Method and system for decrypting mail content in foxmail offline environment

Abstract

The invention discloses a method and a system for decrypting mail contents in a foxmail offline environment. The method comprises the following steps of: positioning; the key is decrypted; extracting: extracting set bytes from the encrypted file, recording the data as orderTableMateria, continuously extracting the set bytes, generating a list, and recording the list as byteTableMateria; in the decryption step, the orderTable Materials are decrypted, and a list is formed by the obtained decryption data and is recorded as the orderTable; list operation is conducted, specifically, operation processing is conducted on the byteTable Materials through the orderTable, and a list is obtained and recorded as the byteTable; obtaining elements; completing: cyclically operating the step of acquiring the elements until all bytes of the encrypted file are completely read, and then writing the encrypted file into the file to obtain a decrypted mail; according to the method and the system for decrypting the mail content in the foxmail offline environment, the target mail can be quickly positioned according to the mail trace in the Index, and the mail is decrypted after the data is extracted, so that the decryption of the mail content is realized, and more comprehensive information is obtained.

Description

Technical Field

[0001] The present invention relates to the field of mail encryption and decryption, and in particular to a method and system for decrypting mail content in a foxmail offline environment. Background Art

[0002] As a popular email client, Foxmail's local database contains important email content, which is very valuable in the process of evidence collection. By decrypting Foxmail's local email content, forensic personnel can access and analyze email headers, email bodies, attachments, etc., which may contain key clues to the case. For example, by analyzing the email sending time, sender and recipient information, email body content, etc., it can help build the case's timeline and character relationship network. In addition, decrypting local email content can also help recover deleted or damaged emails, providing additional evidence support for the case. Therefore, Foxmail's decryption of local email content plays an important role in forensic work. It can help forensic personnel understand the case more comprehensively and provide strong support for case detection.

[0003] Currently, evidence collection on FoxMail mainly relies on automatic evidence collection tools. Once the automatic evidence collection tools are used, only email traces can be extracted, and there is a lack of methods to decrypt email contents in an offline environment. Summary of the invention

[0004] Based on this, it is necessary to provide a method for decrypting email content in a foxmail offline environment that can improve performance.

[0005] At the same time, a system for decrypting email content in a foxmail offline environment is provided to improve performance.

[0006] A method for decrypting email content in a foxmail offline environment, comprising: Positioning: There is an Index.key file in the foxmail data storage path. Extract the set byte data from Index.key and record it as keyMaterial. There is an Index file in the foxmail data storage path. Get the email number that needs to be decrypted from Index and locate the encrypted file according to the email number. Decryption key: decrypt keyMaterial to obtain the decrypted data, recorded as key; Extraction: Extract the set bytes from the encrypted file, and record these data as orderTableMaterial. Continue to extract the set bytes to generate a list, which is recorded as byteTableMaterial. Decryption: Decrypt orderTableMaterial, and the decrypted data is formed into a list, recorded as orderTable; List operation: Use orderTable to operate byteTableMaterial to obtain a list, recorded as byteTable; Get element: Get a byte of data from the encrypted file, perform operations with orderTable, get a sequence number, record it as order, get the orderth element of byteTable, and store it in the corresponding position of the byte array array; Completion: Loop through the steps of getting elements until all bytes of the encrypted file are read, then create a new blank file, write the data of the byte array to the file, and get the decrypted email.

[0007] In a preferred embodiment, the positioning includes: extracting data of a set byte in Index.key as a position offset of 0x8 bytes from the beginning of the file, and then reading 0x8 bytes, recorded as keyMaterial.

[0008] In a preferred embodiment, the decryption comprises: Initial permutation: All bytes to be decrypted are grouped into 8 bytes, and the ciphertext is initially permuted to reorder the original 64-bit binary bits; Partition: divided into left and right parts, each part has 32 bits; F function processing: F round function processing is performed for 16 rounds, each round uses a 48-bit subkey, and the subkey is generated from the master key. Each round of processing includes: extended permutation, XOR with the subkey, S box permutation, P box permutation, merging the left and right parts and performing the final permutation to obtain the plaintext; Merge: The left and right parts are merged; Substitution: Perform IP inverse substitution to obtain ciphertext.

[0009] In a preferred embodiment, in the list operation step, each byte of orderTable and each byte of byteTableMaterial are XORed one by one to obtain a new byte array, that is, a replacement array of 0~0xFF, and the replacement array is rearranged according to the replacement relationship, and these 0x100 bytes are called byteTable.

[0010] In a preferred embodiment, the obtaining element includes: offsetting 0x200 + i from the beginning of the encrypted file, i = 0, 1, 2.., until the end of the encrypted file, reading 1 byte, which is the i-th byte of the email, taking i modulo 0x100, using the modulo result as an index, indexing the corresponding element from orderTable, that is, orderTable[i%0x100], XORing the i-th byte with orderTable[i%0x100], and then using the XOR result as an index to index the corresponding element from byteTable, and storing the element in the position indexed by i in the byte array array.

[0011] In a preferred embodiment, the locating step includes: confirming the installation path of foxmail, denoted as P1, then the local data storage path is: P1\Foxmail version\Storage\Mail account\Mails\, denoted as P2, receiving instructions, opening the file Index.key under P2, starting from the position of offset a in the file header, reading b bytes as keyMaterial, if the Index.key file does not exist or the required number of bytes is less than b, then opening the file Index under P2, starting from the position of offset c, reading b bytes as keyMaterial; Receive the instruction, open the file Index under P2, start at the offset 0x1C, read 4 bytes of data in little endian order, then add 8 to the data to get the size occupied by an email trace, recorded as Size, offset the Size position in the Index file, which is the starting position of the first email information, read 4 bytes in little endian order, recorded as Number, that is, the email number, and read 4 bytes of data in little endian order at the offset Size+4 position, recorded as Flag. If Flag is 1, it means that the downloaded email has been deleted. Divide Number by the set size T to get the remainder X and the quotient Y. Under path P2, find the folder named X. Under X, find the folder named Y. Then find the data file F1 named Number under Y. If it cannot be found and the Flag corresponding to Number is 1, it means that the local email has been completely deleted. If it is completely deleted, there is no need to perform subsequent process steps. If it is not deleted or not completely deleted, proceed to the subsequent steps. The decryption key comprises: decrypting keyMaterial to obtain b bytes after decryption, recorded as key; The extraction includes: receiving an instruction, opening the file F1, starting at the position of offset 0, reading n bytes, these data are recorded as orderTableMaterial, starting at the position of offset n, reading m bytes, generating a list, recorded as byteTableMaterial; The decryption includes: using key as a key to decrypt orderTableMaterial, and the obtained decrypted data forms a list, which is recorded as orderTable; The list operation includes: using orderTable to set byteTableMaterial to obtain a disordered bytecode list, recorded as byteTable; The obtaining of elements comprises: starting from the position offset n+m+i of the file F1, i=0,1,2..., to the end of the file, reading a byte, performing an XOR operation on the byte and the corresponding byte of the orderTable to obtain a sequence number, recorded as order, and then reading the orderth element of the byteTable, and storing the read element in the position indexed by i in the byte array array; The completion includes: looping the step of obtaining elements until all bytes of the encrypted file are read, then creating a blank file, writing the data of the byte array array into the file, and obtaining the decrypted email.

[0012] In a preferred embodiment, in the positioning step, the installation path of foxmail is confirmed, recorded as P1, then the local data storage path is: P1\Foxmail version\Storage\Mailbox account\Mails\, recorded as P2, receive the instruction, open the file Index.key under P2, start from the position offset 8 bytes from the file header, read 8 bytes as keyMaterial, if the Index.key file does not exist or the required number of bytes is less than 8, then open the file Index under P2, start from the position offset c=0x2D, ​​read 8 bytes as keyMaterial, Receive the instruction, open the file Index under P2, read 4 bytes of data in little endian at the offset 0x1C of the Index file, then add 8 to the read data to get the size occupied by an email trace, that is, the size occupied by an email message, recorded as Size, then offset the Size position in the Index file, which is the starting position of the first email message, read 4 bytes in little endian, recorded as Number, offset Size+4 position, read 4 bytes of data in little endian, recorded as Flag, if Flag is 1, it means that the downloaded email has been deleted, Divide Number by the set size T=32 to get the remainder X and the quotient Y. Under path P2, find the folder named X. Under X, find the folder named Y. Then find the data file F1 named Number under Y. If it cannot be found and the Flag corresponding to Number is 1, it means that the local email has been completely deleted. If it is completely deleted, there is no need to perform subsequent process steps. If it is not deleted or not completely deleted, perform subsequent steps. The decryption key includes: decrypting keyMaterial to obtain 8 bytes after decryption, which are recorded as key; The extraction includes: receiving an instruction, opening the file F1, starting at the position of offset 0, reading n=0x100 bytes, these data are recorded as orderTableMaterial, starting at the position of offset n=0x100, reading m=0x100 bytes, and generating a list, recorded as byteTableMaterial; The decryption includes: using key as a key to decrypt orderTableMaterial, and the obtained decrypted data forms a list, which is recorded as orderTable.

[0013] The list operation includes: using orderTable to perform an XOR operation on byteTableMaterial, performing XOR operation on the bytes of byteTableMaterial and the bytes of orderTable one by one, using the obtained bytes as subscript numbers, locating the position of the subscript number in byteTable, filling in the number of the byte currently performing the XOR operation in the byteTableMaterial table, and obtaining a disordered bytecode list, recorded as byteTable.

[0014] The element acquisition includes: starting from the position offset n+m+i of file F1, i=0,1,2..., until the end of the file, reading a byte, performing an XOR operation on the byte and the corresponding byte of orderTable to obtain a sequence number, recorded as order, and then reading the orderth element of byteTable, and storing the read element in the position indexed by i in the byte array array, where n=0x100 and m=0x100.

[0015] In a preferred embodiment, the element acquisition includes: batch acquisition. If batch acquisition is performed, the element acquisition includes: starting from the position offset n+m+i of file F1, reading k bytes, k=1,2,3...,256, i=0,k,2k,3k..., until the end of the file, performing an XOR operation on the k bytes with the k bytes corresponding to orderTable at the same time to obtain a byte array of k elements, denoted as orders, and then looping the following steps: reading the j-th sequence number of orders, j=0,1,2...,k-1, denoted as order, and then reading the order-th element of byteTable, and storing the read element in the byte array array indexed at i+j, where n=0x100, m=0x100.

[0016] A system for decrypting email content in a foxmail offline environment, comprising: Positioning module: There is an Index.key file in the foxmail data storage path. The set byte data is extracted from Index.key and recorded as keyMaterial. There is an Index file in the foxmail data storage path. The email number to be decrypted is obtained from Index, and the encrypted file is located according to the email number. Decryption key module: decrypt keyMaterial and obtain the decrypted data, recorded as key; Extraction module: extract the set bytes from the encrypted file, these data are recorded as orderTableMaterial, continue to extract the set bytes, generate a list, recorded as byteTableMaterial; Decryption module: decrypts orderTableMaterial, and the decrypted data is formed into a list, recorded as orderTable; List operation module: use orderTable to operate byteTableMaterial to obtain a list, recorded as byteTable; Get element module: get a byte of data from the encrypted file, perform operations with orderTable, get a sequence number, record it as order, get the orderth element of byteTable, and store it in the corresponding position of the byte array array; Completion module: loop the step of obtaining elements until all bytes of the encrypted file are read, then create a blank file, write the data of the byte array array to the file, and get the decrypted email.

[0017] In a preferred embodiment, the positioning module includes: confirming the installation path of foxmail, recorded as P1, then the local data storage path is: P1\Foxmail version\Storage\Mail account\Mails\, recorded as P2, receiving instructions, opening the file Index.key under P2, starting from the position of file header offset a, reading b bytes as keyMaterial, if the Index.key file does not exist or the required number of bytes is less than b, then opening the file Index under P2, starting from the position of offset c, reading b bytes as keyMaterial, Receive the instruction, open the file Index under P2, start reading the set byte data at the offset 0x1C, then add 8 to the data to get the size occupied by an email trace, recorded as Size, start reading the specific byte data at the offset Size, recorded as Number, that is, the downloaded email number, start reading the set byte data at the offset set position, recorded as Flag, if Flag is 1, it means that the downloaded email has been deleted. Divide Number by the set size T to get the remainder X and the quotient Y. Under path P2, find the folder named X. Under X, find the folder named Y. Then find the data file F1 named Number under Y. If it cannot be found and the Flag corresponding to Number is 1, it means that the local email has been completely deleted. If it is completely deleted, there is no need to perform subsequent process steps. If it is not deleted or not completely deleted, proceed to the subsequent steps. The decryption key module comprises: decrypting keyMaterial to obtain b bytes after decryption, which are recorded as key; The extraction module includes: receiving an instruction, opening the file F1, starting at the position of offset 0, reading n bytes, these data are recorded as orderTableMaterial, starting at the position of offset n, reading m bytes, and generating a list, recorded as byteTableMaterial; The decryption module includes: using key as a key to decrypt orderTableMaterial, and the decrypted data obtained forms a list, which is recorded as orderTable; The list operation module includes: using orderTable to set byteTableMaterial to obtain a disordered bytecode list, recorded as byteTable; The element acquisition module includes: starting from the position offset n+m+i of the file F1, i=0,1,2..., until the end of the file, reading a byte, performing an XOR operation on the byte and the corresponding byte of the orderTable to obtain a sequence number, recorded as order, and then reading the orderth element of byteTable, and storing the read element in the position indexed by i in the byte array array; The completion module includes: looping the step of obtaining elements until all bytes of the encrypted file are read, then creating a blank file, writing the data of the byte array array into the file, and obtaining the decrypted email.

[0018] The above-mentioned method and system for decrypting email content in the foxmail offline environment can quickly locate the target email according to the email traces in the Index, decrypt the email after extracting the data, realize the decryption of the email content, and obtain more comprehensive information. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 This is a partial flow chart of a method for decrypting email content in a foxmail offline environment according to an embodiment of the present invention. DETAILED DESCRIPTION

[0020] like Figure 1 As shown, a method for decrypting email content in a foxmail offline environment according to a preferred embodiment of the present invention includes: Step S101, positioning: there is an Index.key file in the foxmail data storage path, extract the data of set bytes in Index.key, record it as keyMaterial, there is an Index file in the foxmail data storage path, obtain the email number to be decrypted in Index, and locate the encrypted file according to the email number; Step S103, decrypt key: decrypt keyMaterial to obtain decrypted data, recorded as key; Step S105, extracting: extracting set bytes from the encrypted file, these data are recorded as orderTableMaterial, continue to extract set bytes, generate a list, recorded as byteTableMaterial; Step S107, decryption: decrypt orderTableMaterial, and the decrypted data obtained forms a list, recorded as orderTable; Step S109, list operation: use orderTable to operate byteTableMaterial to obtain a list, which is recorded as byteTable; Step S111, obtain element: obtain a byte of data of the encrypted file, perform operation processing with orderTable, obtain a sequence number, recorded as order, obtain the orderth element of byteTable, and store it in the corresponding position of the byte array array; Step S113, completion: loop the step of obtaining elements until all bytes of the encrypted file are read, then create a blank file, write the data of the byte array array into the file, and obtain the decrypted email.

[0021] Further, preferably, the positioning of this embodiment includes: extracting data of a set byte in Index.key as a position offset of 0x8 bytes from the beginning of the file, and then reading 0x8 bytes, which is recorded as keyMaterial.

[0022] Further, preferably, the decryption of this embodiment includes: Initial permutation: All bytes to be decrypted are grouped into 8 bytes, and the ciphertext is initially permuted to reorder the original 64-bit binary bits; Partition: divided into left and right parts, each part has 32 bits; F function processing: F round function processing is performed for 16 rounds, each round uses a 48-bit subkey, and the subkey is generated from the master key. Each round of processing includes: extended permutation, XOR with the subkey, S box permutation, P box permutation, merging the left and right parts and performing the final permutation to obtain the plaintext; Merge: The left and right parts are merged; Substitution: Perform IP inverse substitution to obtain ciphertext.

[0023] Further, preferably, in the list operation step of this embodiment, each byte of orderTable and each byte of byteTableMaterial are XORed one by one to obtain a new byte array, that is, a replacement array of 0~0xFF, and the replacement array is rearranged according to the replacement relationship, and these 0x100 bytes are called byteTable.

[0024] Further, preferably, obtaining elements in this embodiment includes: offsetting 0x200 + i from the beginning of the encrypted file, i = 0, 1, 2.., until the end of the encrypted file, reading 1 byte, which is the i-th byte of the email, taking i modulo 0x100, using the modulo result as an index, indexing to the corresponding element from orderTable, that is, orderTable[i%0x100], XORing the i-th byte with orderTable[i%0x100], and then indexing to the corresponding element from byteTable based on the XOR result as an index, and storing the element in the position indexed by i in the byte array array.

[0025] Further, preferably, the positioning step of this embodiment includes: confirming the installation path of foxmail, recorded as P1, then the local data storage path is: P1\Foxmail version\Storage\Mail account\Mails\, recorded as P2, receiving instructions, opening the file Index.key under P2, starting from the position of file header offset a, reading b bytes as keyMaterial, if the Index.key file does not exist or the required number of bytes is less than b, then opening the file Index under P2, starting from the position of offset c, reading b bytes as keyMaterial; receiving instructions, opening the file Index under P2, starting from the position of offset 0x1C to read the set byte data, and then adding 8 to the data, Get the size occupied by an email trace, denoted as Size, start reading data of a specific byte at the offset of Size, denoted as Number, that is, the number of the downloaded email, start reading data of a set byte at the offset of the set position, denoted as Flag, if Flag is 1, it means that the downloaded email has been deleted; divide Number by the set size T to get the remainder X and the quotient Y, find the folder named X under path P2, find the folder named Y under X, and then find the data file F1 named Number under Y, if it cannot be found and the Flag corresponding to Number is 1, it means that the local email has been completely deleted. If it is completely deleted, there is no need to perform subsequent process steps; if it is not deleted or not completely deleted, perform subsequent steps.

[0026] Further, preferably, the decryption key of this embodiment includes: decrypting keyMaterial to obtain b bytes after decryption, which are recorded as key.

[0027] Further, preferably, the extraction of this embodiment includes: receiving an instruction, opening the file F1, starting at the offset 0, reading n bytes, these data are recorded as orderTableMaterial, starting at the offset n, reading m bytes, and generating a list, recorded as byteTableMaterial.

[0028] Further, preferably, the decryption of this embodiment includes: using key as a key to decrypt orderTableMaterial, and the obtained decrypted data forms a list, which is recorded as orderTable; Further, preferably, the list operation of this embodiment includes: using orderTable to perform a setting operation on byteTableMaterial to obtain a disordered bytecode list, recorded as byteTable.

[0029] Further, preferably, obtaining elements in this embodiment includes: starting from the position offset n+m+i of file F1, i=0,1,2..., to the end of the file, reading a byte, performing an XOR operation on the byte and the corresponding byte of orderTable to obtain a sequence number, recorded as order, and then reading the orderth element of byteTable, and storing the read element in the position indexed by i in the byte array array.

[0030] Further, preferably, the completion of this embodiment includes: looping the step of obtaining elements until all bytes of the encrypted file are read, then creating a blank file, writing the data of the byte array array into the file, and obtaining the decrypted email.

[0031] Furthermore, in a method for decrypting email content in an offline environment of foxmail in a preferred embodiment of the present invention, in the positioning step, the installation path of foxmail is confirmed, which is recorded as P1, and the local data storage path is: P1\Foxmail version\Storage\Mailbox account\Mails\, recorded as P2, receiving instructions, opening the file Index.key under P2, starting from the position offset 8 bytes from the file header, reading 8 bytes as keyMaterial, if the Index.key file does not exist or the number of bytes required is less than 8, then opening the file Index under P2, starting from the position offset c=0x2D, ​​reading 8 bytes as keyMaterial; Receive the instruction, open the file Index under P2, start at the offset 0x1C, read 4 bytes of data in little endian, then add 8 to the data to get the size occupied by an email trace, recorded as Size, offset Size in the Index file, which is the starting position of the first email information, read 4 bytes in little endian, recorded as Number, that is, the email number, read 4 bytes of data in little endian at the offset Size+4, recorded as Flag, if Flag is 1, it means that the downloaded email has been deleted; Divide Number by the set size T=32 to get the remainder X and the quotient Y. Under path P2, find the folder named X. Under X, find the folder named Y. Then find the data file F1 named Number under Y. If it cannot be found and the Flag corresponding to Number is 1, it means that the local email has been completely deleted. If it is completely deleted, there is no need to perform subsequent process steps. If it is not deleted or not completely deleted, perform subsequent steps.

[0032] Furthermore, preferably, the decryption key of this embodiment includes: decrypting keyMaterial to obtain 8 bytes after decryption, which are recorded as key.

[0033] Furthermore, preferably, the extraction in this embodiment includes: receiving an instruction, opening the file F1, starting at the position of offset 0, reading n=0x100 bytes, these data are recorded as orderTableMaterial, starting at the position of offset n=0x100, reading m=0x100 bytes, and generating a list, recorded as byteTableMaterial; Furthermore, preferably, the decryption of this embodiment includes: using key as a key to decrypt orderTableMaterial, and the obtained decrypted data forms a list, which is recorded as orderTable; Furthermore, preferably, the list operation of this embodiment includes: using orderTable to perform an XOR operation on byteTableMaterial, performing XOR operation on the bytes of byteTableMaterial with the bytes of orderTable one by one, using the obtained bytes as subscript numbers, locating the position of the subscript number in byteTable, filling in the number of the byte currently performing the XOR operation in the byteTableMaterial table, and obtaining a disordered bytecode list, recorded as byteTable.

[0034] Furthermore, preferably, obtaining elements in this embodiment includes: starting from the position offset n+m+i of file F1, i=0,1,2..., to the end of the file, reading a byte, performing an XOR operation on the byte and the corresponding byte of orderTable to obtain a sequence number, recorded as order, and then reading the orderth element of byteTable, and storing the read element in the position indexed by i in the byte array array, where n=0x100 and m=0x100.

[0035] Furthermore, preferably, the acquisition elements of this embodiment include: batch acquisition. If batch acquisition is performed, the acquisition elements are: starting from the position offset n+m+i of file F1, reading k bytes, k=1,2,3...,256, i=0,k,2k,3k..., until the end of the file, performing an XOR operation on the k bytes with the k bytes corresponding to orderTable at the same time, and obtaining a byte array of k elements, denoted as orders, and then looping the following steps: reading the j-th sequence number of orders, j=0,1,2...,k-1, denoted as order, and then reading the order-th element of byteTable, and storing the read element in the byte array array with index i+j, where n=0x100 and m=0x100.

[0036] A system for decrypting email content in a foxmail offline environment according to a preferred embodiment of the present invention comprises: Positioning module: There is an Index.key file in the foxmail data storage path. The set byte data is extracted from Index.key and recorded as keyMaterial. There is an Index file in the foxmail data storage path. The email number to be decrypted is obtained from Index, and the encrypted file is located according to the email number. Decryption key module: decrypt keyMaterial and obtain the decrypted data, recorded as key; Extraction module: extract the set bytes from the encrypted file, these data are recorded as orderTableMaterial, continue to extract the set bytes, generate a list, recorded as byteTableMaterial; Decryption module: decrypts orderTableMaterial, and the decrypted data is formed into a list, recorded as orderTable; List operation module: use orderTable to operate byteTableMaterial to obtain a list, recorded as byteTable; Get element module: get a byte of data from the encrypted file, perform operations with orderTable, get a sequence number, record it as order, get the orderth element of byteTable, and store it in the corresponding position of the byte array array; Completion module: loop the step of obtaining elements until all bytes of the encrypted file are read, then create a blank file, write the data of the byte array array to the file, and get the decrypted email.

[0037] Furthermore, the system for decrypting email content in the foxmail offline environment of a preferred embodiment of the present invention decrypts the foxmail local email content as follows: Positioning module: confirm the installation path of foxmail, recorded as P1, then the local data storage path is: P1\Foxmail version\Storage\Mail account\Mails\, recorded as P2. Receive the instruction, open the file Index.key under P2, start from the position of file header offset a, read b bytes as keyMaterial. If the Index.key file does not exist or the required number of bytes is less than b, open the file Index under P2, start from the position of offset c, read b bytes as keyMaterial; Further, preferably, an instruction is received, the file Index.key under P2 is opened, and 8 bytes are read starting from the position offset 8 bytes from the file header as keyMaterial.

[0038] Receive the instruction, open the file Index under P2, start reading the data of a specific byte at the offset 0x1C, then add 8 to the data to get the size occupied by an email trace, recorded as Size. Start reading the data of a specific byte at the offset Size, recorded as Number, which is the number of the downloaded email. Start reading the data of a specific byte at the offset of a certain size, recorded as Flag. If Flag is 1, it means that the downloaded email has been deleted; Divide Number by a specific size T to obtain the remainder X and the quotient Y. Under path P2, find a folder named X, under X, find a folder named Y, and then find a data file F1 named Number under Y. If it cannot be found, and the Flag corresponding to Number is 1, it means that the local email has been completely deleted. If it is completely deleted, there is no need to perform subsequent steps. In the preferred embodiment, T=32.

[0039] Preferably, in the positioning module of the present application, the extraction is completed by reading. The present application requires that the number of bytes of Index.key needs to be greater than or equal to 16. Receive the instruction, open the file Index.key under P2, offset 0x8 bytes from the beginning of the file, and then read 0x8 bytes.

[0040] Preferably, in the positioning module, the installation path of foxmail is confirmed, recorded as P1, then the local data storage path is: P1\Foxmail version\Storage\Mail Account\Mails\, recorded as P2, receive the instruction, open the file Index.key under P2, start from the position offset 8 bytes from the file header, read 8 bytes as keyMaterial, if the Index.key file does not exist or the required number of bytes is less than 8, then open the file Index under P2, start from the position offset c=0x2D, ​​read 8 bytes as keyMaterial.

[0041] Receive the instruction, open the file Index under P2, start reading specific 8 bytes of data at the offset 0x1C, then add 8 to the data to get the size occupied by an email trace, recorded as Size. Start reading specific bytes of data at the offset Size, recorded as Number, which is the number of the downloaded email. The offset 0x1C is based on the beginning of the file.

[0042] Preferably, receiving the instruction, opening the file Index under P2, starting at the offset 0x1C, reading 4 bytes of data in little endian, then adding 8 to the data to get the size occupied by an email trace, recorded as Size, offsetting the Size position in the Index file, which is the starting position of the first email information, reading 4 bytes in little endian, recorded as Number, i.e. the email number, and reading 4 bytes of data in little endian at the offset Size+4 position, recorded as Flag. If Flag is 1, it means that the downloaded email has been deleted. Start reading a specific byte of data at the offset Size, recorded as Number, and read 4 bytes in little-endian order, that is, an int type of data.

[0043] In this embodiment, if the email is deleted, it will be decrypted as in the normal process. If it is completely deleted, the decryption of the email will be skipped.

[0044] The decryption key module of this embodiment decrypts keyMaterial to obtain b bytes after decryption, which are recorded as key.

[0045] The decryption process of this embodiment is as follows: Initial permutation: All bytes to be decrypted are grouped into 8 bytes, the ciphertext is initially permuted, and the original 64-bit binary bits are reordered; Partition: divided into left and right parts, each part has 32 bits; F-round function processing: Perform F-round function processing. Perform 16 rounds, and use a 48-bit subkey (generated from the master key) in each round. Each round of processing includes extended permutation, XOR with the subkey, S-box permutation, P-box permutation, merging the left and right parts and performing the final permutation to obtain the plaintext; Merge: Merge the left and right parts.

[0046] Permutation: Perform the final permutation, i.e., IP inverse permutation, to obtain the ciphertext.

[0047] Further, the extraction module of this embodiment opens the file F1, starts at the position of offset 0, reads n bytes, and these data are recorded as orderTableMaterial. Starts at the position of offset n, reads m bytes, and generates a list, which is recorded as byteTableMaterial.

[0048] The extraction module of this embodiment can complete the extraction by reading, reading 0x100 bytes from the beginning of the encrypted file, recorded as orderTableMaterial, and then continuing to read 0x100 bytes, recorded as byteTableMaterial.

[0049] Furthermore, the decryption module of this embodiment uses key as the key to decrypt orderTableMaterial, and the obtained decrypted data forms a list, which is recorded as orderTable.

[0050] The decryption process of this embodiment is as follows: Initial permutation: All bytes to be decrypted are grouped into 8 bytes, the ciphertext is initially permuted, and the original 64-bit binary bits are reordered; Partition: divided into left and right parts, each part has 32 bits; F-round function processing: Perform F-round function processing. Perform 16 rounds, and use a 48-bit subkey (generated from the master key) in each round. Each round of processing includes extended permutation, XOR with the subkey, S-box permutation, P-box permutation, merging the left and right parts and performing the final permutation to obtain the plaintext; Merge: Merge the left and right parts.

[0051] Permutation: Perform the final permutation, i.e., IP inverse permutation, to obtain the ciphertext.

[0052] Further, preferably, the list operation module of this embodiment uses orderTable to perform an XOR operation on byteTableMaterial to obtain a disordered bytecode list, which is recorded as byteTable.

[0053] XOR each byte of orderTable with each byte of byteTableMaterial one by one to get a new byte array, that is, a replacement array of 0~0xFF. For the convenience of decryption, a new array is needed to describe it. For example, if the 0th element of the replacement array is 5, then fill 0 in the 5th element of the new array. If the 1st element is 0xFF, then fill 1 in the 0xFF element of the new array. Repeat the filling of 0x100 bytes, and call this 0x100 bytes - byteTable. The byteTable table looks like a table with 0~0xFF in scrambled order (actually it describes the mapping relationship between the replacement array and 0~0xFF), and is used to replace the content of the email.

[0054] The next byte of the encrypted file is offset from the beginning of the encrypted file by 0x200, and the next byte is read and XORed.

[0055] The XOR operation performs XOR on the byte and the corresponding byte in orderTable (let the byte be numbered i, i=0,1,2... until the end of the file, i modulo 0x100, and the modulo result is used as the index of orderTable, that is, the i-th byte corresponds to orderTable[i%0x100]), and then uses the XOR result as the index to index the corresponding element from byteTable. For example, if the value obtained after XOR is 8, the final result is byteTable[8].

[0056] In this embodiment, there are a total of 0x100 elements in the byteTable, and the numbers of these elements are 0 to 0xFF from the beginning to the end.

[0057] Furthermore, the element acquisition module of this embodiment starts from the position offset n+m+i of file F1, i=0,1,2,..., until the end of the file, reads a byte, performs a specific operation on the byte and the corresponding byte of orderTable, obtains a sequence number, recorded as order, and then reads the orderth element of byteTable, and stores the read element in the position indexed by i in the byte array array.

[0058] Preferably, in this embodiment, n=0x100, m=0x100. The specific process of performing a specific operation on the byte and orderTable is: XOR the byte with the corresponding byte of orderTable (assuming that the file offset is n+m+i at this time, the byte is numbered i, i is modulo 0x100, and the modulo result is used as the index of orderTable, that is, the i-th byte corresponds to orderTable[i%0x100]).

[0059] Furthermore, the completion module of this embodiment: loops the operation of the acquisition element module until all bytes of the encrypted file are read, then creates a new blank file, writes the data of the byte array array into the file, and obtains the decrypted email.

[0060] The method and system for decrypting email content in the foxmail offline environment of the present invention can obtain elements in batches. For example, 8 bytes are read in a group, and the encrypted bytes of 8 bytes are recorded as data1, and then the 8 bytes corresponding to the orderTable are read and recorded as data2, and then data1 and data2 are XORed. The result is consistent with the result of byte-by-byte XOR.

[0061] The method and system for decrypting email content in the foxmail offline environment of the present invention can temporarily store in disorder after decryption. For example, it can be stored in reverse order, such as storing binary 0x31 0x32 0x33 (i.e., text "123") as 0x33 0x32 0x31 (i.e., text "321"), and then read in reverse order before use. Alternatively, a position rule is defined to stipulate where the first several bytes are stored, where the middle several bytes are stored, etc., so that the entire binary result becomes disordered, and then restored to normal order according to the rule before use.

[0062] The method and system for decrypting email content in the foxmail offline environment of the present invention offsets 0x8 bytes from the beginning of the Index.key file, reads 0x8 bytes and uses foxmailDecrypt to decrypt the key. From the beginning of the encrypted file, read 0x100 bytes and record them as orderTableMaterial. Then continue to read 0x100 bytes and record them as byteTableMaterial.

[0063] The method of the present invention can quickly locate the target email according to the email trace, realize the decryption of the email content, and obtain more comprehensive information.

[0064] The present invention obtains the three elements of key, orderTableMaterial, and byteTableMaterial, and there is no order of precedence. If there is a variation of the order of precedence, it is also within the scope of the present invention.

[0065] The acquisition elements and completion method steps and modules of the present invention express the behavior of decrypting the encrypted bytes as separate units and finally combining them in sequence. If there are the following variations, they will also be within the scope of the present invention.

[0066] The method and system for decrypting email content in the foxmail offline environment of the present invention can read and decrypt in batches, and the obtained results are consistent with the results of reading and decrypting a single byte. After decryption is completed, temporary disorder is stored, but the final combination result is consistent with the result of sequential combination.

[0067] Based on the above ideal embodiments of this application, the relevant staff can make various changes and modifications without departing from the technical concept of this application through the above description. The technical scope of this application is not limited to the content in the specification, and its technical scope must be determined according to the scope of the claims.

[0068] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0069] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0070] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0071] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

Claims

1. A method for decrypting email content in a foxmail offline environment, characterized in that: include: Positioning: There is an Index.key file in the foxmail data storage path. Extract the set byte data from Index.key and record it as keyMaterial. There is an Index file in the foxmail data storage path. Get the email number that needs to be decrypted from Index and locate the encrypted file according to the email number. Decryption key: decrypt keyMaterial to obtain the decrypted data, recorded as key; Extraction: Extract the set bytes from the encrypted file, and record these data as orderTableMaterial. Continue to extract the set bytes to generate a list, which is recorded as byteTableMaterial. Decryption: Decrypt orderTableMaterial, and the decrypted data is formed into a list, recorded as orderTable; List operation: Use orderTable to operate byteTableMaterial to obtain a list, recorded as byteTable; Get element: Get a byte of data from the encrypted file, perform operations with orderTable, get a sequence number, record it as order, get the orderth element of byteTable, and store it in the corresponding position of the byte array array; Completion: Loop through the steps of getting elements until all bytes of the encrypted file are read, then create a new blank file, write the data of the byte array to the file, and get the decrypted email.

2. The method for decrypting email content in the foxmail offline environment according to claim 1, characterized in that: The positioning includes: extracting data of a set byte in Index.key as a position offset of 0x8 bytes from the beginning of the file, and then reading 0x8 bytes, which is recorded as keyMaterial.

3. The method for decrypting email content in the foxmail offline environment according to claim 1, characterized in that: The decryption includes: Initial permutation: All bytes to be decrypted are grouped into 8 bytes, and the ciphertext is initially permuted to reorder the original 64-bit binary bits; Partition: divided into left and right parts, each part has 32 bits; F function processing: F round function processing is performed for 16 rounds, each round uses a 48-bit subkey, and the subkey is generated from the master key. Each round of processing includes: extended permutation, XOR with the subkey, S box permutation, P box permutation, merging the left and right parts and performing the final permutation to obtain the plaintext; Merge: The left and right parts are merged; Substitution: Perform IP inverse substitution to obtain ciphertext.

4. The method for decrypting email content in the foxmail offline environment according to claim 1, characterized in that: In the list operation step, each byte of orderTable and each byte of byteTableMaterial are XORed one by one to obtain a new byte array, that is, a replacement array of 0~0xFF. The replacement array is rearranged according to the replacement relationship, and these 0x100 bytes are called byteTable.

5. The method for decrypting email content in the foxmail offline environment according to claim 1, characterized in that: The obtaining element comprises: offsetting 0x200 + i from the beginning of the encrypted file, i = 0, 1, 2.., until the end of the encrypted file, reading 1 byte, which is the i-th byte of the email, taking i modulo 0x100, using the modulo result as an index, indexing the corresponding element from orderTable, i.e. orderTable[i%0x100], XORing the i-th byte with orderTable[i%0x100], and then using the XOR result as an index, indexing the corresponding element from byteTable, and storing the element in the position indexed by i in the byte array array.

6. The method for decrypting email content in a foxmail offline environment according to any one of claims 1 to 5, characterized in that: The locating step includes: confirming the installation path of foxmail, recorded as P1, then the local data storage path is: P1\Foxmail version\Storage\Mailbox account\Mails\, recorded as P2, receiving instructions, opening the file Index.key under P2, starting from the position of file header offset a, reading b bytes as keyMaterial, if the Index.key file does not exist or the required number of bytes is less than b, then opening the file Index under P2, starting from the position of offset c, reading b bytes as keyMaterial, Receive the instruction, open the file Index under P2, start reading the set byte data at the offset 0x1C, then add 8 to the data to get the size occupied by an email trace, recorded as Size, start reading the specific byte data at the offset Size, recorded as Number, that is, the downloaded email number, start reading the set byte data at the offset set position, recorded as Flag, if Flag is 1, it means that the downloaded email has been deleted. Divide Number by the set size T to get the remainder X and the quotient Y. Under path P2, find the folder named X. Under X, find the folder named Y. Then find the data file F1 named Number under Y. If it cannot be found and the Flag corresponding to Number is 1, it means that the local email has been completely deleted. If it is completely deleted, there is no need to perform subsequent process steps. If it is not deleted or not completely deleted, proceed to the subsequent steps. The decryption key comprises: decrypting keyMaterial to obtain b bytes after decryption, recorded as key; The extraction includes: receiving an instruction, opening the file F1, starting at the position of offset 0, reading n bytes, these data are recorded as orderTableMaterial, starting at the position of offset n, reading m bytes, generating a list, recorded as byteTableMaterial; The decryption includes: using key as a key to decrypt orderTableMaterial, and the obtained decrypted data forms a list, which is recorded as orderTable; The list operation includes: using orderTable to set byteTableMaterial to obtain a disordered bytecode list, recorded as byteTable; The obtaining of elements comprises: starting from the position offset n+m+i of the file F1, i=0,1,2..., to the end of the file, reading a byte, performing an XOR operation on the byte and the corresponding byte of the orderTable to obtain a sequence number, recorded as order, and then reading the orderth element of the byteTable, and storing the read element in the position indexed by i in the byte array array; The completion includes: looping the step of obtaining elements until all bytes of the encrypted file are read, then creating a blank file, writing the data of the byte array array into the file, and obtaining the decrypted email.

7. The method for decrypting email content in a foxmail offline environment according to any one of claims 1 to 5, characterized in that: In the positioning step, confirm the installation path of foxmail, recorded as P1, then the local data storage path is: P1\Foxmail version\Storage\Mailbox account\Mails\, recorded as P2, receive the instruction, open the file Index.key under P2, start from the position of 8 bytes offset from the file header, read 8 bytes as keyMaterial, if the Index.key file does not exist or the required number of bytes is less than 8, then open the file Index under P2, start from the position of offset c=0x2D, ​​read 8 bytes as keyMaterial, Receive the instruction, open the file Index under P2, start at the offset 0x1C, read 4 bytes of data in little endian order, then add 8 to the data to get the size occupied by an email trace, recorded as Size, offset the Size position in the Index file, which is the starting position of the first email information, read 4 bytes in little endian order, recorded as Number, that is, the email number, and read 4 bytes of data in little endian order at the offset Size+4 position, recorded as Flag. If Flag is 1, it means that the downloaded email has been deleted. Divide Number by the set size T=32 to get the remainder X and the quotient Y. Under path P2, find the folder named X. Under X, find the folder named Y. Then find the data file F1 named Number under Y. If it cannot be found and the Flag corresponding to Number is 1, it means that the local email has been completely deleted. If it is completely deleted, there is no need to perform subsequent process steps. If it is not deleted or not completely deleted, perform subsequent steps. The decryption key includes: decrypting keyMaterial to obtain 8 bytes after decryption, which are recorded as key; The extraction includes: receiving an instruction, opening the file F1, starting at the position of offset 0, reading n=0x100 bytes, these data are recorded as orderTableMaterial, starting at the position of offset n=0x100, reading m=0x100 bytes, and generating a list, recorded as byteTableMaterial; The decryption includes: using key as a key to decrypt orderTableMaterial, and the obtained decrypted data forms a list, which is recorded as orderTable; The list operation includes: performing an XOR operation on byteTableMaterial with orderTable, performing XOR operation on the bytes of byteTableMaterial and the bytes of orderTable one by one, taking the obtained bytes as subscript numbers, locating the position of the subscript number in byteTable, filling in the number of the byte currently performing the XOR operation in the byteTableMaterial table, and obtaining a disordered bytecode list, recorded as byteTable; The element acquisition includes: starting from the position offset n+m+i of file F1, i=0,1,2, until the end of the file, reading a byte, performing an XOR operation on the byte and the corresponding byte of orderTable to obtain a sequence number, recorded as order, and then reading the orderth element of byteTable, and storing the read element in the position indexed by i in the byte array array, where n=0x100 and m=0x100.

8. The method for decrypting email content in a foxmail offline environment according to any one of claims 1 to 5, characterized in that: The acquiring elements include: batch acquiring. If batch acquiring is performed, the acquiring elements include: starting from the position offset n+m+i of file F1, reading k bytes, k=1,2,3...,256, i=0,k,2*k,3*k..., until the end of the file, performing an XOR operation on the k bytes with the k bytes corresponding to orderTable at the same time, obtaining a byte array of k elements, recorded as orders, and then looping the following steps: reading the j-th sequence number of orders, j=0,1,2...,k-1, recorded as order, and then reading the order-th element of byteTable, and storing the read element in the position indexed by i+j of the byte array array, where n=0x100 and m=0x100.

9. A system for decrypting email content in a foxmail offline environment, characterized in that: include: Positioning module: There is an Index.key file in the foxmail data storage path. The set byte data is extracted from Index.key and recorded as keyMaterial. There is an Index file in the foxmail data storage path. The email number to be decrypted is obtained from Index, and the encrypted file is located according to the email number. Decryption key module: decrypt keyMaterial and obtain the decrypted data, recorded as key; Extraction module: extract the set bytes from the encrypted file, these data are recorded as orderTableMaterial, continue to extract the set bytes, generate a list, recorded as byteTableMaterial; Decryption module: decrypts orderTableMaterial, and the decrypted data is formed into a list, recorded as orderTable; List operation module: use orderTable to operate byteTableMaterial to obtain a list, recorded as byteTable; Get element module: get a byte of data from the encrypted file, perform operations with orderTable, get a sequence number, record it as order, get the orderth element of byteTable, and store it in the corresponding position of the byte array array; Completion module: loop the step of obtaining elements until all bytes of the encrypted file are read, then create a blank file, write the data of the byte array array to the file, and get the decrypted email.

10. The system for decrypting email content in the foxmail offline environment according to claim 9, characterized in that: The positioning module includes: confirming the installation path of foxmail, recorded as P1, then the local data storage path is: P1\Foxmail version\Storage\Mailbox account\Mails\, recorded as P2, receiving instructions, opening the file Index.key under P2, starting from the position of file header offset a, reading b bytes as keyMaterial, if the Index.key file does not exist or the required number of bytes is less than b, then opening the file Index under P2, starting from the position of offset c, reading b bytes as keyMaterial, Receive the instruction, open the file Index under P2, start reading the set byte data at the offset 0x1C, then add 8 to the data to get the size occupied by an email trace, recorded as Size, start reading the specific byte data at the offset Size, recorded as Number, that is, the downloaded email number, start reading the set byte data at the offset set position, recorded as Flag, if Flag is 1, it means that the downloaded email has been deleted. Divide Number by the set size T to get the remainder X and the quotient Y. Under path P2, find the folder named X. Under X, find the folder named Y. Then find the data file F1 named Number under Y. If it cannot be found and the Flag corresponding to Number is 1, it means that the local email has been completely deleted. If it is completely deleted, there is no need to perform subsequent process steps. If it is not deleted or not completely deleted, proceed to the subsequent steps. The decryption key module comprises: decrypting keyMaterial to obtain b bytes after decryption, which are recorded as key; The extraction module includes: receiving an instruction, opening the file F1, starting at the position of offset 0, reading n bytes, these data are recorded as orderTableMaterial, starting at the position of offset n, reading m bytes, and generating a list, recorded as byteTableMaterial; The decryption module includes: using key as a key to decrypt orderTableMaterial, and the decrypted data obtained forms a list, which is recorded as orderTable; The list operation module includes: using orderTable to set byteTableMaterial to obtain a disordered bytecode list, recorded as byteTable; The element acquisition module includes: starting from the position offset n+m+i of the file F1, i=0,1,2..., until the end of the file, reading a byte, performing an XOR operation on the byte and the corresponding byte of orderTable to obtain a sequence number, recorded as order, and then reading the orderth element of byteTable, and storing the read element in the corresponding position of the byte array array; The completion module includes: looping the step of obtaining elements until all bytes of the encrypted file are read, then creating a blank file, writing the data of the byte array array into the file, and obtaining the decrypted email.

Images