Eltima 端口虚拟化软件授权分析

发布时间：2024年01月08日

Eltima 端口虚拟化软件

授权文件加密方式

授权文件格式

Eltima 端口虚拟化软件

USB Network Gate
通过局域网和互联网共享和接入USB端口
最新版本:https://cdn.electronic.us/products/usb-over-ethernet/windows/update/settings.xml
Serial to Ethernet Connector
通过以太网远程连接串口设备
最新版本:https://cdn.electronic.us/products/sec/windows/update/settings.xml
Virtual Serial Port Driver
创建使用虚拟零调制解调线连接的虚拟串口
最新版本:https://cdn.electronic.us/products/vspd/windows/update/settings.xml

授权文件加密方式

??????授权文件保存在{commonappdata}目录下，名称为*.act，采用RSA2048私钥加密，通过公钥解密。公钥保存在*service.exe文件中，通过搜索“-----BEGIN PUBLIC KEY-----”可以获得。

-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwknN5/81qIoM+k1WEc/5
A+u3YzWeDNE5i5rpayiNWv4TvxX9udMz3uKF4tmDJfjuSCVUHQWAjJefwSv4ZBQ7
egXHtGzh/HVY/Geei7A1TwOroHxxgUKVkXRoPGYIVNBhrqX0CsCgYCZv7Ij6CSy4
Iamw0Gb/BnZ4Uw1AkOs6DfbGaVspeQGg7oTjSj+TKOWdK1dJ7ZoGyoVQLqxpaq41
r893XqSK5mXlbE3pFSjS6Rn8unyt57EuIcFy+x2VqjOf3KiwiGCeIaQtAtF5Pqii
KoEMoGgcDedO4C6h/LKy1oXJR7QeHQijUAn7JXE/i0I57BXyKylR6/YIV6hV+Ovm
bQIDAQAB
-----END PUBLIC KEY-----

通过公钥解密授权文件的代码：


#pragma comment(lib,"crypt32.lib")
#pragma comment(lib,"ws2_32.lib")
#pragma comment(lib,"libssl.lib")
#pragma comment(lib,"libcrypto.lib")
#include <string>
#include <fstream>
#include "openssl/pem.h"
#include "openssl/rsa.h"
#include <openssl/bn.h>
using namespace std;
int main()
{
    ifstream ifs("./vspdpro.act", ifstream::binary | ifstream::ate);
    if (ifs) {
        streampos size = ifs.tellg();
        char* buffer = new char[size];
        ifs.seekg(0, ifstream::beg);
        ifs.read(buffer, size);
        ifs.close();

        string public_key = "-----BEGIN PUBLIC KEY-----\r\n" \
            "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwknN5/81qIoM+k1WEc/5\r\n" \
            "A+u3YzWeDNE5i5rpayiNWv4TvxX9udMz3uKF4tmDJfjuSCVUHQWAjJefwSv4ZBQ7\r\n" \
            "egXHtGzh/HVY/Geei7A1TwOroHxxgUKVkXRoPGYIVNBhrqX0CsCgYCZv7Ij6CSy4\r\n" \
            "Iamw0Gb/BnZ4Uw1AkOs6DfbGaVspeQGg7oTjSj+TKOWdK1dJ7ZoGyoVQLqxpaq41\r\n" \
            "r893XqSK5mXlbE3pFSjS6Rn8unyt57EuIcFy+x2VqjOf3KiwiGCeIaQtAtF5Pqii\r\n" \
            "KoEMoGgcDedO4C6h/LKy1oXJR7QeHQijUAn7JXE/i0I57BXyKylR6/YIV6hV+Ovm\r\n" \
            "bQIDAQAB\r\n" \
            "-----END PUBLIC KEY-----";
        
        BIO* bio = BIO_new_mem_buf(public_key.c_str(), public_key.size());
        RSA* rsa = PEM_read_bio_RSA_PUBKEY(bio, nullptr, nullptr, nullptr);
        BIO_free(bio);
        printf("n='%s';\n", BN_bn2hex(RSA_get0_n(rsa)));
        printf("e='%s';\n", BN_bn2hex(RSA_get0_e(rsa)));
        unsigned char* from = (unsigned char*)buffer;
        unsigned char to[256];
        string txt = "";
        while (true)
        {
            int len = RSA_public_decrypt(256, from, to, rsa, RSA_PKCS1_PADDING);
            if (len < 0) break;
            txt.append((char *)to, len);
            from += 256;
        }
        printf("%s", txt.c_str());
        delete[] buffer;
        RSA_free(rsa);

    }
}

授权文件格式

解密后的授权文件为文本文件：

hid=xxxxxxxx_xxxxxxxx_xxxxxxxx_x_xxxxxxxx
license_key_code=XXXXXXXX-XXXXXXXX-XXXXXXXX-XXXXXXXX-XXXXXXXX-XXXXXXXX
licenseName=Single License SEC
product_id=114
product_name=Serial to Ethernet Connector
product_version=9
serverDate=2024-01-06
activationDate=2024-01-06
nextActivation=2024-01-07
firstActivation=2024-01-06
errorCode=0
key_type=2
registed_name=support
license_options=
key_options=14
serverTime=1704535404
activation_param=
subscription=0
key_not_check_hid=0

其中最关键的两个值key_type和errorCode：

key_type 授权类型

0 = Single License 单机版许可授权

1 = Limited func (license_options)?表示根据功能授权，license_options的值表示功能的限制数量

2 = Limited time(key_options=days) 表示根据时间授权，key_options的值表示授权天数。

3 = OEM

errorCode 授权状态

0 = ALREADY_ACTIVATED?

DEMO_IS_OVER

NO_AVAILABLE_ACTIVATIONS

KEY_BANNED

+REACTIVATE

+STARTING

nextActivation 下次联网验证key的时间

hid 硬件编码

硬件编码由5部分组成，格式如下：

Cpu信息_硬盘几何信息_硬盘固件编号信息_0_系统BIOS信息

详细算法代码如下：

unit HardwareID;

interface
uses Windows,Registry,SysUtils;

  function GetHid():string;

implementation

type
  TRegisters = record
    EAX: DWORD;
    EBX: DWORD;
    ECX: DWORD;
    EDX: DWORD;
  end;
procedure GetCPUID(Param: Cardinal; var Registers: TRegisters);
asm
  PUSH    EBX                         { save affected registers }
  PUSH    EDI
  MOV     EDI, Registers
  XOR     EBX, EBX                    { clear EBX register }
  XOR     ECX, ECX                    { clear ECX register }
  XOR     EDX, EDX                    { clear EDX register }
  DB $0F, $A2                         { CPUID opcode }
  MOV     TRegisters(EDI).&EAX, EAX   { save EAX register }
  MOV     TRegisters(EDI).&EBX, EBX   { save EBX register }
  MOV     TRegisters(EDI).&ECX, ECX   { save ECX register }
  MOV     TRegisters(EDI).&EDX, EDX   { save EDX register }
  POP     EDI                         { restore registers }
  POP     EBX
end;

function GetHid1():Integer;
var
	regs1,regs2:TRegisters;
  i:Cardinal;
begin
	GetCPUID(0,regs1);
  Result:= regs1.EBX xor regs1.ECX xor regs1.EDX;
  if regs1.EAX>=1 then
  begin
  	for i := 1 to 13 do
    begin
    	GetCPUID(i,regs2);
      case i of
        2,3,4,5,8,9,12,13:
        begin
        	Result:=Result xor regs2.EAX xor regs2.EBX xor regs2.ECX xor regs2.EDX;
        end;
        11:
        begin
        	Result:=Result xor regs2.EAX xor regs2.EBX xor regs2.ECX xor(regs2.EDX and $FFFFFF00);
        end;
      end;
    end;
  end;
  GetCPUID($80000000,regs1);
  for i := $80000002 to regs1.EAX do
  begin
  	GetCPUID(i,regs2);
    case i of
    	$80000001,$80000002,$80000003,$80000004,$80000006,$80000008,$8000000A,$8000001A:
      begin
      	Result:=Result xor regs2.EAX xor regs2.EBX xor regs2.ECX xor regs2.EDX;
      end;
    end;
  end;
end;

function GetHid11():Integer;
var
	SystemInfo:TSystemInfo;
begin
	GetSystemInfo(SystemInfo);
  if SystemInfo.wProcessorArchitecture>=0 then
  	Result:=2*SystemInfo.wProcessorArchitecture
  else
  	Result:=2*SystemInfo.wProcessorArchitecture+1;
  Result:=SystemInfo.dwNumberOfProcessors xor Result;
  if Result>=0 then
  	Result := 2 * Result
  else
  	Result := 2 * Result+1;
  Result := SystemInfo.dwProcessorType xor Result;
  if Result>=0 then
  	Result := 2 * Result
  else
  	Result := 2 * Result+1;
  Result := SystemInfo.wProcessorLevel xor Result;
  if Result>=0 then
  	Result := 2 * Result
  else
  	Result := 2 * Result+1;
  Result := SystemInfo.wProcessorRevision xor Result;
  if Result>=0 then
  	Result := 2 * Result
  else
  	Result := 2 * Result+1;
end;


function GetHid2:Integer;
type
	TDiskGeometry=record
    Cylinders:LARGE_INTEGER;
    MediaType:DWORD;
    TracksPerCylinder:DWORD;
    SectorsPerTrack:DWORD;
    BytesPerSector:DWORD;
  end;
var
	hDevice : THandle;
  DiskGeometry:TDiskGeometry;
  cbBytesReturned:DWORD;
  Value1,Value2:LARGE_INTEGER;
const
	IOCTL_DISK_GET_DRIVE_GEOMETRY = $00070000;
begin
	Result:=0;
	hDevice := CreateFile( '\\.\PhysicalDrive0',GENERIC_READ,FILE_SHARE_READ or FILE_SHARE_WRITE,nil, OPEN_EXISTING, 0, 0 );
  if hDevice<>INVALID_HANDLE_VALUE then
  begin
		if DeviceIoControl(hDevice, IOCTL_DISK_GET_DRIVE_GEOMETRY,nil,0, @DiskGeometry,SizeOf(TDiskGeometry), cbBytesReturned, nil ) then
    begin
    	Value1.QuadPart:=DiskGeometry.BytesPerSector * DiskGeometry.SectorsPerTrack*DiskGeometry.TracksPerCylinder*DiskGeometry.Cylinders.QuadPart;
      if (Value1.QuadPart and $80000000)=0 then
      	Value2.QuadPart:=2*Value1.QuadPart
      else
      	Value2.QuadPart:=(2*Value1.QuadPart) or 1;
      Result:=Value2.LowPart xor Value1.HighPart;
      if Result>=0 then
      	Result:=2*Result
      else
      	Result:=(2*Result) or 1;
    end;
    CloseHandle(hDevice);
  end;
end;

function GetHid3:Integer;
type
	TStorgePropertyQuery=record
    PropertyId:DWORD;
    QueryType:DWORD;
    AdditionalParameters:Byte;
  end;
  TStorgeDeviceDescriptor=record
  	Version:DWORD;
    Size:DWORD;
    DeviceType:Byte;
    DeviceTypeModifier:Byte;
    RemovableMedia:Boolean;
    CommandQueueing:Boolean;
    VendorIdOffset:DWORD;
    ProductIdOffset:DWORD;
    ProductRevisionOffset:DWORD;
    SerialNumberOffset:DWORD;
    BusType:DWORD;
    RawPropertiesLength:DWORD;
    RawDeviceProperties:Byte;
  end;
  PStorgeDeviceDescriptor=^TStorgeDeviceDescriptor;
  TGetVersionInParams=record
  	bVersion:Byte;
    bRevision:Byte;
    bReserved:Byte;
    bIDEDeviceMap:Byte;
    fCapabilities:DWORD;
    dwReserved:array[0..3] of DWORD;
  end;
  _IDEREGS=record
    bFeaturesReg:Byte;
    bSectorCountReg:Byte;
    bSectorNumberReg:Byte;
    bCylLowReg:Byte;
    bCylHighReg:Byte;
    bDriveHeadReg:Byte;
    bCommandReg:Byte;
    bReserved:Byte;
  end;
  TSendCmdInParams=record
  	cBufferSize:DWORD;
    irDriveRegs:_IDEREGS;
    bDriveNumber:Byte;
    bReserved:array[0..2] of Byte;
    dwReserved:array[0..3] of DWORD;
    bBuffer:Byte;
  end;
  _DRIVERSTATUS=record
 		bDriverError:Byte;
    bIDEError:Byte;
    bReserved:array[0..1] of Byte;
    dwReserved:array[0..1] of DWORD;
  end;
  TSendCmdOutParams=record
  	cBufferSize:DWORD;
    DriverStatus:_DRIVERSTATUS;
    bBuffer:Byte;
  end;
  PSendCmdOutParams=^TSendCmdOutParams;
var
	hDevice : THandle;
  StorgePropertyQuery:TStorgePropertyQuery;
  StorgeDeviceDescriptor:PStorgeDeviceDescriptor;
  GetVersionInParams:TGetVersionInParams;
  SendCmdInParams:TSendCmdInParams;
  SendCmdOutParams:PSendCmdOutParams;
  cbBytesReturned,i:DWORD;
  P:PChar;
  W:PWORD;
  Str:string;
const
	IOCTL_STORAGE_QUERY_PROPERTY  = $002D1400;
  SMART_GET_VERSION 						= $00074080;
  SMART_RCV_DRIVE_DATA					= $0007C088;
  IDENTIFY_BUFFER_SIZE        	= 512;

  // Valid values for the bCommandReg member of IDEREGS.
  ATAPI_ID_CMD    							= $A1;            // Returns ID sector for ATAPI.
  ID_CMD         								= $EC;            // Returns ID sector for ATA.
  SMART_CMD       							= $B0;            // Performs SMART cmd.
begin
	Result:=0;
	hDevice := CreateFile( '\\.\PhysicalDrive0',GENERIC_READ,FILE_SHARE_READ or FILE_SHARE_WRITE,nil, OPEN_EXISTING, 0, 0 );
  if hDevice<>INVALID_HANDLE_VALUE then
  begin
  	ZeroMemory(@StorgePropertyQuery,SizeOf(TStorgePropertyQuery));
    ZeroMemory(@GetVersionInParams,SizeOf(TGetVersionInParams));
    StorgeDeviceDescriptor:=AllocMem(10000);
		if DeviceIoControl(hDevice, IOCTL_STORAGE_QUERY_PROPERTY,@StorgePropertyQuery,SizeOf(TStorgePropertyQuery),
    		StorgeDeviceDescriptor,10000, cbBytesReturned, nil ) then
    begin
      Str:='';
      P:=PChar(@StorgeDeviceDescriptor^.Version);
      if StorgeDeviceDescriptor^.SerialNumberOffset>0 then Str:=Str+StrPas(PChar(Integer(P)+StorgeDeviceDescriptor^.SerialNumberOffset));
      if StorgeDeviceDescriptor^.VendorIdOffset>0 then Str:=Str+StrPas(PChar(Integer(P)+StorgeDeviceDescriptor^.VendorIdOffset));
      if StorgeDeviceDescriptor^.ProductIdOffset>0 then Str:=Str+StrPas(PChar(Integer(P)+StorgeDeviceDescriptor^.ProductIdOffset));
      for i := 1 to Length(Str) do
      begin
        Result:=Result xor Ord(Str[i]);
        if Result>=0 then
        	Result:=2*Result
        else
        	Result:=(2*Result) or 1;
      end;
    end
    else if DeviceIoControl(hDevice, SMART_GET_VERSION,nil,0,@GetVersionInParams,SizeOf(TGetVersionInParams), cbBytesReturned, nil) then
    begin
    	if GetVersionInParams.bIDEDeviceMap>0 then
      begin
     		SendCmdOutParams:=AllocMem(SizeOf(TSendCmdOutParams)+IDENTIFY_BUFFER_SIZE);
        ZeroMemory(@SendCmdInParams,SizeOf(TSendCmdInParams));
        SendCmdInParams.irDriveRegs.bSectorCountReg:=1;
        SendCmdInParams.irDriveRegs.bSectorNumberReg:=1;
        SendCmdInParams.irDriveRegs.bDriveHeadReg:=$A0;
        if (GetVersionInParams.bIDEDeviceMap and $10) <>0 then
        	SendCmdInParams.irDriveRegs.bCommandReg:=ATAPI_ID_CMD
        else
        	SendCmdInParams.irDriveRegs.bCommandReg:=ID_CMD;
        SendCmdInParams.cBufferSize:=512;
        if DeviceIoControl(hDevice, SMART_RCV_DRIVE_DATA,@SendCmdInParams,SizeOf(TSendCmdInParams),
        	SendCmdOutParams,SizeOf(TSendCmdOutParams)+IDENTIFY_BUFFER_SIZE, cbBytesReturned, nil ) then
        begin
        	W:=@SendCmdOutParams^.bBuffer;
          Inc(W,10);
          Result:=W^;
          if Result>=0 then
          	Result:=2*Result
          else
          	Result:=(2*Result) or 1;
          Inc(W,1);
          Result:=Result xor W^;
          if Result>=0 then
          	Result:=2*Result
          else
          	Result:=(2*Result) or 1;
          Inc(W,1);
          Result:=Result xor W^;
          if Result>=0 then
          	Result:=2*Result
          else
          	Result:=(2*Result) or 1;
          Inc(W,1);
          Result:=Result xor W^;
          if Result>=0 then
          	Result:=2*Result
          else
          	Result:=(2*Result) or 1;
          Inc(W,1);
          Result:=Result xor W^;
          if Result>=0 then
          	Result:=2*Result
          else
          	Result:=(2*Result) or 1;
          Inc(W,1);
          Result:=Result xor W^;
          if Result>=0 then
          	Result:=2*Result
          else
          	Result:=(2*Result) or 1;
          Inc(W,1);
          Result:=Result xor W^;
          if Result>=0 then
          	Result:=2*Result
          else
          	Result:=(2*Result) or 1;
          Inc(W,1);
          Result:=Result xor W^;
          if Result>=0 then
          	Result:=2*Result
          else
          	Result:=(2*Result) or 1;
          Inc(W,1);
          Result:=Result xor W^;
          if Result>=0 then
          	Result:=2*Result
          else
          	Result:=(2*Result) or 1;
          Inc(W,1);
          Result:=Result xor W^;
        end;
        FreeMem(SendCmdOutParams);
      end;
    end;
    FreeMemory(StorgeDeviceDescriptor);
    CloseHandle(hDevice);
  end;
end;

function GetHid5:Integer;
var
	Reg:TRegistry;
  Size,i:Integer;
  B:TBytes;
begin
	Result:=0;
	Reg:=TRegistry.Create;
  try
  	Reg.RootKey:=HKEY_LOCAL_MACHINE;
    if Reg.OpenKeyReadOnly('HARDWARE\DESCRIPTION\System') then
    begin
    	Size:=Reg.GetDataSize('SystemBiosVersion');
      if Size>0 then
      begin
      	SetLength(B,Size);
        if Reg.ReadBinaryData('SystemBiosVersion',B[0],Size)<>0 then
        begin
          for i := 0 to Size - 1 do
          begin
            Result:=Result xor B[i];
            if Result>=0 then
            	Result:=2*Result
            else
            	Result:=2*Result or 1;
           	//UNICODE STRING
            Result:=Result xor $00;
            if Result>=0 then
            	Result:=2*Result
            else
            	Result:=2*Result or 1;
          end;

        end;
      end;
    end;
  finally
 		FreeAndNil(Reg);
  end;
end;

function GetHid():string;
var
	regs:TRegisters;
  hid1,hid2,hid3,hid4,hid5:DWORD;
begin
	GetCPUID(0,regs);
  if regs.EAX>0 then
    hid1:=GetHid1
  else
    hid1:=GetHid11;
  hid2:=GetHid2;
  hid3:=GetHid3;
  hid4:=0;
  hid5:=GetHid5;
  Result:=Format('%x_%x_%x_%x_%x',[hid1,hid2,hid3,hid4,hid5]);
  Result:=LowerCase(Result)
end;

end.

授权许可

可以通过两种方式实现本地授权，一是重新生成RSA2048秘钥对，替换可执行文件内的公钥，用私钥加密授权文件保存为act文件，既可实现授权许可；二是通过dll劫持方式hook可执行文件内解密act文件的函数，修改返回的内容，既可实现本地授权许可。

1、替换公钥

//替换公钥
procedure PatchFile(FileName:string);
var
  Stream:TMemoryStream;
  SubStr,Str:string;
  P:PByte;
  Offset:Integer;
begin
  SubStr:='-----BEGIN PUBLIC KEY-----';
  Stream:=TMemoryStream.Create;
  try
    Stream.LoadFromFile(FileName);
    Stream.Position:=0;
    SetLength(Str,Stream.Size);
    MoveMemory(@Str[1],Stream.Memory,Stream.Size);
    Offset:=Pos(SubStr,Str);
    if Offset<1 then raise Exception.Create('Can not find PublicKey,Patch failed!');
    P:= PByte(DWORD(Stream.Memory)+Offset-1);
    MoveMemory(P,@RSA_PUBLIC_KEY[1],Length(RSA_PUBLIC_KEY));
    Stream.SaveToFile(FileName);
  finally
    Stream.Free;
  end;
end;

通过FGInt实现RSA公钥解密私钥加密，也可以直接通过openssl实现，会增加2个dll文件。

unit FGIntRSA;
{
n=p*q
φ(n) = (p-1)(q-1)
d*e mod φ(n) = 1
public key => n e
private key => n d
public key enc dec => M= C^e mod n
private key enc dec => C= M^d mod n
}
interface
uses FGInt;

type
  RSA_PADDING = (RSA_PKCS1_PADDING,RSA_X931_PADDING,RSA_NO_PADDING);

  function RSA_Public_Decrypt(Src:string;StrE,StrN:string;Padding:RSA_PADDING = RSA_PKCS1_PADDING):string;
  function RSA_Private_Encrypt(Src:string;StrD,StrN:string;Padding:RSA_PADDING = RSA_PKCS1_PADDING):string;

implementation
uses SysUtils,Windows;
const
  RSA_PKCS1_PADDING_SIZE  =  11;
  

function RSA_padding_check_PKCS1_type_1(Src:string):string;
var
  p:PByte;
  i,len:Integer;
begin
{
00 || 01 || PS || 00 || D
PS - padding string, at least 8 bytes of FF
D  - data.
}
  p:=PByte(@Src[1]);
  if p^=$00 then inc(p);
  if p^<>$01 then raise Exception.Create('RSA_R_BLOCK_TYPE_IS_NOT_01');
  Inc(p);
  for i := 0 to Length(Src) - 2 do
  begin
    if p^<>$FF then
    begin
      if p^=0 then
      begin
        Inc(p);
        Break;
      end
      else
        raise Exception.Create('RSA_R_BAD_FIXED_HEADER_DECRYPT');
    end;
    Inc(p);
  end;
  len:=Length(Src) - (Cardinal(p)-Cardinal(@Src[1]));
  SetLength(Result,len);
  MoveMemory(@Result[1],p,len);
end;
function RSA_padding_add_PKCS1_type_1(Src:string;Num:Integer):string;
var
  p:PByte;
  len:Integer;
begin
  if Length(Src)>Num - RSA_PKCS1_PADDING_SIZE then raise Exception.Create('RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE');
  SetLength(Result,Num);
  p:=PByte(@Result[1]);
  p^:=$00;
  Inc(p);
  p^:=$01;
  Inc(p);
  len:=Num - Length(Src) - 3;
  FillMemory(p,len,$FF);
  Inc(p,len);
  p^:=$00;
  Inc(p);
  MoveMemory(p,@Src[1],Length(Src));
end;
function RSA_padding_check_X931(Src:string):string;
var
  p:PByte;
  i,len:Integer;
begin
  p:=PByte(@Src[1]);
  if p^ = $6B then
  begin
    Inc(p);
    for i := 0 to Length(Src) - 3 do
    begin
      if p^ = $BA then
      begin
        inc(p);
        Break;
      end
      else if p^<>$BB then raise Exception.Create('RSA_R_INVALID_PADDING');
      Inc(p);
    end;
    len:=Length(Src) - (Cardinal(p)-Cardinal(@Src[1])) - 1;
  end
  else if p^ = $6A then
  begin
    Inc(p);
    len:=Length(Src) - 2;
  end
  else
    raise Exception.Create('RSA_R_INVALID_HEADER');
  if PByte(Cardinal(p)+len)^ <> $CC then raise Exception.Create('RSA_R_INVALID_TRAILER');
  SetLength(Result,len);
  MoveMemory(@Result[1],p,len);
end;
function RSA_padding_add_X931(Src:string;Num:Integer):string;
var
  p:PByte;
  len:Integer;
begin
  len:= Num -2  - Length(Src);
  if len < 0 then raise Exception.Create('RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE');
  SetLength(Result,Num);
  p:=PByte(@Result[1]);
  if len = 0 then
  begin
    p^:=$6A;
    Inc(p);
  end
  else
  begin
    p^:=$6B;
    Inc(p);
    if len > 1 then
    begin
      FillMemory(p,len - 1,$BB);
      Inc(p,len-1);
    end;
    p^:=$BA;
    Inc(p);
  end;    
  MoveMemory(p,@Src[1],Length(Src));
  Inc(p,Length(Src));
  p^:=$CC;
end;   
function RSA_Public_Decrypt(Src:string;StrE,StrN:string;Padding:RSA_PADDING):string;
var
  tempstr:string;
  c,e,n,temp:TFGInt;
  i,j,num:Integer;
begin
  Base256StringToFGInt(StrE,E);
  Base256StringToFGInt(StrN,N);
  Result:='';
  FGIntToBase2String(n,tempstr);
  num:=Length(tempstr) div 8;
  j :=Length(Src) div num;
  if Length(Src) mod num <> 0 then inc(j);
  for i := 1 To j do
  begin
    tempstr := copy(Src, 1, num);
    delete(Src, 1, num);
    Base256StringToFGInt(tempstr,c);
    FGIntModExp(c, e, n, temp);
    FGIntToBase256String(temp, tempstr);
    case Padding of
      RSA_PKCS1_PADDING:Result := Result + RSA_padding_check_PKCS1_type_1(tempstr);
      RSA_X931_PADDING:Result:= Result + RSA_padding_check_X931(tempstr);
      RSA_NO_PADDING:Result := Result + tempstr;
    end;
    FGIntDestroy(c);
    FGIntDestroy(temp);
  end;
  FGIntDestroy(e);
  FGIntDestroy(n);
end;
function RSA_Private_Encrypt(Src:string;StrD,StrN:string;Padding:RSA_PADDING):string;
var
  i, j ,num,padding_size:Integer;
  tempstr:string;
  c,d,n,temp:TFGInt;
begin
  Base256StringToFGInt(StrD,d);
  Base256StringToFGInt(StrN,n);
  Result:='';
  FGIntToBase2String(n,tempstr);
  num:=Length(tempstr) div 8;
  padding_size:=0;
  case Padding of
    RSA_PKCS1_PADDING:padding_size:=RSA_PKCS1_PADDING_SIZE;
    RSA_X931_PADDING:padding_size:=2;
    RSA_NO_PADDING:padding_size:=0;
  end;
  j :=Length(Src) div (num - padding_size);
  if Length(Src) mod (num - padding_size) <> 0 then inc(j);

  for i := 1 To j do
  begin
    tempstr := copy(Src, 1, num - padding_size);
    delete(Src, 1, num - padding_size);
    case Padding of
      RSA_PKCS1_PADDING:tempstr:=RSA_padding_add_PKCS1_type_1(tempstr,num);
      RSA_X931_PADDING:tempstr:=RSA_padding_add_X931(tempstr,num);
      RSA_NO_PADDING:tempstr:=tempstr;
    end;
    Base256StringToFGInt(tempstr, c);
    FGIntModExp(c, d, n, temp);
    FGIntToBase256String(temp,tempstr);
    Result:=Result+tempstr;
    FGIntDestroy(c);
    FGIntDestroy(temp);
  end;  
  FGIntDestroy(d);
  FGIntDestroy(n);
end;

end.

2、dll劫持hook

通过python脚本创建winhttp.dll的劫持工程模板。

#CreatePatchDll.py

import os,sys,winreg,pefile
from string import Template 

def IsKnownDLLs(dllname:str):
    key = winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE,r"SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs")
    try:
        j = 0
        while True:
            _,value,_ = winreg.EnumValue(key, j)
            if value.upper() == dllname.upper():
                return True
            j += 1
    except WindowsError as e:
        pass
    return False

if __name__ == '__main__':
    if (len(sys.argv)>1):
        name = sys.argv[1]
    else:
        #name = 'version.dll'
        print('Missing file name')
        exit(-1)

    if IsKnownDLLs(name):
        print(f'{name} is system know dll!')
        exit(-1)      


    dll_paths=[os.getcwd(),os.getenv('windir'),os.path.join(os.getenv('windir'),'system32')]
    dll_path = None
    for path in dll_paths:
        if os.path.exists(os.path.join(path,name)):
            dll_path = os.path.join(path,name)
            break
    if not dll_path:
        print('Could not find %s' % name)
        exit(-1)

    name = os.path.basename(dll_path).split('.')[0]
    pe = pefile.PE(dll_path)

    dpr = f"""library {name};
uses
  SysUtils,
  Classes,
  Windows,
  u{name} in 'u{name}.pas';    
{{$R *.res}}
procedure DLLHandler(Reason: Integer);
begin
  case Reason of
    DLL_PROCESS_ATTACH:
    begin
      OnLoad();
    end;
    DLL_PROCESS_DETACH:
    begin
    end;
    DLL_THREAD_ATTACH:;
    DLL_THREAD_DETACH:;
  end;
end;
begin
  DLLProc := @DLLHandler;
  DLLProc(DLL_PROCESS_ATTACH);
end.    
"""
    code = Template(f"""unit u{name};
interface
uses  Windows;
  procedure OnLoad;stdcall;   
$code1
exports
$code2
implementation
const
$code3
var
$code4
$code5
procedure OnLoad;stdcall;
var
  SysPath:array[0..MAX_PATH-1] of Char ;
  LibPath:string ;
  LibHandle: THandle ;
begin
  GetSystemDirectory(SysPath,MAX_PATH);
  LibPath:= SysPath+'\{name}.dll';
  LibHandle := LoadLibrary(PChar(LibPath));
  if LibHandle <> 0 then
  begin
$code6
  end
  else
    ExitProcess(0);
end;
end.
""") 

    code1 = '\n'
    code2 = '\n'
    code3 = '\n'
    code4 = '\n'
    code5 = '\n'
    code6 = '\n'

    for i in range(len(pe.DIRECTORY_ENTRY_EXPORT.symbols)):
        func_name = pe.DIRECTORY_ENTRY_EXPORT.symbols[i].name.decode()
        code1 += f'  procedure {func_name};stdcall;\n'
        if i == len(pe.DIRECTORY_ENTRY_EXPORT.symbols)-1:
            code2 += f'  {func_name};\n'
        else:
            code2 += f'  {func_name},\n'
        code3 += f"  str{func_name} = '{func_name}';\n"   
        code4 += f"  p{func_name}:Pointer;\n"  
        code5 += f"procedure {func_name};stdcall;\n{{$IF Defined(CPUX86)}}\nasm jmp dword ptr [p{func_name}] end;\n{{$ELSEIF Defined(CPUX64)}}\nasm jmp qword ptr [p{func_name}] end;\n{{$ENDIF}}\n\n" 
        code6 += f"    p{func_name}:=GetProcAddress(LibHandle,str{func_name});\n"  

    pas = code.substitute(code1=code1,code2=code2,code3=code3,code4=code4,code5=code5,code6=code6)

    with open(f'u{name}.pas','w') as f:
        f.write(pas)
    with open(f'{name}.dpr','w') as f:
        f.write(dpr)

python?CreatePatchDll.py WinHttp.dll

IDA、OD分析授权文件解密函数，提取特征，通过内存搜索定位hook的位置。

{$IFDEF CPUX86}
  SEARCH:string ='55 8B EC 6A FF 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 83 EC ?? 53 56 57 A1 ?? ?? ?? ?? 33 C5 50 8D 45 ?? 64 A3 00 00 00 00 C7 45 ?? 00 00 00 00 8B C1 C7 45 ?? 00 00 00 00 83 79 ?? ?? C7 45 ?? 00 00 00 00 72';
{
55                            push    ebp
8B EC                         mov     ebp, esp
6A FF                         push    0FFFFFFFFh
68 DE DE 65 00                push    offset SEH_488580  //?? ?? ?? ??
64 A1 00 00 00 00             mov     eax, large fs:0
50                            push    eax
83 EC 0C                      sub     esp, 0Ch  //??
53                            push    ebx
56                            push    esi
57                            push    edi
A1 3C EB 72 00                mov     eax, ___security_cookie  //?? ?? ?? ??
33 C5                         xor     eax, ebp
50                            push    eax
8D 45 F4                      lea     eax, [ebp]       //??
64 A3 00 00 00 00             mov     large fs:0, eax
C7 45 FC 00 00 00 00          mov     [ebp-4], 0      //??
8B C1                         mov     eax, ecx
C7 45 EC 00 00 00 00          mov     [ebp-14h], 0    //??
83 79 14 10                   cmp     dword ptr [ecx+14h], 10h   //??  ??
C7 45 F0 00 00 00 00          mov     [ebp-10h], 0    //??
72 02                         jb      short
}
{$ELSEIF Defined(CPUX64)}
  SEARCH:string = '48 89 5C 24 ?? 48 89 54 24 ?? 55 56 57 41 56 41 57 48 83 EC ?? 49 8B F9 49 8B E8 48 8B F2 33 DB 89 5C 24 ?? 48 89 5C 24 ?? 48 8B C1 48 83 79 ?? ?? 72';
{
48 89 5C 24 18                mov     [rsp+18h], rbx     //??
48 89 54 24 10                mov     [rsp+10h], rdx     //??
55                            push    rbp
56                            push    rsi
57                            push    rdi
41 56                         push    r14
41 57                         push    r15
48 83 EC 40                   sub     rsp, 40h           //??
49 8B F9                      mov     rdi, r9
49 8B E8                      mov     rbp, r8
48 8B F2                      mov     rsi, rdx
33 DB                         xor     ebx, ebx
89 5C 24 30                   mov     [rsp+68h-38h], ebx    //??
48 89 5C 24 70                mov     [rsp+68h+8], rbx      //??
48 8B C1                      mov     rax, rcx
48 83 79 18 10                cmp     qword ptr [rcx+18h], 10h    //?? ??
72 03                         jb      short loc_1400B8E76
}
{$ENDIF}

?根据通配符搜索内存函数

function SearchMemory(Addr:PByte;Size:Cardinal;Search:string):PByte;
var
  i:Integer;
  P:PByte;
  WildcardBytes,SearchBytes:array of Byte;
begin
  Result:=nil;
  Search:=StringReplace(Search,' ','',[rfReplaceAll]);
  if Length(Search) mod 2 <>0 then raise Exception.Create('Search Hex String Lenght Must be Even number');
  SetLength(WildcardBytes,Length(Search) div 2);
  SetLength(SearchBytes,Length(WildcardBytes));
  for i := 0 to Length(SearchBytes) - 1 do
  begin
    if Search[2*i+1] + Search[2*i+2]  = '??' then
    begin
      WildcardBytes[i]:=$00;
      SearchBytes[i]:=$00;
    end
    else if Search[2*i+1] = '?' then
    begin
      WildcardBytes[i]:=$0F;
      SearchBytes[i]:=StrToInt('$'+Search[2*i+2]);
    end
    else if Search[2*i+2] = '?' then
    begin
      WildcardBytes[i]:=$F0;
      SearchBytes[i]:=StrToInt('$'+Search[2*i+1]) shl 8;
    end
    else
    begin
      WildcardBytes[i]:=$FF;
      SearchBytes[i]:=StrToInt('$'+Search[2*i+1] + Search[2*i+2]);
    end;
  end;
  while Size>0 do
  begin
    P:=Addr;
    for i := 0 to Length(SearchBytes) - 1 do
    begin
      if P^ and WildcardBytes[i] <> SearchBytes[i] then Break;
      Inc(P);
    end;
    if i = Length(SearchBytes) then
    begin
      Result:=Addr;
      Break;
    end;
    Inc(Addr);
    Dec(Size);
  end;
end;

根据特征值，搜索确定解密函数位置后进行hook

function HookDecryptLicense:Boolean;
var
  P:PByte;
  ModuleInfo:TModuleInfo;
begin
  Result:=False;
  if GetModuleInformation(GetCurrentProcess,GetModuleHandle(nil),@ModuleInfo,SizeOf(TModuleInfo)) then
  begin
    P:=SearchMemory(ModuleInfo.lpBaseOfDll,ModuleInfo.SizeOfImage,SEARCH);
    if P<>nil then
    begin
      HookProc(P,@New_DecryptLicense,Old_DecryptLicense);
      Result:=True;
    end;
  end;
end;

hook后跳转到新的函数

procedure New_DecryptLicense;assembler;
{$IFDEF CPUX86}
asm
  PUSH EBP
  MOV EBP,ESP
  PUSH [EBP+$10]
  PUSH [EBP+$0C]
  PUSH [EBP+$08]
  CALL Old_DecryptLicense
  CALL ModifyLicense
  POP EBP
  RET $0C
end;
{$ELSEIF Defined(CPUX64)}
asm
  SUB RSP,$18
  CALL Old_DecryptLicense
  MOV RCX,RAX
  CALL ModifyLicense
  ADD RSP,$18
end;
{$ENDIF}

新的函数首先调用原来的解密函数，得到返回值后通过ModifyLicense函数，修改返回的license再返回给程序。

function GenerateKey(LicenseKey:string):string;
const
  DEFAULT_CHAR = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
var
  i,j,Count,Size:Integer;
  StringList:TStringList;
begin
  Randomize;
  Result:='';
  StringList:=TStringList.Create;
  try
    StringList.Delimiter:='-';
    StringList.StrictDelimiter:=True;
    StringList.DelimitedText:=LicenseKey;
    Count:=StringList.Count;
    for i := 0 to Count - 1 do
    begin
      Size:=Length(StringList[i]);
      for j := 0 to Size - 1 do
      begin
        Result:=Result+UpCase(DEFAULT_CHAR[Random(Length(DEFAULT_CHAR) - 1) + 1])
      end;
      if i <> Count - 1 then Result := Result + '-';
    end;
  finally
    StringList.Free;
  end;
end;

function ModifyLicense(pLicense:PPAnsiChar):PPAnsiChar;
var
  StringList:TStringList;
  NewLicense:AnsiString;
begin
  StringList:=TStringList.Create;
  try
    StringList.Delimiter:='&';
    StringList.StrictDelimiter:=True;
    StringList.DelimitedText:=string(pLicense^);
    StringList.Values['license_key_code']:=GenerateKey(StringList.Values['license_key_code']);
    StringList.Values['licenseName']:='Single license';
    StringList.Values['key_type']:='0';  1 Limited func (license_options)   2= Limited time(key_options=days) 3=OEM
    StringList.Values['errorCode']:='0';//ALREADY_ACTIVATED DEMO_IS_OVER NO_AVAILABLE_ACTIVATIONS KEY_BANNED +REACTIVATE +STARTING
    StringList.Values['key_options']:='';
    StringList.Values['license_options']:='';
    StringList.Values['nextActivation']:='2100-01-01';
    StringList.Values['activationDate']:='2010-12-31';
    StringList.Values['firstActivation']:='2010-12-31';
    StringList.Values['serverDate']:='2010-12-31';
    StringList.Values['serverTime']:='1293724800';  //2010/12/31 0:0:0 = 1293724800
    StringList.Values['registed_name']:='ElseIf@Live.cn';
{$IFDEF DEBUG}
    StringList.SaveToFile(ExtractFilePath(ParamStr(0))+'License.txt');
{$ENDIF}
    ZeroMemory(pLicense^,PNativeUInt(NativeUInt(pLicense)+16)^);
    NewLicense:=AnsiString(StringList.DelimitedText);
    CopyMemory(pLicense^,PAnsiChar(NewLicense),Length(NewLicense));
    PNativeUInt(NativeUInt(pLicense)+16)^:=Length(NewLicense);
  finally
    StringList.Free;
  end;
  Result:=pLicense;
end;

另外程序注册表内加密存储了试用期相关信息，可以直接把CryptUnprotectData函数hook掉就好了。

type
  _CRYPTOAPI_BLOB = record
    cbData: DWORD;
    pbData: PByte;
  end;
  DATA_BLOB = _CRYPTOAPI_BLOB;
  PDATA_BLOB = ^DATA_BLOB;
  _CRYPTPROTECT_PROMPTSTRUCT = record
    cbSize: DWORD;
    dwPromptFlags: DWORD;
    hwndApp: HWND;
    szPrompt: PWideChar;
  end;
  CRYPTPROTECT_PROMPTSTRUCT = _CRYPTPROTECT_PROMPTSTRUCT;
  PCRYPTPROTECT_PROMPTSTRUCT = ^CRYPTPROTECT_PROMPTSTRUCT;
var
  Old_CryptProtectData:function(pDataIn: PDATA_BLOB;
  szDataDescr: PWideChar; pOptionalEntropy: PDATA_BLOB;
  pReserved: Pointer; pPromptStruct: PCRYPTPROTECT_PROMPTSTRUCT; dwFlags: DWORD;
  pDataOut: PDATA_BLOB): BOOL; stdcall;

function CryptUnprotectData(pDataIn: PDATA_BLOB; ppszDataDescr: PPWideChar;
  pOptionalEntropy: PDATA_BLOB; pReserved: Pointer;
  pPromptStruct: PCRYPTPROTECT_PROMPTSTRUCT; dwFlags: DWORD;
  pDataOut: PDATA_BLOB): BOOL; stdcall; external 'Crypt32.dll';

function New_CryptUnprotectData(pDataIn: PDATA_BLOB; ppszDataDescr: PPWideChar;
    pOptionalEntropy: PDATA_BLOB; pReserved: Pointer;
    pPromptStruct: PCRYPTPROTECT_PROMPTSTRUCT; dwFlags: DWORD;
    pDataOut: PDATA_BLOB): BOOL; stdcall;
begin
  Result:=False;
//Result:=Old_CryptUnprotectData(pDataIn,ppszDataDescr,pOptionalEntropy,pReserved,pPromptStruct,dwFlags,pDataOut);
end;


 HookProc(@CryptUnprotectData,@New_CryptUnprotectData,@Old_CryptUnprotectData);

测试验证

把编译好的WinHttp.dll复制到程序根目录下，USB Network Gate 有64位版本，需要复制Win64目录下的WinHttp.dll，32位版本的复制Win32目录下的WinHttp.dll。

重新启动程序后台服务：

Virtual Serial Port Driver = > net stop vspd_pro & net start vspd_pro
Serial to Ethernet Connector= > net stop sec_service & net start sec_service?? ?
USB Network Gate= > net stop usb_service & net start usb_service?? ?

已经测试过的软件版本名称：

Virtual Serial Port Driver 11.0.1047
Released: April 5, 2023
?? ?Fixed: a crash when importing invalid COM-port bundle settings.
?? ?Fixed: minor issues with the software auto-update feature.
https://help.electronic.us/support/solutions/articles/44002275017-what-s-new-in-this-version

Serial to Ethernet Connector 9.0.1253
Released: April 12, 2023
?? ?Added: new software drivers signed by Microsoft.
?? ?Added: color indication that the maximum number of client connections allowed for a remote server has been reached.
?? ?Improved: Spanish, French, and German localizations. ?
?? ?Fixed: compatibility issues with 12th Gen Intel? Core? processors.
?? ?Fixed: issues with displaying long port names.
?? ?Lots of minor fixes and improvements.
https://help.electronic.us/support/solutions/articles/44002207950-what-s-new-in-this-version

USB Network Gate 10.0
Build 10.0.2593 [Released: November 01, 2023]
?? ?Added: Minor bug fixes and performance improvements.
https://help.electronic.us/support/solutions/articles/44001309944-what-s-new-in-this-version-for-windows

成品

Virtual Serial Port Driver 11.0.1047https://download.csdn.net/download/chivalrys/88714991 Serial to Ethernet Connector 9.0.1253https://download.csdn.net/download/chivalrys/88714990 USB Network Gate 10.0.2593https://download.csdn.net/download/chivalrys/88714979

Eltima端口虚拟化软件dll劫持hook授权https://download.csdn.net/download/chivalrys/88714978

文章来源:https://blog.csdn.net/chivalrys/article/details/135445575
本文来自互联网用户投稿，该文观点仅代表作者本人，不代表本站立场。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如若内容造成侵权/违法违规/事实不符，请联系我的编程经验分享网邮箱：chenni525@qq.com进行投诉反馈，一经查实，立即删除！