Elliptic License Framework 通用补丁

c_null

License Framework 源码地址：https://github.com/vslavik/ellipticlicense.git当前版本是0.1.1

正常来说，使用此授权框架的App都可以使用该补丁劫持。
以Ummy Video Downloader来说


它就用了这个授权框架。


一、先来看看要劫持的验证方法：

[Objective-C] 纯文本查看 复制代码

- (BOOL)verifyLicenseKey:(NSString *)licenseKey forName:(NSString *)name;
{
        if (!name || [name length] == 0)
                return NO;

        // Check if license key is blocked. Note that we use key without dashes
        if ([self isBlockedLicenseKey:licenseKey])
                return NO;
        
        ECDSA_SIG *signature = ECDSA_SIG_new();
        if (!signature)
                return NO;
        
        NSData *signatureData = [NSData el_dataWithBase32String:licenseKey];

        // Check length of signature before verifying
        if ([signatureData length] != digestLength * 2) {
                ECDSA_SIG_free(signature);
                return NO;
    }

        int partLen = (int)[signatureData length]/2;
        signature->r = BN_bin2bn([signatureData bytes], partLen, signature->r);
        signature->s = BN_bin2bn([signatureData bytes] + partLen, partLen, signature->s);
        if (!signature->r || !signature->s) {
                ECDSA_SIG_free(signature);
                return NO;                
        }

    uint8_t digest[digestLength];
    el_compute_digest([name UTF8String], digest, digestLength);

        BOOL result = ECDSA_do_verify(digest, digestLength, signature, ecKey);

        ECDSA_SIG_free(signature);
        return result;
}

直接让这个方法返回true就可以完成验证了。

二、劫持的代码，如下

[Objective-C] 纯文本查看 复制代码

#import "EllipticLicensePatch.h"

@implementation EllipticLicensePatch

-(char) verifyLicenseKey:key forName: name {
    NSLog(@"Patching verify method...");
    return 0x1;
}

+(void) load {
    NSLog(@"Applying elliptic license patch...");
    
    Method originMethod = class_getInstanceMethod(NSClassFromString(@"EllipticLicense"), NSSelectorFromString(@"verifyLicenseKey:forName:"));
    
    Method destMethod = class_getInstanceMethod([EllipticLicensePatch class], @selector(verifyLicenseKey:forName:));
    method_exchangeImplementations(originMethod, destMethod);
    NSLog(@"Applying elliptic license patch done! Enjoy it!");
}
@end

偷来的代码，哈哈哈

三、劫持的原理，可以参考：
https://developer.apple.com/lega ... es/man1/dyld.1.html

DYLD_INSERT_LIBRARIES
              This  is  a colon separated list of dynamic libraries to load before the ones specified in the
              program.  This lets you test new modules of existing dynamic shared libraries that are used in
              flat-namespace images by loading a temporary dynamic shared library with just the new modules.
              Note that this has no effect on images built a two-level  namespace  images  using  a  dynamic
              shared library unless DYLD_FORCE_FLAT_NAMESPACE is also used.

四、编写劫持脚本

[Shell] 纯文本查看 复制代码

#!/bin/bash
_PATH="`dirname "${0}"`"
while read _exec
do
        _FULL_PATH="$_PATH/$_exec"
        _BACKUP_FULL_PATH="$_FULL_PATH""-BAK"
        _UNDERLINE_FULL_PATH="$_FULL_PATH""_"
          if [ -e "$_FULL_PATH" ]
        then
                echo "$_FULL_PATH FOUND."
                cp "$_FULL_PATH" "$_BACKUP_FULL_PATH"
                echo ">>>>>Backup origin executable to $_BACKUP_FULL_PATH"
                sleep 0.5

                echo ">>>>>Rename origin executable to $_UNDERLINE_FULL_PATH"
                mv "$_FULL_PATH" "$_UNDERLINE_FULL_PATH"
                sleep 0.5

                echo ">>>>>Generate magic executable"
                touch "$_FULL_PATH"
                chmod +x "$_FULL_PATH"
                echo "#!/bin/bash" >> "$_FULL_PATH"
                echo "_PATH=\"\`dirname \"\${0}\"\`\"" >> "$_FULL_PATH"
                echo "_BIN=\"\`dirname \"\${0}\"\`\"/\""$_exec"_\"" >> "$_FULL_PATH"
                echo "export DYLD_INSERT_LIBRARIES=\"\${_PATH}/libEllipticLicensePatch.dylib\"" >> "$_FULL_PATH"
                echo "\"\$_BIN\"" >> "$_FULL_PATH"

                sleep 1
                echo "Executable file [$_FULL_PATH] has been patched! Enjoy it!"
        else
                echo "$_FULL_PATH NOT FOUND."
                echo "!!!!!PATCH FAILED!!!!!"
                exit
        fi
          exit
done < "${1:-/dev/stdin}"

这个脚本会生成最终的魔法文件。

五、使用方法

1、解压附件压缩包，拷贝libEllipticLicensePath.dylib和PatchIt两个文件至Contents/MacOS目录。
2、双击运行PatchIt，输入可执行文件的文件名，比如Ummy Video Downloader， 回车
3、程序自动备份原文件，并会生成同名的可执行脚本文件。劫持完成。
4、打开spotlight，输入程序名称，打开，程序已完成破解。



补丁工具： Elliptic License Patch Pack.zip (3.44 KB, 下载次数: 10)

2016-6-28 00:49 上传

点击文件名下载附件

0xcb

膜拜会shell script的 :D

zxxiaopi

感谢分享

c_null

0xcb 发表于 2016-6-28 10:10
膜拜会shell script的 :D

^_^，其实写个脚本的过程就是Google飞起的过程，各种查资料