abb_password.c

ABB AIN电表的密码解密算法

#include <stdio.h>
static void encrypt_password(unsigned char *pwd, unsigned char *key);
main()
{
	unsigned char pwd[4], key[4];
	pwd[0] = 0x00; pwd[1] = 0x00; pwd[2] = 0x00; pwd[3] = 0x00;
	key[0] = 0x93; key[1] = 0x61; key[2] = 0x13; key[3] = 0x41;
	printf("[pwd: 0x%02X%02X%02X%02X] ",pwd[0],pwd[1],pwd[2],pwd[3]);
	encrypt_password(pwd, key);
	printf("[key: 0x%02X%02X%02X%02X] [encrypted=%02X%02X%02X%02X]\n",
		key[0],key[1],key[2],key[3],pwd[0],pwd[1],pwd[2],pwd[3]);
	printf(" [should be=AA644B72)\n");
	pwd[0] = 0x34; pwd[1] = 0x12; pwd[2] = 0x78; pwd[3] = 0x56;
	key[0] = 0x56; key[1] = 0x5B; key[2] = 0xF7; key[3] = 0x87;
	encrypt_password(pwd, key);
	printf("[pwd: 0x34127856] ");
	printf("[key: 0x565BF787] [encrypted=%02X%02X%02X%02X]\n",
	pwd[0],pwd[1],pwd[2],pwd[3]);
	printf(" [should be=4814BD60)\n");
	pwd[0] = 0x11; pwd[1] = 0x11; pwd[2] = 0x11; pwd[3] = 0x11;
	key[0] = 0xab; key[1] = 0xf4; key[2] = 0x1a; key[3] = 0xba;
	encrypt_password(pwd, key);
	printf("[pwd: 0x11111111] ");
	printf("[key: 0xabf41aba] [encrypted=%02X%02X%02X%02X]\n",
		pwd[0],pwd[1],pwd[2],pwd[3]);
	printf(" [should be=5AE40EEF)\n");
	pwd[0] = 0x11; pwd[1] = 0x11; pwd[2] = 0x11; pwd[3] = 0x11;
	key[0] = 0xa4; key[1] = 0x53; key[2] = 0x24; key[3] = 0x3a;
	encrypt_password(pwd, key);
	printf("[pwd: 0x11111111] ");
	printf("[key: 0xa453243a] [encrypted=%02X%02X%02X%02X]\n",
		pwd[0],pwd[1],pwd[2],pwd[3]);
	printf(" [should be=c8f9b20a)\n");
}

static void encrypt_password(unsigned char *pwd, unsigned char *e_key)
{
	short i, tmp[3];
	unsigned short j,k = 0;
	unsigned char key[4];
	/* place key into stack variable */
	key[0] = e_key[0];
	key[1] = e_key[1];
	key[2] = e_key[2];
	key[3] = e_key[3];
	/* Add an arbitrary number (0xAB41) to the key just for fun. */
	tmp[0] = 0x0041;
	tmp[1] = key[3];
	tmp[2] = tmp[0] + tmp[1];
	key[3] += 0x41;
	if( tmp[2] & 0xff00 )
	{
		tmp[2] = (0xff00 & tmp[2]) >> 8;
		key[2] += tmp[2];
		tmp[0] = tmp[2];
		tmp[1] = key[2];
		tmp[2] = tmp[0] + tmp[1];
		if( tmp[2] & 0xff00 )
		{
			tmp[2] = (0xff00 & tmp[2]) >> 8;
			key[1] += tmp[2];
			tmp[0] = tmp[2];
			tmp[1] = key[1];
			tmp[2] = tmp[0] + tmp[1];
			if( tmp[2] & 0xff00 )
			{
				tmp[2] = (0xff00 & tmp[2]) >> 8;
				key[0] += tmp[2];
			}
		}
	}
	tmp[0] = 0x00ab;
	tmp[1] = key[2];
	tmp[2] = tmp[0] + tmp[1];
	key[2] += 0xab;
	if( tmp[2] & 0xff00 )
	{
		tmp[2] = (0xff00 & tmp[2]) >> 8;
		key[1] += tmp[2];
		tmp[0] = tmp[2];
		tmp[1] = key[1];
		tmp[2] = tmp[0] + tmp[1];
		if( tmp[2] & 0xff00 )
		{
			tmp[2] = (0xff00 & tmp[2]) >> 8;
			key[0] += tmp[2];
		}
	}
	/* Generate a four bit checksum to be used as loop index */
	i = key[3] + key[2] + key[1] + key[0];
	i = i & 0x0f;
	while(i >= 0)
	{
		/* Shift the key and maintain the carry bit. */
		if(key[3] & 0x80) j = 1;
		else j = 0;
		key[3] = key[3] << 1;
		key[3] += k;
		k = j;
		if(key[2] & 0x80) j = 1;
		else j = 0;
		key[2] = key[2] << 1;
		key[2] += k;
		k = j;
		if(key[1] & 0x80) j = 1;
		else j = 0;
		key[1] = key[1] << 1;
		key[1] += k;
		k = j;
		if(key[0] & 0x80) j = 1;
		else j = 0;
		key[0] = key[0] << 1;
		key[0] += k;
		k = j;
		/* Apply the key to the password */
		pwd[0] ^= key[0];
		pwd[1] ^= key[1];
		pwd[2] ^= key[2];
		pwd[3] ^= key[3];
		i--;
	}
}