mirror of
https://github.com/encounter/ghidra-cli.git
synced 2026-07-10 03:18:56 -07:00
86 lines
8.2 KiB
Plaintext
86 lines
8.2 KiB
Plaintext
|
+
|
|||
|
|
ˆ"wiÔ ã óØ € R t ^ RItRtRtRtRtRtRtRtR R
|
|||
|
|
lt R R lt
|
|||
|
|
R
|
|||
|
|
R lt R R lt R R lt
|
|||
|
|
R R ltR t]R8X d( ^ RIt]P$ ! ]! 4 ;' g ^ 4 R# R# )z;Keygen for Ragnarok.exe crackme based on bytecode analysis.Nl Å 9 i“ imNÆAi90 l ¾:ýßL¸ l ÿÿÿÿ l ÿÿ c ó0 € V ^8„ d QhR\ R\ /# ©é ÚusernameÚreturn)ÚstrÚint)Úformats "Ú./home/kiselev/git/ghidra-cli/crackme/keygen.pyÚ __annotate__r s € ÷ ñ œð ¤ñ ó c ót € \ pV F+ p\ V4 V, \ , \ , pK- V# )zrCompute FNV-1a hash of username.
|
|||
|
|
|
|||
|
|
Binary does: hash = (byte ^ hash) * prime
|
|||
|
|
Note the XOR happens BEFORE multiply.
|
|||
|
|
)ÚFNV_INITÚordÚ FNV_PRIMEÚMASK_32)r Ú
|
|||
|
|
hash_valueÚchars & r
|
|||
|
|
Ú
|
|||
|
|
fnv1a_hashr s1 € ô €Jۈܘ4“y :Õ-´Õ:¼gÕEŠ
|
|||
|
|
ñ à Ðr c ó0 € V ^8„ d QhR\ R\ /# )r Ústater )r )r s "r
|
|||
|
|
r r s € ÷ 2ñ 2”Cð 2œCñ 2r c óH € V \ , \ , \ , # )zPerform one LCG step.)ÚLCG_MULTÚLCG_ADDr )r s &r
|
|||
|
|
Úlcg_nextr s € à ”HÕ œwÕ &¬'Õ 1Ð1r c ó0 € V ^8„ d QhR\ R\ /# r )r Útuple)r s "r
|
|||
|
|
r r s € ÷ /,ñ /,¤3ð /,¬5ñ /,r c ó¬ € \ V 4 p\ V4 p\ V4 pV^, R, VR, , pTp\ V4 p\ V4 pV^, R, VR, , pTp\ V4 p\ V4 pV^, R, VR, , pTp\ V4 p\ V4 pV^, R, VR, , pTp\ V4 pV^, R, p\ V4 pV^, R, p \ V4 pV^, R, p
|
|||
|
|
\ V4 pV^, R, p WEWgW‰W«3# )zêGenerate C1-C4 and PRNG offsets from username hash.
|
|||
|
|
|
|||
|
|
From FUN_140001bf0 decompilation:
|
|||
|
|
- Two LCG steps per coefficient
|
|||
|
|
- Coefficient = (state1 >> 16 & 0x7fff) | (state2 & 0x7fff0000)
|
|||
|
|
- This creates a 30-bit value with bit 15 always 0
|
|||
|
|
iÿ i ÿ)r r ) r r Ústate1Ústate2Úc1Úc2Úc3Úc4Úp1Úp2Úp3Úp4s & r
|
|||
|
|
Úextract_coefficientsr( sC € ô
|
|||
|
|
�xÓ €Eô �e‹_€FÜ
|
|||
|
|
�fÓ
|
|||
|
|
€FØ �R�<˜6Õ
|
|||
|
|
! f¨zÕ&9Õ :€BØ €Eô �e‹_€FÜ
|
|||
|
|
�fÓ
|
|||
|
|
€FØ �R�<˜6Õ
|
|||
|
|
! f¨zÕ&9Õ :€BØ €Eô �e‹_€FÜ
|
|||
|
|
�fÓ
|
|||
|
|
€FØ �R�<˜6Õ
|
|||
|
|
! f¨zÕ&9Õ :€BØ €Eô �e‹_€FÜ
|
|||
|
|
�fÓ
|
|||
|
|
€FØ �R�<˜6Õ
|
|||
|
|
! f¨zÕ&9Õ :€BØ €Eô
|
|||
|
|
�U‹O€EØ
|
|||
|
|
�2�+˜Õ €Bä �U‹O€EØ
|
|||
|
|
�2�+˜Õ €Bä �U‹O€EØ
|
|||
|
|
�2�+˜Õ €Bä �U‹O€EØ
|
|||
|
|
�2�+˜Õ €Bà �B˜B BÐ +Ð+r c
|
|||
|
|
óT € V ^8„ d QhR\ R\ R\ R\ R\ /# )r ÚcoeffsÚs1Ús2Ús3r )r r )r s "r
|
|||
|
|
r r R s/ € ÷ ñ œð ¤Cð ¬Sð ´cð ¼cñ r c óò € V w rErgr‰r«WA, V, p WR, V , p
|
|||
|
|
Wc,
|
|||
|
|
V
|
|||
|
|
, pWÍ, V, \ , p\ V,
|
|||
|
|
\ , pVVV , , pV# )að Solve for S4 given coefficients and S1, S2, S3.
|
|||
|
|
|
|||
|
|
From VM trace, the actual equation is:
|
|||
|
|
R0 = (C1 ^ S1 + p1) + ((C2 + S2) ^ p2) + (C3 - S3 + p3) + ((C4 ^ S4) ^ p4)
|
|||
|
|
|
|||
|
|
Each serial part is processed differently:
|
|||
|
|
- S1: XOR with C1, then ADD p1
|
|||
|
|
- S2: ADD to C2, then XOR with p2
|
|||
|
|
- S3: SUB from C3, then ADD p3
|
|||
|
|
- S4: XOR with C4, then XOR with p4
|
|||
|
|
|
|||
|
|
Solving for S4:
|
|||
|
|
TARGET = partial + ((C4 ^ S4) ^ p4)
|
|||
|
|
(C4 ^ S4) ^ p4 = TARGET - partial
|
|||
|
|
C4 ^ S4 = (TARGET - partial) ^ p4
|
|||
|
|
S4 = C4 ^ ((TARGET - partial) ^ p4)
|
|||
|
|
)ÚMASK_64ÚTARGET)r* r+ r, r- r r! r" r# r$ r% r& r' Úr1Úr2Úr3ÚpartialÚneededÚs4s &&&& r
|
|||
|
|
Ú solve_serialr7 R si € ð$ &,Ñ"€BˆB�B˜Bð
|
|||
|
|
�'�R� €BØ
|
|||
|
|
�'�R� €BØ
|
|||
|
|
�'�B�,€Bà�w˜�|œwÕ&€Gô �wÕ ¤'Õ
|
|||
|
|
)€FØ ˆv˜�{Õ €Bà
|
|||
|
|
€Ir c ó` € V ^8„ d QhR\ R\ R\ R\ R\ R\ /# )r r r+ r, r- r6 r )r r r )r s "r
|
|||
|
|
r r t s6 € ÷
|
|||
|
|
ñ
|
|||
|
|
œCð
|
|||
|
|
¤Sð
|
|||
|
|
¬cð
|
|||
|
|
´sð
|
|||
|
|
Äð
|
|||
|
|
Ìñ
|
|||
|
|
r c óö € \ V 4 pVw rgr‰r«rÍWa, V
|
|||
|
|
, pWr, V , pWƒ,
|
|||
|
|
V , pW”, V
|
|||
|
|
, pWï, V, V, \ , pVV\ 8H 3# )z?Verify serial produces target value. Returns (result, matches).)r( r/ r0 )r r+ r, r- r6 r* r r! r" r# r$ r% r& r' r1 r2 r3 Úr4Úr0s &&&&& r
|
|||
|
|
Ú
|
|||
|
|
verify_serialr< t sl € ä
|
|||
|
|
! (Ó
|