当前位置：首页 > article >正文

AT89C51 利用SBIT寻址,并且在内存中实现伪动态密码的混淆

article 2024/9/30 16:14:38

前置发现 && 分析

请添加图片描述

char bdata DB[2]; //char
sbit x = bdata DB[0]^7; //取内存地址数组[0]地址的的七位

这样我们可以对数组DB中索引0的位置进行修改…

例如,将密码A映射到真实密码C,这样做的好处是你的程序被逆向分析的时候,攻击者无法真正知道密码到底是什么…因为真密码没有明文保存在某段内存中(伪动态)

char bdata DB[2];  //char
DB[0]='A'; // 由于A的ASCII的十六进制是41->二进制 0100 0001
//我们可以通过sbit控制该地址上的某个位来进行偏移,达到我们的混淆效果
sbit x = bdata DB[0]^1;  //取内存地址数组[0]地址的的2位
// H <- L
x = 1
// 'C'的ASCII是43 二进制->0100 0011
// 将0100 0001 -> 0100 0011
// 假设我们的BD起始存储位置在内存0x80地址，则0x80首次存贮了0x41，通过x=1我们成功的将DB[0]中从A变成了C

实验

#include <REGX51.H>

sbit led = P2^0;      // Define LED connected to P2.0
sbit led2 = P2^1;     // Define second LED connected to P2.1
sbit button = P1^0;   // Define button connected to P1.0
char bdata fackPassword[5] = "G"; // Fake password (initially set to 'G')
sbit MY_REGISTER = fackPassword[0] ^ 2; // Confuse (no real function)

// Delay function
void Delay(unsigned int time) {
    while(time--); // Simple delay loop
}

// Main function
void main() {
    led = 0;   // Initialize LED to off
    led2 = 0;  // Initialize second LED to off

    while(1) { // Infinite loop
         
        MY_REGISTER = 0; // Repeated operation (can be omitted)
        // Check if the fake password is 'E'
        if (fackPassword[0] == 'E') {
            led = 1; // Turn on LED
        } else {
            led = 0; // Turn off LED
        }

        // Check if the fake password is 'C'
        if (fackPassword[0] == 'C') {
            led2 = 1; // Turn on second LED
        } else {
            led2 = 0; // Turn off second LED
        }
    } // End of infinite loop
}

这段demo中,我定义了一个假密码’G’,最总也就是从’G’修改成’C’。最后进入语句if (fackPassword[0] == 'C')并且led2=1

通过DEBUG调试,很明显这个G被修改成了C,意味着我们的混淆起作用了

请添加图片描述

再次修改代码，这次通过一个按钮来模拟混淆触发事件

#include <REGX51.H>

sbit led = P2^0;      // Define LED connected to P2.0
sbit led2 = P2^1;     // Define second LED connected to P2.1
sbit button = P1^0;   // Define button connected to P1.0
char bdata fackPassword[5] = "G"; // Fake password (initially set to 'G')
sbit MY_REGISTER = fackPassword[0] ^ 2; // Confuse (no real function)

// Delay function
void Delay(unsigned int time) {
    while(time--); // Simple delay loop
}

// Main function
void main() {
    led = 0;   // Initialize LED to off
    led2 = 0;  // Initialize second LED to off

    while(1) { // Infinite loop
        if (button == 0) { // Check if button is pressed
            Delay(100); // Debounce delay
            if (button == 0) { // Confirm button is still pressed
                MY_REGISTER = 0; // Update MY_REGISTER
                while(button == 0); // Wait until button is released
            }
        }

       

        // Check if the fake password is 'E'
        if (fackPassword[0] == 'G') {
            led = 1; // Turn on LED
        } else {
            led = 0; // Turn off LED
        }

        // Check if the fake password is 'C'
        if (fackPassword[0] == 'C') {
            led2 = 1; // Turn on second LED
        } else {
            led2 = 0; // Turn off second LED
        }
    } // End of infinite loop
}

为此我们画一个仿真图纸

请添加图片描述