actionscript-3 - 如何破解 Adob​​e Air 中的加密本地存储？

Question

假设用户 Tom 安装了一个名为 X 的 Adob​​e Air 应用程序，并且 X 在 EncryptedLocalStore 中存储了一些 secret ；那么 Tom 想要破解 EncryptedLocalStore(检查并更改其内容)，他怎么能做到呢？

谢谢!

Answer 1

根据AS3语言引用:

The data in the encrypted local store is protected by the user’s operating system account credentials. Other entities cannot access the data in the store unless they can login as that user. However, the data is not secure against access by other applications run by an authenticated user. Thus, data that your application may want to keep secret from users, such as keys used for licensing or digital rights management, is not secure. The ELS is not an appropriate location for storing such information. It is only an appropriate place for storing a user’s private data, such as passwords.

关于加密的一些注意事项:

AIR uses DPAPI on Windows, KeyChain on Mac OS and iOS, and KeyRing or KWallet on Linux to associate the encrypted local store to each application and user.

The encrypted local store uses AES-CBC 128-bit encryption.

On Android, the data stored by the EncryptedLocalStorage class are not encrypted.

让我们总结一下:

如果有人可以登录到用户帐户，他就可以访问EncryptedLocalStore

EncryptedLocalStore由操作系统管理，而不是 AIR

数据已加密但未在 Android 上加密

如果你想破解这样的存储，你必须:

检索存储内容

破解加密(挺好的)

查找有关解析此类数据存储库的规范

编写自己的数据阅读器