首页
社区
课程
招聘
[原创]Synalyze It! Pro v1.11.2授权验证分析及x
发表于: 2015-6-11 10:50 3250

[原创]Synalyze It! Pro v1.11.2授权验证分析及x

2015-6-11 10:50
3250
-------------------------------------------------------------------

#Synalyze It! Pro v1.11.2

-------------------------------------------------------------------

www.synalysis.net -> [link](http://www.synalysis.net)

![image](http://www.synalysis.net/_Media/screenshot1_med.png)

试想一下...

你有一个二进制文件,不知道它的内容。或者你有一个规范,但不希望他们手动解码某些软件创建的二进制文件。

你曾经看着十六进制转储,并认为它是多么困难,使这有意义吗?而且要记住所有的比特和字节的意思?

你来对地方了! Synalyze它!允许您为你的二进制文件创建交互式语法。不同于常规的十六进制编辑器或观众文件自动为您解读!二进制文件分析从未如此简单。

此外Synalyze It!是Mac OS X上面一个全功能的十六进制编辑器,让您用几十种文字的编码编辑任意大小的文件,并解释字节含义。

### 主要功能:[link](http://www.synalysis.net/additional-features.html)

**十六进制编辑**

Synalyze It! allows editing of files of any size without delay. Even copying of data of any size via clipboard is possible.
When you insert a string from the clipboard, the selected encoding is applied, of course. This enables you to convert text from one encoding to another easily.

**计算检验字节**

Compute various checksums for the selected bytes

**数据可视化关系导出**

Visualize your grammars by exporting to .dot (GrapzViz) files

**数据视图**

Display the selection in different number and color representations

**打印预览**

Print the hex view with or without text and mapped structures

**保存选中字节**

Selected bytes can be written to disk directly

**跳到指定位置**

Directly jump to a specific file offset (decimal or hex)

**在工具栏中跳到指定位置**

Jump to positions entering expressions

**数据统计**

Let Synalyze It! count the occurence of each byte in a file.

**比较字节的不同编码值**

Check the text encoding (ASCII/EBCDIC) of some hex values

**增量文本搜索与编码选择**

Search text incrementally using one of dozens of code pages

**查找数值8-64 Bit signed/unsigned, little/big endian**

Find a number in a file instantly and jump directly to the findings

**查找字节序列匹配蒙版**

Find all places in a file that match a certain bit mask

**查找字符串**

See all strings with a certain encoding

Find all strings in a file like with the Unix strings command

**使用脚本的可扩展语法高亮**

Write Python or Lua scripts where the "static" grammar is not enough

**语法支持强大的表达式**

Structure and element sizes as well as repeat counts can contain complex formulas

---------------------------------------------------------------------------
**1.试用过期后,打开后会有日志输出:**

        0xcb@cb.cn ~/Desktop> cd Synalyze\ It!\ Pro.app/Contents/MacOS/
        0xcb@cb.cn ~/D/S/C/MacOS> ./Synalyze\ It!\ Pro
        2015-06-11 00:07:35.804 Synalyze It! Pro[2844:507] Encountered error 'Invalid product key' ('91')
        2015-06-11 00:07:35.804 Synalyze It! Pro[2844:507] Encountered error 'Invalid product key' ('91')
---------------------------------------------------------------------------
**2.所以先调试定位验证授权的位置,用`lldb`打开`Synalyze It! Pro`进行调试,在输出日志的方法`NSLogv`打断点,之后运行程序。断点断在:Foundation.Formwork的`0x7fff9349f2dd NSLogv` 位置。查看调用堆栈,根据方法名很容易找到弹出过期窗口的验证方法:`-[TurboActivateController showIfNotActivatedOrInTrial:] + 80`**

        0xcb@cb.cn ~/Desktop> lldb Synalyze\ It!\ Pro.app
        (lldb) target create "Synalyze It! Pro.app"
        Current executable set to 'Synalyze It! Pro.app' (x86_64).
        (lldb) br s -n NSLogv
        Breakpoint 1: where = Foundation`NSLogv, address = 0x00000000000442dd
        (lldb) r
        Process 2873 launched: '/Users/0xcb/Desktop/Synalyze It! Pro.app/Contents/        MacOS/Synalyze It! Pro' (x86_64)
        Process 2873 stopped
        * thread #1: tid = 0x11181, 0x00007fff9349f2dd Foundation`NSLogv, queue =         'com.apple.main-thread', stop reason = breakpoint 1.1
    frame #0: 0x00007fff9349f2dd Foundation`NSLogv
        Foundation`NSLogv:
        -> 0x7fff9349f2dd:  pushq  %rbp
           0x7fff9349f2de:  movq   %rsp, %rbp
          0x7fff9349f2e1:  pushq  %r15
           0x7fff9349f2e3:  pushq  %r14
        (lldb) bt
        * thread #1: tid = 0x11181, 0x00007fff9349f2dd Foundation`NSLogv, queue =         'com.apple.main-thread', stop reason = breakpoint 1.1
         * frame #0: 0x00007fff9349f2dd Foundation`NSLogv
    frame #1: 0x00000001000368fe Synalyze It! Pro`_LogTraceMessage + 51
    frame #2: 0x000000010006ffe5 Synalyze It! Pro`TraceMessage + 1064
    frame #3: 0x000000010006fb79 Synalyze It! Pro`TraceFatal + 185
    frame #4: 0x0000000100067f09 Synalyze It! Pro`-[TurboActivateController windowDidLoad] + 329
    frame #5: 0x00007fff95d063ac AppKit`-[NSWindowController _windowDidLoad] + 450
    frame #6: 0x00007fff95cecfa6 AppKit`-[NSWindowController window] + 110
    frame #7: 0x0000000100067ba3 Synalyze It! Pro`-[TurboActivateController transitionToTab:] + 32
    frame #8: 0x0000000100067db9 Synalyze It! Pro`-[TurboActivateController selectTabViewIndex] + 121
    frame #9: 0x0000000100068179 Synalyze It! Pro`-[TurboActivateController showWindow:] + 36
    frame #10: 0x000000010006820e Synalyze It! Pro`-[TurboActivateController showIfNotActivatedOrInTrial:] + 80
    frame #11: 0x0000000100035a74 Synalyze It! Pro`-[SynalyzeItApplicationDelegate applicationDidFinishLaunching:] + 587
    frame #12: 0x00007fff8ec54e0c CoreFoundation`__CFNOTIFICATIONCENTER_IS_CALLING_OUT_TO_AN_OBSERVER__ + 12
    frame #13: 0x00007fff8eb4882d CoreFoundation`_CFXNotificationPost + 2893
    frame #14: 0x00007fff9345ddda Foundation`-[NSNotificationCenter postNotificationName:object:userInfo:] + 68
    frame #15: 0x00007fff95a78b69 AppKit`-[NSApplication _postDidFinishNotification] + 289
    frame #16: 0x00007fff95a7889c AppKit`-[NSApplication _sendFinishLaunchingNotification] + 195
    frame #17: 0x00007fff95a75786 AppKit`-[NSApplication(NSAppleEventHandling) _handleAEOpenEvent:] + 570
    frame #18: 0x00007fff95a751db AppKit`-[NSApplication(NSAppleEventHandling) _handleCoreEvent:withReplyEvent:] + 242
    frame #19: 0x00007fff9347c52a Foundation`-[NSAppleEventManager dispatchRawAppleEvent:withRawReply:handlerRefCon:] + 294
    frame #20: 0x00007fff9347c39d Foundation`_NSAppleEventManagerGenericHandler + 106
    frame #21: 0x00007fff95791e1f AE`aeDispatchAppleEvent(AEDesc const*, AEDesc*, unsigned int, unsigned char*) + 381
    frame #22: 0x00007fff95791c32 AE`dispatchEventAndSendReply(AEDesc const*, AEDesc*) + 31
    frame #23: 0x00007fff95791b36 AE`aeProcessAppleEvent + 315
    frame #24: 0x00007fff97e39161 HIToolbox`AEProcessAppleEvent + 56
    frame #25: 0x00007fff95a710b6 AppKit`_DPSNextEvent + 1026
    frame #26: 0x00007fff95a7089b AppKit`-[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 122
    frame #27: 0x00007fff95a6499c AppKit`-[NSApplication run] + 553
    frame #28: 0x00007fff95a4f783 AppKit`NSApplicationMain + 940
    frame #29: 0x000000010006a155 Synalyze It! Pro`main + 97
    frame #30: 0x0000000100001934 Synalyze It! Pro`start + 52
        (lldb)
**3.接下来查看该方法的汇编:`-[TurboActivateController showIfNotActivatedOrInTrial:] + 80`**

[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课

上传的附件:
收藏
免费 0
支持
分享
最新回复 (3)
雪    币: 60
活跃值: (11)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
2
是不是判断 m_register.size() > 0 就表明 已授权 ?
2015-6-11 12:28
0
雪    币: 133
活跃值: (233)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
3
直接研究sdk接口的:
    HRESULT hr;
    GENUINE_OPTIONS opts;
    opts.nLength = sizeof(GENUINE_OPTIONS);

    // How often to verify with the LimeLM servers (90 days)
    opts.nDaysBetweenChecks = 90;

    // The grace period if TurboActivate couldn't connect to the servers.
    // after the grace period is over IsGenuinEx() will return TA_FAIL instead of
    // TA_E_INET or TA_E_INET_DELAYED
    opts.nGraceDaysOnInetErr = 14;

    // In this example we won't show an error if the activation
    // was done offline by passing the TA_SKIP_OFFLINE flag
    opts.flags = TA_SKIP_OFFLINE;

    hr = IsGenuineEx(TA_GUID, &opts);

    if (hr == TA_OK || hr == TA_E_FEATURES_CHANGED || hr == TA_E_INET || hr == TA_E_INET_DELAYED)
    {
        TCHAR * featureValue;

        printf("YourApp is activated and genuine! Enable any app features now.\n");

        if (hr == TA_E_INET || hr == TA_E_INET_DELAYED)
        {
            // TODO: show a warning to your user that this time (or the last time)
            // the IsGenuineEx() failed to connect to the LimeLM servers.
            printf("YourApp is activated, but it failed to verify the activation with the LimeLM servers. You can still use the app for the duration of the grace period.\n");
        }

        // if this app is activated then you can get a feature value (completely optional)
        // See: http://wyday.com/limelm/help/license-features/
        /*

        hr = GetFeatureValue(_T("your feature value"), 0, 0);

        featureValue = (TCHAR *)malloc(hr * sizeof(TCHAR));

        hr = GetFeatureValue(_T("your feature value"), featureValue, hr);

        if (hr == TA_OK)
        {
#ifdef _WIN32
            wprintf(L"Feature value: %s\n", featureValue);
#else
            printf("Feature value: %s\n", featureValue);
#endif
        }
        else
            printf("Getting feature failed: %d\n", hr);

        free(featureValue);

        */
    }
    else // not activated or genuine
    {
        uint32_t trialDays = 0;

        // Look in TurboActivate.h for what the error codes mean.
        printf("Not activated: hr = %d\n", hr);

        // Start or re-validate the trial if it has already started.
        // This need to be called at least once before you can use
        // any other trial functions.
        hr = UseTrial(TA_SYSTEM);

        if (hr == TA_OK)
        {
            // Get the number of trial days remaining.
            hr = TrialDaysRemaining(TA_GUID, &trialDays);

            if (hr == TA_OK)
                printf("Trial days remaining: %d\n", trialDays);
            else
                printf("Failed to get the trial days remaining: hr = %d\n", hr);
        }
        else
            printf("Failed to UseTrial: hr = %d\n", hr);


        //TODO: prompt for a product key (if it's not present)
        //Note: here we're just hard-coding the product key to show how you
        //      save the product key and try to activation

        // Also note we're using the TA_SYSTEM flag. This means the activation will be system-wide.
        // However calling using the TA_SYSTEM flag (the first time only) requires system-admin privileges.
        // If your app will never have system admin privileges then you can use the TA_USER flag.
        hr = CheckAndSavePKey(_T("U9MM-4NJ5-QFG8-TWM5-QM75-92YI-NETA"), TA_SYSTEM);
        if (hr == TA_OK)
        {
            printf("Product key saved successfully.\n");

            // try to activate
            hr = Activate();

            if (hr == TA_OK)
                printf("Activated successfully\n");
            else
                printf("Activation failed: hr = %d\n", hr);
        }
        else
            printf("Product key failed to save: hr = %d\n", hr);
    }
上传的附件:
2015-6-11 13:01
0
雪    币: 60
活跃值: (11)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
4
大赞,懂了,谢谢。
2015-6-12 09:44
0
游客
登录 | 注册 方可回帖
返回
//