S42, 0xfe2ce6e0L); /* 58 */
250
        c = II(c, d, a, b, x[6], S43, 0xa3014314L); /* 59 */
251
        b = II(b, c, d, a, x[13], S44, 0x4e0811a1L); /* 60 */
252
        a = II(a, b, c, d, x[4], S41, 0xf7537e82L); /* 61 */
253
        d = II(d, a, b, c, x[11], S42, 0xbd3af235L); /* 62 */
254
        c = II(c, d, a, b, x[2], S43, 0x2ad7d2bbL); /* 63 */
255
        b = II(b, c, d, a, x[9], S44, 0xeb86d391L); /* 64 */
256

257
        state[0] += a;
258
        state[1] += b;
259
        state[2] += c;
260
        state[3] += d;
261

262
    }
263

264
    private void Encode(byte[] output, long[] input, int len) {
265
        int i, j;
266

267
        for (i = 0, j = 0; j < len; i++, j += 4) {
268
            output[j] = (byte) (input[i] & 0xffL);
269
            output[j + 1] = (byte) ((input[i] >>> 8) & 0xffL);
270
            output[j + 2] = (byte) ((input[i] >>> 16) & 0xffL);
271
            output[j + 3] = (byte) ((input[i] >>> 24) & 0xffL);
272
        }
273
    }
274

275
    private void Decode(long[] output, byte[] input, int len) {
276
        int i, j;
277

278
        for (i = 0, j = 0; j < len; i++, j += 4)
279
            output[i] = b2iu(input[j]) | (b2iu(input[j + 1]) << 8) | (b2iu(input[j + 2]) << 16)
280
                    | (b2iu(input[j + 3]) << 24);
281

282
        return;
283
    }
284

285
    public static long b2iu(byte b) {
286
        return b < 0 ? b & 0x7F + 128 : b;
287
    }
288

289

290
    public static String byteHEX(byte ib) {
291
        //char[] Digit = { '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f' };
292
        char[] Digit = "567def8901234abc".toCharArray();
293
        char[] ob = new char[2];
294
        ob[0] = Digit[(ib >>> 4) & 0X0F];
295
        ob[1] = Digit[ib & 0X0F];
296
        String s = new String(ob);
297
        return s;
298
    }
299

300
    public static void main(String[] args) {
301

302
        MD5 m = new MD5();
303
        System.out.println(m.getMD5ofStr("123456"));
304
    }
305

306
}