Elliptic License Framework 通用补丁
本帖最后由 c_null 于 2016-6-28 12:51 编辑License Framework 源码地址：https://github.com/vslavik/ellipticlicense.git当前版本是0.1.1
正常来说，使用此授权框架的App都可以使用该补丁劫持。
以Ummy Video Downloader来说
它就用了这个授权框架。
一、先来看看要劫持的验证方法：
- (BOOL)verifyLicenseKey:(NSString *)licenseKey forName:(NSString *)name;
{
if (!name || == 0)
return NO;
// Check if license key is blocked. Note that we use key without dashes
if ()
return NO;
ECDSA_SIG *signature = ECDSA_SIG_new();
if (!signature)
return NO;
NSData *signatureData = ;
// Check length of signature before verifying
if ( != digestLength * 2) {
ECDSA_SIG_free(signature);
return NO;
}
int partLen = (int)/2;
signature->r = BN_bin2bn(, partLen, signature->r);
signature->s = BN_bin2bn( + partLen, partLen, signature->s);
if (!signature->r || !signature->s) {
ECDSA_SIG_free(signature);
return NO;
}
uint8_t digest;
el_compute_digest(, digest, digestLength);
BOOL result = ECDSA_do_verify(digest, digestLength, signature, ecKey);
ECDSA_SIG_free(signature);
return result;
}
直接让这个方法返回true就可以完成验证了。
二、劫持的代码，如下
#import "EllipticLicensePatch.h"
@implementation EllipticLicensePatch
-(char) verifyLicenseKey:key forName: name {
NSLog(@"Patching verify method...");
return 0x1;
}
+(void) load {
NSLog(@"Applying elliptic license patch...");
Method originMethod = class_getInstanceMethod(NSClassFromString(@"EllipticLicense"), NSSelectorFromString(@"verifyLicenseKey:forName:"));
Method destMethod = class_getInstanceMethod(, @selector(verifyLicenseKey:forName:));
method_exchangeImplementations(originMethod, destMethod);
NSLog(@"Applying elliptic license patch done! Enjoy it!");
}
@end
偷来的代码，哈哈哈
三、劫持的原理，可以参考：
https://developer.apple.com/lega ... es/man1/dyld.1.html
DYLD_INSERT_LIBRARIES
Thisisa colon separated list of dynamic libraries to load before the ones specified in the
program.This lets you test new modules of existing dynamic shared libraries that are used in
flat-namespace images by loading a temporary dynamic shared library with just the new modules.
Note that this has no effect on images built a two-levelnamespaceimagesusingadynamic
shared library unless DYLD_FORCE_FLAT_NAMESPACE is also used.
四、编写劫持脚本
#!/bin/bash
_PATH="`dirname "${0}"`"
while read _exec
do
_FULL_PATH="$_PATH/$_exec"
_BACKUP_FULL_PATH="$_FULL_PATH""-BAK"
_UNDERLINE_FULL_PATH="$_FULL_PATH""_"
if [ -e "$_FULL_PATH" ]
then
echo "$_FULL_PATH FOUND."
cp "$_FULL_PATH" "$_BACKUP_FULL_PATH"
echo ">>>>>Backup origin executable to $_BACKUP_FULL_PATH"
sleep 0.5
echo ">>>>>Rename origin executable to $_UNDERLINE_FULL_PATH"
mv "$_FULL_PATH" "$_UNDERLINE_FULL_PATH"
sleep 0.5
echo ">>>>>Generate magic executable"
touch "$_FULL_PATH"
chmod +x "$_FULL_PATH"
echo "#!/bin/bash" >> "$_FULL_PATH"
echo "_PATH=\"\`dirname \"\${0}\"\`\"" >> "$_FULL_PATH"
echo "_BIN=\"\`dirname \"\${0}\"\`\"/\""$_exec"_\"" >> "$_FULL_PATH"
echo "export DYLD_INSERT_LIBRARIES=\"\${_PATH}/libEllipticLicensePatch.dylib\"" >> "$_FULL_PATH"
echo "\"\$_BIN\"" >> "$_FULL_PATH"
sleep 1
echo "Executable file [$_FULL_PATH] has been patched! Enjoy it!"
else
echo "$_FULL_PATH NOT FOUND."
echo "!!!!!PATCH FAILED!!!!!"
exit
fi
exit
done < "${1:-/dev/stdin}"
这个脚本会生成最终的魔法文件。
五、使用方法
1、解压附件压缩包，拷贝libEllipticLicensePath.dylib和PatchIt两个文件至Contents/MacOS目录。
2、双击运行PatchIt，输入可执行文件的文件名，比如Ummy Video Downloader， 回车
3、程序自动备份原文件，并会生成同名的可执行脚本文件。劫持完成。
4、打开spotlight，输入程序名称，打开，程序已完成破解。
补丁工具：
膜拜会shell script的 :D 感谢分享 0xcb 发表于 2016-6-28 10:10
膜拜会shell script的 :D
^_^，其实写个脚本的过程就是Google飞起的过程，各种查资料
页:
[1]