当前位置：首页 > news >正文

AT89C51 利用SBIT寻址,并且在内存中实现伪动态密码的混淆

news 2025/4/30 13:28:54

前置发现 && 分析

请添加图片描述

char bdata DB[2]; //char
sbit x = bdata DB[0]^7; //取内存地址数组[0]地址的的七位

这样我们可以对数组DB中索引0的位置进行修改…

例如,将密码A映射到真实密码C,这样做的好处是你的程序被逆向分析的时候,攻击者无法真正知道密码到底是什么…因为真密码没有明文保存在某段内存中(伪动态)

char bdata DB[2];  //char
DB[0]='A'; // 由于A的ASCII的十六进制是41->二进制 0100 0001
//我们可以通过sbit控制该地址上的某个位来进行偏移,达到我们的混淆效果
sbit x = bdata DB[0]^1;  //取内存地址数组[0]地址的的2位
// H <- L
x = 1
// 'C'的ASCII是43 二进制->0100 0011
// 将0100 0001 -> 0100 0011
// 假设我们的BD起始存储位置在内存0x80地址，则0x80首次存贮了0x41，通过x=1我们成功的将DB[0]中从A变成了C

实验

#include <REGX51.H>sbit led = P2^0;      // Define LED connected to P2.0
sbit led2 = P2^1;     // Define second LED connected to P2.1
sbit button = P1^0;   // Define button connected to P1.0
char bdata fackPassword[5] = "G"; // Fake password (initially set to 'G')
sbit MY_REGISTER = fackPassword[0] ^ 2; // Confuse (no real function)// Delay function
void Delay(unsigned int time) {while(time--); // Simple delay loop
}// Main function
void main() {led = 0;   // Initialize LED to offled2 = 0;  // Initialize second LED to offwhile(1) { // Infinite loopMY_REGISTER = 0; // Repeated operation (can be omitted)// Check if the fake password is 'E'if (fackPassword[0] == 'E') {led = 1; // Turn on LED} else {led = 0; // Turn off LED}// Check if the fake password is 'C'if (fackPassword[0] == 'C') {led2 = 1; // Turn on second LED} else {led2 = 0; // Turn off second LED}} // End of infinite loop
}

这段demo中,我定义了一个假密码’G’,最总也就是从’G’修改成’C’。最后进入语句if (fackPassword[0] == 'C')并且led2=1

通过DEBUG调试,很明显这个G被修改成了C,意味着我们的混淆起作用了

请添加图片描述

再次修改代码，这次通过一个按钮来模拟混淆触发事件

#include <REGX51.H>sbit led = P2^0;      // Define LED connected to P2.0
sbit led2 = P2^1;     // Define second LED connected to P2.1
sbit button = P1^0;   // Define button connected to P1.0
char bdata fackPassword[5] = "G"; // Fake password (initially set to 'G')
sbit MY_REGISTER = fackPassword[0] ^ 2; // Confuse (no real function)// Delay function
void Delay(unsigned int time) {while(time--); // Simple delay loop
}// Main function
void main() {led = 0;   // Initialize LED to offled2 = 0;  // Initialize second LED to offwhile(1) { // Infinite loopif (button == 0) { // Check if button is pressedDelay(100); // Debounce delayif (button == 0) { // Confirm button is still pressedMY_REGISTER = 0; // Update MY_REGISTERwhile(button == 0); // Wait until button is released}}// Check if the fake password is 'E'if (fackPassword[0] == 'G') {led = 1; // Turn on LED} else {led = 0; // Turn off LED}// Check if the fake password is 'C'if (fackPassword[0] == 'C') {led2 = 1; // Turn on second LED} else {led2 = 0; // Turn off second LED}} // End of infinite loop
}

为此我们画一个仿真图纸

请添加图片描述