diff --git a/cpp/licensegen.cpp b/cpp/licensegen.cpp deleted file mode 100644 index 01dc5ab..0000000 --- a/cpp/licensegen.cpp +++ /dev/null @@ -1,40 +0,0 @@ -#include -#include -#include -#pragma GCC diagnostic ignored "-Wwrite-strings" - -int LicenseCalc(char *sInput); -int strtoupper(char *sInput); -char input [40]; - -int main () -{ - while(true) { - printf("Please enter a User Name or ^C to cancel:\n >"); - fgets(input, 40, stdin); - strtoupper(input); - - if ((strlen(input) > 0) && (input[strlen(input) - 1] == '\n')) - input[strlen(input) - 1] = '\0'; - - int license = LicenseCalc(input); - printf("Input: %s\tLicense: %05u\tHex: 0x%x\n", input, license, license); - } - return 0; -} - -int LicenseCalc(char *sInput) -{ - int salt = 0x5217; - for (int i = 0; i < strlen(sInput); i++) { - salt += sInput[i] * 0xa3; - } - return salt & 0xffff; -} - -int strtoupper(char *input) -{ - for (int i = 0; input[i] != 0; i++) { - input[i] = toupper(input[i]); - } -} \ No newline at end of file diff --git a/frida/licensegen.py b/frida/licensegen.py deleted file mode 100644 index 14d4b1e..0000000 --- a/frida/licensegen.py +++ /dev/null @@ -1,75 +0,0 @@ -############################################################################### -# Generate keys based on black box discovery -############################################################################### - -import frida -import sys - -def on_message(message, data): - print("[on_message] message:", message, "data:", data) - -# vistatn3270!LicenceCalc@00432CF0 -# vistatn3270!SanitizeString@00430830 - -session = frida.attach("vistatn3270.exe") - -script = session.create_script(""" - -var santitizeString = new NativeFunction(ptr(0x00430830), 'int', ['pointer']); -var strToUpper = new NativeFunction(ptr(0x0044F046), 'void', ['pointer']); -var iLicenseCalc = new NativeFunction(ptr(0x00432CF0), 'uint', ['pointer', 'pointer', 'uint', 'char']); - -Interceptor.attach(iLicenseCalc, { - - // When function is called, print out its parameters - onEnter: function (args) { - this.inptr = args[0]; - this.outptr = args[1]; - this.inint = args[2]; - this.inchar = args[3]; - console.log(''); - console.log('[+] Called iLicenseCalc@' + iLicenseCalc); - console.log('Input:' + this.inptr.readAnsiString()); - console.log('Output:' + this.outptr.readAnsiString()); - console.log('IntVal:' + this.inint); - console.log('CharVal:' + this.inchar); - }, - - // When function is finished - onLeave: function (retval) { - console.log('Output:' + this.outptr.readAnsiString()); - console.log('[+] Returned from iLicenseCalc: ' + retval); - } -}); - -Interceptor.attach(santitizeString, { - - // When function is called, print out its parameters - onEnter: function (args) { - this.outptr = args[0]; // Store arg0 in order to see when we leave the function - console.log(''); - console.log('[+] Called santitizeString@' + santitizeString); - console.log('Input:' + this.outptr.readAnsiString()); - }, - - // When function is finished - onLeave: function (retval) { - console.log('Output:' + this.outptr.readAnsiString()); // Print out data array, which will contain some data as output - console.log('[+] Returned from santitizeString: ' + retval); - } -}); - -var jst = " Longhorn 3270"; -var jsts = Memory.allocAnsiString(jst); -var buf = Memory.alloc(8); - -strToUpper(jsts); -iLicenseCalc(buf, jsts, jst.length, 0x1); - -""") - -script.on('message', on_message) -script.load() -print("[!] Ctrl+D on UNIX, Ctrl+Z on Windows/cmd.exe to detach from instrumented program.\n\n") -sys.stdin.read() -session.detach() diff --git a/frida/licensehooks.py b/frida/licensehooks.py deleted file mode 100644 index 2d19d93..0000000 --- a/frida/licensehooks.py +++ /dev/null @@ -1,83 +0,0 @@ -############################################################################### -# Hook into Licence related functions for black-box testing -############################################################################### - -import frida -import sys - -def on_message(message, data): - print("[on_message] message:", message, "data:", data) - -session = frida.attach("vista32.exe") - -script = session.create_script(""" - -var santitizeString = new NativeFunction(ptr(0x00421f90), 'int', ['pointer']); -var sPrepRegCode = new NativeFunction(ptr(0x00421df0), 'void', ['pointer', 'pointer']); -var iLicenseCalc = new NativeFunction(ptr(0x0042a570), 'uint', ['pointer', 'pointer', 'uint', 'char']); - -Interceptor.attach(iLicenseCalc, { - - // When function is called, print out its parameters - onEnter: function (args) { - this.inptr = args[0]; - this.outptr = args[1]; - this.inint = args[2]; - this.inchar = args[3]; - console.log(''); - console.log('[+] Called iLicenseCalc@' + iLicenseCalc); - console.log('Input:' + this.inptr.readAnsiString()); - console.log('Output:' + this.outptr.readAnsiString()); - console.log('IntVal:' + this.inint); - console.log('CharVal:' + this.inchar); - }, - - // When function is finished - onLeave: function (retval) { - console.log('Output:' + this.outptr.readAnsiString()); - console.log('[+] Returned from iLicenseCalc: ' + retval); - } -}); - -Interceptor.attach(sPrepRegCode, { - - // When function is called, print out its parameters - onEnter: function (args) { - this.outptr = args[0]; // Store arg0 in order to see when we leave the function - this.inptr = args[1]; // Store arg0 in order to see when we leave the function - console.log(''); - console.log('[+] Called sPrepRegCode@' + sPrepRegCode); - console.log('Input:' + this.inptr.readAnsiString()); - }, - - // When function is finished - onLeave: function (retval) { - console.log('Output:' + this.outptr.readAnsiString()); // Print out data array, which will contain some data as output - console.log('[+] Returned from sPrepRegCode: ' + retval); - } -}); - -Interceptor.attach(santitizeString, { - - // When function is called, print out its parameters - onEnter: function (args) { - this.outptr = args[0]; // Store arg0 in order to see when we leave the function - console.log(''); - console.log('[+] Called santitizeString@' + santitizeString); - console.log('Input:' + this.outptr.readAnsiString()); - }, - - // When function is finished - onLeave: function (retval) { - console.log('Output:' + this.outptr.readAnsiString()); // Print out data array, which will contain some data as output - console.log('[+] Returned from santitizeString: ' + retval); - } -}); - -""") - -script.on('message', on_message) -script.load() -print("[!] Ctrl+D on UNIX, Ctrl+Z on Windows/cmd.exe to detach from instrumented program.\n\n") -sys.stdin.read() -session.detach()