proc ::maui::util::randbuf {length} { set result "" if {[RLPut unix]} { foreach fname {/dev/urandom /dev/random} { if {[catch { set chan [open $fname r] fconfigure $chan -translation binary set result [read $chan $length] close $chan }]} { catch {close $chan} } else { break } } } else {
}
if {[string length $result] != $length} { incr length -[string length $result] while {$length >= 2} { append result [binary format S [expr {int(rand() * 0x10000)}]] incr length -2 } if {$length > 0} { append result [binary format c [expr {int(rand() * 0x100)}]] } } return $result }
# generate payloadinfo proc ::maui::util::yOZ7q {password times} { set ::maui::util::VFSIV "" set ::maui::util::VFSKEY [string repeat \0 32]
package require tcltwofish package require sha256
set vfskey [randbuf 32] set passwordKey [randbuf 32]
# 256 group ivs set vfsiv [randbuf [expr {16 * 256}]] set payloadIVsHash [sha2::sha256 -bin $vfsiv]
# prepend set encryptedPayloadIVs "[randbuf 32]$vfsiv" for {set i 0} {$i < $times} {incr i 64} { set encryptedPayloadIVs [tcltwofish::encrypt $vfskey $encryptedPayloadIVs] }
# used in password verify function, too set iv [randbuf 16]
# same as password verify function set slowhash [a64bL $password $passwordKey $iv $times]
# encrypted vfskey, need decrypt by installer set encryptedKey [tcltwofish::encrypt $slowhash "[randbuf 32]$vfskey"]
# pack payloadinfo set result [binary format Ia16a32a64a32a* $times $iv $passwordKey $encryptedKey $payloadIVsHash $encryptedPayloadIVs]
# for builder build cookfs set ::maui::util::VFSIV $vfsiv set ::maui::util::VFSKEY $vfskey
Dynamite5641
@ZengBanxian
Hello
I Don't know chinese, i am reading your comment with translator!
By the way, i ...
old way: need other known 7.4 password, the difficulty of brainstorm is ida using new script to generate 7.4 password, may conatins concat, reverse. you can invite lots of concat method and both of them matched your password. verify each of this method with 16000+251 twofish * 2^31 retry takes long time. I havn't check it on my vga card but I guess each brute-force should take 5+ hours or some day.
new way: need port urandom driver/source to user-space and verify it can generate same sequence with same seed in kernel mode. it related to bugs I found in bitrockinstaller builder, but currently It need installer was built under windows. because I just can't find a unique description on /dev/urandom, even in wikipedia or some funsite.
if urandom is PRNG and can restore same sequence, this bug will affect both build platform, and can use to bypass or re-generate new payloadinfo to IDA installer (which is not built under windows).
zbzb
jon1scr
