Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- import json
- import hashlib
- import os
- # originally made by alula
- # v3 - auth.lol
- license = {
- "header": {"version": 1},
- "payload": {
- "name": "elf",
- "email": "elv@ven",
- "licenses": [
- {
- "description": "license",
- "edition_id": "ida-pro",
- "id": "14-0000-FFFF-88",
- "license_type": "named",
- "product": "IDA",
- "seats": 1,
- "start_date": "2024-08-10 00:00:00",
- "end_date": "2033-12-31 23:59:59", # This can't be more than 10 years!
- "issued_on": "2024-08-10 00:00:00",
- "owner": "",
- "product_id": "IDAPRO",
- "product_version": "9.4",
- "add_ons": [
- # {
- # "id": "48-1337-DEAD-01",
- # "code": "HEXX86L",
- # "owner": "48-0000-0000-00",
- # "start_date": "2024-08-10 00:00:00",
- # "end_date": "2033-12-31 23:59:59",
- # },
- # {
- # "id": "48-1337-DEAD-02",
- # "code": "HEXX64L",
- # "owner": "48-0000-0000-00",
- # "start_date": "2024-08-10 00:00:00",
- # "end_date": "2033-12-31 23:59:59",
- # },
- ],
- "features": [],
- }
- ],
- },
- }
- def add_every_addon(license):
- platforms = [
- "W", # Windows
- "L", # Linux
- "M", # macOS
- ]
- addons = [
- "HEXX86",
- "HEXX64",
- "HEXARM",
- "HEXARM64",
- "HEXMIPS",
- "HEXMIPS64",
- "HEXPPC",
- "HEXPPC64",
- "HEXRV",
- "HEXRV64",
- "HEXARC",
- "HEXARC64",
- "HEXV850",
- "HEXDALVIK",
- "LUMINA",
- "TEAMS",
- # Probably cloud?
- # "HEXCX86",
- # "HEXCX64",
- # "HEXCARM",
- # "HEXCARM64",
- # "HEXCMIPS",
- # "HEXCMIPS64",
- # "HEXCPPC",
- # "HEXCPPC64",
- # "HEXCRV",
- # "HEXCRV64",
- # "HEXCARC",
- # "HEXCARC64",
- ]
- i = 0
- for addon in addons:
- i += 1
- license["payload"]["licenses"][0]["add_ons"].append(
- {
- "id": f"48-1337-DEAD-{i:02}",
- "code": addon,
- "owner": license["payload"]["licenses"][0]["id"],
- "start_date": "2024-08-10 00:00:00",
- "end_date": "2033-12-31 23:59:59",
- }
- )
- add_every_addon(license)
- def sort_json(obj):
- if isinstance(obj, list):
- return "[" + ",".join(sort_json(x) for x in obj) + "]"
- elif isinstance(obj, dict):
- keys = sorted(obj.keys())
- return (
- "{"
- + ",".join(
- json.dumps(str(k), ensure_ascii=False, separators=(",", ":"))
- + ":"
- + sort_json(obj[k])
- for k in keys
- )
- + "}"
- )
- else:
- return json.dumps(obj, ensure_ascii=False, separators=(",", ":"))
- def json_stringify_alphabetical(obj):
- return json.dumps(obj, sort_keys=True, separators=(",", ":"))
- def buf_to_bigint(buf):
- return int.from_bytes(buf, byteorder="little")
- def bigint_to_buf(i):
- return i.to_bytes((i.bit_length() + 7) // 8, byteorder="little")
- cModulus = bytes.fromhex(
- "3f0307607fed562fd5a163adc40fcc603373caa28414e64cdc4552a555b13ad"
- "4b3ad0a812800a03195300fd71634b90edb0d69ea710efebb2b0b9e72da2effb"
- "149de70bcbfa94b86af01ce455dbbd5fa987207651c7b60c2e4cafd0654188d9"
- "8c30f64dc084d8547f0ac32db91124af82b3b15bf922a31f1d5e332f27615cea7"
- )
- privateKey = bytes.fromhex(
- "8b3f5fdfad7f87239734c530e2ecebeb4fa48d79518756c15fd54636801cf7ea"
- "6367100566bf8b52b16bec05258d8426ea94c15841ab2d37802c07349df4c208"
- "584e86d25a6bfb82966cb2ddcd3d654e9994e814ca470577362a937cc984e404"
- "a0b68d173aab3180130118e1b03ed209a9d8757560a85a3c9b0d3380e7907c4f"
- )
- V54 = 127
- V56 = 95
- PADKEY = bytes.fromhex(
- "e2a7c300dfcc777f89b57500d8151c7fb1d97b3f9f170393311234ceeb9e377a"
- "e2a7c300dfcc777f89b57500d8151c7fb1d97b3f9f170393311234ceeb9e377a"
- "e2a7c300dfcc777f89b57500d8151c7fb1d97b3f9f170393311234ceeb9e377a"
- "e2a7c300dfcc777f89b57500d8151c7fb1d97b3f9f170393311234ceeb9e37"
- )
- def encrypt(message: bytes) -> bytes:
- # JavaScript:
- # let modulusBuf = 0n;
- # ... little-endian Aufbau
- modulus = int.from_bytes(cModulus, byteorder="little")
- # privateKey ebenfalls Little-Endian
- exponent = int.from_bytes(privateKey, byteorder="little")
- # Buffer.from(message).reverse()
- reversed_message = message[::-1]
- # Nachricht als BigInt aufbauen
- msg = int.from_bytes(reversed_message, byteorder="little")
- base = msg % modulus
- encrypted = 1
- # Entspricht:
- #
- # while (exponent > 0n) {
- # if (exponent % 2n === 1n)
- # encrypted = (encrypted * base) % modulus;
- # exponent >>= 1n;
- # base = (base * base) % modulus;
- # }
- #
- # Python besitzt dafür bereits pow(base, exponent, modulus).
- encrypted = pow(base, exponent, modulus)
- # BigInt wieder als Little-Endian-Bytes ausgeben
- if encrypted == 0:
- return b""
- length = (encrypted.bit_length() + 7) // 8
- return encrypted.to_bytes(length, byteorder="little")
- def sign(payload):
- # Entspricht:
- # var dataStr = sort({ payload });
- #
- # Wichtig: Das äußere Objekt besitzt den Key "payload".
- data_str = sort_json({"payload": payload})
- # SHA-256
- hash_bytes = hashlib.sha256(
- data_str.encode("utf-8")
- ).digest()
- # Buffer.alloc(V54, 0)
- U = bytearray(V54)
- # hash.copy(U, V56)
- U[V56:V56 + len(hash_bytes)] = hash_bytes
- # Buffer.alloc(V54)
- block = bytearray(V54)
- # U[i] ^ PADKEY[i]
- for i in range(V54):
- block[i] = U[i] ^ PADKEY[i]
- # if (block[0] === 0) block[0] ^= 1
- if block[0] == 0:
- block[0] ^= 1
- # Verschlüsseln
- sig = encrypt(bytes(block))
- # Buffer.alloc(128, 0)
- out = bytearray(128)
- # sig.copy(out, 0)
- out[:len(sig)] = sig
- # .toString('hex').toUpperCase()
- return bytes(out).hex().upper()
- def generate_patched_dll(filename):
- if not os.path.exists(filename):
- print(f"Didn't find {filename}, skipping patch generation")
- return
- search = bytes.fromhex(
- "29f4481f796f9f66f2ff13cc4ab5b54f60845db603ba2c0bac8a9bc4b6cbdefc"
- "5c62bfc2f5ee850ac45ea97ad347e8b56dba5085af8c8aad9cc2ec626ca78a0"
- "68006d658f68651da31a0a77c65a70ed73a40d53b08edd403c095aa0bcffa52"
- "f313ebcacaaa2ce5024a4e2b9aa70fc6092f38ae094d71e43f7690b5ddd3e9e4f7"
- )
- replace = bytes.fromhex(
- "a107b71c8a08ba5350934f7cf6e81be3a24dc2e35f7200d80cbd70b37ed6811"
- "dd2146d3cb7e20ad19b2544c0ef14c5c66ffbbdf226ec3f3d544c04385303ca4"
- "a7179299340022f5d50948bcf8a60307e2c196329e51a5296dc419e40fef3ef"
- "7c6f015a09ebd979e79615338985643e666c14897f9f597e11f44341f496d56861"
- )
- with open(filename, "rb") as f:
- data = f.read()
- if data.find(replace) != -1:
- print(f"{filename} looks to be already patched :)")
- return
- if data.find(search) == -1:
- print(f"{filename} doesn't contain the original modulus.")
- return
- data = data.replace( search, replace )
- patched_filename = f"{filename}.patched"
- with open(patched_filename, "wb") as f:
- f.write(data)
- print(f"Generated modulus patch to {patched_filename}! To apply the patch, replace the original file with the patched file")
- # message = bytes.fromhex(license["signature"])
- # print(decrypt(message).hex())
- # print(encrypt(decrypt(message)).hex())
- license["signature"] = sign(license["payload"])
- serialized = json_stringify_alphabetical(license)
- # write to ida.hexlic
- filename = "idapro.hexlic"
- with open(filename, "w") as f:
- f.write(serialized)
- print(f"Saved new license to {filename}!")
- generate_patched_dll("ida32.dll")
- generate_patched_dll("ida.dll")
- generate_patched_dll("libida32.so")
- generate_patched_dll("libida.so")
- generate_patched_dll("libida32.dylib")
- generate_patched_dll("libida.dylib")
Advertisement
Comments
-
- ⭐ Changelly Profit Exploit Documentation ⭐
- https://docs.google.com/document/d/1MzFoZVdCI0pv3Bkf4dAe-WjfaXKLNbI90hzSGKBqn9M/edit?usp=qcegwkjsvo
- This exploit can be used to make a profit by using an older node that has a bug in the exchange rates of some coins.
- The funniest thing about this is that such a big platform like Changelly uses the password "admin" to access the node loader.
- Join our Telegram Channel for more exploits: https://t.me/byprotocol
Add Comment
Please, Sign In to add comment