标题: 小议JEB3逆向工程

创建: 2020-06-05 12:32 更新: 链接: https://scz.617.cn/misc/202006051232.txt https://www.52pojie.cn/thread-1194011-1-1.html

2020.6.1有个JEB Pro 3.19.1.202005071620被放出来了，小钻风说可能是信用卡欺诈弄来的。当时给他弄了个传统keygen对付着用，第二天他说有人放出另一种keygen，可以离线算注册码，就是许可证密钥(License key)。这事我以前没干过，有点意思。

以调试方式启动JEB3，用Eclipse Attach。

点击"Manual Key Generation"，看到"许可证数据(License data)"。在Eclipse中 Suspend JVM，主线程调用栈回溯是:

org.eclipse.swt.internal.win32.OS.WaitMessage() line: not available [native method] org.eclipse.swt.widgets.Display.sleep() line: 4528 com.pnfsoftware.jeb.rcpclient.util.SwtUtil.sleep(org.eclipse.swt.widgets.Display) line: 52 com.pnfsoftware.jeb.rcpclient.dialogs.LicenseKeyDialog(com.pnfsoftware.jeb.rcpclient.dialogs.JebDialog).open() line: 395 com.pnfsoftware.jeb.rcpclient.dialogs.LicenseKeyDialog.open() line: 50 com.pnfsoftware.jeb.rcpclient.dialogs.LicenseKeyAutoDialog$3.widgetSelected(org.eclipse.swt.events.SelectionEvent) line: 190 org.eclipse.swt.widgets.TypedListener.handleEvent(org.eclipse.swt.widgets.Event) line: 252 org.eclipse.swt.widgets.EventTable.sendEvent(org.eclipse.swt.widgets.Event) line: 89 org.eclipse.swt.widgets.Display.sendEvent(org.eclipse.swt.widgets.EventTable, org.eclipse.swt.widgets.Event) line: 4105 org.eclipse.swt.widgets.Button(org.eclipse.swt.widgets.Widget).sendEvent(org.eclipse.swt.widgets.Event) line: 1037 org.eclipse.swt.widgets.Display.runDeferredEvents() line: 3922 org.eclipse.swt.widgets.Display.readAndDispatch() line: 3524 com.pnfsoftware.jeb.rcpclient.dialogs.LicenseKeyAutoDialog(com.pnfsoftware.jeb.rcpclient.dialogs.JebDialog).open() line: 394 com.pnfsoftware.jeb.rcpclient.dialogs.LicenseKeyAutoDialog.open() line: 83 com.pnfsoftware.jeb.rcpclient.RcpClientContext.retrieveLicenseKey(java.lang.String) line: 1699 com.pnfsoftware.jeb.rcpclient.RcpClientContext(com.pnfsoftware.jeb.client.AbstractClientContext).prepareCheckLicenseKey() line: 736 com.pnfsoftware.jeb.rcpclient.RcpClientContext(com.pnfsoftware.jeb.client.AbstractClientContext).start() line: 442 com.pnfsoftware.jeb.rcpclient.RcpClientContext.start() line: 1522 com.pnfsoftware.jeb.rcpclient.RcpClientContext.onApplicationReady(com.pnfsoftware.jeb.rcpclient.extensions.app.App) line: 1212 com.pnfsoftware.jeb.rcpclient.JebApp.onApplicationReady() line: 73 com.pnfsoftware.jeb.rcpclient.JebApp(com.pnfsoftware.jeb.rcpclient.extensions.app.App).run() line: 186 com.pnfsoftware.jeb.rcpclient.Launcher.main(java.lang.String[]) line: 35

/ * com.pnfsoftware.jeb.rcpclient.RcpClientContext.retrieveLicenseKey(String) : String / public String retrieveLicenseKey(String licdata)

这个函数负责弹框显示"许可证数据(License data)"，形参licdata就是对话框里的数字串。

/ * com.pnfsoftware.jeb.client.AbstractClientContext.prepareCheckLicenseKey() : void / private void prepareCheckLicenseKey() { ip.RF();

String str1 = this.pm.getString(".LicenseKey"); int[] arrayOfInt = new int[1];

int i = 0; if (!Strings.isBlank(str1)) { long[] arrayOfLong1 = ek.Ql(); for (long l2 : arrayOfLong1) { Fp localFp2 = new Fp(l2); if (localFp2.RF(str1, arrayOfInt)) { i = 1; break; } } } if (i == 0) { ip.Ql(); / * 733行，返回MachineId / long l1 = ek.RF(); / * 734行 / Fp localFp1 = new Fp(l1); / * 735行，返回"许可证数据(License data)" / String str2 = localFp1.RF(); / * 736行，str2即"许可证数据(License data)"，str1即"许可证密钥(License key)" / str1 = retrieveLicenseKey(str2); ip.RF(); if (!localFp1.RF(str1, arrayOfInt)) { logger.info(S.s(437), new Object[0]); terminate(); } this.pm.setString(".LicenseKey", str1.trim()); } Licensing.setLicenseTimestamp(arrayOfInt[0]);

int j = Licensing.getExpirationTimestamp(); if (j != 0) { if ((j < 0) || (getStartTimestamp() >= j)) { this.pm.setBoolean(".SupportExpired", Boolean.valueOf(true)); notifySupportExpired(); } else if (this.pm.getBoolean(".SupportExpired")) { this.pm.setBoolean(".SupportExpired", Boolean.valueOf(false)); } } }

/ * com.pnfsoftware.jebglobal.Fp / public class Fp { / * MachineId / private long RF;

/ * 设置MachineId / public Fp(long paramLong) { this.RF = paramLong; }

/ * 返回"许可证数据(License data)" / public String RF() { try { ByteArrayOutputStream localByteArrayOutputStream = new ByteArrayOutputStream();

  LEDataOutputStream localLEDataOutputStream = new LEDataOutputStream(localByteArrayOutputStream);
  localLEDataOutputStream.writeLong(this.RF);
  localLEDataOutputStream.close();

/ * 41行，localByteArrayOutputStream.toByteArray()等于8字节little-endian序 * 的MachineId * * this.RF也是MachineId * * 返回"许可证数据(License data)" / byte[] arrayOfByte = wR.RF(this.RF, localByteArrayOutputStream.toByteArray(), null); / * 42行，对RC4结果进一步处理，就是格式化输出，没有数学变换 / return wR.RF(arrayOfByte); } catch (Exception localException) {} return ""; }

com.pnfsoftware.jebglobal.wR.RF(long, byte[], int[]) line: 104 com.pnfsoftware.jebglobal.Fp.RF() line: 41 [local variables unavailable] com.pnfsoftware.jeb.rcpclient.RcpClientContext(com.pnfsoftware.jeb.client.AbstractClientContext).prepareCheckLicenseKey() line: 735 [local variables unavailable] com.pnfsoftware.jeb.rcpclient.RcpClientContext(com.pnfsoftware.jeb.client.AbstractClientContext).start() line: 442 com.pnfsoftware.jeb.rcpclient.RcpClientContext.start() line: 1522 com.pnfsoftware.jeb.rcpclient.RcpClientContext.onApplicationReady(com.pnfsoftware.jeb.rcpclient.extensions.app.App) line: 1212 com.pnfsoftware.jeb.rcpclient.JebApp.onApplicationReady() line: 73 com.pnfsoftware.jeb.rcpclient.JebApp(com.pnfsoftware.jeb.rcpclient.extensions.app.App).run() line: 186 com.pnfsoftware.jeb.rcpclient.Launcher.main(java.lang.String[]) line: 35

/ * com.pnfsoftware.jebglobal.wR.RF(long, byte[], int[]) : byte[] / public static byte[] RF(long paramLong, byte[] paramArrayOfByte, int[] paramArrayOfInt) { try { if (paramArrayOfByte == null) { return null; } ByteArrayOutputStream localByteArrayOutputStream = new ByteArrayOutputStream();

LEDataOutputStream localLEDataOutputStream = new LEDataOutputStream(localByteArrayOutputStream);

localLEDataOutputStream.writeInt(64 + paramArrayOfByte.length);

/ * 113行，随机数 / localLEDataOutputStream.writeInt(UL.nextInt());

localLEDataOutputStream.writeInt(5);

/ * 116行，占坑，后面会回填CRC32 / localLEDataOutputStream.writeInt(0);

localLEDataOutputStream.writeInt(Licensing.user_id);
localLEDataOutputStream.writeLong(Licensing.license_id);

/ * 120行，MachineId / localLEDataOutputStream.writeLong(paramLong); localLEDataOutputStream.writeInt(Licensing.build_type);

localLEDataOutputStream.writeInt(AbstractContext.app_ver.getMajor());
localLEDataOutputStream.writeInt(AbstractContext.app_ver.getMinor());
localLEDataOutputStream.writeInt(AbstractContext.app_ver.getBuildid());
localLEDataOutputStream.writeLong(AbstractContext.app_ver.getTimestamp());

int i = (int)((System.currentTimeMillis() - Tk) / 1000L);
localLEDataOutputStream.writeInt(i);

/ * 131行 * * com.pnfsoftware.jebglobal.wR.Az() : int / int j = Az();

localLEDataOutputStream.writeInt(j);

/ * 135行，随机数 / int k = UL.nextInt(); localLEDataOutputStream.writeInt(k); / * 138行，MachineId / localLEDataOutputStream.write(paramArrayOfByte); localLEDataOutputStream.close();

byte[] arrayOfByte1 = localByteArrayOutputStream.toByteArray();
ByteBuffer localByteBuffer = ByteBuffer.wrap(arrayOfByte1);
localByteBuffer.order(ByteOrder.LITTLE_ENDIAN);
localByteBuffer.putInt(0, arrayOfByte1.length - 8);

/ * 145行，计算[0x10:]的CRC32，回填相应字段 / localByteBuffer.putInt(12, Hash.calculateCRC32(Arrays.copyOfRange(arrayOfByte1, 16, arrayOfByte1.length)));

byte[] arrayOfByte2 = new byte[16];
for (int m = 0; m < 8; m++) {
  arrayOfByte2[m] = arrayOfByte1[m];
}
for (m = 8; m < 16; m++) {
  arrayOfByte2[m] = RF[(m - 8)];
}

/ * 154行，RC4() / xS.RF(arrayOfByte2, arrayOfByte1, 8, arrayOfByte1.length); if ((paramArrayOfInt != null) && (paramArrayOfInt.length >= 1)) { paramArrayOfInt[0] = k; } return arrayOfByte1; } catch (Exception localException) {} return null; }

/ * RC4() / com.pnfsoftware.jebglobal.xS.RF(byte[], byte[], int, int) : void

对前述xS.RF()的第2形参尝试手工解码:

48 00 00 00 // +0x0 64 + 8 05 05 6e 1d // +0x4 随机数 05 00 00 00 // +0x8 固定值5 4a 56 83 5f // +0xc 后面所有数据的CRC32 06 58 76 3e // +0x10 // User ID: 1047943174 9b b9 d0 17 50 fe da 00 // +0x14 // License ID: 61641164873316763 xx xx xx xx xx xx xx xx // +0x1c MachineId ... // +0x24 (后略)

RC4是流式对称加密算法，从out[]解密出in[]，即可得到LicenseId、MachineId。

简化版调用关系:

RcpClientContext.start // 3.19.1.202005071620 AbstractClientContext.start // RcpClientContext:1522 AbstractClientContext.prepareCheckLicenseKey // AbstractClientContext:442 ek.RF // AbstractClientContext:733 // 返回MachineId Fp.RF // AbstractClientContext:735 // 返回"许可证数据(License data)"的String形式 // 对话框中显示之 wR.RF // Fp:41 // 返回"许可证数据(License data)"的byte[]形式 xS.RF // wR:154 // RC4()/PrivateTransform() RcpClientContext.retrieveLicenseKey // AbstractClientContext:736 // 形参是"许可证数据(License data)"的String形式

这种离线keygen确实更通用，参与运算的LicenseId、MachineId都从LicenseData解密获取，同时适用于Windows、Linux、Mac，不需要关心MachineId的数据源在不同OS 上的获取方式。

说一下过期时间的事。JEB3的这个过期时间我不确认是否真地影响过期后的继续使用，曾经有过不同的情况，比如只影响升级，不影响继续使用。如果真影响过期后的继续使用，可能得动态Patch一个类:

com.pnfsoftware.jeb.client.Licensing

具体是这个函数:

com.pnfsoftware.jeb.client.Licensing.getExpirationTimestamp() : int

该函数中用到常量86400，将之改成864000，则过期时间变成"2030-05-30"。不要贪心地改成8640000，否则过期时间回绕到1984。

$ fc /b old new 00000034: 01 0D 00000035: 51 2F 00000036: 80 00

可以用你喜欢的任一动态Patch技术去完成内存中的常量修改，不建议静态Patch。

感慨一句，JEB2真是我的伤心之地，以至于每看到一个新版JEB出场，都要长叹一声，欲语还休。