[简介]
常用网名: 猪头三
出生日期: 1981.XX.XX
QQ: 643439947
个人网站: 80x86汇编小站
编程生涯: 2001年~至今[共22年]
职业生涯: 20年
开发语言: C/C++、80x86ASM、PHP、Perl、Objective-C、Object Pascal、C#、Python
开发工具: Visual Studio、Delphi、XCode、Eclipse、C++ Builder
技能种类: 逆向 驱动 磁盘 文件
研发领域: Windows应用软件安全/Windows系统内核安全/Windows系统磁盘数据安全/macOS应用软件安全
项目经历: 磁盘性能优化/文件系统数据恢复/文件信息采集/敏感文件监测跟踪/网络安全检测
[序言]
在2024年08月左右, hex-rays官方意外的泄露了全版本(Win Mac Linux)全功能的IDA Pro 9.0, 让整个逆向社区打一剂鸡血针, 随后大量的打包版本出现比如: IDA Pro 9.0 Beta官方泄露版, IDA Pro 9.0 RC1发行版. 总之版本混乱, 但随着时间的推移, 大概快2个多月左右, 官方突然把RC1版本直接转换为了正式版. 因此就有目前最纯净最干净的版本: 2024 IDA Pro 9.0.240925 v2官方正式版.
[Windows平台运行]
首先，需要下载2024 IDA Pro 9.0.240925 v2官方正式版 的安装包, 可以从下面的链接下载:
* 磁力链接：magnet:?xt=urn:btih:b2e16894b6c40774283560fe292e5d4bc68c512f&dn=IDA%209.0.240925%20v2
* 下载完成后, 还需要另外下载 keygen2.py 文件(已附上源码, 请下载保存）
打开keygen2.py文件, 并修改其源码. 具体修改如下：
* 替换 elf： "name": "elf" -> 随便替换一个名字
* 替换 "elv@ven： "email": "elv@ven" -> 随便替换一个邮箱
* 修正授权文件发行时间： "issued_on": "2024-08-10 00:00:00"
修改完成后, 将修改好的keygen2.py文件复制到由ida-pro_90_x64win.exe生成的安装目录(IDA Professional 9.0), 并运行. 成功的话, 会出现以下三个文件:
* ida.dll.patched
* ida32.dll.patched
* idapro.hexlic
这三个文件就是破解好的文件.
最后, 我们需要备份原版的 ida.dll 和 ida32.dll 文件, 并将 ida.dll.patched 和 ida32.dll.patched 文件重命名为 ida.dll 和 ida32.dll. 这样一来, IDA Pro 9.0就能完美运行了.
[注意]
* 需要有一定的Python动手能力.
* 这个教程适合具有中等以上编程经验的用户.
[总结]
虽然上面给出的是Windows平台的操作步骤, 但是其他平台Mac, Linux的处理方式差不多一样的, 大家可以自行研究.
[keygen2.py源码]
python
import json
import hashlib
import os
# originally made by alula
license = {
"header": {"version": 1},
"payload": {
"name": "elf",
"email": "elv@ven",
"licenses": [
{
"description": "license",
"edition_id": "ida-pro",
"id": "48-2137-ACAB-99",
"license_type": "named",
"product": "IDA",
"seats": 1,
"start_date": "2024-08-10 00:00:00",
"end_date": "2033-12-31 23:59:59", # This can't be more than 10 years!
"issued_on": "2024-08-10 00:00:00",
"owner": "",
"product_id": "IDAPRO",
"add_ons": [
# {
# "id": "48-1337-DEAD-01",
# "code": "HEXX86L",
# "owner": "48-0000-0000-00",
# "start_date": "2024-08-10 00:00:00",
# "end_date": "2033-12-31 23:59:59",
# },
# {
# "id": "48-1337-DEAD-02",
# "code": "HEXX64L",
# "owner": "48-0000-0000-00",
# "start_date": "2024-08-10 00:00:00",
# "end_date": "2033-12-31 23:59:59",
# },
],
"features": [],
}
],
},
}
def add_every_addon(license):
platforms = [
"W", # Windows
"L", # Linux
"M", # macOS
]
addons = [
"HEXX86",
"HEXX64",
"HEXARM",
"HEXARM64",
"HEXMIPS",
"HEXMIPS64",
"HEXPPC",
"HEXPPC64",
"HEXRV64",
"HEXARC",
"HEXARC64",
# Probably cloud?
# "HEXCX86",
# "HEXCX64",
# "HEXCARM",
# "HEXCARM64",
# "HEXCMIPS",
# "HEXCMIPS64",
# "HEXCPPC",
# "HEXCPPC64",
# "HEXCRV",
# "HEXCRV64",
# "HEXCARC",
# "HEXCARC64",
]
i = 0
for addon in addons:
i += 1
license["payload"]["licenses"][0]["add_ons"].append(
{
"id": f"48-1337-DEAD-{i:02}",
"code": addon,
"owner": license["payload"]["licenses"][0]["id"],
"start_date": "2024-08-10 00:00:00",
"end_date": "2033-12-31 23:59:59",
}
)
# for addon in addons:
# for platform in platforms:
# i += 1
# license["payload"]["licenses"][0]["add_ons"].append(
# {
# "id": f"48-1337-DEAD-{i:02}",
# "code": addon + platform,
# "owner": license["payload"]["licenses"][0]["id"],
# "start_date": "2024-08-10 00:00:00",
# "end_date": "2033-12-31 23:59:59",
# }
# )
add_every_addon(license)
def json_stringify_alphabetical(obj):
return json.dumps(obj, sort_keys=True, separators=(",", ":"))
def buf_to_bigint(buf):
return int.from_bytes(buf, byteorder="little")
def bigint_to_buf(i):
return i.to_bytes((i.bit_length() + 7) // 8, byteorder="little")
# Yup, you only have to patch 5c -> cb in libida64.so
pub_modulus_hexrays = buf_to_bigint(
bytes.fromhex(
"edfd425cf978546e8911225884436c57140525650bcf6ebfe80edbc5fb1de68f4c66c29cb22eb668788afcb0abbb718044584b810f8970cddf227385f75d5dddd91d4f18937a08aa83b28c49d12dc92e7505bb38809e91bd0fbd2f2e6ab1d2e33c0c55d5bddd478ee8bf845fcef3c82b9d2929ecb71f4d1b3db96e3a8e7aaf93"
)
)
pub_modulus_patched = buf_to_bigint(
bytes.fromhex(
"edfd42cbf978546e8911225884436c57140525650bcf6ebfe80edbc5fb1de68f4c66c29cb22eb668788afcb0abbb718044584b810f8970cddf227385f75d5dddd91d4f18937a08aa83b28c49d12dc92e7505bb38809e91bd0fbd2f2e6ab1d2e33c0c55d5bddd478ee8bf845fcef3c82b9d2929ecb71f4d1b3db96e3a8e7aaf93"
)
)
private_key = buf_to_bigint(
bytes.fromhex(
"77c86abbb7f3bb134436797b68ff47beb1a5457816608dbfb72641814dd464dd640d711d5732d3017a1c4e63d835822f00a4eab619a2c4791cf33f9f57f9c2ae4d9eed9981e79ac9b8f8a411f68f25b9f0c05d04d11e22a3a0d8d4672b56a61f1532282ff4e4e74759e832b70e98b9d102d07e9fb9ba8d15810b144970029874"
)
)
def decrypt(message):
decrypted = pow(buf_to_bigint(message), exponent, pub_modulus_patched)
decrypted = bigint_to_buf(decrypted)
return decrypted[::-1]
def encrypt(message):
encrypted = pow(buf_to_bigint(message[::-1]), private_key, pub_modulus_patched)
encrypted = bigint_to_buf(encrypted)
return encrypted
exponent = 0x13
def sign_hexlic(payload: dict) -> str:
data = {"payload": payload}
data_str = json_stringify_alphabetical(data)
buffer = bytearray(128)
# first 33 bytes are random
for i in range(33):
buffer[i] = 0x42
# compute sha256 of the data
sha256 = hashlib.sha256()
sha256.update(data_str.encode())
digest = sha256.digest()
# copy the sha256 digest to the buffer
for i in range(32):
buffer[33 + i] = digest[i]
# encrypt the buffer
encrypted = encrypt(buffer)
return encrypted.hex().upper()
def generate_patched_dll(filename):
if not os.path.exists(filename):
print(f"Didn't find {filename}, skipping patch generation")
return
with open(filename, "rb") as f:
data = f.read()
if data.find(bytes.fromhex("EDFD42CBF978")) != -1:
print(f"{filename} looks to be already patched :)")
return
if data.find(bytes.fromhex("EDFD425CF978")) == -1:
print(f"{filename} doesn't contain the original modulus.")
return
data = data.replace(
bytes.fromhex("EDFD425CF978"), bytes.fromhex("EDFD42CBF978")
)
patched_filename = f"{filename}.patched"
with open(patched_filename, "wb") as f:
f.write(data)
print(f"Generated modulus patch to {patched_filename}! To apply the patch, replace the original file with the patched file")
# message = bytes.fromhex(license["signature"])
# print(decrypt(message).hex())
# print(encrypt(decrypt(message)).hex())
license["signature"] = sign_hexlic(license["payload"])
serialized = json_stringify_alphabetical(license)
# write to ida.hexlic
filename = "idapro.hexlic"
with open(filename, "w") as f:
f.write(serialized)
print(f"Saved new license to {filename}!")
generate_patched_dll("ida32.dll")
generate_patched_dll("ida.dll")
generate_patched_dll("libida32.so")
generate_patched_dll("libida.so")
generate_patched_dll("libida32.dylib")
generate_patched_dll("libida.dylib")