GTBank APP SecurityTest

前言

国庆放假期间领导给了一个任务，分析非洲某银行APP，绕过反抓包，并且分析加密算法，能实现自动登录，这也是我第一次分析APP（以前从未接触，也只是看大佬们的文章），所以记录一下

一、反编译APK获得源码

1、需要的工具

• Apktool

下载地址：http://ibotpeaches.github.io/Apktool/install/

• dex2jar
• jd-gui

2、反编译代码

先把.apk后缀修改为.zip后解压，再使用dex2jar工具

d2j-dex2jar classes.dex

该jar包可以用jd-gui打开

2、反编译资源

apktool.bat d xxx.apk

二、绕反抓包

1、安卓5.x

在自己写东拼西凑写Hook的时候发现，安卓版本在5.x以下的话，是可以不需要Xposed的，直接burp代理+证书即可

未安装Xposed+JustTrustMe

1、SSL Pinning

夜神模拟器

主要是公司测试机放公司了忘记拿了，所以用夜神模拟器 :) 国庆放假太开心

安卓版本：Android 5（已Root）

Burp 2020

Java11

Fiddler

需要下载JustTrustMe:https://github.com/Fuzion24/JustTrustMe/releases/tag/v.2

Xposed框架: http://repo.xposed.info/module/de.robv.android.xposed.installer

但是如果使用夜神模拟器的话，安装Xposed框架的时候会出现一个情况，夜神模拟器会提示你该框架可能不兼容或不适用，夜神模拟器本身在应用商店中已经存在Xposed框架，是否需要安装夜神模拟器官方的Xposed框架，我这里测试使用的是夜神模拟器官方的Xposed框架

Tips：这里在安装Xposed.info下载的框架时遇到一个问题，如果使用官方的框架的话，就会遇到可能x86不兼容或者不适用的情况，夜神模拟器建议最方便的就是使用夜神模拟器的Xposed框架

如果不想使用夜神的Xposed框架，只需要更换降低安卓版本即可

夜神模拟器更换安卓版本的步骤

1、选择多开

2、选择添加模拟器中的三个点

随后安装安卓5即可

至于更低的版本，暂时没研究夜神如何更换

随后Burp开启代理，模拟器WiFi修改一下代理即可

正常打开APP抓包

那么如何验证这个包是否抓到，只需要点击forward，如果弹出账号错误，那么就是成功了

绕过原理

使用JustTrustMe来突破验证的原理就是，JustTrustMe将APK中所有用于校验的SSL证书的API都进行了HOOK，从而绕过证书验证。

Https建立的完整过程

客户端与服务端经过通信交换获得了三个随机数，通过这三个随机数，客户端与服务端能够使用相同的算法生成后续HTTP通信过程中对称加密算法使用的密钥。也就是说HTTPS协议中非对称加密只是在协议建立时使用，协议建立后使用的是对称加密。

SSL-PinNing技术，在开发的时候将服务端整数打包在客户端里，这样在Https建立时与服务端返回的证书对比一致性。

安卓实现Https的几种方式

1、通过OkHttp来实现

第三方库，OkHttp中进行SSL证书校验，有如下两种方式

1、CertificatePinner（证书锁定）

通过CertificatePinner进行连接的OkHttp，在连接之前，会调用其Check方法进行证书校验

2、自定义证书和HostNameVerify来实现Https校验

OkHttp中如果不执行HostNameVerifier默认调用的是OkHostNameVerifier.verify进行服务器主机名校验，如果设置了HostNameVerifier，则默认调用的是自定义的Verify方法

绕过SSL证书验证，Xposed需要Hook的方法名和类名

类名	方法名
com.squareup.okhttp.CertificatePinner	public void check(String hostname, List peerCertificates) throws SSLPeerUnverifiedException{}
com.squareup.okhttp.CertificatePinner	public void check(String,List)
okhttp3.internal.tls.OkHostnameVerifier	public boolean verify(String, SSLSession)
okhttp3.internal.tls.OkHostnameVerifier	public boolean verify(String, X509Certificate)
okhttp3.OkHttpClient.Builder	public OkHttpClient.Builder hostnameVerifier(HostnameVerifier hostnameVerifier)

JustTrustME 中的代码并没有 Hook (public OkHttpClient.Builder hostnameVerifier)这个方法，应 该是漏掉了这个方法。 对其中上述四个方法只需要 Hook 函数后，不抛出异常，并设置函数返回值为 true 即可绕过 验证。 对 于 OkHttpClient.Builder 中 的 hostnameVerifier 方 法 的 Hook ， 替 换 成 自 定 义 的 HostnameVerifier(上述代码中的 MyHostnameVerifier 即可)。

2、通过Apache的HttpClient来实现

HttpClient中进行SSL证书校验，也分为两种方式

1、通过在APK中内置的整数初始化与一个KeyStore，然后用这个Keystore去引导生成的TrustManager来提供验证

2、自定义SSLSocketFacetory实现其中的TrustManager校验策略

绕过上述SSL证书验证，Xposed需要Hook的方法名和类名

类名	方法名
external/apachehttp/src/org/apache/http/impl/client/DefaultHttpClie nt.java	public DefaultHttpClient()
external/apachehttp/src/org/apache/http/impl/client/DefaultHttpClie nt.java	public DefaultHttpClient(HttpParams params)
external/apachehttp/src/org/apache/http/impl/client/DefaultHttpClie nt.java	public DefaultHttpClient(ClientConnectionMa nager conman, HttpParams params)
external/apachehttp/src/org/apache/http/conn/ssl/SSLSocketFactory. java	public SSLSocketFactory(String, KeyStore, String, KeyStore)
external/apachehttp/src/org/apache/http/conn/ssl/SSLSocketFactory. java	public SSLSocketFactory(String, KeyStore, String, KeyStore)

Hook 的 DefaultHttpClient 三个构造方法，对中都调用(ClientConnectionManager, HttpParams) 这个函数，其中重点需要 Hook 的是 ClientConnectionManager 这个参数，将其替换成如下函 数内容，让其信任所有证书：

public ClientConnectionManager getSCCM() {
 KeyStore trustStore;
 try {
     trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
     trustStore.load(null, null);
     SSLSocketFactory sf = new TrustAllSSLSocketFactory(trustStore);
     sf.setHostnameVerifier(SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);
     SchemeRegistry registry = new SchemeRegistry();
     registry.register(new Scheme("http", PlainSocketFactory.getSocketFactory(), 80));
     registry.register(new Scheme("https", sf, 443));
     ClientConnectionManager ccm = new SingleClientConnManager(null, registry);
     return ccm;
     } catch (Exception e) {
         return null;
 }
}

Hook 的 SSLSocketFactory 重点是替换其中 TrustManager，将其策略可以加载信任任意 证书，替换后“TrustManager”代码如下：

class ImSureItsLegitTrustManager implements X509TrustManager {
 @Override
 public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException
{ }
 @Override
 public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException
{ }
 @Override
 public X509Certificate[] getAcceptedIssuers() {
 return new X509Certificate[0];
 }
}

3、通过HttpsURLConnection来实现

HttpsURLConnection中进行SSL证书校验，也分为两种方式

1、自定义的HostNameVerifier和X509TrustManager实现

2、使用内置的整数初始化一个KeyStore实现Manager

绕过上述SSL证书验证，Xposed需要Hook的方法名和类名

类名	方法名
libcore/luni/src/main/java/javax/net/ssl/TrustMana gerFactory.java	public final TrustManager[] getTrustManager()
libcore/luni/src/main/java/javax/net/ssl/HttpsURL Connection.java	public void setDefaultHostnameVerifier(HostnameVe rifier)
libcore/luni/src/main/java/javax/net/ssl/HttpsURL Connection.java	public void setSSLSocketFactory(SSLSocketFactory)
libcore/luni/src/main/java/javax/net/ssl/HttpsURL Connection.java	public void setHostnameVerifier(HostNameVerifier)

getTrustManager的Hook，跟2一样，换成自定义的TrustManager让其信任所有证书。

4、Webview加载Https页面时的证书校验

Adnroid中通过Webview加载Https页面时，如果出现证书校验错误，则会停止加载页面，因为只需要Hook掉WebView的证书校验失败的处理方法：onReceivedSsLError，让其继续加载即可

类名	方法名
frameworks/base/core/java/android/webkit/W ebViewClient.java	public void onReceivedSslError(Webview, SslErrorHandler, SslError)
frameworks/base/core/java/android/webkit/W ebViewClient.java	public void onReceivedError(WebView, int, String, String)

只需要WEbview继续加载网页即可：handler.processd()

5、JustTrustMe中其他Hook函数

类名	方法名
external/apachehttp/src/org/apache/http/conn/ssl/SSLSocketF actory.java	public static SSLSocketFactory getSocketFactory()/已废弃
external/apachehttp/src/org/apache/http/conn/ssl/SSLSocketF actory.java	public boolean isSecure(Socket)/已废弃
ch.boye.httpclientandroidlib.conn.ssl.Abstract Verifier	verify(String, String[], String[], boolean)

前两个函数已经基本没有在使用，而第三个是使用的第三方的库——httpclientandroidlib 进行进行 https 连接的，该 jar14 年以后也没在更新了，几乎没人在使用。

2、绕过WebView onReceivedSslError检测

对上述提供的方法，反编译APK后在Jar包中搜索可以发现，使用了onReceivedSsLError进行检测

1、检测点InAppBrowser.clss

2、检测点SystemWebViewClient.class

3、自己写Hook

虽然有现成的xposed和justTrustme，但是对原理比较好奇，自己动手照着教程也写了一个基于xposed的hook

其实是在JustTrustme里面抄的

package Hook;

import android.net.http.SslError;
import android.util.Log;
import android.webkit.SslErrorHandler;
import android.webkit.WebView;

import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodReplacement;
import de.robv.android.xposed.callbacks.XC_LoadPackage;

import org.json.JSONObject;

import javax.xml.transform.ErrorListener;

import de.robv.android.xposed.IXposedHookLoadPackage;
import de.robv.android.xposed.XC_MethodHook;
import de.robv.android.xposed.XposedBridge;
import de.robv.android.xposed.XposedHelpers;
import de.robv.android.xposed.callbacks.XC_LoadPackage;

public class HookMain implements IXposedHookLoadPackage {

    @Override
    public void handleLoadPackage(final XC_LoadPackage.LoadPackageParam lpparam) throws Throwable {
        String packageName = lpparam.packageName;
        XposedHelpers.findAndHookMethod("android.webkit.WebViewClient", lpparam.classLoader, "onReceivedSslError",
                WebView.class, SslErrorHandler.class, SslError.class, new XC_MethodReplacement() {
                    @Override
                    protected Object replaceHookedMethod(MethodHookParam param) throws Throwable {
                        XposedBridge.log("开始绕过");
                        ((android.webkit.SslErrorHandler) param.args[1]).proceed();
                        return null;
                    }
                });

    }
}

但是在准备测试自己的Hook的时候突然傻了，发现安卓5.0以下都可以不需要用xposed就可以抓包。。。所以自己的hook就没有测试，也不知道该的对不对。。。

三、解密WebView前端代码

1、反编译APK获得WebView源码

对APK反编译后可以发现assets下是前端代码，但是该代码进行了加密，简单查看后发现第一次加密是Base64，

通过对APK的逆向，可以在源代码中发现，加密方式是AES(CBC, PKCS5Padding)，在private中可以看到KEY和VI，那么对其解密

2、Python3解密WebView源码

from Crypto.Cipher import AES  
from base64 import b64decode, b64encode
import os
BLOCK_SIZE = AES.block_size
# 不足BLOCK_SIZE的补位(s可能是含中文，而中文字符utf-8编码占3个位置,gbk是2，所以需要以len(s.encode())，而不是len(s)计算补码)
pad = lambda s: s + (BLOCK_SIZE - len(s.encode()) % BLOCK_SIZE) * chr(BLOCK_SIZE - len(s.encode()) % BLOCK_SIZE)
# 去除补位
unpad = lambda s: s[:-ord(s[len(s) - 1:])]


class AESCipher:
    def __init__(self, secretkey: str, vi: str):
        self.key = secretkey  # 密钥
        self.iv = vi  # 偏移量

    def encrypt(self, text):
        """
        加密 ：先补位，再AES加密，后base64编码
        :param text: 需加密的明文
        :return:
        """
        # text = pad(text) 包pycrypto的写法，加密函数可以接受str也可以接受bytess
        text = pad(text).encode()  # 包pycryptodome 的加密函数不接受str
        cipher = AES.new(key=self.key.encode(), mode=AES.MODE_CBC, IV=self.iv.encode())
        encrypted_text = cipher.encrypt(text)
        # 进行64位的编码,返回得到加密后的bytes，decode成字符串
        return b64encode(encrypted_text).decode('utf-8')

    def decrypt(self, encrypted_text):
        """
        解密 ：偏移量为key[0:16]；先base64解，再AES解密，后取消补位
        :param encrypted_text : 已经加密的密文
        :return:
        """
        encrypted_text = b64decode(encrypted_text)
        cipher = AES.new(key=self.key.encode(), mode=AES.MODE_CBC, IV=self.iv.encode())
        decrypted_text = cipher.decrypt(encrypted_text)
        return unpad(decrypted_text).decode('utf-8')



key = 'k6qBTDf7HVWSWdThFVkgYiTEdZFIRSAd'
vi = 'MCvyRMdSJW15wfBb'
NewCipher = AESCipher(key, vi)

Ciphertext = '密文'

decrypt = NewCipher.decrypt(Ciphertext)
print(decrypt)

3、分析WebView前端源码

1、寻找加密算法

通过报错关键词与抓包的关键字可以轻松的找到，随后用IDE的功能，查看password的调用

可以看到password都是来自Sign_In_View.js

跟过去后直接看encrypt这个方法

随后来到了aesCTR.js

通过注释可以发现，AES.Ctr.encrypt这个函数，接收三个参数，第一个Plaintext是要加密的文本字符串，第二个password是加密用的key，第三个是要在密钥中使用的位数

那么需要加密的密文很显然就是传进去的参数，password也写在了appData.js里面，密钥的位数也写在了调用传参里

目前可以确定，有AES的key，加密算法为AES的CTR模式，那么还需要找到一个计数器，寻找一些关键字发现，计数器是一个取当前时间戳

那么换一种思路，是不是只需要调用这个JS就可以达到逆加密的效果？因为这里也有encrypt也有decrypt，那么我只需要调用encrypt去加密，再调用decrypt解密即可，而且搜索银行官方的加密算法中的注释可以搜索到，其实这是一段公开的加密算法JS代码，既然找到一模一样的，直接引入到HTML中，打开控制台调用对应的函数即可

之前实战分析过steam登录的rsa加密算法，所以在此次分析中，直接照搬上次的方法，调用即可

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
<body>
<script src="aes.js" type="text/javascript"></script>
    <!-- aes.js见文章末尾 -->
</body>
</html>

打开控制台，直接调用，并输入appdate.js中的AESKEY和256的位数

可以正常加解密，那么抓包后，将POST请求的数据拿过来解密，看看能否解密

正常解密，再进行英文字母测试，成功！

至此，该APP 前端源码解密算法与登录加解密算法已全部逆向完成

1、WebView加密算法表

算法	密钥
AES CBC PkCsDDing Key	k6qBTDf7HVWSWdThFVkgYiTEdZFIRSAd
AES CBC PkCsDDing VI	MCvyRMdSJW15wfBb

2、账户加密算法表

算法	密钥
AES CTR Key	B374A26A71490437AA024E4FADD5B497FDFF1A8EA6FF12F6FB65AF2720B59CCF

2、分析加解密算法后的自动登录

知道加解密算法的原理后，其实自动登录是比较简单的，第一想法就是requests配合requests.session来达到自动登录的效果

但是目前这里只能自己手动去加密然后再输入进去，为了做到自动化，尝试了execjs用python的库来调用JS，不知道什么原因，一直报GBK的错误，无解！，只能换成js2py库了

可以正常加解密

那么只需要把加密和解密封装成两个函数即可

先手动输入正确的账号密码，看看APP返回什么信息

如果账号密码正确，那么就会提示用户需要绑定设备（也就是注册OTP）

那么看看脚本自动登录是不是也是这样

已大致实现了自动登录的功能，登录成功后，session会保持会话，只需要post和get其他页面即可，至此，目标为自动登录的任务已经完成。

1、Python实现自动登录代码

import requests.sessions
import js2py

req = requests.session()

'''
POST /ISWBPGTBankWeb/ws/authenticate HTTP/1.1
Host: mbank.gtbank.com:8443
Connection: close
Content-Length: 199
Accept: */*
Origin: file://
User-Agent: Mozilla/5.0 (Linux; Android 5.1.1; SM-G973N Build/PPR1.190810.011; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/74.0.3729.136 Mobile Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: visid_incap_981350=yQL3gJ2wSWG5sjrdkNj357NQXWEAAAAAQUIPAAAAAADbIvu6L78AQkiegOwinUSR; incap_ses_1223_981350=z0dND28uIk+/JUv7Zvj4ELVQXWEAAAAAZ59d8Yt2cKjqPkqbgVpgeQ==; incap_ses_1224_981350=+LfMHhgfpD+vCvr34IX8EPVrXWEAAAAAc7GpzsoPIi39Crnw53T52w==
X-Requested-With: com.vanso.gtbankapp

loginId=pwInl%2FlrXWGGpfsqQSj%2FcgY%3D&password=pwKUPPlrXWE7qjD8EYMMjck%3D&device_uuid=pwL0dvlrXWFTlsXfG3oBCcB5QQ5y8IOm&email=&appVersion=4.4.4&airshipChannelId=&airshipIdentifierType=android_channel
'''

headers = {
    "Accept": "*/*",
    "Origin": "file://",
    "User-Agent": "Mozilla/5.0 (Linux; Android 5.1.1; SM-G973N Build/PPR1.190810.011; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/74.0.3729.136 Mobile Safari/537.36",
    "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
    "Accept-Encoding": "gzip, deflate",
    "Accept-Language": "zh-CN,zh;q=0.9,en-US;q=0.8,en;q=0.7",
    "Cookie": "visid_incap_981350=yQL3gJ2wSWG5sjrdkNj357NQXWEAAAAAQUIPAAAAAADbIvu6L78AQkiegOwinUSR; incap_ses_1223_981350=z0dND28uIk+/JUv7Zvj4ELVQXWEAAAAAZ59d8Yt2cKjqPkqbgVpgeQ==; incap_ses_1224_981350=bb6DJp/28A7pbgj44IX8EBt7XWEAAAAAo5YIaGF6It7gKFrN9CqSmQ==",
    "X-Requested-With": "com.vanso.gtbankapp"
}

context = js2py.EvalJs()


# 解密算法
def decrypt(text):
    with open('aes.js', encoding='utf-8') as f:
        jsdata = f.read()

    context.execute(jsdata)
    result = context.Aes.Ctr.decrypt(text, 'B374A26A71490437AA024E4FADD5B497FDFF1A8EA6FF12F6FB65AF2720B59CCF', 256)
    print(result)


# 加密算法
def encrypt(text):
    with open('aes.js', encoding='utf-8') as f:
        jsdata = f.read()

    context.execute(jsdata)
    result = context.Aes.Ctr.encrypt(text, 'B374A26A71490437AA024E4FADD5B497FDFF1A8EA6FF12F6FB65AF2720B59CCF', 256)
    return result


def LoginBank(account, password):
    crypt_account = encrypt(account)
    crypt_password = encrypt(password)
    print('[+]加密后账号: ', crypt_account)
    print('[+]加密后密码: ', crypt_password)
    data = {
        'loginId': crypt_account,
        'password': crypt_password,
        'device_uuid': 'pwL0dvlrXWFTlsXfG3oBCcB5QQ5y8IOm',
        'email': '',
        "appVersion": "4.4.4",
        "airshipChannelId": "",
        "airshipIdentifierType": "android_channel"
    }
    result = req.post(url='https://mbank.gtbank.com:8443/ISWBPGTBankWeb/ws/authenticate', data=data, headers=headers)
    print(result.json())


LoginBank('51224580701', '456789')

2、aes.js解密算法原文

var Aes = {};  // Aes namespace

/**
 * AES Cipher function: encrypt 'input' state with Rijndael algorithm
 *   applies Nr rounds (10/12/14) using key schedule w for 'add round key' stage
 *
 * @param {Number[]} input 16-byte (128-bit) input state array
 * @param {Number[][]} w   Key schedule as 2D byte-array (Nr+1 x Nb bytes)
 * @returns {Number[]}     Encrypted output state array
 */
Aes.cipher = function(input, w) {    // main Cipher function [§5.1]
  var Nb = 4;               // block size (in words): no of columns in state (fixed at 4 for AES)
  var Nr = w.length/Nb - 1; // no of rounds: 10/12/14 for 128/192/256-bit keys

  var state = [[],[],[],[]];  // initialise 4xNb byte-array 'state' with input [§3.4]
  for (var i=0; i<4*Nb; i++) state[i%4][Math.floor(i/4)] = input[i];

  state = Aes.addRoundKey(state, w, 0, Nb);

  for (var round=1; round<Nr; round++) {
    state = Aes.subBytes(state, Nb);
    state = Aes.shiftRows(state, Nb);
    state = Aes.mixColumns(state, Nb);
    state = Aes.addRoundKey(state, w, round, Nb);
  }

  state = Aes.subBytes(state, Nb);
  state = Aes.shiftRows(state, Nb);
  state = Aes.addRoundKey(state, w, Nr, Nb);

  var output = new Array(4*Nb);  // convert state to 1-d array before returning [§3.4]
  for (var i=0; i<4*Nb; i++) output[i] = state[i%4][Math.floor(i/4)];
  return output;
}

/**
 * Perform Key Expansion to generate a Key Schedule
 *
 * @param {Number[]} key Key as 16/24/32-byte array
 * @returns {Number[][]} Expanded key schedule as 2D byte-array (Nr+1 x Nb bytes)
 */
Aes.keyExpansion = function(key) {  // generate Key Schedule (byte-array Nr+1 x Nb) from Key [§5.2]
  var Nb = 4;            // block size (in words): no of columns in state (fixed at 4 for AES)
  var Nk = key.length/4  // key length (in words): 4/6/8 for 128/192/256-bit keys
  var Nr = Nk + 6;       // no of rounds: 10/12/14 for 128/192/256-bit keys

  var w = new Array(Nb*(Nr+1));
  var temp = new Array(4);

  for (var i=0; i<Nk; i++) {
    var r = [key[4*i], key[4*i+1], key[4*i+2], key[4*i+3]];
    w[i] = r;
  }

  for (var i=Nk; i<(Nb*(Nr+1)); i++) {
    w[i] = new Array(4);
    for (var t=0; t<4; t++) temp[t] = w[i-1][t];
    if (i % Nk == 0) {
      temp = Aes.subWord(Aes.rotWord(temp));
      for (var t=0; t<4; t++) temp[t] ^= Aes.rCon[i/Nk][t];
    } else if (Nk > 6 && i%Nk == 4) {
      temp = Aes.subWord(temp);
    }
    for (var t=0; t<4; t++) w[i][t] = w[i-Nk][t] ^ temp[t];
  }

  return w;
}

/*
 * ---- remaining routines are private, not called externally ----
 */

Aes.subBytes = function(s, Nb) {    // apply SBox to state S [§5.1.1]
  for (var r=0; r<4; r++) {
    for (var c=0; c<Nb; c++) s[r][c] = Aes.sBox[s[r][c]];
  }
  return s;
}

Aes.shiftRows = function(s, Nb) {    // shift row r of state S left by r bytes [§5.1.2]
  var t = new Array(4);
  for (var r=1; r<4; r++) {
    for (var c=0; c<4; c++) t[c] = s[r][(c+r)%Nb];  // shift into temp copy
    for (var c=0; c<4; c++) s[r][c] = t[c];         // and copy back
  }          // note that this will work for Nb=4,5,6, but not 7,8 (always 4 for AES):
  return s;  // see asmaes.sourceforge.net/rijndael/rijndaelImplementation.pdf
}

Aes.mixColumns = function(s, Nb) {   // combine bytes of each col of state S [§5.1.3]
  for (var c=0; c<4; c++) {
    var a = new Array(4);  // 'a' is a copy of the current column from 's'
    var b = new Array(4);  // 'b' is a•{02} in GF(2^8)
    for (var i=0; i<4; i++) {
      a[i] = s[i][c];
      b[i] = s[i][c]&0x80 ? s[i][c]<<1 ^ 0x011b : s[i][c]<<1;

    }
    // a[n] ^ b[n] is a•{03} in GF(2^8)
    s[0][c] = b[0] ^ a[1] ^ b[1] ^ a[2] ^ a[3]; // 2*a0 + 3*a1 + a2 + a3
    s[1][c] = a[0] ^ b[1] ^ a[2] ^ b[2] ^ a[3]; // a0 * 2*a1 + 3*a2 + a3
    s[2][c] = a[0] ^ a[1] ^ b[2] ^ a[3] ^ b[3]; // a0 + a1 + 2*a2 + 3*a3
    s[3][c] = a[0] ^ b[0] ^ a[1] ^ a[2] ^ b[3]; // 3*a0 + a1 + a2 + 2*a3
  }
  return s;
}

Aes.addRoundKey = function(state, w, rnd, Nb) {  // xor Round Key into state S [§5.1.4]
  for (var r=0; r<4; r++) {
    for (var c=0; c<Nb; c++) state[r][c] ^= w[rnd*4+c][r];
  }
  return state;
}

Aes.subWord = function(w) {    // apply SBox to 4-byte word w
  for (var i=0; i<4; i++) w[i] = Aes.sBox[w[i]];
  return w;
}

Aes.rotWord = function(w) {    // rotate 4-byte word w left by one byte
  var tmp = w[0];
  for (var i=0; i<3; i++) w[i] = w[i+1];
  w[3] = tmp;
  return w;
}

// sBox is pre-computed multiplicative inverse in GF(2^8) used in subBytes and keyExpansion [§5.1.1]
Aes.sBox =  [0x63,0x7c,0x77,0x7b,0xf2,0x6b,0x6f,0xc5,0x30,0x01,0x67,0x2b,0xfe,0xd7,0xab,0x76,
             0xca,0x82,0xc9,0x7d,0xfa,0x59,0x47,0xf0,0xad,0xd4,0xa2,0xaf,0x9c,0xa4,0x72,0xc0,
             0xb7,0xfd,0x93,0x26,0x36,0x3f,0xf7,0xcc,0x34,0xa5,0xe5,0xf1,0x71,0xd8,0x31,0x15,
             0x04,0xc7,0x23,0xc3,0x18,0x96,0x05,0x9a,0x07,0x12,0x80,0xe2,0xeb,0x27,0xb2,0x75,
             0x09,0x83,0x2c,0x1a,0x1b,0x6e,0x5a,0xa0,0x52,0x3b,0xd6,0xb3,0x29,0xe3,0x2f,0x84,
             0x53,0xd1,0x00,0xed,0x20,0xfc,0xb1,0x5b,0x6a,0xcb,0xbe,0x39,0x4a,0x4c,0x58,0xcf,
             0xd0,0xef,0xaa,0xfb,0x43,0x4d,0x33,0x85,0x45,0xf9,0x02,0x7f,0x50,0x3c,0x9f,0xa8,
             0x51,0xa3,0x40,0x8f,0x92,0x9d,0x38,0xf5,0xbc,0xb6,0xda,0x21,0x10,0xff,0xf3,0xd2,
             0xcd,0x0c,0x13,0xec,0x5f,0x97,0x44,0x17,0xc4,0xa7,0x7e,0x3d,0x64,0x5d,0x19,0x73,
             0x60,0x81,0x4f,0xdc,0x22,0x2a,0x90,0x88,0x46,0xee,0xb8,0x14,0xde,0x5e,0x0b,0xdb,
             0xe0,0x32,0x3a,0x0a,0x49,0x06,0x24,0x5c,0xc2,0xd3,0xac,0x62,0x91,0x95,0xe4,0x79,
             0xe7,0xc8,0x37,0x6d,0x8d,0xd5,0x4e,0xa9,0x6c,0x56,0xf4,0xea,0x65,0x7a,0xae,0x08,
             0xba,0x78,0x25,0x2e,0x1c,0xa6,0xb4,0xc6,0xe8,0xdd,0x74,0x1f,0x4b,0xbd,0x8b,0x8a,
             0x70,0x3e,0xb5,0x66,0x48,0x03,0xf6,0x0e,0x61,0x35,0x57,0xb9,0x86,0xc1,0x1d,0x9e,
             0xe1,0xf8,0x98,0x11,0x69,0xd9,0x8e,0x94,0x9b,0x1e,0x87,0xe9,0xce,0x55,0x28,0xdf,
             0x8c,0xa1,0x89,0x0d,0xbf,0xe6,0x42,0x68,0x41,0x99,0x2d,0x0f,0xb0,0x54,0xbb,0x16];

// rCon is Round Constant used for the Key Expansion [1st col is 2^(r-1) in GF(2^8)] [§5.2]
Aes.rCon = [ [0x00, 0x00, 0x00, 0x00],
             [0x01, 0x00, 0x00, 0x00],
             [0x02, 0x00, 0x00, 0x00],
             [0x04, 0x00, 0x00, 0x00],
             [0x08, 0x00, 0x00, 0x00],
             [0x10, 0x00, 0x00, 0x00],
             [0x20, 0x00, 0x00, 0x00],
             [0x40, 0x00, 0x00, 0x00],
             [0x80, 0x00, 0x00, 0x00],
             [0x1b, 0x00, 0x00, 0x00],
             [0x36, 0x00, 0x00, 0x00] ]; 


Aes.Ctr = {};

Aes.Ctr.encrypt = function(plaintext, password, nBits) {
  var blockSize = 16;  // block size fixed at 16 bytes / 128 bits (Nb=4) for AES
  if (!(nBits==128 || nBits==192 || nBits==256)) return '';  // standard allows 128/192/256 bit keys
  plaintext = Utf8.encode(plaintext);
  password = Utf8.encode(password);
  //var t = new Date();  // timer

  // use AES itself to encrypt password to get cipher key (using plain password as source for key
  // expansion) - gives us well encrypted key (though hashed key might be preferred for prod'n use)
  var nBytes = nBits/8;  // no bytes in key (16/24/32)
  var pwBytes = new Array(nBytes);
  for (var i=0; i<nBytes; i++) {  // use 1st 16/24/32 chars of password for key
    pwBytes[i] = isNaN(password.charCodeAt(i)) ? 0 : password.charCodeAt(i);
  }
  var key = Aes.cipher(pwBytes, Aes.keyExpansion(pwBytes));  // gives us 16-byte key
  key = key.concat(key.slice(0, nBytes-16));  // expand key to 16/24/32 bytes long

  // initialise 1st 8 bytes of counter block with nonce (NIST SP800-38A §B.2): [0-1] = millisec,
  // [2-3] = random, [4-7] = seconds, together giving full sub-millisec uniqueness up to Feb 2106
  var counterBlock = new Array(blockSize);

  var nonce = (new Date()).getTime();  // timestamp: milliseconds since 1-Jan-1970
  var nonceMs = nonce%1000;
  var nonceSec = Math.floor(nonce/1000);
  var nonceRnd = Math.floor(Math.random()*0xffff);

  for (var i=0; i<2; i++) counterBlock[i]   = (nonceMs  >>> i*8) & 0xff;
  for (var i=0; i<2; i++) counterBlock[i+2] = (nonceRnd >>> i*8) & 0xff;
  for (var i=0; i<4; i++) counterBlock[i+4] = (nonceSec >>> i*8) & 0xff;

  // and convert it to a string to go on the front of the ciphertext
  var ctrTxt = '';
  for (var i=0; i<8; i++) ctrTxt += String.fromCharCode(counterBlock[i]);

  // generate key schedule - an expansion of the key into distinct Key Rounds for each round
  var keySchedule = Aes.keyExpansion(key);

  var blockCount = Math.ceil(plaintext.length/blockSize);
  var ciphertxt = new Array(blockCount);  // ciphertext as array of strings

  for (var b=0; b<blockCount; b++) {
    // set counter (block #) in last 8 bytes of counter block (leaving nonce in 1st 8 bytes)
    // done in two stages for 32-bit ops: using two words allows us to go past 2^32 blocks (68GB)
    for (var c=0; c<4; c++) counterBlock[15-c] = (b >>> c*8) & 0xff;
    for (var c=0; c<4; c++) counterBlock[15-c-4] = (b/0x100000000 >>> c*8)

    var cipherCntr = Aes.cipher(counterBlock, keySchedule);  // -- encrypt counter block --

    // block size is reduced on final block
    var blockLength = b<blockCount-1 ? blockSize : (plaintext.length-1)%blockSize+1;
    var cipherChar = new Array(blockLength);

    for (var i=0; i<blockLength; i++) {  // -- xor plaintext with ciphered counter char-by-char --
      cipherChar[i] = cipherCntr[i] ^ plaintext.charCodeAt(b*blockSize+i);
      cipherChar[i] = String.fromCharCode(cipherChar[i]);
    }
    ciphertxt[b] = cipherChar.join('');
  }

  // Array.join is more efficient than repeated string concatenation in IE
  var ciphertext = ctrTxt + ciphertxt.join('');
  ciphertext = Base64.encode(ciphertext);  // encode in base64

  //alert((new Date()) - t);
  return ciphertext;
}

/** 
 * Decrypt a text encrypted by AES in counter mode of operation
 *
 * @param {String} ciphertext Source text to be encrypted
 * @param {String} password   The password to use to generate a key
 * @param {Number} nBits      Number of bits to be used in the key (128, 192, or 256)
 * @returns {String}          Decrypted text
 */
Aes.Ctr.decrypt = function(ciphertext, password, nBits) {
  var blockSize = 16;  // block size fixed at 16 bytes / 128 bits (Nb=4) for AES
  if (!(nBits==128 || nBits==192 || nBits==256)) return '';  // standard allows 128/192/256 bit keys
  ciphertext = Base64.decode(ciphertext);
  password = Utf8.encode(password);
  //var t = new Date();  // timer

  // use AES to encrypt password (mirroring encrypt routine)
  var nBytes = nBits/8;  // no bytes in key
  var pwBytes = new Array(nBytes);
  for (var i=0; i<nBytes; i++) {
    pwBytes[i] = isNaN(password.charCodeAt(i)) ? 0 : password.charCodeAt(i);
  }
  var key = Aes.cipher(pwBytes, Aes.keyExpansion(pwBytes));
  key = key.concat(key.slice(0, nBytes-16));  // expand key to 16/24/32 bytes long

  // recover nonce from 1st 8 bytes of ciphertext
  var counterBlock = new Array(8);
  ctrTxt = ciphertext.slice(0, 8);
  for (var i=0; i<8; i++) counterBlock[i] = ctrTxt.charCodeAt(i);

  // generate key schedule
  var keySchedule = Aes.keyExpansion(key);

  // separate ciphertext into blocks (skipping past initial 8 bytes)
  var nBlocks = Math.ceil((ciphertext.length-8) / blockSize);
  var ct = new Array(nBlocks);
  for (var b=0; b<nBlocks; b++) ct[b] = ciphertext.slice(8+b*blockSize, 8+b*blockSize+blockSize);
  ciphertext = ct;  // ciphertext is now array of block-length strings

  // plaintext will get generated block-by-block into array of block-length strings
  var plaintxt = new Array(ciphertext.length);

  for (var b=0; b<nBlocks; b++) {
    // set counter (block #) in last 8 bytes of counter block (leaving nonce in 1st 8 bytes)
    for (var c=0; c<4; c++) counterBlock[15-c] = ((b) >>> c*8) & 0xff;
    for (var c=0; c<4; c++) counterBlock[15-c-4] = (((b+1)/0x100000000-1) >>> c*8) & 0xff;

    var cipherCntr = Aes.cipher(counterBlock, keySchedule);  // encrypt counter block

    var plaintxtByte = new Array(ciphertext[b].length);
    for (var i=0; i<ciphertext[b].length; i++) {
      // -- xor plaintxt with ciphered counter byte-by-byte --
      plaintxtByte[i] = cipherCntr[i] ^ ciphertext[b].charCodeAt(i);
      plaintxtByte[i] = String.fromCharCode(plaintxtByte[i]);
    }
    plaintxt[b] = plaintxtByte.join('');
  }

  // join array of blocks into single plaintext string
  var plaintext = plaintxt.join('');
  plaintext = Utf8.decode(plaintext);  // decode from UTF8 back to Unicode multi-byte chars

  //alert((new Date()) - t);
  return plaintext;
}


/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  */
/*  Base64 class: Base 64 encoding / decoding (c) Chris Veness 2002-2012                          */
/*    note: depends on Utf8 class                                                                 */
/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  */

var Base64 = {};  // Base64 namespace

Base64.code = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";

/**
 * Encode string into Base64, as defined by RFC 4648 [http://tools.ietf.org/html/rfc4648]
 * (instance method extending String object). As per RFC 4648, no newlines are added.
 *
 * @param {String} str The string to be encoded as base-64
 * @param {Boolean} [utf8encode=false] Flag to indicate whether str is Unicode string to be encoded 
 *   to UTF8 before conversion to base64; otherwise string is assumed to be 8-bit characters
 * @returns {String} Base64-encoded string
 */ 
Base64.encode = function(str, utf8encode) {  // http://tools.ietf.org/html/rfc4648
  utf8encode =  (typeof utf8encode == 'undefined') ? false : utf8encode;
  var o1, o2, o3, bits, h1, h2, h3, h4, e=[], pad = '', c, plain, coded;
  var b64 = Base64.code;

  plain = utf8encode ? str.encodeUTF8() : str;

  c = plain.length % 3;  // pad string to length of multiple of 3
  if (c > 0) { while (c++ < 3) { pad += '='; plain += '\0'; } }
  // note: doing padding here saves us doing special-case packing for trailing 1 or 2 chars

  for (c=0; c<plain.length; c+=3) {  // pack three octets into four hexets
    o1 = plain.charCodeAt(c);
    o2 = plain.charCodeAt(c+1);
    o3 = plain.charCodeAt(c+2);

    bits = o1<<16 | o2<<8 | o3;

    h1 = bits>>18 & 0x3f;
    h2 = bits>>12 & 0x3f;
    h3 = bits>>6 & 0x3f;
    h4 = bits & 0x3f;

    // use hextets to index into code string
    e[c/3] = b64.charAt(h1) + b64.charAt(h2) + b64.charAt(h3) + b64.charAt(h4);
  }
  coded = e.join('');  // join() is far faster than repeated string concatenation in IE

  // replace 'A's from padded nulls with '='s
  coded = coded.slice(0, coded.length-pad.length) + pad;

  return coded;
}

/**
 * Decode string from Base64, as defined by RFC 4648 [http://tools.ietf.org/html/rfc4648]
 * (instance method extending String object). As per RFC 4648, newlines are not catered for.
 *
 * @param {String} str The string to be decoded from base-64
 * @param {Boolean} [utf8decode=false] Flag to indicate whether str is Unicode string to be decoded 
 *   from UTF8 after conversion from base64
 * @returns {String} decoded string
 */ 
Base64.decode = function(str, utf8decode) {
  utf8decode =  (typeof utf8decode == 'undefined') ? false : utf8decode;
  var o1, o2, o3, h1, h2, h3, h4, bits, d=[], plain, coded;
  var b64 = Base64.code;

  coded = utf8decode ? str.decodeUTF8() : str;


  for (var c=0; c<coded.length; c+=4) {  // unpack four hexets into three octets
    h1 = b64.indexOf(coded.charAt(c));
    h2 = b64.indexOf(coded.charAt(c+1));
    h3 = b64.indexOf(coded.charAt(c+2));
    h4 = b64.indexOf(coded.charAt(c+3));

    bits = h1<<18 | h2<<12 | h3<<6 | h4;

    o1 = bits>>>16 & 0xff;
    o2 = bits>>>8 & 0xff;
    o3 = bits & 0xff;

    d[c/4] = String.fromCharCode(o1, o2, o3);
    // check for padding
    if (h4 == 0x40) d[c/4] = String.fromCharCode(o1, o2);
    if (h3 == 0x40) d[c/4] = String.fromCharCode(o1);
  }
  plain = d.join('');  // join() is far faster than repeated string concatenation in IE

  return utf8decode ? plain.decodeUTF8() : plain; 
}


/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  */
/*  Utf8 class: encode / decode between multi-byte Unicode characters and UTF-8 multiple          */
/*              single-byte character encoding (c) Chris Veness 2002-2012                         */
/* - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  */

var Utf8 = {};  // Utf8 namespace

/**
 * Encode multi-byte Unicode string into utf-8 multiple single-byte characters 
 * (BMP / basic multilingual plane only)
 *
 * Chars in range U+0080 - U+07FF are encoded in 2 chars, U+0800 - U+FFFF in 3 chars
 *
 * @param {String} strUni Unicode string to be encoded as UTF-8
 * @returns {String} encoded string
 */
Utf8.encode = function(strUni) {
  // use regular expressions & String.replace callback function for better efficiency 
  // than procedural approaches
  var strUtf = strUni.replace(
      /[\u0080-\u07ff]/g,  // U+0080 - U+07FF => 2 bytes 110yyyyy, 10zzzzzz
      function(c) { 
        var cc = c.charCodeAt(0);
        return String.fromCharCode(0xc0 | cc>>6, 0x80 | cc&0x3f); }
    );
  strUtf = strUtf.replace(
      /[\u0800-\uffff]/g,  // U+0800 - U+FFFF => 3 bytes 1110xxxx, 10yyyyyy, 10zzzzzz
      function(c) { 
        var cc = c.charCodeAt(0); 
        return String.fromCharCode(0xe0 | cc>>12, 0x80 | cc>>6&0x3F, 0x80 | cc&0x3f); }
    );
  return strUtf;
}

/**
 * Decode utf-8 encoded string back into multi-byte Unicode characters
 *
 * @param {String} strUtf UTF-8 string to be decoded back to Unicode
 * @returns {String} decoded string
 */
Utf8.decode = function(strUtf) {
  // note: decode 3-byte chars first as decoded 2-byte strings could appear to be 3-byte char!
  var strUni = strUtf.replace(
      /[\u00e0-\u00ef][\u0080-\u00bf][\u0080-\u00bf]/g,  // 3-byte chars
      function(c) {  // (note parentheses for precence)
        var cc = ((c.charCodeAt(0)&0x0f)<<12) | ((c.charCodeAt(1)&0x3f)<<6) | ( c.charCodeAt(2)&0x3f); 
        return String.fromCharCode(cc); }
    );
  strUni = strUni.replace(
      /[\u00c0-\u00df][\u0080-\u00bf]/g,                 // 2-byte chars
      function(c) {  // (note parentheses for precence)
        var cc = (c.charCodeAt(0)&0x1f)<<6 | c.charCodeAt(1)&0x3f;
        return String.fromCharCode(cc); }
    );
  return strUni;
}

四、参考

加密算法(原版)：https://www.cnblogs.com/pengyingh/articles/4829871.html

https://bbs.pediy.com/thread-214012.htm

https://www.jianshu.com/p/22b56d977825