[原创]Source Insight 4.x 补丁
参考了 http://bbs.pediy.com/thread-215669.htm 的帖子，顺手写了个补丁，理论上支持更新。劫持msimg32。工具用的aheadlib,微软的Detours。
代码
// Patch
BOOL WINAPI Mine_CryptVerifySignatureW(HCRYPTHASH hHash, const BYTE *pbSignature, DWORD dwSigLen, HCRYPTKEY hPubKey, LPCWSTR szDescription, DWORD dwFlags)
{
return TRUE;
}
BOOL (WINAPI *Real_CryptVerifySignatureW)(HCRYPTHASH , const BYTE *, DWORD , HCRYPTKEY , LPCWSTR , DWORD ) = CryptVerifySignatureW;
enum
{
FACKED_FILE_HANDLE = -2
};
HANDLE (WINAPI *Real_CreateFileA)(LPCSTR lpFileName, DWORD dwDesiredAccess,
DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile) = CreateFileA;
HANDLE WINAPI Mine_CreateFileA(LPCSTR lpFileName, DWORD dwDesiredAccess,
DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile)
{
LPCSTR lpName = PathFindFileNameA(lpFileName);
if(lpName && !_stricmp(lpName, "si4update.dat"))
{
if(dwCreationDisposition == OPEN_EXISTING)
{
// not exist
return INVALID_HANDLE_VALUE;
}
HANDLE h = Real_CreateFileA(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);
TlsSetValue(m_tlsIdx, h);
return h;
}
else
{
return Real_CreateFileA(lpFileName, dwDesiredAccess, dwShareMode, lpSecurityAttributes, dwCreationDisposition, dwFlagsAndAttributes, hTemplateFile);
}
}
BOOL (WINAPI *Real_WriteFile)(HANDLE, LPCVOID, DWORD, LPDWORD, LPOVERLAPPED) = WriteFile;
BOOL WINAPI Mine_WriteFile(HANDLE hFile, LPCVOID lpBuffer, DWORD nNumberOfBytesToWrite, LPDWORD lpNumberOfBytesWritten, LPOVERLAPPED lpOverlapped)
{
if((HANDLE)TlsGetValue(m_tlsIdx) == hFile)
{
DWORD newSize = 0;
// Patch联网下载回来的黑名单，如果不想自动获取升级信息的话，InternetOpenW 直接拦截掉就好了
PatchBlackList((LPSTR)lpBuffer, nNumberOfBytesToWrite, &newSize);
return Real_WriteFile(hFile, lpBuffer, newSize, lpNumberOfBytesWritten, lpOverlapped);;
}
return Real_WriteFile(hFile, lpBuffer, nNumberOfBytesToWrite, lpNumberOfBytesWritten, lpOverlapped);
}
BOOL (WINAPI *Real_CloseHandle)(HANDLE) = CloseHandle;
BOOL WINAPI Mine_CloseHandle(HANDLE hObject)
{
if((HANDLE)TlsGetValue(m_tlsIdx) == hObject)
{
TlsSetValue(m_tlsIdx, INVALID_HANDLE_VALUE);
}
return Real_CloseHandle(hObject);
}
HINTERNET (WINAPI *Real_InternetOpenW)(LPCWSTR, DWORD, LPCWSTR, LPCWSTR, DWORD) = InternetOpenW;
HINTERNET WINAPI Mine_InternetOpenW(LPCWSTR lpszAgent, DWORD dwAccessType, LPCWSTR lpszProxy, LPCWSTR lpszProxyBypass, DWORD dwFlags)
{
// 拦截授权的动作，这个会上传机器信息，KEY信息，最后KEY就会被加黑
if(!_wcsicmp(L"Source Insight", lpszAgent)) { return NULL; }
// SourceInsight/4.0 这个UA是升级联网的UA
return Real_InternetOpenW(lpszAgent, dwAccessType, lpszProxy, lpszProxyBypass, dwFlags);
}
BOOL PatchBlackList(LPSTR pOrgInfo, DWORD cbInfo, LPDWORD newSize)
{
//1. base64 decode
BIN rawInfo;
rawInfo.resize(cbInfo);
int rawsize = (int)rawInfo.size();
if(!Base64Decode(pOrgInfo, (int)cbInfo, &rawInfo[0], &rawsize) || rawsize <= sizeof(HDR)) { return FALSE; }
//2.decrypt buf
PHDR hdr = (PHDR)&rawInfo[0];
if(hdr->size > (int)(rawsize - offsetof(HDR, data))) { return FALSE; }
for (int i = 0; i < hdr->size; i++)
{
int idx = (hdr->key + i)%sizeof(g_decrypt_table);
hdr->data[i] ^= g_decrypt_table[idx];
}
//3. patch black list
std::tr1::regex re("(<BlackList>)([\\r\\n\\w<>/=\\s\"-]+)(</BlackList>)");
std::tr1::regex_replace(hdr->data, hdr->data, hdr->data+hdo->size, re, std::string("$1$3"));
hdr->size = min(hdr->size, (int)strnlen(hdr->data, hdr->size)+1);
calc_checksum(hdr->data, hdr->size, hdr->key, (LPBYTE)&hdr->checksum, (int)sizeof(hdr->checksum));
//4. encrypt buf
for (int i = 0; i < hdr->size; i++)
{
int idx = (hdr->key + i)%sizeof(g_decrypt_table);
hdr->data[i] ^= g_decrypt_table[idx];
}
//5.base64buf
*newSize = cbInfo;
memset(pOrgInfo, 0, cbInfo);
Base64Encode(&rawInfo[0], (int)(offsetof(HDR, data)+hdo->size + 1), pOrgInfo, (int*)newSize, ATL_BASE64_FLAG_NOCRLF);
return TRUE;
} 补充一下吧：
HOOK CryptVerifySignatureW 过签名校验，和Patch公钥实现的效果是一样的
HOOK CreateFileA 过黑名单的，联网更新之后，他会下载si4update.dat，不让他写入，就不会触发序列号黑名单的逻辑，在这点可以PATCH联网获取到的信息，可以把联网升级的信息PATCH掉。
2017-04-08:
1.4.00.0085 直接把黑名单编译到程序中了，不仅仅是联网获取，要patch这个逻辑灰常的复杂，最好就是人手一个KEY，然后把网络禁掉，如果还想保持升级的话，用补丁把黑列表去掉最好。
2.注册机是redacker同学的，我直接拿来用了。操作方法就是，选一个KEY，替换si4.lic中的序列号，把补丁文件msimg32放到si的目录，理论上就好了。。
3.有问题估计不会再更新了。老版本已经够用了，新版就是加了一堆对抗逻辑，一堆定时器。代码那叫一个乱。
4.调试的几个关键点
01315320 状态 01315f24 列表 0266DED0 266DDF0 0050BB94 这个地方写入的黑名单列表 sub_439B60 解密加载黑列表 unk_613FF8 加密的黑列表
5.附上我生成的100KEY
S4SV-UFWS-T1LD-Z6NF S4SV-UFWS-UBCN-DJ4G S4SV-UFWS-ED7V-MKZD S4SV-UFWS-DU9E-SGRS S4SV-UFWS-336A-N6GH S4SV-UFWS-YP56-FVGD S4SV-UFWS-0XCA-97YS S4SV-UFWS-3PB4-UQHK S4SV-UFWS-WQT3-5VGK S4SV-UFWS-D8D7-TVUR S4SV-UFWS-N5J1-WPMS S4SV-UFWS-JM1X-VZYP S4SV-UFWS-DM0L-JNP6 S4SV-UFWS-PPVB-36R5 S4SV-UFWS-S8KA-VNFD S4SV-UFWS-RL8H-937X S4SV-UFWS-H50D-4NMG S4SV-UFWS-JC1O-WSZF S4SV-UFWS-Z149-V9FM S4SV-UFWS-7ZA6-DYT4 S4SV-UFWS-08P8-GKHN S4SV-UFWS-SJKI-MYWU S4SV-UFWS-FB8X-CRHY S4SV-UFWS-CLC6-K5FK S4SV-UFWS-OYHB-R354 S4SV-UFWS-X317-J5CN S4SV-UFWS-OT18-57CT S4SV-UFWS-ZPDO-7XFZ S4SV-UFWS-L6D0-MN75 S4SV-UFWS-2GHM-CMC6 S4SV-UFWS-NTC1-Q6PT S4SV-UFWS-XYL5-J4QY S4SV-UFWS-I9D2-CWKX S4SV-UFWS-XWXQ-WM5U S4SV-UFWS-9X7L-6FS9 S4SV-UFWS-G3IG-V5JV S4SV-UFWS-G7N3-WT4C S4SV-UFWS-RGLC-S7QM S4SV-UFWS-34HX-Z9YQ S4SV-UFWS-CO74-G94K S4SV-UFWS-1YGH-D5PP S4SV-UFWS-W5S0-TURM S4SV-UFWS-AS9T-FYGM S4SV-UFWS-U740-6WWD S4SV-UFWS-5ES4-Y5FJ S4SV-UFWS-BF9J-WWZV S4SV-UFWS-FYZY-MHV5 S4SV-UFWS-GNVF-CMC9 S4SV-UFWS-U4PS-3W9Y S4SV-UFWS-30B2-3CJ5 S4SV-UFWS-SN0U-XWYY S4SV-UFWS-ARWJ-6ZN3 S4SV-UFWS-9ANW-ZMTF S4SV-UFWS-HDDR-9TSH S4SV-UFWS-CW96-TMJ6 S4SV-UFWS-13XS-ZPKM S4SV-UFWS-IT80-CK7C S4SV-UFWS-0AH6-XK3N S4SV-UFWS-1EJQ-5WSU S4SV-UFWS-E8MT-VFZ3 S4SV-UFWS-UGLL-SRU4 S4SV-UFWS-NLOG-TRS6 S4SV-UFWS-GIC4-U9XF S4SV-UFWS-Z3WE-KUT4 S4SV-UFWS-V3I4-MCTG S4SV-UFWS-PVNR-M4R9 S4SV-UFWS-M5JL-CWGP S4SV-UFWS-4UTN-H7W4 S4SV-UFWS-2OMU-P39K S4SV-UFWS-XDEB-C9VW S4SV-UFWS-00JX-9PRP S4SV-UFWS-U5LI-6HPU S4SV-UFWS-JZR8-3R44 S4SV-UFWS-8ZW5-FFY7 S4SV-UFWS-3S8H-HTC6 S4SV-UFWS-VPX4-VP9Y S4SV-UFWS-FIH4-V4ZC S4SV-UFWS-5F9B-QJVS S4SV-UFWS-OTRF-N3NN S4SV-UFWS-A7N5-JVWM S4SV-UFWS-KOJX-GKG9 S4SV-UFWS-3H9L-9TPC S4SV-UFWS-LM5K-UZK3 S4SV-UFWS-IKFC-RCDY S4SV-UFWS-VEQX-DT9Y S4SV-UFWS-WGAW-N7UG S4SV-UFWS-XZGL-3NPR S4SV-UFWS-NQZ8-66XQ S4SV-UFWS-W08M-5SM4 S4SV-UFWS-XVXQ-MQWN S4SV-UFWS-UGF1-9JGY S4SV-UFWS-3GFS-6Z3T S4SV-UFWS-PJE3-XKXV S4SV-UFWS-EVNZ-MHDD S4SV-UFWS-PCXS-U7XP S4SV-UFWS-M5WB-VMDX S4SV-UFWS-ULLZ-VCGX S4SV-UFWS-XVDO-UK3K S4SV-UFWS-ZM9D-HFNV S4SV-UFWS-HTO3-ZZ7F
附件是MistHill 同学提供的授权文件，工程文件等。
