【VB】VB6＋ASM写文件的SHA1哈希值计算工具

0xAA55

BIN下载： sha1_demo_bin.7z (11.62 KB, 下载次数: 21)

2016-6-11 01:54 上传

点击文件名下载附件

要下载源代码请先回帖。

游客，如果您要查看本帖隐藏内容请回复

VB6用自己的加减乘除与或非进行位运算的话有个先天性不足：左移或右移难以实现。VB6的IDE有整数溢出检查，挺麻烦的。
然后SHA1的算法是需要做 leftrotate 运算的。所以要是用加减乘除来模拟左移和右移就会严重影响速度。因此我写了个Shellcode，用这个Shellcode完成SHA1的区块处理。

1. bits 32
   
2. 
   
3. _SHA1_ProcChunk:
   
4. 
   
5. ;[esp+4]        void*psrc // uint8_t src[64]
   
6. ;[esp+8]        uint32_t pstate[5]
   
7. 
   
8. push esi
   
9. push edi
   
10. 
    
11. %define SizeOfTempVar (80*4+6*4)
    
12. %define OffsetToInitESP (SizeOfTempVar+8)
    
13. ;Parameters
    
14. %define pSrcData_ [esp+OffsetToInitESP+4]
    
15. %define pSHA1States_ [esp+OffsetToInitESP+8]
    
16. ;Local vars
    
17. %define WordBuf (esp+6*4)
    
18. %define A_ [esp+0*4]
    
19. %define B_ [esp+1*4]
    
20. %define C_ [esp+2*4]
    
21. %define D_ [esp+3*4]
    
22. %define E_ [esp+4*4]
    
23. %define T_ [esp+5*4]
    
24. %macro MovRegs 0
    
25. mov T_,eax
    
26. mov eax,D_
    
27. mov E_,eax
    
28. mov eax,C_
    
29. mov D_,eax
    
30. mov eax,B_
    
31. rol eax,30
    
32. mov C_,eax
    
33. mov eax,A_
    
34. mov B_,eax
    
35. mov eax,T_
    
36. mov A_,eax
    
37. %endmacro
    
38. 
    
39. ;Allocate memory from stack
    
40. sub esp,SizeOfTempVar
    
41. 
    
42. ;break chunk into sixteen 32-bit big-endian words w[i], 0 ≤ i ≤ 15
    
43. mov ecx,16
    
44. mov esi,pSrcData_
    
45. lea edi,[WordBuf]
    
46. .InitWords:
    
47. lodsd
    
48. bswap eax
    
49. stosd
    
50. loop .InitWords
    
51. 
    
52. ;Extend the sixteen 32-bit words into eighty 32-bit words:
    
53. ;for i from 16 to 79
    
54. ;    w[i] = (w[i-3] xor w[i-8] xor w[i-14] xor w[i-16]) leftrotate 1
    
55. lea edi,[WordBuf+16*4]
    
56. mov ecx,64
    
57. .InitAllWords:
    
58. mov eax,[edi-3*4]
    
59. xor eax,[edi-8*4]
    
60. xor eax,[edi-14*4]
    
61. xor eax,[edi-16*4]
    
62. rol eax,1
    
63. stosd
    
64. loop .InitAllWords
    
65. 
    
66. ;Initialize hash value for this chunk:
    
67. ;a = h0
    
68. ;b = h1
    
69. ;c = h2
    
70. ;d = h3
    
71. ;e = h4
    
72. mov esi,pSHA1States_
    
73. lea edi,A_
    
74. mov ecx,5
    
75. rep movsd
    
76. 
    
77. lea esi,[WordBuf]
    
78. 
    
79. ;========
    
80. mov ecx,20
    
81. .ProcStep1:
    
82. mov eax,B_
    
83. mov edx,eax
    
84. and eax,C_ ;B & C
    
85. not edx
    
86. and edx,D_ ;(~B) & D
    
87. or eax,edx ;(B & C) | ((~B) & D)
    
88. mov edx,A_
    
89. rol edx,5
    
90. add edx,eax ;+ rotateleft(A,5)
    
91. lodsd
    
92. add eax,edx ;+ W[i]
    
93. add eax,E_  ;+ E
    
94. add eax,0x5A827999 ;+ K
    
95. MovRegs
    
96. loop .ProcStep1
    
97. 
    
98. ;========
    
99. mov ecx,20
    
100. .ProcStep2:
     
101. mov eax,A_
     
102. rol eax,5  ;rorareleft(A,5)
     
103. mov edx,B_
     
104. xor edx,C_
     
105. xor edx,D_ ;B^C^D
     
106. add eax,E_
     
107. add edx,eax
     
108. lodsd
     
109. add eax,edx;+ W[i]
     
110. add eax,0x6ED9EBA1;+ K
     
111. MovRegs
     
112. loop .ProcStep2
     
113. 
     
114. ;========
     
115. mov ecx,20
     
116. .ProcStep3:
     
117. mov edx,B_
     
118. and edx,D_ ;B & D
     
119. mov eax,B_
     
120. and eax,C_ ;B & C
     
121. or edx,eax
     
122. mov eax,C_
     
123. and eax,D_ ;C & D
     
124. or edx,eax
     
125. mov eax,A_
     
126. rol eax,5  ;rorareleft(A,5)
     
127. add eax,E_
     
128. add edx,eax
     
129. lodsd
     
130. add eax,edx;+ W[i]
     
131. add eax,0x8F1BBCDC;+ K
     
132. MovRegs
     
133. loop .ProcStep3
     
134. 
     
135. ;========
     
136. mov ecx,20
     
137. .ProcStep4:
     
138. mov eax,A_
     
139. rol eax,5  ;rorareleft(A,5)
     
140. mov edx,B_
     
141. xor edx,C_
     
142. xor edx,D_ ;B^C^D
     
143. add eax,E_
     
144. add edx,eax
     
145. lodsd
     
146. add eax,edx;+ W[i]
     
147. add eax,0xCA62C1D6;+ K
     
148. MovRegs
     
149. loop .ProcStep4
     
150. 
     
151. ;Finished
     
152. mov edi,pSHA1States_
     
153. mov eax,A_
     
154. add [edi+0*4],eax
     
155. mov eax,B_
     
156. add [edi+1*4],eax
     
157. mov eax,C_
     
158. add [edi+2*4],eax
     
159. mov eax,D_
     
160. add [edi+3*4],eax
     
161. mov eax,E_
     
162. add [edi+4*4],eax
     
163. 
     
164. add esp,SizeOfTempVar
     
165. 
     
166. pop edi
     
167. pop esi
     
168. ret 16

复制代码

因为我打算用CallWindowProc来调用它，因此它其实是被当作LRESULT CALLBACK WndProc(HWND,UINT,WPARAM,LPARAM);来调用的。但其实第一个参数是数据Chunk的指针，第二个参数是SHA1状态结构体（存储5个uint32_t）的指针。

1. Attribute VB_Name = "modSHA1"
   
2. Option Explicit
   
3. 
   
4. Type SHA1State_t
   
5.     h0 As Long
   
6.     h1 As Long
   
7.     h2 As Long
   
8.     h3 As Long
   
9.     h4 As Long
   
10. End Type
    
11. 
    
12. Private Declare Function CallProc4Param Lib "user32" Alias "CallWindowProcA" (ByVal lpPrevWndFunc As Long, ByVal Param1 As Long, ByVal Param2 As Long, ByVal Param3 As Long, ByVal Param4 As Long) As Long
    
13. Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (Destination As Any, Source As Any, ByVal Length As Long)
    
14. Private Declare Sub ZeroMemory Lib "kernel32" Alias "RtlZeroMemory" (Dest As Any, ByVal numBytes As Long)
    
15. Private Declare Function GetSystemDefaultLCID Lib "kernel32" () As Long
    
16. 
    
17. 
    
18. Private m_Ops(121) As Long
    
19. 
    
20. Sub SHA1_Init(State As SHA1State_t)
    
21. 
    
22. m_Ops(0) = &HEC815756:   m_Ops(1) = &H158&:       m_Ops(2) = &H10B9&:      m_Ops(3) = &H24B48B00:   m_Ops(4) = &H164&
    
23. m_Ops(5) = &H18247C8D:   m_Ops(6) = &HABC80FAD:   m_Ops(7) = &H7C8DFAE2:   m_Ops(8) = &H40B95824:   m_Ops(9) = &H8B000000
    
24. m_Ops(10) = &H4733F447:  m_Ops(11) = &HC84733E0:  m_Ops(12) = &HD1C04733:  m_Ops(13) = &HEFE2ABC0:  m_Ops(14) = &H6824B48B
    
25. m_Ops(15) = &H8D000001:  m_Ops(16) = &H5B9243C:   m_Ops(17) = &HF3000000:  m_Ops(18) = &H24748DA5:  m_Ops(19) = &H14B918
    
26. m_Ops(20) = &H448B0000:  m_Ops(21) = &HC2890424:  m_Ops(22) = &H8244423:   m_Ops(23) = &H5423D2F7:  m_Ops(24) = &HD0090C24
    
27. m_Ops(25) = &HC124148B:  m_Ops(26) = &HC20105C2:  m_Ops(27) = &H3D001AD:   m_Ops(28) = &H5102444:   m_Ops(29) = &H5A827999
    
28. m_Ops(30) = &H14244489:  m_Ops(31) = &HC24448B:   m_Ops(32) = &H10244489:  m_Ops(33) = &H824448B:   m_Ops(34) = &HC244489
    
29. m_Ops(35) = &H424448B:   m_Ops(36) = &H891EC0C1:  m_Ops(37) = &H8B082444:  m_Ops(38) = &H44892404:  m_Ops(39) = &H448B0424
    
30. m_Ops(40) = &H4891424:   m_Ops(41) = &HB9ABE224:  m_Ops(42) = &H14&:       m_Ops(43) = &HC124048B:  m_Ops(44) = &H548B05C0
    
31. m_Ops(45) = &H54330424:  m_Ops(46) = &H54330824:  m_Ops(47) = &H44030C24:  m_Ops(48) = &HC2011024:  m_Ops(49) = &H5D001AD
    
32. m_Ops(50) = &H6ED9EBA1:  m_Ops(51) = &H14244489:  m_Ops(52) = &HC24448B:   m_Ops(53) = &H10244489:  m_Ops(54) = &H824448B
    
33. m_Ops(55) = &HC244489:   m_Ops(56) = &H424448B:   m_Ops(57) = &H891EC0C1:  m_Ops(58) = &H8B082444:  m_Ops(59) = &H44892404
    
34. m_Ops(60) = &H448B0424:  m_Ops(61) = &H4891424:   m_Ops(62) = &HB9B1E224:  m_Ops(63) = &H14&:       m_Ops(64) = &H424548B
    
35. m_Ops(65) = &HC245423:   m_Ops(66) = &H424448B:   m_Ops(67) = &H8244423:   m_Ops(68) = &H448BC209:  m_Ops(69) = &H44230824
    
36. m_Ops(70) = &HC2090C24:  m_Ops(71) = &HC124048B:  m_Ops(72) = &H440305C0:  m_Ops(73) = &HC2011024:  m_Ops(74) = &H5D001AD
    
37. m_Ops(75) = &H8F1BBCDC:  m_Ops(76) = &H14244489:  m_Ops(77) = &HC24448B:   m_Ops(78) = &H10244489:  m_Ops(79) = &H824448B
    
38. m_Ops(80) = &HC244489:   m_Ops(81) = &H424448B:   m_Ops(82) = &H891EC0C1:  m_Ops(83) = &H8B082444:  m_Ops(84) = &H44892404
    
39. m_Ops(85) = &H448B0424:  m_Ops(86) = &H4891424:   m_Ops(87) = &HB9A1E224:  m_Ops(88) = &H14&:       m_Ops(89) = &HC124048B
    
40. m_Ops(90) = &H548B05C0:  m_Ops(91) = &H54330424:  m_Ops(92) = &H54330824:  m_Ops(93) = &H44030C24:  m_Ops(94) = &HC2011024
    
41. m_Ops(95) = &H5D001AD:   m_Ops(96) = &HCA62C1D6:  m_Ops(97) = &H14244489:  m_Ops(98) = &HC24448B:   m_Ops(99) = &H10244489
    
42. m_Ops(100) = &H824448B:  m_Ops(101) = &HC244489:  m_Ops(102) = &H424448B:  m_Ops(103) = &H891EC0C1: m_Ops(104) = &H8B082444
    
43. m_Ops(105) = &H44892404: m_Ops(106) = &H448B0424: m_Ops(107) = &H4891424:  m_Ops(108) = &H8BB1E224: m_Ops(109) = &H16824BC
    
44. m_Ops(110) = &H48B0000:  m_Ops(111) = &H8B070124: m_Ops(112) = &H1042444:  m_Ops(113) = &H448B0447: m_Ops(114) = &H47010824
    
45. m_Ops(115) = &H24448B08: m_Ops(116) = &HC47010C:  m_Ops(117) = &H1024448B: m_Ops(118) = &H81104701: m_Ops(119) = &H158C4
    
46. m_Ops(120) = &HC25E5F00: m_Ops(121) = &H10&
    
47. 
    
48. State.h0 = &H67452301
    
49. State.h1 = &HEFCDAB89
    
50. State.h2 = &H98BADCFE
    
51. State.h3 = &H10325476
    
52. State.h4 = &HC3D2E1F0
    
53. 
    
54. Int64_InitGlobal
    
55. End Sub
    
56. 
    
57. '读取sha1.bin并在立即窗口打印数组
    
58. 'Sub SHA1_LoadOps()
    
59. 'Dim Ops() As Long
    
60. 'Open App.Path & "\sha1.bin" For Binary Access Read As #1
    
61. 'ReDim Ops(LOF(1) \ 4)
    
62. 'Get #1, , Ops
    
63. 'Close #1
    
64. '
    
65. 'Dim I&, X&
    
66. 'For I = 0 To UBound(Ops)
    
67. '    X = X + 1
    
68. '    If X > 4 Then
    
69. '        Debug.Print "m_Ops("; CStr(I); ") = &H"; Hex$(Ops(I)); "&"
    
70. '        X = 0
    
71. '    Else
    
72. '        Debug.Print "m_Ops("; CStr(I); ") = &H"; Hex$(Ops(I)); "&:";
    
73. '    End If
    
74. 'Next
    
75. 'End Sub
    
76. 
    
77. '处理每个64字节区块
    
78. Sub SHA1_ProcChunk(State As SHA1State_t, ByVal ChunkPtr As Long)
    
79. CallProc4Param VarPtr(m_Ops(0)), ChunkPtr, VarPtr(State), 0, 0
    
80. End Sub
    
81. 
    
82. '处理最后一个区块
    
83. Sub SHA1_ProcLastChunk(State As SHA1State_t, ByVal LastDataPtr As Long, ByVal cbLastData As Long, cbTotal As Int64_t)
    
84. Dim Padded(63) As Byte
    
85. Dim BETotalBits As Int64_t
    
86. 
    
87. '规则：
    
88. '在数据的最后一个字节后面添加一个0x80
    
89. '总数据用0补足为64字节的N倍大小
    
90. '将数据最后的8个字节替换成，数据的总bits的Big-Ending顺序方式存储
    
91. '然后做一次区块计算
    
92. 
    
93. BETotalBits = cbTotal
    
94. Int64_Shl BETotalBits, 3 'Bytes * 8
    
95. Int64_BSWAP BETotalBits
    
96. 
    
97. If cbLastData + 9 <= 64 Then
    
98.     CopyMemory Padded(0), ByVal LastDataPtr, cbLastData
    
99.     Padded(cbLastData) = &H80 'Last bit
    
100.     CopyMemory Padded(56), BETotalBits, 8
     
101.     SHA1_ProcChunk State, VarPtr(Padded(0))
     
102. ElseIf cbLastData = 64 Then
     
103.     SHA1_ProcChunk State, LastDataPtr
     
104.     Padded(0) = &H80
     
105.     CopyMemory Padded(56), BETotalBits, 8
     
106.     SHA1_ProcChunk State, VarPtr(Padded(0))
     
107. Else
     
108.     CopyMemory Padded(0), ByVal LastDataPtr, cbLastData
     
109.     Padded(cbLastData) = &H80  'Last bit
     
110.     SHA1_ProcChunk State, VarPtr(Padded(0))
     
111.    
     
112.     ZeroMemory Padded(0), 64
     
113.     CopyMemory Padded(56), BETotalBits, 8
     
114.     SHA1_ProcChunk State, VarPtr(Padded(0))
     
115. End If
     
116. End Sub
     
117. 
     
118. '将处理后的5个寄存器输出为字符串
     
119. Function SHA1_GetResultStr(State As SHA1State_t) As String
     
120. SHA1_GetResultStr = Hex32(State.h0) & Hex32(State.h1) & Hex32(State.h2) & Hex32(State.h3) & Hex32(State.h4)
     
121. End Function
     
122. 
     
123. '数字转换为用0补足的8位十六进制数字字符串
     
124. Private Function Hex32(ByVal Num As Long) As String
     
125. Hex32 = Right$("0000000" & Hex$(Num), 8)
     
126. End Function
     
127. 
     
128. '计算字符串的SHA1值
     
129. Function SHA1_CalcStringSHA1(ByVal StrToCalc As String, Optional ByVal LocaleID As Long) As String
     
130. Dim MBArr() As Byte, cbMBArr As Int64_t
     
131. If LocaleID = 0 Then LocaleID = GetSystemDefaultLCID
     
132. MBArr = StrConv(StrToCalc, vbFromUnicode, LocaleID)
     
133. cbMBArr.L = UBound(MBArr) + 1
     
134. 
     
135. Dim State As SHA1State_t, I&
     
136. SHA1_Init State
     
137. Do While I + 64 < cbMBArr.L
     
138.     SHA1_ProcChunk State, VarPtr(MBArr(I))
     
139.     I = I + 64
     
140. Loop
     
141. SHA1_ProcLastChunk State, VarPtr(MBArr(I)), cbMBArr.L - I, cbMBArr
     
142. SHA1_CalcStringSHA1 = SHA1_GetResultStr(State)
     
143. End Function
     
144. 
     
145. Function SHA1_CalcFileSHA1(ByVal FilePath As String) As String
     
146. Dim Chunk(63) As Byte, FileLen As Long
     
147. Dim ChunkLen As Int64_t
     
148. Dim SHA1State As SHA1State_t
     
149. 
     
150. SHA1_Init SHA1State
     
151. 
     
152. ChunkLen.L = 64
     
153. 
     
154. Dim FO As File_t
     
155. If File_OpenForRead(FilePath, FO) = False Then GoTo ErrHandler
     
156. Dim RestLen As Int64_t
     
157. 
     
158. RestLen = FO.Size
     
159. 
     
160. Do While RestLen.H <> 0 Or RestLen.L > 64
     
161.     File_Read FO, VarPtr(Chunk(0)), 64
     
162.     SHA1_ProcChunk SHA1State, VarPtr(Chunk(0))
     
163.     Int64_Sub RestLen, ChunkLen
     
164. Loop
     
165. 
     
166. File_Read FO, VarPtr(Chunk(0)), RestLen.L
     
167. SHA1_ProcLastChunk SHA1State, VarPtr(Chunk(0)), RestLen.L, FO.Size
     
168. File_Close FO
     
169. SHA1_CalcFileSHA1 = SHA1_GetResultStr(SHA1State)
     
170. 
     
171. Exit Function
     
172. ErrHandler:
     
173. File_Close FO
     
174. SHA1_CalcFileSHA1 = "Calc SHA1 failed."
     
175. End Function
     
176. 
     
177. 'Sub SHA1_Test()
     
178. 'Dim Blank(63) As Byte
     
179. 'Blank(0) = &H80
     
180. '
     
181. 'Dim State As SHA1State_t
     
182. '
     
183. 'SHA1_Init State
     
184. 'SHA1_ProcChunk State, VarPtr(Blank(0))
     
185. 'Debug.Print SHA1_GetResultStr(State)
     
186. 'Debug.Print "DA39A3EE5E6B4B0D3255BFEF95601890AFD80709 - 0 byte"
     
187. 'End Sub

复制代码

SHA1的详细算法，请参考以下文章：
https://en.wikipedia.org/wiki/SHA-1
http://www.mattmahoney.net/dc/sha1.c

submariner

这个看起来很赞

jasonchen

支持    ！！

olalala

好好学习天天向上

songxudong

不错的东西，谢谢楼主分享

songxudong

不错的东西谢谢楼主分享

冷清

刚开始学习。

冷清

老哥，我发现，选择大文件就会崩溃。。

besteast

oshi

先回复一下,看看里面的内容.

0xAA55

这是一个手动用汇编写无栈帧函数的实例，给局部变量从栈上分配内存＋使用esp对参数和局部变量进行寻址等。
用了宏把偏移的计算自动化了。
有栈帧便于调试，代码也好写，不过栈帧本身对于运行而言是可有可无的。
其实优不优化栈帧意义不大。

bigwind

VB】VB6＋ASM写文件的SHA1哈希值计算工具

oshi

先回复一下先.

搬砖工

看看汇编怎么做

kx25

不错，正需要这个！！！！

xiongsx

学习一下

系统消息

感觉VB6直接用WinAPI来算就够了

hxin123456

看看学习下

唐凌

可以考虑用sha扩展指令集重写一下asm，把sha1rnds4, sha1nexte, sha1msg1, sha1msg2指令代进来。
需要检测cpuid[eax=7,ecx=0].ebx[bit29]置位。

0xAA55

tangptr@126.com 发表于 2020-7-4 22:54
可以考虑用sha扩展指令集重写一下asm，把sha1rnds4, sha1nexte, sha1msg1, sha1msg2指令代进来。
需要检测c ...

在这之前我需要把文件IO改成支持超4G大文件流式读取的那种