123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425 |
- #include "PatchSolutions.hpp"
- #undef NKG_CURRENT_SOURCE_FILE
- #undef NKG_CURRENT_SOURCE_LINE
- #define NKG_CURRENT_SOURCE_FILE() TEXT(".\\navicat-patcher\\PatchSolution3-generic.cpp")
- #define NKG_CURRENT_SOURCE_LINE() __LINE__
- namespace nkg {
- const PatchSolution3::KeywordInfo PatchSolution3::Keyword[111] = {
- { { 0x4d, 0x49, 0x49 }, 3, STRING_DATA, false },
- { { 0x42, 0x49 }, 2, IMM_DATA, false },
- { { 0x6a }, 1, IMM_DATA, false },
- { { 0x41 }, 1, IMM_DATA, false },
- { { 0x4e, 0x42, 0x67, 0x6b }, 4, IMM_DATA, false },
- { { 0x71 }, 1, IMM_DATA, false },
- { { 0x68, 0x6b, 0x69, 0x47, 0x39, 0x77 }, 6, STRING_DATA, false },
- { { 0x30 }, 1, STRING_DATA, true },
- { { 0x42 }, 1, IMM_DATA, false },
- { { 0x41 }, 1, IMM_DATA, false },
- { { 0x51, 0x45, 0x46, 0x41, 0x41, 0x4f, 0x43 }, 7, STRING_DATA, false },
- { { 0x41, 0x51, 0x38, 0x41, 0x4d, 0x49 }, 6, STRING_DATA, false },
- { { 0x49, 0x42 }, 2, STRING_DATA, false },
- { { 0x43, 0x67, 0x4b, 0x43 }, 4, IMM_DATA, false },
- { { 0x41, 0x51 }, 2, STRING_DATA, false },
- { { 0x45, 0x41, 0x77, 0x31 }, 4, IMM_DATA, false },
- { { 0x64, 0x71, 0x46, 0x33 }, 4, IMM_DATA, false },
- { { 0x53 }, 1, STRING_DATA, true },
- { { 0x6b, 0x43, 0x61, 0x41, 0x41, 0x6d }, 6, STRING_DATA, false },
- { { 0x4d, 0x7a, 0x73, 0x38 }, 4, IMM_DATA, false },
- { { 0x38, 0x39, 0x49, 0x71 }, 4, IMM_DATA, false },
- { { 0x64 }, 1, IMM_DATA, false },
- { { 0x57 }, 1, IMM_DATA, false },
- { { 0x39, 0x4d, 0x32, 0x64 }, 4, IMM_DATA, false },
- { { 0x49, 0x64, 0x68 }, 3, STRING_DATA, false },
- { { 0x33, 0x6a }, 2, IMM_DATA, false },
- { { 0x47, 0x39, 0x79, 0x50 }, 4, IMM_DATA, false },
- { { 0x63, 0x6d }, 2, IMM_DATA, false },
- { { 0x4c }, 1, IMM_DATA, false },
- { { 0x6e, 0x6d, 0x4a }, 3, STRING_DATA, false },
- { { 0x69, 0x47, 0x70, 0x42, 0x46, 0x34, 0x45 }, 7, STRING_DATA, false },
- { { 0x39, 0x56, 0x48, 0x53, 0x4d, 0x47 }, 6, STRING_DATA, false },
- { { 0x65, 0x38, 0x6f, 0x50, 0x41, 0x79, 0x32, 0x6b }, 8, STRING_DATA, false },
- { { 0x4a, 0x44 }, 2, STRING_DATA, false },
- { { 0x6d, 0x64 }, 2, IMM_DATA, false },
- { { 0x4e, 0x74, 0x34 }, 3, STRING_DATA, false },
- { { 0x42, 0x63, 0x45, 0x79, 0x67, 0x76 }, 6, STRING_DATA, false },
- { { 0x73, 0x73, 0x45, 0x66, 0x67, 0x69 }, 6, STRING_DATA, false },
- { { 0x6e, 0x76, 0x61, 0x35, 0x74 }, 5, STRING_DATA, false },
- { { 0x35, 0x6a, 0x6d, 0x33, 0x35, 0x32 }, 6, STRING_DATA, false },
- { { 0x55, 0x41 }, 2, IMM_DATA, false },
- { { 0x6f, 0x44, 0x6f, 0x73 }, 4, IMM_DATA, false },
- { { 0x55, 0x4a }, 2, IMM_DATA, false },
- { { 0x6b, 0x54, 0x58, 0x47, 0x51 }, 5, STRING_DATA, false },
- { { 0x68, 0x70, 0x41, 0x57, 0x4d, 0x46 }, 6, STRING_DATA, false },
- { { 0x34, 0x66, 0x42, 0x6d, 0x42 }, 5, STRING_DATA, false },
- { { 0x70, 0x4f, 0x33, 0x45 }, 4, IMM_DATA, false },
- { { 0x65, 0x64 }, 2, IMM_DATA, false },
- { { 0x47 }, 1, IMM_DATA, false },
- { { 0x36, 0x32, 0x72, 0x4f, 0x73, 0x71 }, 6, STRING_DATA, false },
- { { 0x4d }, 1, IMM_DATA, false },
- { { 0x42, 0x67, 0x6d, 0x53 }, 4, STRING_DATA, false },
- { { 0x64 }, 1, IMM_DATA, false },
- { { 0x41, 0x79, 0x78, 0x43, 0x53 }, 5, STRING_DATA, false },
- { { 0x50 }, 1, IMM_DATA, false },
- { { 0x42, 0x52, 0x4a, 0x49, 0x4f }, 5, STRING_DATA, false },
- { { 0x46, 0x52, 0x30, 0x51, 0x67, 0x5a, 0x46, 0x62 }, 8, STRING_DATA, false },
- { { 0x52 }, 1, IMM_DATA, false },
- { { 0x6e, 0x55, 0x30, 0x66 }, 4, STRING_DATA, false },
- { { 0x72, 0x6a, 0x33, 0x34 }, 4, IMM_DATA, false },
- { { 0x66 }, 1, STRING_DATA, true },
- { { 0x69, 0x56, 0x6d, 0x67 }, 4, IMM_DATA, false },
- { { 0x59, 0x69, 0x4c, 0x75 }, 4, STRING_DATA, false },
- { { 0x5a, 0x53, 0x41, 0x6d }, 4, IMM_DATA, false },
- { { 0x49, 0x62 }, 2, IMM_DATA, false },
- { { 0x73 }, 1, IMM_DATA, false },
- { { 0x38, 0x5a, 0x78, 0x69 }, 4, IMM_DATA, false },
- { { 0x48 }, 1, IMM_DATA, false },
- { { 0x50, 0x64, 0x70, 0x31 }, 4, IMM_DATA, false },
- { { 0x6f, 0x44 }, 2, IMM_DATA, false },
- { { 0x34 }, 1, IMM_DATA, false },
- { { 0x74, 0x55, 0x70, 0x76, 0x73, 0x46 }, 6, STRING_DATA, false },
- { { 0x63, 0x69, 0x34, 0x51, 0x4a, 0x74 }, 6, STRING_DATA, false },
- { { 0x59, 0x4e, 0x6a, 0x4e, 0x6e, 0x47, 0x55 }, 7, STRING_DATA, false },
- { { 0x32, 0x57, 0x50, 0x48 }, 4, STRING_DATA, false },
- { { 0x36, 0x72, 0x76, 0x43, 0x68, 0x47, 0x6c }, 7, STRING_DATA, false },
- { { 0x31, 0x49, 0x52, 0x4b, 0x72, 0x78, 0x4d, 0x74 }, 8, STRING_DATA, false },
- { { 0x71, 0x4c, 0x69, 0x65, 0x6c }, 5, STRING_DATA, false },
- { { 0x73, 0x76, 0x61, 0x6a, 0x55, 0x6a, 0x79, 0x72 }, 8, STRING_DATA, false },
- { { 0x67 }, 1, STRING_DATA, true },
- { { 0x4f, 0x43, 0x36, 0x4e, 0x6d, 0x79, 0x6d, 0x59 }, 8, STRING_DATA, false },
- { { 0x4d }, 1, IMM_DATA, false },
- { { 0x76, 0x5a, 0x4e }, 3, STRING_DATA, false },
- { { 0x45, 0x52, 0x33, 0x68, 0x74 }, 5, STRING_DATA, false },
- { { 0x46 }, 1, IMM_DATA, false },
- { { 0x45, 0x74, 0x4c, 0x31 }, 4, STRING_DATA, false },
- { { 0x65, 0x51, 0x62, 0x43, 0x79 }, 5, STRING_DATA, false },
- { { 0x54, 0x66, 0x44, 0x6d, 0x74, 0x59, 0x79, 0x51 }, 8, STRING_DATA, false },
- { { 0x31, 0x57, 0x74, 0x34 }, 4, STRING_DATA, false },
- { { 0x4f }, 1, IMM_DATA, false },
- { { 0x74, 0x31, 0x32, 0x6c, 0x78, 0x66 }, 6, STRING_DATA, false },
- { { 0x30 }, 1, IMM_DATA, false },
- { { 0x77, 0x56, 0x49, 0x52, 0x35 }, 5, STRING_DATA, false },
- { { 0x6d }, 1, IMM_DATA, false },
- { { 0x63, 0x47, 0x4e, 0x37 }, 4, STRING_DATA, false },
- { { 0x58, 0x43, 0x58, 0x4a }, 4, STRING_DATA, false },
- { { 0x52, 0x48, 0x4f, 0x46 }, 4, IMM_DATA, false },
- { { 0x48, 0x53 }, 2, IMM_DATA, false },
- { { 0x66 }, 1, IMM_DATA, false },
- { { 0x31, 0x67, 0x7a, 0x58, 0x57 }, 5, STRING_DATA, false },
- { { 0x61 }, 1, IMM_DATA, false },
- { { 0x62 }, 1, IMM_DATA, false },
- { { 0x52, 0x53 }, 2, STRING_DATA, false },
- { { 0x76, 0x6d, 0x74, 0x31, 0x6e }, 5, STRING_DATA, false },
- { { 0x72, 0x6c }, 2, STRING_DATA, true },
- { { 0x37, 0x73, 0x57 }, 3, STRING_DATA, false },
- { { 0x36, 0x63, 0x6a }, 3, STRING_DATA, false },
- { { 0x78, 0x6c, 0x6a, 0x75, 0x75, 0x51, 0x61 }, 7, STRING_DATA, false },
- { { 0x77, 0x49, 0x44, 0x41 }, 4, STRING_DATA, false },
- { { 0x51, 0x41 }, 2, IMM_DATA, false },
- { { 0x42 }, 1, IMM_DATA, false }
- };
- [[nodiscard]]
- bool PatchSolution3::IsPrintable(const void* p, size_t s) noexcept {
- auto pb = reinterpret_cast<const uint8_t*>(p);
- for (size_t i = 0; i < s; ++i) {
- if (isprint(pb[i]) == false) {
- return false;
- }
- }
- return true;
- }
- [[nodiscard]]
- CapstoneContext PatchSolution3::GetJumpedBranch(const CapstoneContext& NotJumpedBranch, const cs_insn* lpJxxInsn) const {
- CapstoneContext JumpedBranch;
- JumpedBranch.lpMachineCode = _Image.RvaToPointer<const void*>(
- static_cast<uintptr_t>(lpJxxInsn->detail->x86.operands[0].imm)
- );
- JumpedBranch.cbMachineCode = NotJumpedBranch.cbMachineCode - (
- reinterpret_cast<const uint8_t*>(JumpedBranch.lpMachineCode) -
- reinterpret_cast<const uint8_t*>(NotJumpedBranch.lpMachineCode)
- );
- JumpedBranch.Address = lpJxxInsn->detail->x86.operands[0].imm;
- return JumpedBranch;
- }
- [[nodiscard]]
- CapstoneContext PatchSolution3::SelectBranch(const CapstoneContext& NotJumpedBranch, const CapstoneContext& JumpedBranch, size_t KeywordIdx) const {
- CapstoneContext A = NotJumpedBranch;
- CapstoneContext B = JumpedBranch;
- int WeightA = 0;
- int WeightB = 0;
- auto Disassembler = _Engine.CreateDisassembler();
- while (true) {
- int WeightAPrev = WeightA;
- int WeightBPrev = WeightB;
-
-
-
- Disassembler.SetContext(A);
- while (Disassembler.Next()) {
- auto lpInsn = Disassembler.GetInstruction();
-
-
-
-
- if (lpInsn->mnemonic[0] == 'j' || lpInsn->mnemonic[0] == 'J') {
- auto JumpedBranch = GetJumpedBranch(Disassembler.GetContext(), lpInsn);
- if (_stricmp(lpInsn->mnemonic, "jmp") == 0) {
- Disassembler.SetContext(JumpedBranch);
- } else {
- try {
- Disassembler.SetContext(SelectBranch(Disassembler.GetContext(), JumpedBranch, KeywordIdx));
- } catch (nkg::Exception&) {
-
- break;
- }
- }
- } else if (_stricmp(lpInsn->mnemonic, "ret") == 0) {
- return JumpedBranch;
- } else {
- if (CheckIfMatchPattern(lpInsn) == false) {
- continue;
- }
-
-
-
-
- if (CheckIfFound(lpInsn, KeywordIdx) == false) {
- return JumpedBranch;
- }
-
-
-
-
- ++WeightA;
- break;
- }
- }
- A = Disassembler.GetContext();
-
-
-
- Disassembler.SetContext(B);
- while (Disassembler.Next()) {
- auto lpInsn = Disassembler.GetInstruction();
-
-
-
-
- if (lpInsn->mnemonic[0] == 'j' || lpInsn->mnemonic[0] == 'J') {
- auto JumpedBranch = GetJumpedBranch(Disassembler.GetContext(), lpInsn);
- if (_stricmp(lpInsn->mnemonic, "jmp") == 0) {
- Disassembler.SetContext(JumpedBranch);
- } else {
- try {
- Disassembler.SetContext(SelectBranch(Disassembler.GetContext(), JumpedBranch, KeywordIdx));
- } catch (nkg::Exception&) {
-
- break;
- }
- }
- } else if (_stricmp(lpInsn->mnemonic, "ret") == 0) {
- return NotJumpedBranch;
- } else {
- if (CheckIfMatchPattern(lpInsn) == false) {
- continue;
- }
-
-
-
-
- if (CheckIfFound(lpInsn, KeywordIdx) == false) {
- return NotJumpedBranch;
- }
-
-
-
-
- ++WeightB;
- break;
- }
- }
- B = Disassembler.GetContext();
-
-
- if (WeightAPrev == WeightA && WeightBPrev == WeightB) {
- throw nkg::Exception(NKG_CURRENT_SOURCE_FILE(), NKG_CURRENT_SOURCE_LINE(), TEXT("Branch is not selected."));
- }
- if (WeightA != WeightB)
- return WeightA > WeightB ? NotJumpedBranch : JumpedBranch;
- else
- ++KeywordIdx;
- }
- }
- [[nodiscard]]
- bool PatchSolution3::CheckKey(const RSACipher& Cipher) const noexcept {
-
-
-
- auto SearchString = [](const void* lpRange, size_t cbRange, const char* lpString, size_t cchString) -> const char* {
- const char* p = reinterpret_cast<const char*>(lpRange);
- for (size_t i = 0; i < cbRange; ++i) {
- if (p[i] == lpString[0]) {
- bool match = true;
- __try {
- for (size_t j = 1; j < cchString; ++j) {
- if (p[i + j] != lpString[j]) {
- match = false;
- break;
- }
- }
- } __except (EXCEPTION_EXECUTE_HANDLER) {
- match = false;
- }
- if (match && p[i + cchString] == '\x00')
- return address_offset_cast<const char*>(lpRange, i);
- }
- }
- return nullptr;
- };
- auto szPublicKey = Cipher.ExportKeyString<RSAKeyType::PublicKey, RSAKeyFormat::PEM>();
- for (auto pos = szPublicKey.find("-----BEGIN PUBLIC KEY-----"); pos != std::string::npos; pos = szPublicKey.find("-----BEGIN PUBLIC KEY-----", pos)) {
- szPublicKey.erase(pos, literal_length("-----BEGIN PUBLIC KEY-----"));
- }
- for (auto pos = szPublicKey.find("-----END PUBLIC KEY-----"); pos != std::string::npos; pos = szPublicKey.find("-----END PUBLIC KEY-----", pos)) {
- szPublicKey.erase(pos, literal_length("-----END PUBLIC KEY-----"));
- }
- for (auto pos = szPublicKey.find("\n"); pos != std::string::npos; pos = szPublicKey.find("\n", pos)) {
- szPublicKey.erase(pos, literal_length("\n"));
- }
- if (szPublicKey.length() != 0x188) {
- return false;
- }
- size_t PublicKeyReadCursor = 0;
- auto SectionHeader_rdata = _Image.ImageSectionHeaderByName(".rdata");
- auto SectionView_rdata = _Image.ImageSectionView(SectionHeader_rdata);
-
- for (size_t i = 0; i < _countof(_Patch); PublicKeyReadCursor += Keyword[i].Size, ++i) {
- if (Keyword[i].NotRecommendedToModify) {
- _Patch[i].lpReplaceString = nullptr;
- const char* lpReplaceString = nullptr;
- const void* lpSearchRange = _Patch[i].lpOriginalString;
- size_t cbSearchRange = SectionHeader_rdata->SizeOfRawData - address_delta(_Patch[i].lpOriginalString, SectionView_rdata);
- for (size_t offset = 0;;) {
- lpReplaceString = SearchString(
- address_offset(lpSearchRange, offset),
- cbSearchRange - offset,
- szPublicKey.c_str() + PublicKeyReadCursor,
- Keyword[i].Size
- );
- if (lpReplaceString == nullptr) {
- return false;
- }
- if (_Image.IsRvaRangeInRelocTable(_Image.PointerToRva(lpReplaceString), Keyword[i].Size + 1)) {
-
-
-
-
-
- ++offset;
- } else {
-
-
-
-
- break;
- }
- }
- _Patch[i].lpReplaceString = const_cast<char*>(lpReplaceString);
- }
- }
- return true;
- }
- void PatchSolution3::MakePatch(const RSACipher& Cipher) const {
- for (size_t i = 0; i < _countof(_Patch); ++i) {
- if (_Patch[i].lpPatch == nullptr) {
- throw Exception(NKG_CURRENT_SOURCE_FILE(), NKG_CURRENT_SOURCE_LINE(), TEXT("PatchSolution3 has not been ready yet."));
- }
- }
- auto szPublicKey = Cipher.ExportKeyString<RSAKeyType::PublicKey, RSAKeyFormat::PEM>();
- for (auto pos = szPublicKey.find("-----BEGIN PUBLIC KEY-----"); pos != std::string::npos; pos = szPublicKey.find("-----BEGIN PUBLIC KEY-----", pos)) {
- szPublicKey.erase(pos, literal_length("-----BEGIN PUBLIC KEY-----"));
- }
- for (auto pos = szPublicKey.find("-----END PUBLIC KEY-----"); pos != std::string::npos; pos = szPublicKey.find("-----END PUBLIC KEY-----", pos)) {
- szPublicKey.erase(pos, literal_length("-----END PUBLIC KEY-----"));
- }
- for (auto pos = szPublicKey.find("\n"); pos != std::string::npos; pos = szPublicKey.find("\n", pos)) {
- szPublicKey.erase(pos, literal_length("\n"));
- }
- _putts(TEXT("*******************************************************"));
- _putts(TEXT("* PatchSolution3 *"));
- _putts(TEXT("*******************************************************"));
- size_t readptr = 0;
- for (size_t i = 0; i < _countof(_Patch); readptr += Keyword[i].Size, ++i) {
- _tprintf_s(TEXT("[*] +%.8zx: "), address_delta(_Patch[i].lpPatch, _Image.ImageBase()));
- PrintBytes(_Patch[i].lpPatch, _Patch[i].cbPatch);
- _tprintf_s(TEXT(" ---> "));
- if (Keyword[i].NotRecommendedToModify) {
- auto offset = _Patch[i].lpReplaceString - _Patch[i].lpOriginalString;
- uint64_t disp = 0;
- memcpy(&disp, _Patch[i].lpPatch, _Patch[i].cbPatch);
- disp += offset;
- memcpy(_Patch[i].lpPatch, &disp, _Patch[i].cbPatch);
- } else {
- memcpy(_Patch[i].lpPatch, szPublicKey.c_str() + readptr, Keyword[i].Size);
- }
- PrintBytes(_Patch[i].lpPatch, _Patch[i].cbPatch);
- _tprintf_s(TEXT("\n"));
- }
- _putts(TEXT(""));
- return;
- }
- }
|