sydney/Longhorn-TN3270
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

remove blackbox testing code

Browse Source
This commit is contained in:
Neo Anderson committed 2020-04-02 06:28:00 -07:00
1 parent ebe606f4cf
commit c9b81fa71c
3 files changed
-198
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

cpp/licensegen.cpp
-40
View File
@@ -1,40 +0,0 @@
#include <stdio.h>
#include <string.h>
#include <ctype.h>
#pragma GCC diagnostic ignored "-Wwrite-strings"
int LicenseCalc(char *sInput);
int strtoupper(char *sInput);
char input [40];
int main ()
{
while(true) {
printf("Please enter a User Name or ^C to cancel:\n >");
fgets(input, 40, stdin);
strtoupper(input);
if ((strlen(input) > 0) && (input[strlen(input) - 1] == '\n'))
input[strlen(input) - 1] = '\0';
int license = LicenseCalc(input);
printf("Input: %s\tLicense: %05u\tHex: 0x%x\n", input, license, license);
}
return 0;
}
int LicenseCalc(char *sInput)
{
int salt = 0x5217;
for (int i = 0; i < strlen(sInput); i++) {
salt += sInput[i] * 0xa3;
}
return salt & 0xffff;
}
int strtoupper(char *input)
{
for (int i = 0; input[i] != 0; i++) {
input[i] = toupper(input[i]);
}
}
frida/licensegen.py
-75
View File
@@ -1,75 +0,0 @@
###############################################################################
# Generate keys based on black box discovery
###############################################################################
import frida
import sys
def on_message(message, data):
print("[on_message] message:", message, "data:", data)
# vistatn3270!LicenceCalc@00432CF0
# vistatn3270!SanitizeString@00430830
session = frida.attach("vistatn3270.exe")
script = session.create_script("""
var santitizeString = new NativeFunction(ptr(0x00430830), 'int', ['pointer']);
var strToUpper = new NativeFunction(ptr(0x0044F046), 'void', ['pointer']);
var iLicenseCalc = new NativeFunction(ptr(0x00432CF0), 'uint', ['pointer', 'pointer', 'uint', 'char']);
Interceptor.attach(iLicenseCalc, {
// When function is called, print out its parameters
onEnter: function (args) {
this.inptr = args[0];
this.outptr = args[1];
this.inint = args[2];
this.inchar = args[3];
console.log('');
console.log('[+] Called iLicenseCalc@' + iLicenseCalc);
console.log('Input:' + this.inptr.readAnsiString());
console.log('Output:' + this.outptr.readAnsiString());
console.log('IntVal:' + this.inint);
console.log('CharVal:' + this.inchar);
},
// When function is finished
onLeave: function (retval) {
console.log('Output:' + this.outptr.readAnsiString());
console.log('[+] Returned from iLicenseCalc: ' + retval);
}
});
Interceptor.attach(santitizeString, {
// When function is called, print out its parameters
onEnter: function (args) {
this.outptr = args[0]; // Store arg0 in order to see when we leave the function
console.log('');
console.log('[+] Called santitizeString@' + santitizeString);
console.log('Input:' + this.outptr.readAnsiString());
},
// When function is finished
onLeave: function (retval) {
console.log('Output:' + this.outptr.readAnsiString()); // Print out data array, which will contain some data as output
console.log('[+] Returned from santitizeString: ' + retval);
}
});
var jst = " Longhorn 3270";
var jsts = Memory.allocAnsiString(jst);
var buf = Memory.alloc(8);
strToUpper(jsts);
iLicenseCalc(buf, jsts, jst.length, 0x1);
""")
script.on('message', on_message)
script.load()
print("[!] Ctrl+D on UNIX, Ctrl+Z on Windows/cmd.exe to detach from instrumented program.\n\n")
sys.stdin.read()
session.detach()
frida/licensehooks.py
-83
View File
@@ -1,83 +0,0 @@
###############################################################################
# Hook into Licence related functions for black-box testing
###############################################################################
import frida
import sys
def on_message(message, data):
print("[on_message] message:", message, "data:", data)
session = frida.attach("vista32.exe")
script = session.create_script("""
var santitizeString = new NativeFunction(ptr(0x00421f90), 'int', ['pointer']);
var sPrepRegCode = new NativeFunction(ptr(0x00421df0), 'void', ['pointer', 'pointer']);
var iLicenseCalc = new NativeFunction(ptr(0x0042a570), 'uint', ['pointer', 'pointer', 'uint', 'char']);
Interceptor.attach(iLicenseCalc, {
// When function is called, print out its parameters
onEnter: function (args) {
this.inptr = args[0];
this.outptr = args[1];
this.inint = args[2];
this.inchar = args[3];
console.log('');
console.log('[+] Called iLicenseCalc@' + iLicenseCalc);
console.log('Input:' + this.inptr.readAnsiString());
console.log('Output:' + this.outptr.readAnsiString());
console.log('IntVal:' + this.inint);
console.log('CharVal:' + this.inchar);
},
// When function is finished
onLeave: function (retval) {
console.log('Output:' + this.outptr.readAnsiString());
console.log('[+] Returned from iLicenseCalc: ' + retval);
}
});
Interceptor.attach(sPrepRegCode, {
// When function is called, print out its parameters
onEnter: function (args) {
this.outptr = args[0]; // Store arg0 in order to see when we leave the function
this.inptr = args[1]; // Store arg0 in order to see when we leave the function
console.log('');
console.log('[+] Called sPrepRegCode@' + sPrepRegCode);
console.log('Input:' + this.inptr.readAnsiString());
},
// When function is finished
onLeave: function (retval) {
console.log('Output:' + this.outptr.readAnsiString()); // Print out data array, which will contain some data as output
console.log('[+] Returned from sPrepRegCode: ' + retval);
}
});
Interceptor.attach(santitizeString, {
// When function is called, print out its parameters
onEnter: function (args) {
this.outptr = args[0]; // Store arg0 in order to see when we leave the function
console.log('');
console.log('[+] Called santitizeString@' + santitizeString);
console.log('Input:' + this.outptr.readAnsiString());
},
// When function is finished
onLeave: function (retval) {
console.log('Output:' + this.outptr.readAnsiString()); // Print out data array, which will contain some data as output
console.log('[+] Returned from santitizeString: ' + retval);
}
});
""")
script.on('message', on_message)
script.load()
print("[!] Ctrl+D on UNIX, Ctrl+Z on Windows/cmd.exe to detach from instrumented program.\n\n")
sys.stdin.read()
session.detach()