网马解密大讲堂——网马解密中级篇006(Base64篇)
本帖最后由 roxiel 于 2009-8-20 11:49 编辑by kongzi
一. Base64加密原理：(摘自小聪大牛的博客)
把每三个字符，共24位2进制的ASCII码，折分成连续4个6位的ASCII码，再在每个ASCII码前面补00变成8位， 最后对应一个码表来变成编码字符：
码表为（从0～63分别依次对应）：
0对应A………………………………………………………………………………63对应/
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
如果最后不够3位数，则补0，这时后面对应的编码是“=”
例：原文： a b c
ASCII码： 01100001 | 01100010 | 01100011
分成4个： 011000 | 010110 | 001001 | 100011
补足位数： 00011000 | 00010110 | 00001001 | 00100011
数值大小： 24 22 9 35
对应编码： Y W J j
编码结果： YWJj
如果只有ab两个字符，则第三个字符用全0来代替，这时结果为YWI=
其实按照算法，=对应的编码其实也可以认为是为0，所以QQ==和QQAA用来解密的话，都是A，但是后面补0时用“=”是加密算法自己的设置，所以加密结果只能是QQ==而不会是QQAA
知道了加密原理，解密原理就反其道而行之就行了，呵呵……
二.加密特征：
大小写字母及数字混排，末尾可能包含等号
三. Base64解密方法：
我们还是以一个实例来简单讲解base64解密方法，在实际的网马解密中，这种加密方式很少见。今天我们提供一种解密的方法，
在这里用到的解密工具为：notepad++ 这个软件(附件为notepad++)。后续我们还会讲解使用一些其他的解密工具来解密base64。
我们来看一个base64的源代码：
YgBlAGcAaQBuADwAYgByAD4AMAA4ADEAMgAwADcALAAxACwAMQAsADEALAAyADAAMAAsADAALAAwACwAMQAwACwAOQAwACwAMAAsACwAMwAwACwALAAwACwAMQAsADEAMAAwACwAMQAsADAALAAxADgAMAAsADYAMAAsADEAMAAsADMALAAxADAALAAwACwAOQAwACwAMQAyADMANAAsADAAPABiAHIAPgAsAGgAdAB0AHAAOgAvAC8AdwB3AHcALgBjAG4AZwBnAC4AbwByAGcALwBhAGQALwBhAGQAMQAuAGUAeABlACwAYQBkADEALAAxADMAOQAwADAAMAAsADUAMAAwADAAMAAwACwAMQAsADEALAAsADsAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAGMAbgBnAGcALgBvAHIAZwAvAGEAZAAvAG0AcwBuADAANwA0AC4AZQB4AGUALABtAHMAbgAsADEANAA3ADAAMAAwACwANQAwADAAMAAwADAALAAyACwAMQAsACwAOwBoAHQAdABwADoALwAvAHcAdwB3AC4AYwBuAGcAZwAuAG8AcgBnAC8AYQBkAC8AcQBxADIAMwAuAGUAeABlACwAcQBxACwANAA3ADAAMAAwACwANQAwADAAMAAwADAAMAAsADMALAAxACwALAA7ADwAYgByAD4APABiAHIAPgA2ADAAPABiAHIAPgA8AGIAcgA+ADwAYgByAD4APABiAHIAPgAxADEALAAxACwAMQAwADAALAAwAC0AMgA0ACwAMgA1ADAALAAxADAAMAAsACgAMAAsADAAOwApACwAMQAzADAALAA1ADAAMAAsACgAYQBsAGwAKQAsAGgAdAB0AHAAJQAzAEEALwAvAHcAdwB3AC4AdQBkADkAOQAuAGMAbwBtAC8AdAByAGEAYwBrAC4AYQBzAHAAeAAlADMARgB0AHkAcABlACUAMwBEAEMAUABBACUAMgA2AGkAZAAlADMARAA5ADkAMwAsACwAMAAsADAALAAwACwAMQAsADAALAAsADAAPABiAHIAPgAyADEAMAAwADAAMAAwACwAMQAwADAALAAwAC0AMgA0ACwAMAAsAGgAdAB0AHAAOgAvAC8AdwB3AHcALgB1AGQAOQA5AC4AYwBvAG0ALwB0AHIAYQBjAGsALgBhAHMAcAB4AD8AdAB5AHAAZQA9AEMAUABTACYAaQBkAD0AOQA5ADMAJgBjAG8AZABlAD0AMQAwADMAMQAyADMAMQAsAGgAdAB0AHAAJQAzAEEALwAvAHcAdwB3AC4AYgBhAGkAZAB1AC4AYwBvAG0ALwA8AGIAcgA+ADIAMQAwADAAMAAwADAALAAxADAAMAAsADAALQAyADQALAAwACwAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAHUAZAA5ADkALgBjAG8AbQAvAHQAcgBhAGMAawAuAGEAcwBwAHgAPwB0AHkAcABlAD0AQwBQAFMAJgBpAGQAPQA5ADkAMwAmAGMAbwBkAGUAPQAxADAAMwAxADIAMwAxACwAaAB0AHQAcAAlADMAQQAvAC8AdwB3AHcALgAxADYAMwAuAGMAbwBtAC8APABiAHIAPgAyADEAMAAwADAAMAAwACwAMQAwADAALAAwAC0AMgA0ACwAMAAsAGgAdAB0AHAAOgAvAC8AdwB3AHcALgB1AGQAOQA5AC4AYwBvAG0ALwB0AHIAYQBjAGsALgBhAHMAcAB4AD8AdAB5AHAAZQA9AEMAUABTACYAaQBkAD0AOQA5ADMAJgBjAG8AZABlAD0AMQAwADMAMQAyADMAMQAsAGgAdAB0AHAAJQAzAEEALwAvAHcAdwB3AC4AcwBpAG4AYQAuAGMAbwBtAC8APABiAHIAPgAyADEAMAAwADAAMAAwACwAMQAwADAALAAwAC0AMgA0ACwAMAAsAGgAdAB0AHAAOgAvAC8AdwB3AHcALgB1AGQAOQA5AC4AYwBvAG0ALwB0AHIAYQBjAGsALgBhAHMAcAB4AD8AdAB5AHAAZQA9AEMAUABTACYAaQBkAD0AOQA5ADMAJgBjAG8AZABlAD0AMQAwADMAMQAyADMAMQAsAGgAdAB0AHAAJQAzAEEALwAvAHcAdwB3AC4AcwBvAGgAdQAuAGMAbwBtAC8APABiAHIAPgAyADEAMAAwADAAMAAwACwAMQAwADAALAAwAC0AMgA0ACwAMAAsAGgAdAB0AHAAOgAvAC8AdwB3AHcALgB1AGQAOQA5AC4AYwBvAG0ALwB0AHIAYQBjAGsALgBhAHMAcAB4AD8AdAB5AHAAZQA9AEMAUABTACYAaQBkAD0AOQA5ADMAJgBjAG8AZABlAD0AMQAwADMAMQAyADMAMQAsAGgAdAB0AHAAJQAzAEEALwAvAHcAdwB3AC4AdABhAG8AYgBhAG8ALgBjAG8AbQAvADwAYgByAD4AZQBuAGQAPABiAHIAPgA=
将上述代码复制粘贴到notepad++，详细步骤参看下例截图：
接下来ctrl+a选中代码，
点击TextFX菜单下TextFXTools下的Base64 Decode后，
点击file下的save as(另存为)，将代码保存为扩展名为txt(文件名任意)的文件。
直接打开保存好的文档即可看到解密后的内容。
最终的解密结果相见下图，红色框中内容均为病毒的下载地址(可能已失效)：
好东西是要拿出来分享 学习 你这样的东西对付一些网络封包有帮助吗？ 学习了..
谢谢楼主 只会操作啊。。。 真的感谢你的 东西 非常好 感谢52pojie的团队和所有乐于奉献的朋友，希望52pojie越做越好。。。 支持感谢学习中您辛苦了 感谢啊，好贴 膜拜楼主。。
页:
[1]
2