scrypt算法，不多解释。
可直接在windows、linux、android（ndk）上编译。
crypto_scrypt.h
/*- * Copyright 2009 Colin Percival * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * This file was originally written by Colin Percival as part of the Tarsnap * online backup system. */ #ifndef _CRYPTO_SCRYPT_H_ #define _CRYPTO_SCRYPT_H_ #include <stdint.h> /** * crypto_scrypt(passwd, passwdlen, salt, saltlen, N, r, p, buf, buflen): * Compute scrypt(passwd[0 .. passwdlen - 1], salt[0 .. saltlen - 1], N, r, * p, buflen) and write the result into buf. The parameters r, p, and buflen * must satisfy r * p < 2^30 and buflen <= (2^32 - 1) * 32. The parameter N * must be a power of 2 greater than 1. * * Return 0 on success; or -1 on error. */ int crypto_scrypt(const uint8_t *, size_t, const uint8_t *, size_t, uint64_t, uint32_t, uint32_t, uint8_t *, size_t); #endif /* !_CRYPTO_SCRYPT_H_ */
安卓很早就开始启用了gatekeeper的锁屏密码机制，如果未启用TEE的情况下，是默认使用“软加密”的方式，可以离线破解出原始密码，知道原始密码在某些情况下还是比较有用的，以下是破解实例，自行调整。
import struct
import binascii
import scrypt
N = 16384;
r = 8;
p = 1;
f = open('gatekeeper.password.key', 'rb')
blob = f.read()
s = struct.Struct('<'+'17s 8s 32s')
(meta, salt, signature) = s.unpack_from(blob)
for one in "0123456789":
for two in "0123456789":
for three in "0123456789":
for four in "0123456789":
password = one + two + three + four;
print 'pass: %s' % password
to_hash = meta
to_hash += password
hash = scrypt.hash(to_hash, salt, N, r, p)
print 'signature %s' % signature.encode('hex')
print 'Hash: %s' % hash[0:32].encode('hex')
if hash[0:32] == signature:
print "OK"
exit()工作中经常用到protobuf的场景，但是由于protobuf不是明文信息，在调试和检查时不是很直观，于是就有转换为json的需求，方便排查。
json使用的jsoncpp库，自行补上头文件等。
void _field2json(const Message& msg, const FieldDescriptor *field, size_t index, Json::Value &jsonValue)
{
const Reflection *ref = msg.GetReflection();
const bool repeated = field->is_repeated();
switch (field->cpp_type())
{
#define _CONVERT(type, ctype, sfunc, afunc) \
case FieldDescriptor::type: { \
const ctype value = (repeated)? \
ref->afunc(msg, field, index): \
ref->sfunc(msg, field); \
jsonValue = value; \
break; \
}
_CONVERT(CPPTYPE_DOUBLE, double, GetDouble, GetRepeatedDouble);
_CONVERT(CPPTYPE_FLOAT, double, GetFloat, GetRepeatedFloat);
_CONVERT(CPPTYPE_INT64, INT64, GetInt64, GetRepeatedInt64);
_CONVERT(CPPTYPE_UINT64, UINT64, GetUInt64, GetRepeatedUInt64);
_CONVERT(CPPTYPE_INT32, INT32, GetInt32, GetRepeatedInt32);
_CONVERT(CPPTYPE_UINT32, UINT32, GetUInt32, GetRepeatedUInt32);
_CONVERT(CPPTYPE_BOOL, bool, GetBool, GetRepeatedBool);
#undef _CONVERT
case FieldDescriptor::CPPTYPE_STRING: {
std::string scratch;
const std::string &value = (repeated) ?
ref->GetRepeatedStringReference(msg, field, index, &scratch) :
ref->GetStringReference(msg, field, &scratch);
if (field->type() == FieldDescriptor::TYPE_BYTES)
jsonValue = base64_encode((const unsigned char *)value.c_str(), value.length());
else
jsonValue = value.c_str();
break;
}
case FieldDescriptor::CPPTYPE_MESSAGE: {
const Message& mf = (repeated) ?
ref->GetRepeatedMessage(msg, field, index) :
ref->GetMessage(msg, field);
jsonValue = Protobuf2Json(mf);
break;
}
case FieldDescriptor::CPPTYPE_ENUM: {
const EnumValueDescriptor* ef = (repeated) ?
ref->GetRepeatedEnum(msg, field, index) :
ref->GetEnum(msg, field);
jsonValue = ef->number();
break;
}
default:
break;
}
//if (!jf) throw j2pb_error(field, "Fail to convert to json");
//return jsonRet;
}
Json::Value Protobuf2Json(const Message &msg)
{
Json::Value jsonRet;
const Descriptor *d = msg.GetDescriptor();
const Reflection *ref = msg.GetReflection();
if (!d || !ref)
return jsonRet;
std::vector<const FieldDescriptor *> fields;
ref->ListFields(msg, &fields);
for (size_t i = 0; i != fields.size(); i++)
{
const FieldDescriptor *field = fields[i];
const std::string &name = (field->is_extension()) ? field->full_name() : field->name();
if (field->is_repeated())
{
size_t count = ref->FieldSize(msg, field);
if (!count)
continue;
for (size_t j = 0; j < count; j++)
_field2json(msg, field, j, jsonRet[name][j]);
}
else if (ref->HasField(msg, field))
_field2json(msg, field, 0, jsonRet[name]);
else
continue;
}
return jsonRet;
}安卓相册中有一个隐藏目录，里面有一个thumbdata后缀的文件，经常会非常大（几个G），这就是类似于电脑的thumb.db一样是图片的缩略图缓存文件，用于加速相册等应用显示的。
如果相册里面的照片删除后，这个缓存里面的是不会自动清理的，所以经常被利用来恢复照片，缺点是缩略图，太小了。
这个缓存数据结构是块的，具体也不解释了，直接贴代码好了：
import os
from struct import *
currpath = "D:\\recovery"
filename = ".thumbdata4--1967290299"
offset=0
file_size=os.path.getsize(filename)
f=open(filename, "rb")
while(offset<file_size):
f.seek(offset)
tmp=f.read(10000)
if tmp[0]=="\x01":
#print offset
#normal mode and xiaomi mode
if tmp[21]!="\xFF": #normal mode
tmp_magic_code=tmp[1:9]
tmp_jpg_size=tmp[9:13]
#magic_code=unpack("i",tmp_magic_code[::-1])
jpg_size=unpack("I",tmp_jpg_size[::-1])
#print jpg_size
f2=open(currpath + "\\" + str(offset/10000) + ".jpg","wb")
f.seek(offset + 13)
f2.write(f.read(int(jpg_size[0])))
#print "extracting " + str(offset/10000) + ".jpg"
else:
tmp_magic_code = tmp[1:17]
tmp_jpg_size = tmp[17:21]
jpg_size=unpack("I",tmp_jpg_size[::-1])
#print jpg_siz
f2 = open(currpath + "\\" + str(offset / 10000) + ".jpg", "wb")
f.seek(offset + 21)
f2.write(f.read(int(jpg_size[0])))
#print "extracting " + str(offset / 10000) + ".jpg"
offset+=10000
print "All Done!"IOS通过备份，得到的目录里面是一片乱码（严格来说是sha1编码）。解析出具体的文件列表的分析有很多了，整理了一下，写出来。
大概介绍下，这个文件的开头是“mbdb”，前六个字节一般是固定的“mbdb\05\00”，然后就是一个个结构体。结构体大概是这样子的：
struct fileinfo{
char *domain;
char *filename;
char *linktarget;
char *datahash;
char *unknown1;
unsigned short mode;
unsigned int unknown2;
unsigned int inode;
unsigned int userid;
unsigned int groupid;
unsigned int mtime;
unsigned int atime;
unsigned int ctime;
unsigned long long filelen;
unsigned int flag;
unsigned int numprops;
};domain就是包名，每个应用都不同。filename就是path。datahash发现现在都是空的了，无用。最后就是那个numprops是附加数据，这个必须处理。flag为0是文件夹或者link，也可以通过filelen来判断是否为文件。