Method and system for decrypting mail content in foxmail offline environment

Abstract

The method and system for decrypting mail content in foxmail offline environment include: positioning; decrypting key; extracting: extracting a set of bytes in the encrypted file, which are recorded as orderTableMaterial, and continuing to extract a set of bytes to generate a list, which is recorded as byteTableMaterial; decrypting: decrypting orderTableMaterial to obtain decrypted data forming a list, which is recorded as orderTable; list operation: operating byteTableMaterial by using orderTable to obtain a list, which is recorded as byteTable; obtaining elements; completing: performing the step of obtaining elements through a loop operation until all bytes of the encrypted file are read and written into a file to obtain decrypted mail; the method and system for decrypting mail content in foxmail offline environment can quickly locate target mail according to mail traces in Index, extract data, decrypt the mail, realize decryption of mail content, and obtain more comprehensive information.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of mail encryption and decryption, and in particular to a method and system for decrypting mail content in a foxmail offline environment. BACKGROUND

[0002] Foxmail is a popular email client, and its local database contains important email content, which is very valuable in forensic work. By decrypting the local email content of foxmail, forensic personnel can access and analyze the email header, email body, attachments, etc., which may contain key clues for the case. For example, by analyzing the sending time, sender and receiver information, and email content, etc., the timeline and relationship network of the case can be constructed. In addition, decrypting the local email content can also help recover deleted or damaged emails, providing additional evidence support for the case. Therefore, decrypting the local email content of foxmail plays an important role in forensic work, and it can help forensic personnel to better understand the case and provide strong support for case investigation.

[0003] Currently, foxmail forensics mainly relies on automatic forensic tools. Once the automatic forensic tool is removed, only email traces can be extracted, and there is no decryption method for email content in an offline environment. SUMMARY

[0004] Therefore, it is necessary to provide a method for decrypting email content in a foxmail offline environment that can improve performance.

[0005] At the same time, a system for decrypting email content in a foxmail offline environment that can improve performance is provided.

[0006] A method for decrypting email content in a foxmail offline environment, comprising:

[0007] Positioning: there is an Index.key file under the foxmail data storage path, and the set byte data in the Index.key is extracted and recorded as keyMaterial. There is an Index file under the foxmail data storage path, and the mail number to be decrypted is obtained in the Index, and the encrypted file is positioned according to the mail number;

[0008] Decrypting key: decrypting keyMaterial to obtain decrypted data, recorded as key;

[0009] Extraction: extracting a set of bytes in the encrypted file, which is recorded as orderTableMaterial, and continuing to extract a set of bytes to generate a list, recorded as byteTableMaterial;

[0010] Decryption: decrypt the orderTableMaterial, and the decrypted data forms a list, denoted as orderTable;

[0011] List operation: use the orderTable to operate and process the byteTableMaterial to obtain a list, denoted as byteTable;

[0012] Obtaining an element: obtain a byte data of the encrypted file, and operate and process it with the orderTable to obtain a serial number, denoted as order, obtain the orderth element of the byteTable, and store it to a corresponding position of the byte array array;

[0013] Completion: repeat the element obtaining step until all the bytes of the encrypted file are read, then create a blank file, and write the data of the byte array array to the file to obtain the decrypted email.

[0014] In the preferred embodiment, the positioning includes: extracting data of a set of bytes in the Index.key as a position offset by 0x8 bytes from the beginning of the file, and then reading 0x8 bytes, denoted as keyMaterial.

[0015] In the preferred embodiment, the decryption includes:

[0016] Initial permutation: all the bytes that need to be decrypted are grouped by 8 bytes, and the ciphertext initial permutation is performed to reorder the original 64-bit binary bits;

[0017] Division: divided into left and right parts, each part has 32 bits;

[0018] F function processing: F round function processing is performed, which is performed for 16 rounds, each round uses a 48-bit sub-key, which is generated from the master key, and each round processing includes: expansion permutation, XOR with the sub-key, S-box permutation, P-box permutation, merging the left and right parts and performing the final permutation to obtain the plaintext;

[0019] Merging: the left and right parts are merged;

[0020] Permutation: IP inverse permutation is performed to obtain the ciphertext.

[0021] In the preferred embodiment, in the list operation step, each byte of the orderTable and each byte of the byteTableMaterial are XORed one by one to obtain a new byte array, i.e., a replacement array of 0~0xFF, the replacement array is recombined and arranged according to the replacement relationship, and the 0x100 bytes are referred to as the byteTable table.

[0022] In the preferred embodiment, the obtaining element comprises: reading 1 byte from the position of the offset 0x200+i, i=0, 1, 2, …, until the end of the encrypted file, which is the i-th byte of the mail, taking the modulus of i with 0x100, taking the modulus result as an index, indexing the corresponding element from orderTable, i.e., orderTable[i%0x100], XORing the i-th byte with orderTable[i%0x100], then indexing the corresponding element from byteTable according to the XOR result as an index, and storing the element to the position of the i-th byte of the byte array array.

[0023] In the preferred embodiment, the positioning step comprises: confirming the installation path of foxmail, denoted as P1, then the local data storage path is: P1\Foxmail version\Storage\mailbox account\Mails\, denoted as P2, receiving an instruction, opening the file Index.key under P2, reading b bytes from the position of the offset a of the file header, as keyMaterial, if the Index.key file does not exist or the required number of bytes is less than b, then opening the file Index under P2, reading b bytes from the position of the offset c, as keyMaterial;

[0024] receiving an instruction, opening the file Index under P2, starting from the position of the offset 0x1C, reading 4 bytes of data in little-endian order, then adding 8 to the data to obtain the size occupied by a mail trace, denoted as Size, offsetting Size in the Index file, which is the starting position of the first mail information, reading 4 bytes in little-endian order, denoted as Number, which is the mail number, offsetting Size+4, reading 4 bytes of data in little-endian order, denoted as Flag, if Flag is 1, indicating that the downloaded mail has been deleted,

[0025] dividing Number by a set size T to obtain a remainder X and a quotient Y, finding the folder named X under the path P2, finding the folder named Y under X, then finding the data file F1 named Number under Y, if it cannot be found and the Flag corresponding to the Number is 1, it indicates that the local mail has been completely deleted, if it is completely deleted, there is no need to perform the subsequent process steps; if it is not deleted or not completely deleted, the subsequent steps are performed;

[0026] The decryption key comprises: decrypting keyMaterial to obtain b bytes of decrypted data, denoted as key;

[0027] The extracting includes: receiving an instruction, opening the file F1, reading n bytes starting from the position with offset 0, and recording the data as orderTableMaterial, reading m bytes starting from the position with offset n, and generating a list recorded as byteTableMaterial;

[0028] The decrypting includes: decrypting orderTableMaterial using key as a key, and forming a list recorded as orderTable using the decrypted data obtained;

[0029] The list operation includes: performing a setting operation on byteTableMaterial using orderTable, and obtaining a disordered byte code list recorded as byteTable;

[0030] The obtaining element includes: reading a byte starting from the position with offset n+m+i of the file F1, i=0, 1, 2,..., until the end of the file, performing an exclusive or operation on the byte and a corresponding byte of orderTable to obtain a serial number recorded as order, and then reading an element of byteTable at the order, and storing the read element to the position with index i of the byte array array;

[0031] The completing includes: performing the obtaining element step in a loop until all bytes of the encrypted file are read, then creating a blank file, and writing the data of the byte array array to the file to obtain the decrypted email.

[0032] In the preferred embodiment, in the positioning step, the installation path of foxmail is confirmed and recorded as P1, the local data storage path is P1\Foxmail version\Storage\mailbox account\Mails\, recorded as P2, an instruction is received, a file Index.key under P2 is opened, 8 bytes starting from the position with offset 8 of the file header are read as keyMaterial, if the file Index.key does not exist or the required number of bytes is less than 8, a file Index under P2 is opened, 8 bytes starting from the position with offset c=0x2D are read as keyMaterial,

[0033] Receiving an instruction, opening the file Index under P2, reading 4 bytes of data in little-endian order at the position of the offset 0x1C of the Index file, then reading the data obtained +8 to obtain the size of a mail trace, i.e. the size of a mail information, denoted as Size, then offsetting the position of Size in the Index file, which is the starting position of the first mail information, reading 4 bytes in little-endian order, denoted as Number, offsetting the position of Size+4, reading 4 bytes of data in little-endian order, denoted as Flag, if Flag is 1, it indicates that the downloaded mail has been deleted,

[0034] Dividing Number by a set size T=32 to obtain a remainder X and a quotient Y, finding a folder named X under path P2, finding a folder named Y under X, and then finding a data file F1 named Number under Y, if it cannot be found and the Flag corresponding to the Number is 1, it indicates that the local mail has been completely deleted, if it is completely deleted, there is no need to execute the subsequent process steps; if it is not deleted or not completely deleted, execute the subsequent steps;

[0035] The decryption key includes: decrypting keyMaterial to obtain 8 bytes of decrypted data, denoted as key;

[0036] The extraction includes: receiving an instruction, opening the file F1, reading n=0x100 bytes starting from the position of the offset 0, and these data are denoted as orderTableMaterial, reading m=0x100 bytes starting from the position of the offset n=0x100, to generate a list, denoted as byteTableMaterial;

[0037] The decryption includes: using key as a key to decrypt orderTableMaterial, and the decrypted data obtained form a list, denoted as orderTable.

[0038] The list operation includes: performing an exclusive OR operation on byteTableMaterial with orderTable, i.e. performing an exclusive OR operation on each byte of byteTableMaterial with each byte of orderTable, using the obtained byte as an index number to locate the position of the index number in byteTable, and filling in the number of the byte of byteTableMaterial that is currently performing the exclusive OR operation to obtain a disordered byte code list, denoted as byteTable.

[0039] The obtaining element includes: reading a byte from the position of n+m+i of file F1, i=0, 1, 2..., until the end of the file, performing XOR operation on the byte and the corresponding byte of orderTable to obtain a serial number, denoted as order, then reading the element of the orderTable, and storing the read element to the position of i of the byte array array, wherein n=0x100, m=0x100.

[0040] In the preferred embodiment, the obtaining element includes batch obtaining, if batch obtaining, the obtaining element includes: reading k bytes from the position of n+m+i of file F1, k=1, 2, 3..., 256, i=0, k, 2k, 3k..., until the end of the file, performing XOR operation on the k bytes and the corresponding k bytes of orderTable to obtain a byte array of k elements, denoted as orders, then performing the following steps in a loop: reading the jth serial number of orders, j=0, 1, 2..., k-1, denoted as order, then reading the element of the orderTable, and storing the read element to the position of i+j of the byte array array, wherein n=0x100, m=0x100.

[0041] A system for decrypting mail content in a foxmail offline environment, comprising:

[0042] A positioning module: there is an Index.key file under the foxmail data storage path, extracting the data of a set of bytes in Index.key, denoted as keyMaterial, there is an Index file under the foxmail data storage path, obtaining the mail number to be decrypted in Index, and positioning the encrypted file according to the mail number;

[0043] A decryption key module: decrypting keyMaterial to obtain decrypted data, denoted as key;

[0044] An extraction module: extracting a set of bytes in the encrypted file, denoted as orderTableMaterial, and continuing to extract a set of bytes to generate a list, denoted as byteTableMaterial;

[0045] A decryption module: decrypting orderTableMaterial to obtain a list of decrypted data, denoted as orderTable;

[0046] List operation module: using orderTable to operate byteTableMaterial to obtain a list, denoted as byteTable;

[0047] Element acquisition module: obtaining a byte data of the encrypted file, operating with orderTable to obtain a serial number, denoted as order, obtaining the orderth element of byteTable and storing it to the corresponding position of the byte array array;

[0048] Completion module: repeating the element acquisition step until all bytes of the encrypted file are read, then creating a blank file and writing the data of the byte array array to the file to obtain the decrypted email.

[0049] In the preferred embodiment, the positioning module comprises: confirming the installation path of foxmail, denoted as P1, then the local data storage path is: P1\Foxmail version\Storage\mailbox account\Mails\, denoted as P2, receiving an instruction, opening the file Index.key under P2, reading b bytes from the position offset a from the file header as keyMaterial, if the Index.key file does not exist or the required number of bytes is less than b, then opening the file Index under P2, reading b bytes from the position offset c as keyMaterial,

[0050] receiving an instruction, opening the file Index under P2, reading a set number of bytes from the position offset 0x1C, then obtaining the size of a mail trace occupied by +8, denoted as Size, reading a specific number of bytes from the position offset Size, denoted as Number, which is the number of downloaded emails, reading a set number of bytes from the position offset, denoted as Flag, if Flag is 1, it indicates that the downloaded email has been deleted,

[0051] dividing Number by a set size T to obtain a remainder X and a quotient Y, finding the folder named X under path P2, finding the folder named Y under X, then finding the data file F1 named Number under Y, if it cannot be found and the Flag corresponding to the Number is 1, it indicates that the local email has been completely deleted, if it is completely deleted, there is no need to perform the subsequent process steps; if it is not deleted or not completely deleted, the subsequent steps are performed;

[0052] The decryption key module comprises: decrypting keyMaterial to obtain b decrypted bytes, denoted as key;

[0053] The extracting module comprises: receiving an instruction, opening the file F1, reading n bytes starting from the position with offset 0, and recording the data as orderTableMaterial, reading m bytes starting from the position with offset n, and generating a list recorded as byteTableMaterial;

[0054] The decrypting module comprises: decrypting orderTableMaterial by taking key as a key, and the decrypted data forms a list recorded as orderTable;

[0055] The list operating module comprises: performing a setting operation on byteTableMaterial by taking orderTable, and obtaining a disordered bytecode list recorded as byteTable;

[0056] The element obtaining module comprises: reading a byte starting from the position with offset n+m+i of the file F1, i=0, 1, 2,..., until the end of the file, performing an exclusive or operation on the byte and a corresponding byte of orderTable, obtaining a serial number recorded as order, and then reading an element of the orderTable, and storing the read element to the position with index i of the byte array array;

[0057] The completing module comprises: cyclically operating the element obtaining step until all the bytes of the encrypted file are read, and then creating a blank file, writing the data of the byte array array to the file, and obtaining the decrypted email.

[0058] The method and system for decrypting email content in the foxmail offline environment can quickly locate the target email according to the email trace in the Index, decrypt the email after extracting the data, realize the decryption of the email content, and obtain more comprehensive information. BRIEF DESCRIPTION OF DRAWINGS

[0059] Figure 1 Part of the flow chart of the method for decrypting email content in the foxmail offline environment according to an embodiment of the present application. DETAILED DESCRIPTION

[0060] As shown in the figure, the method for decrypting email content in the foxmail offline environment according to a preferred embodiment of the present application comprises: Figure 1

[0061] ​Step S101, positioning: there is an Index.key file under the foxmail data storage path, data of a set of bytes in the Index.key is extracted, denoted as keyMaterial, there is an Index file under the foxmail data storage path, the mail number to be decrypted is obtained in the Index, and the encrypted file is positioned according to the mail number;

[0062] Step S103, decrypting key: the keyMaterial is decrypted to obtain decrypted data, denoted as key;

[0063] Step S105, extracting: a set of bytes in the encrypted file is extracted, denoted as orderTableMaterial, and a set of bytes is continuously extracted to generate a list, denoted as byteTableMaterial;

[0064] Step S107, decrypting: the orderTableMaterial is decrypted to obtain decrypted data forming a list, denoted as orderTable;

[0065] Step S109, list operation: the byteTableMaterial is processed by using the orderTable to obtain a list, denoted as byteTable;

[0066] Step S111, obtaining element: a byte data of the encrypted file is obtained, and the orderTable is processed to obtain an order number, denoted as order, and the orderth element of the byteTable is obtained and stored in a corresponding position of an array.

[0067] Step S113, completing: the element obtaining step is operated in a loop until all bytes of the encrypted file are read, then a blank file is created, and data of the array is written into the file to obtain the decrypted mail.

[0068] Further, preferably, the positioning of the embodiment comprises: the data of a set of bytes extracted in the Index.key is 0x8 bytes from the beginning of the file, and then 0x8 bytes are read, denoted as keyMaterial.

[0069] Further, preferably, the decrypting of the embodiment comprises:

[0070] Initial permutation: all bytes to be decrypted are grouped in 8 bytes, and ciphertext initial permutation is performed to reorder the original 64-bit binary bits;

[0071] Part: divided into left and right parts, each part has 32 bits;

[0072] F function processing: F round function processing is performed, 16 rounds are performed, a 48-bit sub-key is used in each round, the sub-key is generated from the master key, and each round of processing includes: extended permutation, XOR with the sub-key, S-box permutation, P-box permutation, merging of the left and right two parts, and final permutation to obtain plaintext;

[0073] Merging: the left and right two parts are merged;

[0074] Permutation: IP inverse permutation is performed to obtain ciphertext.

[0075] Further, preferably, in the list operation step of the embodiment, each byte of the orderTable and each byte of the byteTableMaterial are XORed one by one to obtain a new byte array, that is, a replacement array of 0~0xFF, the replacement array is recombined and arranged according to the replacement relationship, and the 0x100 bytes are referred to as the byteTable table.

[0076] Further, preferably, the obtaining element includes: reading 1 byte from the position of 0x200+i of the encrypted file, i=0, 1, 2,..., until the end of the encrypted file, the byte is the i-th byte of the mail, taking i modulo 0x100, the modulo result is used as an index to index the corresponding element from the orderTable, that is, orderTable[i%0x100], XORing the i-th byte with orderTable[i%0x100], then indexing the corresponding element from byteTable according to the XOR result as an index, and storing the element to the position of the i-th byte of the byte array array.

[0077] Further, preferably, the positioning steps in this embodiment include: confirming the installation path of Foxmail, denoted as P1, then the local data storage path is: P1\Foxmail version\Storage\email account\Mails\, denoted as P2; receiving the instruction, opening the file Index.key under P2, starting from offset a at the beginning of the file, reading b bytes as keyMaterial; if the Index.key file does not exist or the required number of bytes is less than b, then opening the file Index under P2, starting from offset c, reading b bytes as keyMaterial; receiving the instruction, opening the file Index under P2, starting from offset 0x1C, reading a set number of bytes of data, and then adding 8 to the data. Obtain the size of an email trace, denoted as Size. Starting at an offset of Size, read a specific number of bytes of data, denoted as Number (the downloaded email number). Starting at a set offset, read a set number of bytes of data, denoted as Flag. If Flag is 1, it indicates that the downloaded email has been deleted. Divide Number by the set size T to obtain the remainder X and quotient Y. Locate the folder named X under path P2, then find the folder named Y under X, and finally find the data file named Number F1 under Y. If it cannot be found, and the Flag corresponding to Number is 1, it means that the local email has been completely deleted. If completely deleted, no further steps are needed; otherwise, proceed with the next steps.

[0078] Furthermore, preferably, the decryption key in this embodiment includes: decrypting keyMaterial to obtain b decrypted bytes, denoted as key.

[0079] Further, preferably, the extraction in this embodiment includes: receiving an instruction, opening file F1, starting at offset 0, reading n bytes, which are denoted as orderTableMaterial, and starting at offset n, reading m bytes to generate a list, denoted as byteTableMaterial.

[0080] Furthermore, preferably, the decryption in this embodiment includes: using the key as a key to decrypt orderTableMaterial, and the decrypted data formed a list, denoted as orderTable;

[0081] Furthermore, preferably, the list operation in this embodiment includes: setting the byteTableMaterial using orderTable to obtain an out-of-order bytecode list, denoted as byteTable.

[0082] Further, preferably, the obtaining element of the embodiment includes: starting from a position offset n+m+i of the file F1, i=0, 1, 2,..., until the end of the file, reading a byte, performing XOR operation between the byte and a corresponding byte of the orderTable to obtain a serial number, denoted as order, then reading an element of the byteTable at the order, and storing the read element to a position indexed by i of the byte array array.

[0083] Further, preferably, the completing of the embodiment includes: performing the obtaining element step in a loop until all bytes of the encrypted file are read, then creating a blank file, and writing data of the byte array array to the file to obtain the decrypted email.

[0084] Further, in the method for decrypting email content in the foxmail offline environment according to the preferred embodiment of the present application, in the positioning step, the installation path of the foxmail is confirmed and denoted as P1, then the local data storage path is P1\Foxmail version\Storage\mailbox account\Mails\, denoted as P2, a file Index.key under P2 is opened, 8 bytes starting from a position offset 8 bytes from the file header are read as keyMaterial, if the file Index.key does not exist or the required number of bytes is less than 8, a file Index under P2 is opened, 8 bytes starting from a position offset c=0x2D are read as keyMaterial.

[0085] A file Index under P2 is opened, data of 4 bytes starting from a position offset 0x1C are read in little-endian order, then data+8 is obtained as a size occupied by a mail trace, denoted as Size, a position offset Size in the file Index is a starting position of the first mail information, 4 bytes are read in little-endian order, denoted as Number, which is a mail number, a position offset Size+4 is read as data of 4 bytes in little-endian order, denoted as Flag, if Flag is 1, it indicates that the downloaded mail has been deleted.

[0086] Number is divided by a set size T=32 to obtain a remainder X and a quotient Y, a folder named X under the path P2 is found, a folder named Y under X is found, then a data file F1 named Number under Y is found, if the file cannot be found and Flag corresponding to the Number is 1, it indicates that the local mail is completely deleted, if the mail is completely deleted, subsequent process steps are not needed to be executed, if the mail is not deleted or not completely deleted, subsequent process steps are executed.

[0087] Further, preferably, the decrypting key of the embodiment comprises: decrypting the keyMaterial to obtain 8 bytes of decrypted data, denoted as key.

[0088] Further, preferably, the extracting of the embodiment comprises: receiving an instruction, opening the file F1, reading n=0x100 bytes starting from the position with offset 0x100, denoted as orderTableMaterial, and reading m=0x100 bytes starting from the position with offset n=0x100, to generate a list, denoted as byteTableMaterial.

[0089] Further, preferably, the decrypting of the embodiment comprises: decrypting the orderTableMaterial using the key as the key, to obtain decrypted data forming a list, denoted as orderTable.

[0090] Further, preferably, the list operation of the embodiment comprises: performing XOR operation between the byteTableMaterial and the orderTable, to obtain a byte sequence, using the byte of the byteTableMaterial as the index to locate the position of the byteTable, and filling the index of the byte of the byteTableMaterial currently performing the XOR operation in the byteTableMaterial, to obtain a disordered byte code list, denoted as byteTable.

[0091] Further, preferably, the obtaining element of the embodiment comprises: reading a byte starting from the position with offset n+m+i of the file F1, i=0, 1, 2,..., until the end of the file, performing XOR operation between the byte and the corresponding byte of the orderTable to obtain a sequence number, denoted as order, and then reading the element of the byteTable with the order as the index, and storing the read element to the position with index i of the byte array array, wherein n=0x100 and m=0x100.

[0092] Further, preferably, the obtaining element of the embodiment includes batch obtaining, if the batch obtaining, the obtaining element is: starting from the position of n+m+i offset from the file F1, reading k bytes, k=1, 2, 3..., 256, i=0, k, 2k, 3k..., until the end of the file, performing XOR operation on the k bytes and the k bytes corresponding to the orderTable simultaneously, obtaining the byte array of k elements, denoted as orders, and then performing the following steps in the loop operation: reading the jth order number of orders, j=0, 1, 2..., k-1, denoted as order, then reading the element of the orderTable at the order, and storing the read element to the position of i+j of the byte array array, wherein n=0x100, m=0x100.

[0093] The system for decrypting mail content in the foxmail offline environment of a preferred embodiment of the application includes:

[0094] The positioning module: there is an Index.key file under the foxmail data storage path, and the data of a set of bytes in the Index.key is extracted and denoted as keyMaterial, and there is an Index file under the foxmail data storage path, and the mail number to be decrypted is obtained in the Index, and the encrypted file is positioned according to the mail number;

[0095] The decryption key module: the keyMaterial is decrypted to obtain decrypted data, denoted as key;

[0096] The extraction module: a set of bytes is extracted from the encrypted file, and these data are denoted as orderTableMaterial, and a set of bytes is further extracted to generate a list, denoted as byteTableMaterial;

[0097] The decryption module: the orderTableMaterial is decrypted to obtain a list of decrypted data, denoted as orderTable;

[0098] The list operation module: the byteTableMaterial is processed by using the orderTable to obtain a list, denoted as byteTable;

[0099] The obtaining element module: a byte data of the encrypted file is obtained, processed by using the orderTable to obtain an order number, denoted as order, and the element of the byteTable at the order is obtained and stored in the corresponding position of the byte array array;

[0100] The completion module: the loop operation obtains the element step until all the bytes of the encrypted file are read and completed, and then a blank file is newly built, the data of the byte array array is written into the file, and the decrypted mail is obtained.

[0101] Further, the system for decrypting the mail content in the foxmail offline environment of the preferred embodiment of the present application has the following for decrypting the foxmail local mail content:

[0102] The positioning module: confirming the installation path of foxmail, recorded as P1, the local data storage path is: P1\Foxmail version\Storage\mailbox account\Mails\, recorded as P2. Receiving instructions, opening the file Index.key under P2, starting from the position of the file header offset a, reading b bytes as keyMaterial. If the Index.key file does not exist or the required number of bytes is less than b, opening the file Index under P2, starting from the position of the offset c, reading b bytes as keyMaterial;

[0103] Further, preferably, receiving instructions, opening the file Index.key under P2, starting from the position of the file header offset 8 bytes, reading 8 bytes as keyMaterial.

[0104] Receiving instructions, opening the file Index under P2, starting from the position of the offset 0x1C, reading the data of a specific byte, and then adding 8 to the data to obtain the size occupied by a mail trace, recorded as Size. Starting from the position of the offset Size, reading the data of a specific byte, recorded as Number, that is, the number of downloaded mails. Starting from the position of the offset of a certain size, reading the data of a specific byte, recorded as Flag. If Flag is 1, it indicates that the downloaded mail has been deleted;

[0105] Dividing Number by a certain size T to obtain the remainder X and the quotient Y. In the path P2, find the folder named X, in X, find the folder named Y, and then in Y, find the data file F1 named Number. If it cannot be found, and the Flag corresponding to the Number is 1, it indicates that the local mail has been completely deleted. If it is completely deleted, the subsequent steps do not need to be performed. In the preferred embodiment, T=32.

[0106] Preferably, in the positioning module of the present application, reading is completed to extract. The present application requires that the number of bytes of Index.key needs to be greater than or equal to 16. Receiving instructions, opening the file Index.key under P2, starting from the position of the file header offset 0x8 bytes, and then reading 0x8 bytes.

[0107] Preferably, in the positioning module, the installation path of foxmail is confirmed, denoted as P1, and the local data storage path is: P1\Foxmail version\Storage\mailbox account\Mails\, denoted as P2. A file Index.key under P2 is opened, 8 bytes starting from the position of file header offset 8 bytes are read as keyMaterial. If the file Index.key does not exist or the required number of bytes is less than 8, a file Index under P2 is opened, 8 bytes starting from the position of offset c=0x2D are read as keyMaterial.

[0108] A file Index under P2 is opened, and 8 specific bytes of data starting from the position of offset 0x1C are read, and then data+8 is obtained to obtain the size occupied by a mail trace, denoted as Size. 8 specific bytes of data starting from the position of offset Size are read, denoted as Number, that is, the number of downloaded mails. Offset 0x1C is referenced from the beginning of the file.

[0109] Preferably, a file Index under P2 is opened, 4 bytes of data starting from the position of offset 0x1C are read in little-endian order, and then data+8 is obtained to obtain the size occupied by a mail trace, denoted as Size. 4 bytes of data starting from the position of offset Size in the Index file are read in little-endian order, denoted as Number, that is, the number of mails. 4 bytes of data starting from the position of offset Size+4 are read in little-endian order, denoted as Flag. If Flag is 1, it indicates that the downloaded mail has been deleted

[0110] 4 bytes of data starting from the position of offset Size are read, denoted as Number, that is, an int type of data.

[0111] In this embodiment, if the mail is deleted, the decryption will be performed as the normal process. If it is completely deleted, the decryption of the mail is skipped.

[0112] The decryption key module of this embodiment decrypts keyMaterial to obtain b bytes of decrypted data, denoted as key.

[0113] The decryption process of this embodiment is as follows:

[0114] Initial permutation: all bytes that need to be decrypted are grouped into 8 bytes, and the original 64-bit binary bits are reordered for initial permutation of ciphertext;

[0115] Part: divided into left and right parts, each part has 32 bits;

[0116] F round function processing: F round function processing is performed. 16 rounds are performed, and a 48-bit sub-key (generated from the master key) is used in each round. Each round of processing includes an expansion permutation, XOR with the sub-key, S-box permutation, P-box permutation operation, merging of the left and right parts, and final permutation to obtain plaintext;

[0117] Merging: the left and right parts are merged.

[0118] Permutation: final permutation, i.e. IP inverse permutation, is performed to obtain ciphertext.

[0119] Further, the extraction module of the embodiment opens the file F1, reads n bytes starting from the position with an offset of 0, and records the data as orderTableMaterial. A list is generated by reading m bytes starting from the position with an offset of n, and is recorded as byteTableMaterial.

[0120] The extraction module of the embodiment reads orderTableMaterial by reading 0x100 bytes from the beginning of the encrypted file, and records the data as orderTableMaterial. Then, 0x100 bytes are continuously read, and are recorded as byteTableMaterial.

[0121] Further, the decryption module of the embodiment decrypts orderTableMaterial using key as the key, and the decrypted data forms a list, which is recorded as orderTable.

[0122] The decryption process of the embodiment is as follows:

[0123] Initial permutation: all bytes to be decrypted are grouped into 8-byte groups, and the ciphertext is initially permuted to reorder the original 64-bit binary bits;

[0124] Part: divided into left and right parts, each part being 32 bits;

[0125] F round function processing: F round function processing is performed. 16 rounds are performed, and a 48-bit sub-key (generated from the master key) is used in each round. Each round of processing includes an expansion permutation, XOR with the sub-key, S-box permutation, P-box permutation operation, merging of the left and right parts, and final permutation to obtain plaintext;

[0126] Merging: the left and right parts are merged.

[0127] Permutation: final permutation, i.e. IP inverse permutation, is performed to obtain ciphertext.

[0128] Further, preferably, the list operation module of the embodiment performs an exclusive OR operation on byteTableMaterial with orderTable to obtain a disordered byte code list, denoted as byteTable.

[0129] Each byte of orderTable is exclusive ORed with each byte of byteTableMaterial to obtain a new byte array, i.e. a replacement array of 0~0xFF. In order to facilitate decryption, a new array is needed to describe, for example, if the 0th element of the replacement array is 5, then 0 is filled in the 5th element of the new array, and if the 1st element is 0xFF, then 1 is filled in the 0xFFth element of the new array. Repeat the filling of 0x100 bytes, and these 0x100 bytes are called byteTable. The byteTable looks like a table of 0~0xFF in disordered order (actually describing the mapping relationship of the replacement array and 0~0xFF), and is used for replacement of the content of the email.

[0130] The next byte data of the encrypted file is read from the position 0x200 offset from the beginning of the encrypted file, and exclusive OR operation is performed.

[0131] The exclusive OR operation exclusive ORs the byte with the corresponding byte of orderTable (assuming the number of the byte is i, i=0,1,2,... until the end of the file, i is taken modulo 0x100, and the modulo result is used as the index of orderTable, i.e. the ith byte corresponds to orderTable[i%0x100]), and then the element corresponding to the index of byteTable is indexed according to the exclusive OR result. For example, if the value obtained after exclusive OR is 8, then the final result is byteTable[8].

[0132] The elements in byteTable of the embodiment are a total of 0x100, and the numbers of these elements from the beginning to the end are 0~0xFF.

[0133] Further, the element acquisition module of the embodiment starts from the position n+m+i of file F1, i=0,1,2,..., until the end of the file, reads a byte, performs a specific operation on the byte and the corresponding byte of orderTable to obtain a serial number, denoted as order, and then reads the 0rderth element of byteTable and stores the read element to the position indexed by i of the byte array array.

[0134] Preferably, n=0x100, m=0x100 in the embodiment. The specific process of the specific operation of the byte and the orderTable is: XOR the byte and the corresponding byte of the orderTable (suppose the file offset is n+m+i at this time, the number of the byte is i, i is taken modulo 0x100, and the modulo result is used as the index of the orderTable, that is, the i-th byte corresponds to orderTable[i%0x100]).

[0135] Further, the completion module of the embodiment: the element acquisition module is operated in a loop until all bytes of the encrypted file are read and completed. Then a blank file is newly created, and the data of the byte array array is written into the file to obtain the decrypted email.

[0136] The method and system for decrypting email content in the foxmail offline environment of the application can batch acquire elements. For example, 8 bytes are a group, 8 bytes of encrypted bytes are read and recorded as data1, then 8 bytes corresponding to the orderTable are read and recorded as data2, and then data1 and data2 are XORed. The result is consistent with the result of byte-by-byte XORing.

[0137] The method and system for decrypting email content in the foxmail offline environment of the application can temporarily store in disorder after decryption. For example, store in reverse order, such as binary 0x31 0x32 0x33 (i.e. text "123") is stored as 0x33 0x32 0x31 (i.e. text "321"), and read in reverse order before use. Or define a position rule to specify where to store the first several bytes, where to store the middle several bytes, etc., so that the entire binary result is disordered, and then restore to normal order according to the rule before use.

[0138] The method and system for decrypting email content in the foxmail offline environment of the application read 0x8 bytes from the position offset 0x8 bytes from the beginning of the Index.key file, and then decrypt the 0x8 bytes using foxmailDecrypt to obtain the key. 0x100 bytes are read from the beginning of the encrypted file and recorded as orderTableMaterial. Then 0x100 bytes are continuously read and recorded as byteTableMaterial.

[0139] The method of the application can quickly locate the target email according to the email traces, realize decryption of the email content, and obtain more comprehensive information.

[0140] The three elements of the application are key, orderTableMaterial and byteTableMaterial, and there is no order, and if there is an order, it is also within the scope of the application.

[0141] The acquisition elements, method steps and modules of the application express the behavior of decrypting encrypted bytes as individual units and finally combining them in order, and if there are the following modifications, they will also be within the scope of the application.

[0142] The method and system for decrypting mail content in the foxmail offline environment of the application can batch read and batch decrypt, and the results obtained are consistent with the results of single byte reading and decryption. After decryption, the results are temporarily stored in disorder, but the final combination results are consistent with the order combination results.

[0143] Based on the above ideal embodiments according to the application, through the above description, relevant personnel can make various changes and modifications without deviating from the technical idea of the application. The technical scope of the application is not limited to the contents of the specification, and must be determined according to the scope of the claims.

[0144] Those skilled in the art should understand that the embodiments of the application can be provided as a method, a system, or a computer program product. Therefore, the application can be in the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the application can be in the form of a computer program product implemented on one or more computer usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

[0145] The application is described with reference to flowcharts and / or block diagrams according to the method, device (system) and computer program product of the embodiments of the application. It should be understood that each flow and / or block in the flowchart and / or block diagram, and the combination of the flows and / or blocks in the flowchart and / or block diagram can be realized by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a machine that implements the functions specified in the flowchart and / or block diagram. Figure 1 The device for performing the functions specified in one or more flows and / or blocks. Figure 1 The device for performing the functions specified in one or more flows and / or blocks.

[0146] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instructions which implement the flow Figure 1 The flow or flows and / or blocks Figure 1 The flow or flows and / or blocks

[0147] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions that execute on the computer or other programmable apparatus provide steps for implementing the flow Figure 1 The flow or flows and / or blocks Figure 1 The flow or flows and / or blocks

Claims

1. A method for decrypting mail content in a foxmail offline environment, characterized in that, The method comprises the following steps: Positioning: there is an Index.key file under the foxmail data storage path, data of a set of bytes in the Index.key file is extracted and recorded as keyMaterial, there is an Index file under the foxmail data storage path, the number of the mail to be decrypted is obtained from the Index file, and the encrypted file is positioned according to the number of the mail; Decrypting the key: the keyMaterial is decrypted to obtain decrypted data, which is recorded as key; Extraction: a set of bytes is extracted from the encrypted file, and the data is recorded as orderTableMaterial; a set of bytes is continuously extracted to generate a list, which is recorded as byteTableMaterial; Decryption: the orderTableMaterial is decrypted to obtain a list of decrypted data, which is recorded as orderTable; List operation: the byteTableMaterial is processed by using the orderTable to obtain a list, which is recorded as byteTable; Obtaining an element: a byte data of the encrypted file is obtained, and the byte data is processed by using the orderTable to obtain a serial number, which is recorded as order; the orderth element of the byteTable is obtained and stored in a corresponding position of an array; Completion: the element obtaining step is repeated until all the bytes of the encrypted file are read, then a blank file is created, and the data of the array is written into the file to obtain the decrypted mail.

2. The method for decrypting mail content in a foxmail offline environment according to claim 1, characterized in that, The positioning comprises the following steps: a set of bytes of data is extracted from the Index.key file, which is offset by 0x8 bytes from the beginning of the file, then 0x8 bytes are read, and the data is recorded as keyMaterial.

3. The method for decrypting mail content in a foxmail offline environment according to claim 1, characterized in that, The decryption comprises the following steps: Initial permutation: all the bytes to be decrypted are grouped into 8 bytes, and the original 64-bit binary bits are reordered by performing an initial permutation of the ciphertext; Division: the 64-bit binary bits are divided into left and right parts, each part being 32 bits; F function processing: the F function processing is performed for 16 rounds, each round using a 48-bit sub-key, the sub-key being generated from the master key, and each round of processing comprising an expansion permutation, an XOR operation with the sub-key, an S-box permutation, a P-box permutation, merging the left and right parts and performing a final permutation to obtain the plaintext; Merging: the left and right parts are merged; Permutation: an IP inverse permutation is performed to obtain the ciphertext.

4. The method for decrypting mail content in foxmail offline environment according to claim 1, characterized in that, In the list operation step, each byte of the orderTable and each byte of the byteTableMaterial are XORed one by one to obtain a new byte array, i.e. a replacement array of 0~0xFF, the replacement array is recombined and arranged according to the replacement relationship, and the 0x100 bytes are referred to as the byteTable.

5. The method for decrypting mail content in foxmail offline environment according to claim 1, characterized in that, The obtaining element includes: reading 1 byte from the position of the offset 0x200+i of the encrypted file, i=0,1,2..., until the end of the encrypted file, the byte is the i-th byte of the mail, taking the i modulo 0x100, taking the modulo result as an index, indexing the corresponding element from the orderTable, i.e. orderTable[i%0x100], XORing the i-th byte with orderTable[i%0x100], then indexing the corresponding element from byteTable according to the XOR result as an index, and storing the element to the position of the i-th byte of the byte array array.

6. The method for decrypting mail content in a foxmail offline environment according to any one of claims 1 to 5, characterized in that, The positioning step includes: confirming the installation path of foxmail, denoted as P1, then the local data storage path is: P1\Foxmail version\Storage\mailbox account\Mails\, denoted as P2, receiving an instruction, opening the file Index.key under P2, reading b bytes from the position of the offset a of the file header, as keyMaterial, if the Index.key file does not exist or the required number of bytes is less than b, then opening the file Index under P2, reading b bytes from the position of the offset c, as keyMaterial, Receiving an instruction, opening the file Index under P2, reading data of a set byte from the position of the offset 0x1C, then obtaining a size occupied by a mail trace by adding 8 to the data, denoted as Size, reading data of a specific byte from the position of the offset Size, denoted as Number, i.e. the number of downloaded mails, reading data of a set byte from the position of the offset, denoted as Flag, if Flag is 1, indicating that the downloaded mail has been deleted, Dividing Number by a set size T to obtain a remainder X and a quotient Y, finding the folder named X under the path P2, finding the folder named Y under X, then finding the data file F1 named Number under Y, if it cannot be found, and the Flag corresponding to the Number is 1, indicating that the local mail has been completely deleted, if it is completely deleted, there is no need to perform the subsequent process steps; if it is not deleted or not completely deleted, performing the subsequent steps; The decryption key includes: decrypting keyMaterial to obtain b bytes of decrypted data, denoted as key; The extraction includes: receiving an instruction, opening the file F1, reading n bytes from the position of the offset 0, the data is denoted as orderTableMaterial, reading m bytes from the position of the offset n, generating a list, denoted as byteTableMaterial; The decryption includes: using key as a key to decrypt orderTableMaterial, the decrypted data forms a list, denoted as orderTable. The list operation includes: setting operation of byteTableMaterial with orderTable, to obtain a disordered bytecode list, denoted as byteTable; The element obtaining includes: starting from the position of n+m+i of file F1, i=0, 1, 2..., until the end of the file, reading a byte, performing XOR operation on the byte and the corresponding byte of orderTable to obtain a serial number, denoted as order, then reading the orderth element of byteTable, and storing the read element to the position of index i of byte array array; The completion includes: cyclically operating the element obtaining step until all bytes of the encrypted file are read, then creating a blank file, and writing the data of byte array array to the file to obtain the decrypted email.

7. The method for decrypting mail content in a foxmail offline environment according to any one of claims 1 to 5, characterized in that, In the positioning step, the installation path of foxmail is confirmed, denoted as P1, then the local data storage path is: P1\Foxmail version\Storage\mailbox account\Mails\, denoted as P2, a file Index.key under P2 is opened, 8 bytes starting from the position of 8 bytes of the file header are read as keyMaterial, if the Index.key file does not exist or the required number of bytes is less than 8, a file Index under P2 is opened, 8 bytes starting from the position of c=0x2D are read as keyMaterial, A file Index under P2 is opened, 4 bytes of data starting from the position of 0x1C are read in little-endian sequence, then the data+8 is obtained to obtain the size occupied by a mail trace, denoted as Size, the position of Size in the Index file is offset, which is the starting position of the first mail information, 4 bytes are read in little-endian sequence, denoted as Number, which is the mail number, the position of Size+4 is offset, 4 bytes of data are read in little-endian sequence, denoted as Flag, if Flag is 1, it indicates that the downloaded mail has been deleted, Number is divided by a set size T=32 to obtain a remainder X and a quotient Y, a folder with the name X is found under the path P2, a folder with the name Y is found under X, then a data file F1 with the name Number is found under Y, if it cannot be found, and the Flag corresponding to the Number is 1, it indicates that the local mail has been completely deleted, if it is completely deleted, the subsequent process steps are not needed to be executed; if it is not deleted or not completely deleted, the subsequent steps are executed; The decryption key includes: decrypting keyMaterial to obtain 8 decrypted bytes, denoted as key; The extracting includes: receiving an instruction, opening the file F1, reading n=0x100 bytes starting from the position with offset 0x100, and recording the data as orderTableMaterial; reading m=0x100 bytes starting from the position with offset n=0x100, and generating a list recorded as byteTableMaterial; The decrypting includes: decrypting orderTableMaterial by taking key as a key, and forming a list recorded as orderTable by the decrypted data; The list operation includes: performing XOR operation on byteTableMaterial by taking orderTable, and performing XOR operation on each byte of byteTableMaterial and each byte of orderTable, and taking the obtained byte as an index number to locate the position of the index number in byteTable, and filling the index number of the byte currently performing XOR operation in byteTableMaterial to obtain a disordered byte code list recorded as byteTable; The obtaining element includes: reading a byte starting from the position with offset n+m+i of file F1, i=0, 1, 2, until the end of the file, performing XOR operation on the byte and the corresponding byte of orderTable to obtain a serial number recorded as order, and then reading the element of byteTable at the order, and storing the read element to the position with index i of byte array array, wherein n=0x100 and m=0x100.

8. The method for decrypting mail content in a foxmail offline environment according to any one of claims 1 to 5, characterized in that, The obtaining element includes: batch obtaining, and if the batch obtaining is performed, the obtaining element includes: reading k bytes starting from the position with offset n+m+i of file F1, k=1, 2, 3..., 256, i=0, k, 2*k, 3*k..., until the end of the file, performing XOR operation on the k bytes and the corresponding k bytes of orderTable to obtain a byte array of k elements recorded as orders, and then performing the following steps in a loop: reading the jth serial number of orders, j=0, 1, 2..., k-1, recorded as order, and then reading the element of byteTable at the order, and storing the read element to the position with index i+j of byte array array, wherein n=0x100 and m=0x100.

9. A system for decrypting mail content in a foxmail offline environment, characterized in that, The method comprises: The positioning module: there is an Index.key file in the foxmail data storage path, and data of a set byte in Index.key is extracted and recorded as keyMaterial; there is an Index file in the foxmail data storage path, and the number of a mail to be decrypted is obtained in Index, and the encrypted file is located according to the number of the mail; The decrypting key module: decrypting keyMaterial to obtain decrypted data recorded as key; The extraction module extracts the set bytes in the encrypted file, and the data is recorded as orderTableMaterial. The extraction of the set bytes continues to generate a list, which is recorded as byteTableMaterial. The decryption module decrypts orderTableMaterial, and the decrypted data forms a list, which is recorded as orderTable. The list operation module operates byteTableMaterial using orderTable to obtain a list, which is recorded as byteTable. The element acquisition module acquires a byte data of the encrypted file, and operates the byte data with orderTable to obtain an order number, which is recorded as order. The orderth element of byteTable is acquired and stored in the corresponding position of the byte array array. The completion module performs the element acquisition step in a loop until all the bytes of the encrypted file are read. Then, a blank file is created, and the data of the byte array array is written into the file to obtain the decrypted email.

10. The system for decrypting mail content in a foxmail offline environment according to claim 9, wherein, The positioning module includes the following steps: confirming the installation path of foxmail, which is recorded as P1, and then the local data storage path is P1\Foxmail version\Storage\mailbox account\Mails\, which is recorded as P2. A file Index.key under P2 is opened, b bytes are read from the position offset a in the file header as keyMaterial. If the Index.key file does not exist or the required number of bytes is less than b, a file Index under P2 is opened, b bytes are read from the position offset c as keyMaterial. A file Index under P2 is opened, and a set number of bytes of data are read from the position offset 0x1C. Then, the data + 8 is obtained to obtain the size of a mail trace, which is recorded as Size. A specific number of bytes of data are read from the position offset Size, which is recorded as Number, i.e., the number of downloaded emails. A set number of bytes of data are read from the position offset, which is recorded as Flag. If Flag is 1, it indicates that the downloaded email has been deleted. Number is divided by a set size T to obtain a remainder X and a quotient Y. In the path P2, a folder with the name X is found. In X, a folder with the name Y is found. Then, in Y, a data file F1 with the name Number is found. If the file cannot be found and the Flag corresponding to the Number is 1, it indicates that the local email has been completely deleted. If it is completely deleted, the subsequent process steps are not needed. If it is not deleted or not completely deleted, the subsequent steps are performed. The decryption key module includes the following steps: decrypting keyMaterial to obtain b bytes of decrypted data, which is recorded as key. The extracting module includes: receiving an instruction, opening the file F1, reading n bytes starting from the position with offset 0, and recording the data as orderTableMaterial, reading m bytes starting from the position with offset n, and generating a list recorded as byteTableMaterial; The decrypting module includes: decrypting orderTableMaterial by taking key as a key, and forming a list recorded as orderTable from the decrypted data; The list operating module includes: performing a setting operation on byteTableMaterial by using orderTable, and obtaining a disordered byte code list recorded as byteTable; The element obtaining module includes: starting from the position with offset n+m+i of the file F1, reading a byte, performing an exclusive OR operation on the byte and the corresponding byte of orderTable, obtaining a serial number recorded as order, and then reading the orderth element of byteTable, and storing the read element to the corresponding position of the byte array array; The completing module includes: cyclically operating the element obtaining step until all the bytes of the encrypted file are read, and then creating a blank file, writing the data of the byte array array to the file, and obtaining the decrypted email.

Images