当前位置： 首页 > news >正文

CRYPT32!CryptMsgUpdate函数分析之CRYPT32!PkiAsn1Decode函数的作用是得到pci

news 2025/8/30 7:40:39

第一部分：
CryptMsgUpdate(
#endif
IN HCRYPTMSG    hCryptMsg,
IN const BYTE   *pbData,
IN DWORD        cbData,
IN BOOL         fFinal)
{


ContentInfo         *pci = NULL;


if ((PHASE_FIRST_FINAL == pcmi->dwPhase) &&
(0 == pcmi->dwMsgType)) {
if (0 != (Asn1Err = PkiAsn1Decode(
pDec,
(void **)&pci,
ContentInfoNC_PDU,
pbData,
cbData)))


第二部分：

0: kd> p
CRYPT32!CryptMsgUpdate+0x1b2:
001b:75c79dcc e83b110200      call    CRYPT32!PkiAsn1Decode (75c9af0c)
0: kd> t
CRYPT32!PkiAsn1Decode:
001b:75c9af0c 55              push    ebp
0: kd> kc
#
00 CRYPT32!PkiAsn1Decode
01 CRYPT32!CryptMsgUpdate
02 WINTRUST!_GetMessage
03 WINTRUST!SoftpubLoadMessage
04 WINTRUST!_VerifyTrust
05 WINTRUST!WinVerifyTrust
06 sfc_os!SfcValidateFileSignature
07 sfc_os!SfcGetValidationData
08 sfc_os!SfcValidateDLL
09 sfc_os!SfcQueueValidationThread
0a kernel32!BaseThreadStart
0: kd> dv
pDec = 0x012337d0
ppvAsn1Info = 0x007ce944
id = 0x13
pbEncoded = 0x01e00020 "0???"
cbEncoded = 0x96934
0: kd> db 0x01e00020
01e00020  30 83 09 69 2f 06 09 2a-86 48 86 f7 0d 01 07 02  0..i/..*.H......
01e00030  a0 83 09 69 1f 30 83 09-69 1a 02 01 01 31 0b 30  ...i.0..i....1.0
01e00040  09 06 05 2b 0e 03 02 1a-05 00 30 83 09 57 31 06  ...+......0..W1.
01e00050  09 2b 06 01 04 01 82 37-0a 01 a0 83 09 57 21 30  .+.....7.....W!0
01e00060  83 09 57 1c 30 0c 06 0a-2b 06 01 04 01 82 37 0c  ..W.0...+.....7.
01e00070  01 01 04 10 bb fd 30 fb-6f a3 d9 40 82 26 85 87  ......0.o..@.&..
01e00080  87 cd 89 4b 17 0d 32 34-30 39 31 35 30 33 34 35  ...K..2409150345
01e00090  30 36 5a 30 0e 06 0a 2b-06 01 04 01 82 37 0c 01  06Z0...+.....7..
0: kd> dx -id 0,0,ffffffff89ce3d88 -r1 ((CRYPT32!ASN1decoding_s *)0x12337d0)
((CRYPT32!ASN1decoding_s *)0x12337d0)                 : 0x12337d0 [Type: ASN1decoding_s *]
[+0x000] magic            : 0x44434544 [Type: unsigned long]
[+0x004] version          : 0x0 [Type: unsigned long]
[+0x008] module           : 0x75788 [Type: tagASN1module_t *]
[+0x00c] buf              : 0x16cdde1 : 0x30 [Type: unsigned char *]
[+0x010] size             : 0xb [Type: unsigned long]
[+0x014] len              : 0xb [Type: unsigned long]
[+0x018] err              : ASN1_SUCCESS (0) [Type: tagASN1error_e]
[+0x01c] bit              : 0x0 [Type: unsigned long]
[+0x020] pos              : 0x16cddec : 0xa0 [Type: unsigned char *]
[+0x024] eRule            : ASN1_BER_RULE_DER (1024) [Type: ASN1encodingrule_e]
[+0x028] dwFlags          : 0x1000 [Type: unsigned long]
0: kd> p
CRYPT32!PkiAsn1Decode+0x1:
001b:75c9af0d 8bec            mov     ebp,esp
0: kd> p
CRYPT32!PkiAsn1Decode+0x3:
001b:75c9af0f 56              push    esi
0: kd> p
CRYPT32!PkiAsn1Decode+0x4:
001b:75c9af10 ff7518          push    dword ptr [ebp+18h]
0: kd> p
CRYPT32!PkiAsn1Decode+0x7:
001b:75c9af13 8b750c          mov     esi,dword ptr [ebp+0Ch]
0: kd> p
CRYPT32!PkiAsn1Decode+0xa:
001b:75c9af16 ff7514          push    dword ptr [ebp+14h]
0: kd> p
CRYPT32!PkiAsn1Decode+0xd:
001b:75c9af19 832600          and     dword ptr [esi],0
0: kd> p
CRYPT32!PkiAsn1Decode+0x10:
001b:75c9af1c 6a08            push    8
0: kd> p
CRYPT32!PkiAsn1Decode+0x12:
001b:75c9af1e ff7510          push    dword ptr [ebp+10h]
0: kd> p
CRYPT32!PkiAsn1Decode+0x15:
001b:75c9af21 56              push    esi
0: kd> p
CRYPT32!PkiAsn1Decode+0x16:
001b:75c9af22 ff7508          push    dword ptr [ebp+8]
0: kd> p
CRYPT32!PkiAsn1Decode+0x19:
001b:75c9af25 e8124f0000      call    CRYPT32!ASN1_Decode (75c9fe3c)
0: kd> t
CRYPT32!ASN1_Decode:
001b:75c9fe3c ff259013c175    jmp     dword ptr [CRYPT32!_imp__ASN1_Decode (75c11390)]
0: kd> p
MSASN1!ASN1_Decode:
001b:75bf7d82 55              push    ebp
0: kd> kc
#
00 MSASN1!ASN1_Decode
01 CRYPT32!PkiAsn1Decode
02 CRYPT32!CryptMsgUpdate
03 WINTRUST!_GetMessage
04 WINTRUST!SoftpubLoadMessage
05 WINTRUST!_VerifyTrust
06 WINTRUST!WinVerifyTrust
07 sfc_os!SfcValidateFileSignature
08 sfc_os!SfcGetValidationData
09 sfc_os!SfcValidateDLL
0a sfc_os!SfcQueueValidationThread
0b kernel32!BaseThreadStart
0: kd> dv
dec = 0x012337d0
valref = 0x007ce944
id = 0x13
flags = 8
pbBuf = 0x01e00020 "0???"
cbBufSize = 0x96934
0: kd> dx -id 0,0,ffffffff89ce3d88 -r1 ((MSASN1!ASN1decoding_s *)0x12337d0)
((MSASN1!ASN1decoding_s *)0x12337d0)                 : 0x12337d0 [Type: ASN1decoding_s *]
[+0x000] magic            : 0x44434544 [Type: unsigned long]
[+0x004] version          : 0x0 [Type: unsigned long]
[+0x008] module           : 0x75788 [Type: tagASN1module_t *]
[+0x00c] buf              : 0x16cdde1 : 0x30 [Type: unsigned char *]
[+0x010] size             : 0xb [Type: unsigned long]
[+0x014] len              : 0xb [Type: unsigned long]
[+0x018] err              : ASN1_SUCCESS (0) [Type: tagASN1error_e]
[+0x01c] bit              : 0x0 [Type: unsigned long]
[+0x020] pos              : 0x16cddec : 0xa0 [Type: unsigned char *]
[+0x024] eRule            : ASN1_BER_RULE_DER (1024) [Type: ASN1encodingrule_e]
[+0x028] dwFlags          : 0x1000 [Type: unsigned long]
0: kd> dx -id 0,0,ffffffff89ce3d88 -r1 ((MSASN1!tagASN1module_t *)0x75788)
((MSASN1!tagASN1module_t *)0x75788)                 : 0x75788 [Type: tagASN1module_t *]
[+0x000] nModuleName      : 0x73636b70 [Type: unsigned long]
[+0x004] eRule            : ASN1_BER_RULE_DER (1024) [Type: ASN1encodingrule_e]
[+0x008] dwFlags          : 0x1000 [Type: unsigned long]
[+0x00c] cPDUs            : 0x30 [Type: unsigned long]
[+0x010] apfnFreeMemory   : 0x75c22418 [Type: void (**)(void *)]
[+0x014] acbStructSize    : 0x75c224d8 : 0x44 [Type: unsigned long *]
[+0x018] PER              [Type: tagASN1PerFunArr_t]
[+0x018] BER              [Type: tagASN1BerFunArr_t]
0: kd> dx -id 0,0,ffffffff89ce3d88 -r1 (*((MSASN1!tagASN1PerFunArr_t *)0x757a0))
(*((MSASN1!tagASN1PerFunArr_t *)0x757a0))                 [Type: tagASN1PerFunArr_t]
[+0x000] apfnEncoder      : 0x75c22298 [Type: long (**)(ASN1encoding_s *,void *)]
[+0x004] apfnDecoder      : 0x75c22358 [Type: long (**)(ASN1decoding_s *,void *)]
0: kd> dx -id 0,0,ffffffff89ce3d88 -r1 ((MSASN1!long (**)(ASN1decoding_s *,void *))0x75c22358)
((MSASN1!long (**)(ASN1decoding_s *,void *))0x75c22358)                 : 0x75c22358 [Type: long (**)(ASN1decoding_s *,void *)]
0x75c7ae10 [Type: long (*)(ASN1decoding_s *,void *)]
0: kd> u 75c7ae10
CRYPT32!ASN1Dec_ObjectID [d:\srv03rtm\ds\security\cryptoapi\pki\wincrmsg\pkcs.c @ 443]:
75c7ae10 55              push    ebp
75c7ae11 8bec            mov     ebp,esp
75c7ae13 8b450c          mov     eax,dword ptr [ebp+0Ch]
75c7ae16 85c0            test    eax,eax
75c7ae18 7503            jne     CRYPT32!ASN1Dec_ObjectID+0xd (75c7ae1d)
75c7ae1a 6a06            push    6
75c7ae1c 58              pop     eax
75c7ae1d ff7510          push    dword ptr [ebp+10h]
0: kd> dd 0x75c22358
75c22358  75c7ae10 75c7ae10 75c8ce81 75c7ae48
75c22368  75c7ae6c 75c7af08 75c7af8e 75c7b0d0
75c22378  75c7b20f 75c7b937 75c7b20f 75c7b37a
75c22388  75c7b4a5 75c7b937 75c7b6b1 75c7b937
75c22398  75c7b937 75c7ba4e 75c7bb9a 75c7bc73
75c223a8  75c7b937 75c7d861 75c7b937 75c7b937
75c223b8  75c7da15 75c7bf62 75c7c106 75c7c2f7
75c223c8  75c7dbbc 75c7c4ac 75c7c600 75c7dd94
0: kd> u 75c7bb9a
CRYPT32!ASN1Dec_ContentInfo [d:\srv03rtm\ds\security\cryptoapi\pki\wincrmsg\pkcs.c @ 1574]:
75c7bb9a 55              push    ebp
75c7bb9b 8bec            mov     ebp,esp
75c7bb9d 83ec10          sub     esp,10h
75c7bba0 8b450c          mov     eax,dword ptr [ebp+0Ch]
75c7bba3 85c0            test    eax,eax
75c7bba5 7503            jne     CRYPT32!ASN1Dec_ContentInfo+0x10 (75c7bbaa)
75c7bba7 6a10            push    10h
75c7bba9 58              pop     eax


第三部分：返回到CRYPT32!PkiAsn1Decode

0: kd> p
CRYPT32!PkiAsn1Decode+0x24:
001b:75c9af30 eb0d            jmp     CRYPT32!PkiAsn1Decode+0x33 (75c9af3f)
0: kd> p
CRYPT32!PkiAsn1Decode+0x33:
001b:75c9af3f 5e              pop     esi
0: kd> p
CRYPT32!PkiAsn1Decode+0x34:
001b:75c9af40 5d              pop     ebp
0: kd> p
CRYPT32!PkiAsn1Decode+0x35:
001b:75c9af41 c21400          ret     14h
0: kd> p
CRYPT32!CryptMsgUpdate+0x1b7:
001b:75c79dd1 8945c8          mov     dword ptr [ebp-38h],eax
0: kd> dv
hCryptMsg = 0x016e7290
pbData = 0x01e00020 "0???"
cbData = 0x96934
fFinal = 0n1
dwError = 0
fRet = 0n0
pci = 0x0007ea10
Asn1Err = 0n272 (No matching enumerant)
cb = 0x75c9d114
pDec = 0x012337d0
pb = 0x75c25e20 "???"
lth = 0n8186136
0: kd> dx -id 0,0,ffffffff89ce3d88 -r1 ((CRYPT32!ContentInfo *)0x7ea10)
((CRYPT32!ContentInfo *)0x7ea10)                 : 0x7ea10 [Type: ContentInfo *]
[+0x000] bit_mask         : 0x80 [Type: unsigned short]
[+0x000] o                [Type: unsigned char [1]]
[+0x004] contentType      [Type: tagASN1objectidentifier2_t]
[+0x048] content          [Type: tagASN1open_t]
0: kd> dx -id 0,0,ffffffff89ce3d88 -r1 (*((CRYPT32!tagASN1objectidentifier2_t *)0x7ea14))
(*((CRYPT32!tagASN1objectidentifier2_t *)0x7ea14))                 [Type: tagASN1objectidentifier2_t]
[+0x000] count            : 0x7 [Type: unsigned short]
[+0x004] value            [Type: unsigned long [16]]
0: kd> dx -id 0,0,ffffffff89ce3d88 -r1 (*((CRYPT32!unsigned long (*)[16])0x7ea18))
(*((CRYPT32!unsigned long (*)[16])0x7ea18))                 [Type: unsigned long [16]]
    [0]              : 0x1 [Type: unsigned long]
[1]              : 0x2 [Type: unsigned long]
[2]              : 0x348 [Type: unsigned long]
[3]              : 0x1bb8d [Type: unsigned long]
[4]              : 0x1 [Type: unsigned long]
[5]              : 0x7 [Type: unsigned long]
[6]              : 0x2 [Type: unsigned long]
[7]              : 0x0 [Type: unsigned long]
[8]              : 0x0 [Type: unsigned long]
[9]              : 0x0 [Type: unsigned long]
[10]             : 0x0 [Type: unsigned long]
[11]             : 0x0 [Type: unsigned long]
[12]             : 0x0 [Type: unsigned long]
[13]             : 0x0 [Type: unsigned long]
[14]             : 0x0 [Type: unsigned long]
[15]             : 0x0 [Type: unsigned long]
0: kd> dx -id 0,0,ffffffff89ce3d88 -r1 (*((CRYPT32!tagASN1open_t *)0x7ea58))
(*((CRYPT32!tagASN1open_t *)0x7ea58))                 [Type: tagASN1open_t]
[+0x000] length           : 0x9691f [Type: unsigned long]
[+0x004] encoded          : 0x1e00035 [Type: void *]
[+0x004] value            : 0x1e00035 [Type: void *]

http://www.xdnf.cn/news/1389205.html

相关文章：

  • 达梦数据库-归档日志（一）
  • JavaScript 入门教程
  • 《Linux 网络编程六：数据存储与SQLite应用指南》
  • TF-IDF：文本分析的“火眼金睛”
  • PCIe 6.0 TLP路由机制：解密高效数据传输的核心架构
  • 【微知】如何撤销一个git的commit？以及撤销的3种方式？
  • 在本地获取下载chrome，然后离线搬运到 ECS
  • 最小生成树——Kruskal
  • go 使用rabbitMQ
  • 【谷歌浏览器】浏览器实用自用版——谷歌浏览器（Google Chrome）离线纯净版安装 官方版无任何捆绑及广告 【离线安装谷歌浏览器】
  • 通过 KafkaMQ 接入Skywalking 数据最佳实践
  • R ggplot2学习Nature子刊一张图，换数据即可用！
  • leetcode 338 比特位计数
  • 04数据库约束实战：从入门到精通
  • Linux下的网络编程SQLITE3详解
  • 算法题打卡力扣第1004. 最大连续1的个数 III（mid）
  • 技术速递｜新手指南：如何在 Foundry Local 中使用自定义模型
  • 百度后端岗位--面试真题分析
  • CCS的诡异报错合集1(以C2000为例)
  • MAC spotlight 搜不到应用程序和 tags 生效
  • ZooKeeper 安装配置
  • C++基础（②VS2022创建项目）
  • 球型摄像机实现360°无死角
  • CLion 中配置运行 Qt 项目指南
  • 三一重工AI预测性维护破局：非计划停机减少60%，技师转型与数字孪生技术搅动制造业
  • 预制菜餐厅：工业化与温度餐平衡术
  • 【Rust】 5. Trait 与运算符重载
  • Python Imaging Library (PIL) 全面指南：PIL高级图像处理-分割与颜色空间转换
  • [Mysql数据库] 知识点总结6
  • 人工智能-python-深度学习-批量标准化与模型保存加载详解