诊断0x27服务解密文件DLL制作与使用

DLL文件在CANoe的使用方法

DLL文件在诊断里面可以用在0x27秘钥服务里面，对解密有帮助，在下图位置加载。

DLL文件制作

vector公司本来就给了我们一个demo，先拷贝一份下来，别把原来的文件给改坏了。我这个是CANoe12，demo代码的路径在C:\Users\Public\Documents\Vector\CANoe\Sample Configurations 12.0.75\CAN\Diagnostics\UDSSystem\SecurityAccess\Sources，大家可以参考下，把里面这个KeyGenDll_GenerateKeyEx文件夹复制一份出来，当然你也可以用KeyGenDll_GenerateKeyExOpt，待会打开源代码看得到是差不多的。

打开Visual Studio 2019，将工程里面的工程文件GenerateKeyExImpl.vcproj拖进去，就能打开工程。展开工程，然后打开源文件GenerateKeyExImpl.cpp。

程序比较简单，还有注释，里面有很多空行，我删了几行放在这里大家看看，这个是工程KeyGenDll_GenerateKeyEx的源代码。

// KeyGeneration.cpp : Defines the entry point for the DLL application.
#include <windows.h>
#include "KeyGenAlgoInterfaceEx.h"BOOL APIENTRY DllMain( HANDLE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved)
{return TRUE;
}KEYGENALGO_API VKeyGenResultEx GenerateKeyEx(const unsigned char*  iSeedArray,     /* Array for the seed [in] */unsigned int          iSeedArraySize, /* Length of the array for the seed [in] */const unsigned int    iSecurityLevel, /* Security level [in] */const char*           iVariant,       /* Name of the active variant [in] */unsigned char*        ioKeyArray,     /* Array for the key [in, out] */unsigned int          iKeyArraySize,  /* Maximum length of the array for the key [in] */unsigned int&         oSize           /* Length of the key [out] */)
{if (iSeedArraySize>iKeyArraySize)return KGRE_BufferToSmall;for (unsigned int i=0;i<iSeedArraySize;i++)ioKeyArray[i]=~iSeedArray[i];oSize=iSeedArraySize;return KGRE_Ok;
}

这个是KeyGenDll_GenerateKeyExOpt工程的源代码GenerateKeyExOpt.cpp，相对于KeyGenDll_GenerateKeyEx工程就是多了个选项作为入参，高级用法才会用到，我们一般都用不到，所以这里就用KeyGenDll_GenerateKeyEx工程。

//
/// Seed & Key DLL with extended interface and options argument
/// This is an example implementation for CANoe demo configuration "UDSsim"
//#include <windows.h>
#include "GenerateKeyExOpt.h"KEYGENALGO_API VKeyGenResultExOpt GenerateKeyExOpt(const unsigned char*  ipSeedArray,            // Array for the seed [in]unsigned int          iSeedArraySize,         // Length of the array for the seed [in]const unsigned int    iSecurityLevel,         // Security level [in]const char*           ipVariant,              // Name of the active variant [in]const char*           ipOptions,              // Optional parameter which might be used for OEM specific information [in]unsigned char*        iopKeyArray,            // Array for the key [in, out]unsigned int          iMaxKeyArraySize,       // Maximum length of the array for the key [in]unsigned int&         oActualKeyArraySize)    // Length of the key [out]
{// Check the input argumentsif( iSecurityLevel == 0 || iSecurityLevel > 10)return KGREO_SecurityLevelInvalid;if( iMaxKeyArraySize < iSeedArraySize || 4 > iSeedArraySize)return KGREO_BufferToSmall;if( !ipSeedArray || !iopKeyArray || !ipOptions || strlen( ipOptions) < iSeedArraySize)return KGREO_UnspecifiedError;// Copy the input bytes to the output bytesmemcpy( iopKeyArray, ipSeedArray, iSeedArraySize);// As an example each byte in the options array will be added to each byte of the seed array securityLevel times.for( unsigned int l = 0; l < iSecurityLevel; ++l){for( unsigned int i = 0; i < iSeedArraySize; ++i)iopKeyArray[i] += ipOptions[i];}oActualKeyArraySize = iSeedArraySize;return KGREO_Ok;
}

修改KeyGenDll_GenerateKeyEx工程源代码GenerateKeyExImpl.cpp，里面做了注释。

KEYGENALGO_API VKeyGenResultEx GenerateKeyEx(unsigned char*  iSeedArray,     /* 种子数组 */unsigned int          iSeedArraySize, /* 种子长度 */const unsigned int    iSecurityLevel, /* 秘钥等级（调试打印） */const char*           iVariant,       /* 激活状态（调试打印） */unsigned char*        ioKeyArray,     /* 秘钥数组 */unsigned int          iKeyArraySize,  /* 秘钥长度 */unsigned int&         oSize           /* 秘钥长度（调试打印） */)
{if (iSeedArraySize>iKeyArraySize)//秘钥长度大于种子长度的话就是长度错误return KGRE_BufferToSmall;……(这里是我的算法，计算出来的秘钥放在iSeedArray[]数组)for (int i = 0; i < iKeyArraySize; i++) {ioKeyArray[i] = iSeedArray[i];}oSize = iSeedArraySize;//这个其实没啥用，长度是CDD里面定义的return KGRE_Ok;
}

对着工程右键，重新生成就行，输出信息会告诉你把DLL文件生成到了哪里。

DLL文件检查

如果你很有自信一次写对，那直接在CANoe里面直接加载就行。如果想谨慎点，想要检查写得对不对，就新建个控制台工程来调用DLL文件里面的函数进行验证。

把上面生成的DLL文件拷贝到控制台路径下。

调用代码如下

// CallDLL.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。
//
#include <iostream>
#include <Windows.h>
#include <tchar.h>using namespace std;
#define iSeedArraySize 16
const unsigned char SeedArray[iSeedArraySize] = {0xD1,0x28,0xD2,0x7B,0x25,0xCE,0x78,0x22,0xCB,0x75,0x1E,0xC8,0x71,0x1B,0xC5,0x6E }; const unsigned int    iSecurityLevel = 1;
const char iVariant = 0;#define iKeyArraySize 16
unsigned char ioKeyArray[iSeedArraySize] = { 0x0 };unsigned int oSize = 0;int main()
{HINSTANCE handle = LoadLibrary(_T("SeednKey.dll"));//加载dll ,需要加上头文件tchar.h并在调用时加上_T 由句柄指向dll文件cout << "Dll Adddr:" << handle << endl;if (handle){typedef int(*GenerateKeyExOpt_API_Type)(const unsigned char*,unsigned int,const unsigned int,const char*,unsigned char*,unsigned int,unsigned int &);GenerateKeyExOpt_API_Type GenerateKeyExOpt_API_Point = (GenerateKeyExOpt_API_Type)GetProcAddress(handle, "GenerateKeyEx"); //GetProcAddress获取dll中的Add_Func函数，用add_API_Point指向函数它cout << "dll 函数的句柄返回值:" << GenerateKeyExOpt_API_Point << endl;//打印dll的函数句柄地址值,不为0就说明调用成功printf("\n");if (GenerateKeyExOpt_API_Point){int result = (*GenerateKeyExOpt_API_Point)(SeedArray,iSeedArraySize, iSecurityLevel,&iVariant, ioKeyArray, iKeyArraySize, oSize);for (int i = 0; i < iSeedArraySize; i++) {/*打印种子*/printf("SeedArray[%d]: %2X\n", i, SeedArray[i]);}printf("\n");for (int j = 0; j < iKeyArraySize; j++) {/*打印秘钥*/printf("ioKeyArray[%d]: %2X\n", j, ioKeyArray[j]);}cout << "oSize = " << oSize << endl;/*调试打印*/FreeLibrary(handle); //释放句柄}}return 0;
}// Run program: Ctrl + F5 or Debug > Start Without Debugging menu
// Debug program: F5 or Debug > Start Debugging menu

对一下打印出来的结果，是对的话就是验证通过。