- 積分
- 297
注冊時間2015-6-9
閱讀權限20
最后登錄1970-1-1
以武會友
 
TA的每日心情 | 奮斗 2017-12-7 21:27 |
---|
簽到天數: 251 天 [LV.8]以壇為家I
|
1. 工具
x32dbg: 調試
CyberChef https://gchq.github.io/CyberChef: 測試如 sha1, sha256, asn1解析等
Big Integer Calculator v1.13: 測試 RSA 簽名過程
加密解密小玩具 Ver0.3 by Lucky_789 [bbs.chinapyg.com]: double check
RSA-Tool 2 by tE!: 生成替換 RSA 秘鑰
sfk191 https://sourceforge.net/projects/swissfileknife/: 二進制文件替換修改
2. 載入后搜索 "License" and "Unregistered", 設定斷點
[Asm] 純文本查看 復制代碼 地址 反匯編 字符串
* 002CF7F2 mov edx,sublime_text.664930 "Hello! Thanks for trying out Sublime Text.\n\nThis is an unregistered evaluation version, and although the trial is untimed, a license must be purchased for continued use.\n\nWould you like to purchase a license now?"
* 002CF883 mov edx,sublime_text.664A70 "Hello! Thanks for trying out Sublime Text 3!\n\nSublime Text 3 is a paid upgrade from Sublime Text 2, and your license key is for Sublime Text 2.\n\nWould you like to upgrade your license now?"
* 002CF8AD mov edx,sublime_text.664B70 "That license key doesn't appear to be valid.\n\nPlease check that you have entered all lines from the license key, including the BEGIN LICENSE and END LICENSE lines."
* 002CF8B9 mov edx,sublime_text.664C14 "That license key is no longer valid."
* 002CF8C5 mov edx,sublime_text.664C40 "That license key has been invalidated, due to being shared.\n\nPlease email [url=mailto:[email protected]][email protected][/url] to get your license key reissued."
* 002D086B push sublime_text.664D68 "Enter your license key below. You can purchase one from [url=https://www.sublimetext.com/buy]https://www.sublimetext.com/buy[/url]"
* 002D0F02 mov ecx,sublime_text.664E18 "license_check"
* 002D10A0 mov esi,sublime_text.664E30 "license.sublimehq.com"
* 002D10EB mov esi,sublime_text.664E48 "sublime-license-check/3.0"
* 002E9A67 mov edx,sublime_text.667B18 "Remove license key? This will revert Sublime Text to an unregistered state."
* 002F6594 mov dword ptr ss:[esp],sublime_text.66965C "Unregistered"
* 00308DBC push sublime_text.66B428 "%s\nSingle User License\n%s-%s"
* 00308DE7 push sublime_text.66B408 "%s\nUnlimited User License\n%s-%s"
* 00308E29 push sublime_text.66B45C "%s\n%d User License\n%s-%s"
* 00309214 mov esi,sublime_text.66B4BC "----- BEGIN LICENSE -----\n"
* 003092AD mov ebx,sublime_text.66B4A0 "------ END LICENSE ------"
3. 使用網上泄露的 TwitterInc 證書調試
—– BEGIN LICENSE —–
TwitterInc
200 User License
EA7E-890007
1D77F72E 390CDD93 4DCBA022 FAF60790
61AA12C0 A37081C5 D0316412 4584D136
94D7F7D4 95BC8C1C 527DA828 560BB037
D1EDDD8C AE7B379F 50C9D69D B35179EF
2FE898C4 8E4277A8 555CE714 E1FB0E43
D5D52613 C3D12E98 BC49967F 7652EED2
9D2D2E61 67610860 6D338B72 5CF95C69
E36B85CC 84991F19 7575D828 470A92AB
—— END LICENSE ——
4. 單步調試. 拋磚引玉, 簡單錄了小視頻來描述流程, 地址在 .zip 格式的附件中 (論壇提示不允許上傳 .txt 格式)
(1) 跑起來之后, CPU 窗格點右鍵, 轉到, 文件偏移, 4F17B, 下斷點, F7/F8 調試可以發現, 這個函數將產生 asn1 der 編碼的 rsa 公鑰字串 (需要 xor 0x53).
[Asm] 純文本查看 復制代碼 00401910 63 D2 CE 63 5E 55 5A 79 D5 1B D5 A4 5E 52 52 52 còÎc^UZyÕ.Õ¤^RRR
00401920 56 53 50 D2 D8 53 63 D2 D4 51 D2 D2 53 8B 28 F1 VSPòØScòÔQòòS.(ñ
00401930 16 31 A4 96 82 19 5F A8 41 EA 27 5F 4A 0F 38 8F .1¤..._¨Aê'_J.8.
00401940 2D 3E 3D 9A 78 FF 5D E1 CE 0A B2 8A FD 34 DA 5F ->=.xÿ]áÎ.2.y4ú_
00401950 78 DB 90 F8 8F FC AD 2E 19 60 8F 92 EC ED 00 49 xÛ.ø.ü...`..ìí.I
00401960 76 4F BC 5F C1 6C 55 ED 2A E1 61 D6 0A FF AD BA vO¼_álUí*áaÖ.ÿ.o
00401970 D5 86 B2 0D 1E 44 35 B9 05 97 B2 55 04 A9 27 88 Õ.2..D51..2U.©'.
00401980 5A 24 90 A8 26 D1 E4 DF 87 28 E1 94 AA E1 01 E7 Z$.¨&Ñäß.(á.aá.ç
00401990 FA 15 6E 46 A5 FD 3D BA 70 2E 07 96 1B 48 A0 B3 ú.nF¥y=op....H 3
004019A0 E3 CA 73 4A 58 9C E0 4D 08 B6 5A 90 68 51 52 42 ãêsJX.àM.¶Z.hQRB
(2) CPU 窗格點右鍵, 轉到, 文件偏移, 4F276, 下斷點, 這個函數將使用 rsa 公鑰驗證輸入的驗證碼信息, 成功則在 eax 返回1. 該函數體內幾步關鍵的流程為:
首先計算注冊信息前三行的 sha1 hash. 可以參見下面函數調用, 文件偏移 (x32dbg 中按 ctrl+shift+G) 為 87E82
[Asm] 純文本查看 復制代碼 00FD8A82 | E8 9E 57 15 00 | call sublime_text.112E225 | InArg.1 保存了 注冊信息的 sha1 值 (記得追進去時好像看到了 MD5 特征碼, 看來是沒用)
然后從 asn1 der 編碼的 rsa 公鑰字串中解碼 rsa 公鑰. 可以參見下面函數調用, 文件偏移 (x32dbg 中按 ctrl+shift+G) 為 87EDC
[Asm] 純文本查看 復制代碼 00FD8ADC | E8 14 77 15 00 | call <sublime_text.從 asn1 中解碼 rsa_key> | 有機會再檢查下, 和手動在 cyberchef 得到的值不一樣 ???
最后調用 LibTomCrypt 中的 rsa_verify_hash.c 中的函數, 驗證 RSA PKCS #1 v1.5 or v2 PSS signature verification, 驗證成功則將在 [ebp-10] 寫 1. 可以參見下面函數調用, 文件偏移 (x32dbg 中按 ctrl+shift+G) 為 87F3E
[Asm] 純文本查看 復制代碼 00FD8B24 | 50 | push eax | InArg.9 = *key
00FD8B25 | 8D 45 F0 | lea eax,dword ptr ss:[ebp-10] |
00FD8B28 | 8B D6 | mov edx,esi | InArg.2 = siglen
00FD8B2A | 50 | push eax | InArg.8 = *stat
00FD8B2B | 51 | push ecx | InArg.7 = saltlen = 0x80
00FD8B2C | 57 | push edi | InArg.6 = hash_idx = 0
00FD8B2D | 51 | push ecx | InArg.5 = padding = 0x80 ??
00FD8B2E | FF 75 EC | push dword ptr ss:[ebp-14] | InArg.4 = hashlen = length(sha1_of_lic)
00FD8B31 | 8D 85 48 FF FF FF | lea eax,dword ptr ss:[ebp-B8] | [ebp-B8]:&"43C60213C780ACBF344A91DB577163EA1F7257AF110E619447A45D3A4F6ECAC45E0F25FDA71A537DBCD6B2A179B45AD4F532B5B65933D7FB5578436F6D5B854CC430DB4EE87FDF991D85C91E61076223A33E841D0A529D79D5A493DE28717FB4C4C323033F7AA81384B46A0F52AC424E495E98DA284C7F894810D723C3969C6F"
00FD8B37 | 50 | push eax | InArg.3 = hash = sha1_of_lic
00FD8B38 | 8D 8D 48 DF FF FF | lea ecx,dword ptr ss:[ebp-20B8] | InArg.1 = sig = 注冊信息下面的碼
00FD8B3E | E8 8F 88 15 00 | call <sublime_text.int rsa_verify_hash_ex(const unsi |
00FD8B43 | 83 C4 1C | add esp,1C |
00FD8B46 | 85 C0 | test eax,eax |
00FD8B48 | 0F 85 40 FF FF FF | jne sublime_text.FD8A8E |
00FD8B4E | 8D 4D C8 | lea ecx,dword ptr ss:[ebp-38] |
00FD8B51 | E8 1A 79 15 00 | call sublime_text.1130470 |
00FD8B56 | 33 C0 | xor eax,eax |
00FD8B58 | 83 7D F0 01 | cmp dword ptr ss:[ebp-10],1 | 比較 *stat, 看來還是九層樓的信息沒通過 ??
(3) CPU 窗格點右鍵, 轉到, 文件偏移, 4F2B9, 下斷點, 這個函數將計算 asn1 der 編碼的 rsa 公鑰字串的 sha256 hash 并隨后驗證其中三位
例如, 對于內置的 asn1 der 編碼的 rsa 公鑰字串, 將驗證中括號內的幾位
[Asm] 純文本查看 復制代碼 ori 30819D300D06092A864886F70D010101050003818B0030818702818100D87BA24562F7C5D14A0CFB12B9740C195C6BDC7E6D6EC92BAC0EB29D59E1D9AE67890C2B88C3ABDCAFFE7D4A33DCC1BFBE531A251CEF0C923F06BE79B2328559ACFEE986D5E15E4D1766EA56C4E10657FA74DB0977C3FB7582B78CD47BB2C7F9B252B4A9463D15F6AE6EE9237D54C5481BF3E0B09920190BCFB31E5BE509C33B020111
[c6] 34 03 97 05 9a 1d 2a
b1 a4 13 40 ce d7 a5 a8
f8 6d [ea] 0c 22 7f a9 40
b6 e7 4f 0e f8 46 [56] ea
x. 破解步驟
(1) 在 Cygwin 下運行下面步驟使用 sfk 修改原文件
exe=sublime_text.exe
bak=sublime_text.exe.bak
cp $exe $bak
./sfk191 replace $exe -firsthit -yes -bin "/807DBCC6/807DBCA3/"
./sfk191 replace $exe -firsthit -yes -bin "/807DCEEA/807DCE38/"
./sfk191 replace $exe -firsthit -yes -bin "/807DDA56/807DDA62/"
./sfk191 replace $exe -firsthit -yes -bin "/63d2ce635e555a79d51bd5a45e525252565350d2d85363d2d451d2d2538b28f11631a49682195fa841ea275f4a0f388f2d3e3d9a78ff5de1ce0ab28afd34da5f78db90f88ffcad2e19608f92eced0049764fbc5fc16c55ed2ae161d60affadbad586b20d1e4435b90597b25504a927885a2490a826d1e4df8728e194aae101e7fa156e46a5fd3dba702e07961b48a0b3e3ca734a589ce04d08b65a9068515242/63d2ce635e555a79d51bd5a45e525252565350d2d85363d2d451d2d253d1b87c5f52734dd758ee69729ed18e5880ba3628a3a0b95df0599205cf7026d74d3c0a985ff9b5bd6401d58fc2e2bb6ebee7c4b5ffc02e7bd194f4083b85cb3f370b5d8c7d604684f7314b72fbd29679a15795d4ee20340d1b2aacb5ad10cfdd6163625f33c42766094478d1211a53bdaad7f5a7e6454c43c27aa6954d4cd50a515242/"
(2) 在斷開網絡的情況下, 使用下面的許可注冊
—– BEGIN LICENSE —–
九層樓/PYG
Single User License
EA7E-887766
43C60213 C780ACBF 344A91DB 577163EA
1F7257AF 110E6194 47A45D3A 4F6ECAC4
5E0F25FD A71A537D BCD6B2A1 79B45AD4
F532B5B6 5933D7FB 5578436F 6D5B854C
C430DB4E E87FDF99 1D85C91E 61076223
A33E841D 0A529D79 D5A493DE 28717FB4
C4C32303 3F7AA813 84B46A0F 52AC424E
495E98DA 284C7F89 4810D723 C3969C6F
—— END LICENSE ——
y. 驗證流程總結
(1) 對前三行信息計算 sha1
(2) 添加 salt
(3) RSA 私鑰簽名即得注冊碼. 因此需要替換公鑰, 以及程序對于公鑰的三處驗證
z. 知識總結 (僅僅是一知半解)
(1) RSA 加解密, 簽名
(2) ASN
(3) RSA PKCS #1 v1.5 or v2 PSS signature verification
(4) LibTomMath & LibTomCrypt
(5) 遇到函數調用時, 可以通過觀察傳入的指針型參數在調用完成后的賦值推測流程.
(6) 積累并應用經驗: 例如通過識別 +10/+14 偏移發現 C++ 字符串, 通過 Assert 語句查閱相關庫
最后, 感謝飄云閣的老師們 !
|
本帖子中包含更多資源
您需要 登錄 才可以下載或查看,沒有帳號?加入論壇
x
評分
-
查看全部評分
|