看看激活过程系统做了些什么东西
hResult = SLActivateProduct(hSLC, ref bSkuId, null, null, null, null, 0);
关联API及函数:
WINHTTP.DLL WinHttpCrackUrl WinHttpOpen inHttpGetDefaultProxyConfiguration WinHttpSetTimeouts WinHttpConnect WinHttpOpenRequest WinHttpCreateUrl WinHttpSetOption WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpCrackUrl WinHttpCloseHandle WinHttpSendRequest WinHttpAddRequestHeaders WinHttpCreateUrl WinHttpSetStatusCallback WinHttpGetProxyForUrlEx2 WinHttpFreeProxyResultEx WinHttpReceiveResponse WinHttpQueryHeaders WinHttpReadData
大致应该是这样(密钥激活过程):加密密钥及硬件等信息，利用httprequest post这些信息到指定网址,如果错误返回错误代码,如果正确返回合法licenseID. 将这些信息存储到SSL Store.Windows调用一系列算法如果该license对应的各种信息是合法就激活系统。
经过拦截WinHttpOpen找到sppcext.dll中的调用加密密钥数据后调用httprequest的关键部分,这样可以不通过安装密钥的模式直接通过sppcext.dll获取错误代码.
.text:572CCD4B lea eax, [ebp-0ACh] .text:572CCD51 mov edx, esi ; pSKUId .text:572CCD53 push eax ; ActivationInfo .text:572CCD54 mov ecx, ebx ; hSLCs .text:572CCD56 call GetEncryptKey ; 第一层 .text:572CCD5B ; 232: *(_DWORD *)Data = hGet; .text:572CCD5B mov [ebp-70h], eax text:572CAFC1 push [ebp+ActivationInfo] ; ActivationInfo .text:572CAFC4 mov edx, [ebp+pSKUID] ; skuid .text:572CAFC7 mov ecx, [ebp+hslc] ; hSlc .text:572CAFCA ; 51: int_1 = 1; .text:572CAFCA mov [ebp+int_1], 1 .text:572CAFD1 call geterrercode ; 第二层 .text:572CAFD6 ; 53: hSLpSetActivationInProgress = hErrorcode; .text:572CAFD6 mov ebx, eax .text:572CA8AF push eax .text:572CA8B0 call GetResult ; 第三层 .text:572CA8B5 mov esi, eax .text:572CA125 push [ebp+lpMem] ; int .text:572CA128 lea edx, [esi+64h] .text:572CA12B push [ebp+var_C] ; int .text:572CA12E push eax ; psz .text:572CA12F push ecx ; int .text:572CA130 push edx ; int .text:572CA131 mov ecx, esi .text:572CA133 call GetRes ; 第四层 .text:572CA138 mov [esi+60h], eax .text:572CA13B ; 107: sub_572C8E58(0); .text:572CA13B xor ecx, ecxvoid *__fastcall GetEncryptKey(int hSLCs, SLID *pSKUId, int ActivationInfo) { char *v3; // esi void *v4; // ecx char *v5; // edi void *hSLpSetActivationInProgress; // ebx void *hGetProductSku; // eax void *v8; // eax void *v9; // eax void *hErrorcode; // eax char v12; // [esp+10h] [ebp-2Ch] BYTE pbValue[4]; // [esp+14h] [ebp-28h] int a3a; // [esp+18h] [ebp-24h] int v15; // [esp+1Ch] [ebp-20h] int v16; // [esp+20h] [ebp-1Ch] int int_1; // [esp+24h] [ebp-18h] int v18; // [esp+28h] [ebp-14h] char *v19; // [esp+2Ch] [ebp-10h] char *v20; // [esp+30h] [ebp-Ch] int hslc; // [esp+34h] [ebp-8h] SLID *pSKUID; // [esp+38h] [ebp-4h] int savedregs; // [esp+3Ch] [ebp+0h] hslc = hSLCs; v3 = 0; v16 = 0; v4 = *(void **)(ActivationInfo + 12); v5 = 0; v15 = 0; int_1 = 0; pSKUID = pSKUId; v19 = 0; v20 = 0; hSLpSetActivationInProgress = (void *)sub_55C06B08(v4, &v18); if ( (signed int)hSLpSetActivationInProgress < 0 ) goto LABEL_2; hGetProductSku = (void *)GetProductSkuInformation(hslc, (int)pSKUID, &a3a); hSLpSetActivationInProgress = hGetProductSku; if ( (signed int)hGetProductSku < 0 ) { sub_55C08E2B(hGetProductSku); sub_55C21625(dword_55BEF908, &unk_55C4C738); goto LABEL_22; } if ( !a3a ) { if ( v18 ) goto LABEL_22; hSLpSetActivationInProgress = (void *)SLpSetActivationInProgress(hslc, pSKUID); if ( (signed int)hSLpSetActivationInProgress >= 0 ) { int_1 = 1; hErrorcode = (void *)geterrercode((int)pSKUID, hslc, (int)&savedregs, 0, 0, ActivationInfo); hSLpSetActivationInProgress = hErrorcode; if ( (signed int)hErrorcode >= 0 ) goto LABEL_21; sub_55C08E2B(hErrorcode); sub_55C21348(&dword_55C03228, &unk_55C4BC00); LABEL_20: if ( !int_1 ) goto LABEL_22; goto LABEL_21; } goto LABEL_2; } if ( v18 ) { *(_DWORD *)pbValue = 1; hSLpSetActivationInProgress = (void *)SLSetGenuineInformation( pSKUID, L"SL_ACTIVATION_VALIDATION_IN_PROGRESS", SL_DATA_DWORD, 4u, pbValue); if ( (signed int)hSLpSetActivationInProgress >= 0 ) goto LABEL_11; LABEL_2: sub_55C08E2B(hSLpSetActivationInProgress); goto LABEL_22; } hSLpSetActivationInProgress = (void *)SLpSetActivationInProgress(hslc, pSKUID); sub_55C20DA2(&dword_55C022C0, &unk_55C4C4D0); if ( (signed int)hSLpSetActivationInProgress < 0 ) goto LABEL_2; int_1 = 1; v8 = (void *)sub_55C0AB42(hslc, pSKUID, ActivationInfo); hSLpSetActivationInProgress = v8; if ( (signed int)v8 >= 0 ) { LABEL_11: hSLpSetActivationInProgress = (void *)sub_55C0AD04(&v19, &v20); if ( (signed int)hSLpSetActivationInProgress < 0 || (hSLpSetActivationInProgress = (void *)SLOpen(&v16), (signed int)hSLpSetActivationInProgress < 0) ) { sub_55C08E2B(hSLpSetActivationInProgress); v3 = v19; v5 = v20; } else { v5 = v20; v3 = v19; v9 = (void *)sub_55C1ED09(v19, v20, 0, pSKUID, v18 == 0 ? ActivationInfo : 0, 1, &v15, &v12); hSLpSetActivationInProgress = v9; if ( (signed int)v9 < 0 ) sub_55C08E2B(v9); } goto LABEL_20; } sub_55C08E2B(v8); LABEL_21: SLpClearActivationInProgress(hslc, pSKUID); LABEL_22: sub_55C08E58(hSLpSetActivationInProgress); sub_55C0B09C(&v15); if ( v5 ) { sub_55C08F07(v5); sub_55C2107D(&dword_55C0371C, &unk_55C4B99C); } if ( v3 ) sub_55C08F07(v3); sub_55C0B049(&v16); return hSLpSetActivationInProgress; }主要就一处,只要从外部找到这个函数(因为不是输出函数,只能通过基地址加函数入口地址的偏移量定位),直接就可以调用这个函数获取错误代码:
hErrorcode = (void *)geterrercode(hslc,(int)pSKUID, (int)&savedregs, 0, 0, ActivationInfo);以32位的10.0.18362.1为例,比如dll的入口地址为0x10000000,该函数的地址为0x1002A791,偏移量为0x2A791.如果不会算可以找个已有的输出函数做为中间值计算.
public enum SL_ACTIVATION_TYPE { SL_ACTIVATION_TYPE_DEFAULT, SL_ACTIVATION_TYPE_ACTIVE_DIRECTORY } public struct SL_ACTIVATION_INFO_HEADER { public uint cbSize; public SL_ACTIVATION_TYPE type; } public struct SL_AD_ACTIVATION_INFO { public SL_ACTIVATION_INFO_HEADER header; public string pwszProductKey; public string pwszActivationObjectName; } [UnmanagedFunctionPointer(CallingConvention.Cdecl)] private delegate int GetErrerCode(ref SLID pProductSkuId, IntPtr hSLC, IntPtr unknown, int unk1, int unk2, SL_ACTIVATION_INFO_HEADER pActivationInfo); //第三个参数具体不详,可能会引起内存写入异常 RetID = PidGenX(Keys, pkeyfilePath, "XXXXX", 0, PID, DPID3, DPID4); if (RetID == 0) { DigitalProductId3 pid3 = (DigitalProductId3)Marshal.PtrToStructure(DPID3, typeof(DigitalProductId3)); DigitalProductId4 pid4 = (DigitalProductId4)Marshal.PtrToStructure(DPID4, typeof(DigitalProductId4)); string szActivationId = Encoding.Unicode.GetString(pid4.szActivationId).Replace("\0", ""); Guid GuidSkuId = new Guid(szActivationId); IntPtr hSLC = new IntPtr(); int hResult = SLOpen(ref hSLC); if (hResult == 0) { hResult = SLpSetActivationInProgress( hSLC, ref GuidSkuId); if (hResult==0) { IntPtr pDll = LoadLibrary("sppcext.dll"); if (pDll != IntPtr.Zero) { var hMod = GetModuleHandle("sppcext"); if (hMod == IntPtr.Zero) { Console.WriteLine(Marshal.GetLastWin32Error()); } var pGetErrerCode = hMod + 0x2A791; GetErrerCode GetErrerCodeFunc = (GetErrerCode)Marshal.GetDelegateForFunctionPointer(pGetErrerCode, typeof(GetErrerCode)); IntPtr Values = Marshal.AllocHGlobal(128); var hErrorCode = GetErrerCodeFunc(ref GuidSkuId, hSLC, Values, 0, 0, value); if (hErrorCode != 0) { Console.WriteLine(hResult.ToString()); } else { Console.WriteLine("在线密钥"); } bool hFree = FreeLibrary(pDll); Marshal.FreeHGlobal(Values); } } hResult = SLpClearActivationInProgress(hSLC, GuidSkuId.ToByteArray()); } } }64位dll:
.text:00007FF9B03DD380 lea r8, [rsp+180h+ptr] ; ptr .text:00007FF9B03DD385 mov rdx, r14 ; pProductSkuId .text:00007FF9B03DD388 mov rcx, r15 ; hSLC .text:00007FF9B03DD38B call GetResult ; 第一层 .text:00007FF9B03DD390 ; 290: hrCode = hRes; .text:00007FF9B03DD390 mov [rsp+180h+hrCode], eax hRes = GetResult(hSLC, pProductSkuId, (__int64)&ptr);// 第一层 偏移地址RVA=0xAA4C .text:00007FF9B03DAC43 mov r8, r13 ; activateinfo .text:00007FF9B03DAC46 ; 77: v36 = 1; .text:00007FF9B03DAC46 mov [rbp+arg_10], 1 .text:00007FF9B03DAC4D mov rdx, r14 ; SKUID .text:00007FF9B03DAC50 mov rcx, r15 ; hSLC .text:00007FF9B03DAC53 call GetRes ; 第二层 hResult = GetRes(SLC, SKUID, intptr); // 第二层 偏移地址RVA=0xA1D4 .text:00007FF9BE4CA24A ; 47: res = VertifyKey(slc, pSKUID, 1, (_DWORD **)activateinfo, (__int64)&int128); .text:00007FF9BE4CA24A lea rax, [rsp+130h+int128] .text:00007FF9BE4CA24F mov r9, rsi .text:00007FF9BE4CA252 mov r8d, 1 .text:00007FF9BE4CA258 mov [rsp+130h+var_110], rax .text:00007FF9BE4CA25D ; 44: v5 = sub_7FF9BE4C45D0(v4); .text:00007FF9BE4CA25D mov rdx, rdi .text:00007FF9BE4CA260 mov rcx, r14 .text:00007FF9BE4CA263 call VertifyKey ; 调用SLpGetLicenseAcquisitionInfo,该函数必须返回0值 res = VertifyKey(slc, pSKUID, 1, (_DWORD **)activateinfo, (__int64)&int128); ... .text:00007FF9B03DA33C mov rax, [rbp+30h+var_B0] .text:00007FF9B03DA340 lea rcx, [rsi+28h] ; slc .text:00007FF9B03DA344 ; 76: Dst = v19; .text:00007FF9B03DA344 mov [rbp+30h+Dst], rax .text:00007FF9B03DA348 lea r8, [rbp+30h+Dst] ; a3 .text:00007FF9B03DA34C mov rax, [rbp+30h+var_A0] .text:00007FF9B03DA350 mov rdx, r14 ; skuid .text:00007FF9B03DA353 ; 77: v27 = v20; .text:00007FF9B03DA353 mov [rbp+30h+var_38], rax .text:00007FF9B03DA357 ; 78: v28 = v21; .text:00007FF9B03DA357 mov eax, [rbp+30h+var_98] .text:00007FF9B03DA35A mov [rbp+30h+var_30], eax .text:00007FF9B03DA35D call activateinfo ; 第三层 errorcode = ::activateinfo((_DWORD *)pActivateinfo + 10, slc, (__int64)&Dst); 偏移地址RVA=0x95D4 .text:00007FF9A9E896A3 loc_7FF9A9E896A3: ; CODE XREF: activateinfo+C1↑j .text:00007FF9A9E896A3 mov r9d, [rbp+40h+var_C0] .text:00007FF9A9E896A7 lea rax, [rbp+40h+var_A0] .text:00007FF9A9E896AB mov r8, [rbp+40h+var_90] .text:00007FF9A9E896AF mov rdx, r13 .text:00007FF9A9E896B2 mov [rsp+140h+var_108], rax .text:00007FF9A9E896B7 mov rcx, r12 .text:00007FF9A9E896BA lea rax, [rbp+40h+var_A8] .text:00007FF9A9E896BE mov [rsp+140h+var_110], rax .text:00007FF9A9E896C3 lea rax, [rsp+140h+var_FC] .text:00007FF9A9E896C8 mov [rsp+140h+var_118], rax .text:00007FF9A9E896CD lea rax, [rbp+40h+var_B0] .text:00007FF9A9E896D1 mov [rsp+140h+var_120], rax .text:00007FF9A9E896D6 call httprequest ; 发送请求数据 ... .text:00007FF9A9E8978F loc_7FF9A9E8978F: ; CODE XREF: activateinfo+164↑j .text:00007FF9A9E8978F ; activateinfo+195↑j .text:00007FF9A9E8978F mov r8, [r13+18h] .text:00007FF9A9E89793 mov rdx, [r13+20h] .text:00007FF9A9E89797 ; 142: v11 = sub_7FF9B08E8668(v5); .text:00007FF9A9E89797 .text:00007FF9A9E89797 loc_7FF9A9E89797: ; CODE XREF: activateinfo+1AB↑j .text:00007FF9A9E89797 mov r9d, [rsp+140h+var_FC] .text:00007FF9A9E8979C mov rcx, rbx .text:00007FF9A9E8979F mov [rsp+140h+var_120], rdi .text:00007FF9A9E897A4 call post ;通过POST获取错误代码 ... .text:00007FF9B03D9829 loc_7FF9B03D9829: ; CODE XREF: activateinfo+21A↑j .text:00007FF9B03D9829 test rax, rax .text:00007FF9B03D982C mov r8d, r12d .text:00007FF9B03D982F ; 159: if ( v17 ) .text:00007FF9B03D982F cmovnz r9, rax .text:00007FF9B03D9833 mov rax, [r13+58h] .text:00007FF9B03D9837 mov edx, [rax+0Ch] .text:00007FF9B03D983A call Get ; 第四层 Get(v14, *(unsigned int *)(*(_QWORD *)(v4 + 88) + 12i64), (unsigned int)RESULTS, v16, v6);// 第四层 ```c 拿第二层的这个函数测试下: ```c# [UnmanagedFunctionPointer(CallingConvention.Cdecl)] private delegate int GetResult(IntPtr hSLC, ref SLID pProductSkuId, byte[] pActivationInfo); Guid GuidSkuId = new Guid(szActivationId); IntPtr hSLC = new IntPtr(); int hResult = SLOpen(ref hSLC); if (hResult == 0) { hResult = SLpSetActivationInProgress( hSLC, ref GuidSkuId); if (hResult==0) { IntPtr pDll = LoadLibrary("sppcext.dll"); if (pDll != IntPtr.Zero) { var hMod = GetModuleHandle("sppcext"); if (hMod == IntPtr.Zero) { Console.WriteLine(Marshal.GetLastWin32Error()); } var pGetResult = hMod + 0xA1D4; GetResult GetResultFunc = (GetResult)Marshal.GetDelegateForFunctionPointer(pGetResult, typeof(GetResult)); byte[] Activatinfo = new byte[64]; var hErrorCode = GetResultFunc(hSLC, ref GuidSkuId, value); if (hErrorCode != 0) { Console.WriteLine(hResult.ToString()); } else { Console.WriteLine("在线密钥"); } bool hFree = FreeLibrary(pDll); } } hResult = SLpClearActivationInProgress(hSLC, GuidSkuId.ToByteArray()); } }
