How to generate whitebox AES decryption algorithm and code, with existing WB-AES encryption code? I can find several whitebox AES 128 implementations on Github, such as wbaes-1, wbaes-2, wbaes-3, etc. All of them are developed based on WB AES encryption. Ideally, most implementations include two parts:

(1). Table_Generator.c  (or .cpp, .h ...). Input: 16-byte key; Output: a big lookup table (e.g., table.h), where the key information is already hidden in this lookup table

(2). AES_Encrypt.c. Input: plain text &amp; table generated from (1); Output: cipher text

But I need decryption implementation as well.

First, let me confirm one basic question:


Encryption table &amp; decryption table are generated separately, using one same key (e.g., 16 byte key for AES128)? Correct? which means there are two table generation algorithms (and hence two separate lookup tables) - one encryption, one for decryption.


Then, the main questions:


What are the important steps to modify an WB encryption project into
a WB decryption project?
Is there any WB AES decryption implementation for me to read?
Encryption table &amp; decryption table are generated separately, using one same key (e.g., 16 byte key for AES128)? Correct? which means there are two table generation algorithms (and hence two separate lookup tables) - one encryption, one for decryption.


yes, this is correct. you need two different sets of tables to implement the encryption and the decryption algorithm. Both set are generated using, of course, the same secret AES key.


  What are the important steps to modify an WB encryption project into a WB decryption project?


To implement the AES decryption, one should undo all operation one-by-one doing the inverse: you could, therefore, rewrite the table generator algorithm following this logic and then writing the corresponding decryption function where the round structure is inversed.
Otherwise one can notice that decryption can be implemented using the same round structure as encryption but with a slightly modified key schedule (and the operations replaced by their inverses).
I suggest using this second way to implement decryption, as you only need to change the key schedule function and the rest of the implementation stays the same.

EDIT: more details are available on the AES standard publication at Section 5.3.5 where the Equivalent Inverse Cipher is described.


  Is there any WB AES decryption implementation for me to read?


if I remember correctly, the following implementation contains both encryption and decryption direction.
You can also read the very good tutorial by James A. Muir (pdf)