Kartom

IDA 9.4 keyGen (Not working)

Oct 3rd, 2026
35
0
Never
2
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 8.47 KB | None | 0 0
  1. import json
  2. import hashlib
  3. import os
  4.  
  5. # originally made by alula
  6. # v3 - auth.lol
  7. license = {
  8.     "header": {"version": 1},
  9.     "payload": {
  10.         "name": "elf",
  11.         "email": "elv@ven",
  12.         "licenses": [
  13.             {
  14.                 "description": "license",
  15.                 "edition_id": "ida-pro",
  16.                 "id": "14-0000-FFFF-88",
  17.                 "license_type": "named",
  18.                 "product": "IDA",
  19.                 "seats": 1,
  20.                 "start_date": "2024-08-10 00:00:00",
  21.                 "end_date": "2033-12-31 23:59:59",  # This can't be more than 10 years!
  22.                 "issued_on": "2024-08-10 00:00:00",
  23.                 "owner": "",
  24.                 "product_id": "IDAPRO",
  25.                 "product_version": "9.4",
  26.                 "add_ons": [
  27.                     # {
  28.                     #     "id": "48-1337-DEAD-01",
  29.                     #     "code": "HEXX86L",
  30.                     #     "owner": "48-0000-0000-00",
  31.                     #     "start_date": "2024-08-10 00:00:00",
  32.                     #     "end_date": "2033-12-31 23:59:59",
  33.                     # },
  34.                     # {
  35.                     #     "id": "48-1337-DEAD-02",
  36.                     #     "code": "HEXX64L",
  37.                     #     "owner": "48-0000-0000-00",
  38.                     #     "start_date": "2024-08-10 00:00:00",
  39.                     #     "end_date": "2033-12-31 23:59:59",
  40.                     # },
  41.                 ],
  42.                 "features": [],
  43.             }
  44.         ],
  45.     },
  46. }
  47.  
  48.  
  49. def add_every_addon(license):
  50.     platforms = [
  51.         "W",  # Windows
  52.         "L",  # Linux
  53.         "M",  # macOS
  54.     ]
  55.     addons = [
  56.         "HEXX86",
  57.         "HEXX64",
  58.         "HEXARM",
  59.         "HEXARM64",
  60.         "HEXMIPS",
  61.         "HEXMIPS64",
  62.         "HEXPPC",
  63.         "HEXPPC64",
  64.         "HEXRV",
  65.         "HEXRV64",
  66.         "HEXARC",
  67.         "HEXARC64",
  68.         "HEXV850",
  69.         "HEXDALVIK",
  70.         "LUMINA",
  71.         "TEAMS",
  72.         # Probably cloud?
  73.         # "HEXCX86",
  74.         # "HEXCX64",
  75.         # "HEXCARM",
  76.         # "HEXCARM64",
  77.         # "HEXCMIPS",
  78.         # "HEXCMIPS64",
  79.         # "HEXCPPC",
  80.         # "HEXCPPC64",
  81.         # "HEXCRV",
  82.         # "HEXCRV64",
  83.         # "HEXCARC",
  84.         # "HEXCARC64",
  85.     ]
  86.  
  87.     i = 0
  88.     for addon in addons:
  89.         i += 1
  90.         license["payload"]["licenses"][0]["add_ons"].append(
  91.             {
  92.                 "id": f"48-1337-DEAD-{i:02}",
  93.                 "code": addon,
  94.                 "owner": license["payload"]["licenses"][0]["id"],
  95.                 "start_date": "2024-08-10 00:00:00",
  96.                 "end_date": "2033-12-31 23:59:59",
  97.             }
  98.         )
  99.  
  100.  
  101. add_every_addon(license)
  102.  
  103. def sort_json(obj):
  104.     if isinstance(obj, list):
  105.         return "[" + ",".join(sort_json(x) for x in obj) + "]"
  106.  
  107.     elif isinstance(obj, dict):
  108.         keys = sorted(obj.keys())
  109.         return (
  110.             "{"
  111.             + ",".join(
  112.                 json.dumps(str(k), ensure_ascii=False, separators=(",", ":"))
  113.                 + ":"
  114.                 + sort_json(obj[k])
  115.                 for k in keys
  116.             )
  117.             + "}"
  118.         )
  119.  
  120.     else:
  121.         return json.dumps(obj, ensure_ascii=False, separators=(",", ":"))
  122.  
  123. def json_stringify_alphabetical(obj):
  124.     return json.dumps(obj, sort_keys=True, separators=(",", ":"))
  125.  
  126.  
  127. def buf_to_bigint(buf):
  128.     return int.from_bytes(buf, byteorder="little")
  129.  
  130.  
  131. def bigint_to_buf(i):
  132.     return i.to_bytes((i.bit_length() + 7) // 8, byteorder="little")
  133.  
  134.  
  135.  
  136. cModulus = bytes.fromhex(
  137.     "3f0307607fed562fd5a163adc40fcc603373caa28414e64cdc4552a555b13ad"
  138.     "4b3ad0a812800a03195300fd71634b90edb0d69ea710efebb2b0b9e72da2effb"
  139.     "149de70bcbfa94b86af01ce455dbbd5fa987207651c7b60c2e4cafd0654188d9"
  140.     "8c30f64dc084d8547f0ac32db91124af82b3b15bf922a31f1d5e332f27615cea7"
  141. )
  142.  
  143. privateKey = bytes.fromhex(
  144.     "8b3f5fdfad7f87239734c530e2ecebeb4fa48d79518756c15fd54636801cf7ea"
  145.     "6367100566bf8b52b16bec05258d8426ea94c15841ab2d37802c07349df4c208"
  146.     "584e86d25a6bfb82966cb2ddcd3d654e9994e814ca470577362a937cc984e404"
  147.     "a0b68d173aab3180130118e1b03ed209a9d8757560a85a3c9b0d3380e7907c4f"
  148. )
  149.  
  150. V54 = 127
  151. V56 = 95
  152.  
  153. PADKEY = bytes.fromhex(
  154.     "e2a7c300dfcc777f89b57500d8151c7fb1d97b3f9f170393311234ceeb9e377a"
  155.     "e2a7c300dfcc777f89b57500d8151c7fb1d97b3f9f170393311234ceeb9e377a"
  156.     "e2a7c300dfcc777f89b57500d8151c7fb1d97b3f9f170393311234ceeb9e377a"
  157.     "e2a7c300dfcc777f89b57500d8151c7fb1d97b3f9f170393311234ceeb9e37"
  158. )
  159.  
  160.  
  161. def encrypt(message: bytes) -> bytes:
  162.     # JavaScript:
  163.     # let modulusBuf = 0n;
  164.     # ... little-endian Aufbau
  165.     modulus = int.from_bytes(cModulus, byteorder="little")
  166.  
  167.     # privateKey ebenfalls Little-Endian
  168.     exponent = int.from_bytes(privateKey, byteorder="little")
  169.  
  170.     # Buffer.from(message).reverse()
  171.     reversed_message = message[::-1]
  172.  
  173.     # Nachricht als BigInt aufbauen
  174.     msg = int.from_bytes(reversed_message, byteorder="little")
  175.  
  176.     base = msg % modulus
  177.     encrypted = 1
  178.  
  179.     # Entspricht:
  180.     #
  181.     # while (exponent > 0n) {
  182.     #     if (exponent % 2n === 1n)
  183.     #         encrypted = (encrypted * base) % modulus;
  184.     #     exponent >>= 1n;
  185.     #     base = (base * base) % modulus;
  186.     # }
  187.     #
  188.     # Python besitzt dafür bereits pow(base, exponent, modulus).
  189.     encrypted = pow(base, exponent, modulus)
  190.  
  191.     # BigInt wieder als Little-Endian-Bytes ausgeben
  192.     if encrypted == 0:
  193.         return b""
  194.  
  195.     length = (encrypted.bit_length() + 7) // 8
  196.     return encrypted.to_bytes(length, byteorder="little")
  197.  
  198. def sign(payload):
  199.     # Entspricht:
  200.     # var dataStr = sort({ payload });
  201.     #
  202.     # Wichtig: Das äußere Objekt besitzt den Key "payload".
  203.     data_str = sort_json({"payload": payload})
  204.  
  205.     # SHA-256
  206.     hash_bytes = hashlib.sha256(
  207.         data_str.encode("utf-8")
  208.     ).digest()
  209.  
  210.     # Buffer.alloc(V54, 0)
  211.     U = bytearray(V54)
  212.  
  213.     # hash.copy(U, V56)
  214.     U[V56:V56 + len(hash_bytes)] = hash_bytes
  215.  
  216.     # Buffer.alloc(V54)
  217.     block = bytearray(V54)
  218.  
  219.     # U[i] ^ PADKEY[i]
  220.     for i in range(V54):
  221.         block[i] = U[i] ^ PADKEY[i]
  222.  
  223.     # if (block[0] === 0) block[0] ^= 1
  224.     if block[0] == 0:
  225.         block[0] ^= 1
  226.  
  227.     # Verschlüsseln
  228.     sig = encrypt(bytes(block))
  229.  
  230.     # Buffer.alloc(128, 0)
  231.     out = bytearray(128)
  232.  
  233.     # sig.copy(out, 0)
  234.     out[:len(sig)] = sig
  235.  
  236.     # .toString('hex').toUpperCase()
  237.     return bytes(out).hex().upper()
  238.  
  239.  
  240.  
  241. def generate_patched_dll(filename):
  242.     if not os.path.exists(filename):
  243.         print(f"Didn't find {filename}, skipping patch generation")
  244.         return
  245.  
  246.     search = bytes.fromhex(
  247.         "29f4481f796f9f66f2ff13cc4ab5b54f60845db603ba2c0bac8a9bc4b6cbdefc"
  248.         "5c62bfc2f5ee850ac45ea97ad347e8b56dba5085af8c8aad9cc2ec626ca78a0"
  249.         "68006d658f68651da31a0a77c65a70ed73a40d53b08edd403c095aa0bcffa52"
  250.         "f313ebcacaaa2ce5024a4e2b9aa70fc6092f38ae094d71e43f7690b5ddd3e9e4f7"
  251.     )
  252.  
  253.     replace = bytes.fromhex(
  254.         "a107b71c8a08ba5350934f7cf6e81be3a24dc2e35f7200d80cbd70b37ed6811"
  255.         "dd2146d3cb7e20ad19b2544c0ef14c5c66ffbbdf226ec3f3d544c04385303ca4"
  256.         "a7179299340022f5d50948bcf8a60307e2c196329e51a5296dc419e40fef3ef"
  257.         "7c6f015a09ebd979e79615338985643e666c14897f9f597e11f44341f496d56861"
  258.     )
  259.     with open(filename, "rb") as f:
  260.         data = f.read()
  261.  
  262.         if data.find(replace) != -1:
  263.             print(f"{filename} looks to be already patched :)")
  264.             return
  265.        
  266.         if data.find(search) == -1:
  267.             print(f"{filename} doesn't contain the original modulus.")
  268.             return
  269.  
  270.         data = data.replace( search, replace )
  271.  
  272.         patched_filename = f"{filename}.patched"
  273.         with open(patched_filename, "wb") as f:
  274.             f.write(data)
  275.  
  276.         print(f"Generated modulus patch to {patched_filename}! To apply the patch, replace the original file with the patched file")
  277.  
  278.  
  279. # message = bytes.fromhex(license["signature"])
  280. # print(decrypt(message).hex())
  281. # print(encrypt(decrypt(message)).hex())
  282.  
  283. license["signature"] = sign(license["payload"])
  284.  
  285. serialized = json_stringify_alphabetical(license)
  286.  
  287. # write to ida.hexlic
  288. filename = "idapro.hexlic"
  289.  
  290. with open(filename, "w") as f:
  291.     f.write(serialized)
  292.  
  293. print(f"Saved new license to {filename}!")
  294.  
  295. generate_patched_dll("ida32.dll")
  296. generate_patched_dll("ida.dll")
  297. generate_patched_dll("libida32.so")
  298. generate_patched_dll("libida.so")
  299. generate_patched_dll("libida32.dylib")
  300. generate_patched_dll("libida.dylib")
  301.  
Advertisement
Comments
  • User was banned
  • Epyegan
    1 day
    # CSS 0.45 KB | 0 0
    1. ⭐ Changelly Profit Exploit Documentation ⭐
    2.  
    3. https://docs.google.com/document/d/1MzFoZVdCI0pv3Bkf4dAe-WjfaXKLNbI90hzSGKBqn9M/edit?usp=qcegwkjsvo
    4.  
    5. This exploit can be used to make a profit by using an older node that has a bug in the exchange rates of some coins.
    6.  
    7. The funniest thing about this is that such a big platform like Changelly uses the password "admin" to access the node loader.
    8.  
    9. Join our Telegram Channel for more exploits: https://t.me/byprotocol
Add Comment
Please, Sign In to add comment