-
-
[原创]VMWare安装破解FortiGate7.4.2
-
发表于: 2024-12-13 14:45
-
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
大佬厉害
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
大佬，我想搭建这个环境，但是为什么提取不出来key？
 FGT_VM64-v7.4.2.F/fortigate-crypto$ python getrootfskey.py ~/fortios/FGT_VM64-v7.4.2.F/flatkc_elf Architecture: x86_64 [WARNING ]: cannot get bytes [WARNING ]: cannot disasm at FF4C6D6DFF4C6E3E Traceback (most recent call last): File "/home/sakura/fortios/FGT_VM64-v7.4.2.F/fortigate-crypto/getrootfskey.py", line 57, in <module> seed_addr = min(all_seeds) ^^^^^^^^^^^^^^ ValueError: min() iterable argument is empty |
|
|
fgt_verifier_pub_key函数的地址有问题，你提取出来的elf有符号表吗，或者看看有没有fgt_verifier_pub_key函数 |
|
|
|
|
|
有的 .init.text:FFFFFFFF81709368 .init.text:FFFFFFFF81709368 ; =============== S U B R O U T I N E ======================================= .init.text:FFFFFFFF81709368 .init.text:FFFFFFFF81709368 ; fgt_verifier_pub_key: Derives RSA public key (n, e) from hardcoded seed using SHA-256. .init.text:FFFFFFFF81709368 ; Seed @ 0xffffffff817932E0, RSA key material @ 0xffffffff817931C0. .init.text:FFFFFFFF81709368 ; Calls sha256_init/update/final to compute key components. .init.text:FFFFFFFF81709368 ; Attributes: bp-based frame .init.text:FFFFFFFF81709368 .init.text:FFFFFFFF81709368 ; unsigned __int64 __fastcall fgt_verifier_pub_key(__int64) .init.text:FFFFFFFF81709368 fgt_verifier_pub_key proc near ; CODE XREF: fgt_verifier_init+61↓p .init.text:FFFFFFFF81709368 .init.text:FFFFFFFF81709368 var_120 = byte ptr -120h .init.text:FFFFFFFF81709368 var_100 = byte ptr -100h .init.text:FFFFFFFF81709368 var_C0 = qword ptr -0C0h .init.text:FFFFFFFF81709368 var_58 = byte ptr -58h .init.text:FFFFFFFF81709368 var_38 = byte ptr -38h .init.text:FFFFFFFF81709368 var_18 = qword ptr -18h .init.text:FFFFFFFF81709368 .init.text:FFFFFFFF81709368 push rbp ; fgt_verifier_pub_key: Derives RSA public key (n, e) from hardcoded seed using SHA-256. .init.text:FFFFFFFF81709368 ; Seed @ 0xffffffff817932E0, RSA key material @ 0xffffffff817931C0. .init.text:FFFFFFFF81709368 ; Calls sha256_init/update/final to compute key components. .init.text:FFFFFFFF81709369 mov rbp, rsp .init.text:FFFFFFFF8170936C push r13 .init.text:FFFFFFFF8170936E push r12 .init.text:FFFFFFFF81709370 sub rsp, 110h .init.text:FFFFFFFF81709377 mov r13, rdi .init.text:FFFFFFFF8170937A mov rax, gs:28h .init.text:FFFFFFFF81709383 mov [rbp+var_18], rax .init.text:FFFFFFFF81709387 xor eax, eax .init.text:FFFFFFFF81709389 lea rdi, [rbp+var_C0] .init.text:FFFFFFFF81709390 call sha256_init_0 .init.text:FFFFFFFF81709395 mov edx, 1Dh .init.text:FFFFFFFF8170939A mov rsi, offset unk_FFFFFFFF817932E3 .init.text:FFFFFFFF817093A1 lea rdi, [rbp+var_C0] .init.text:FFFFFFFF817093A8 call sha256_update_0 .init.text:FFFFFFFF817093AD mov edx, 3 .init.text:FFFFFFFF817093B2 mov rsi, offset unk_FFFFFFFF817932E0 .init.text:FFFFFFFF817093B9 lea rdi, [rbp+var_C0] .init.text:FFFFFFFF817093C0 call sha256_update_0 .init.text:FFFFFFFF817093C5 lea r12, [rbp+var_58] .init.text:FFFFFFFF817093C9 mov rsi, r12 .init.text:FFFFFFFF817093CC lea rdi, [rbp+var_C0] .init.text:FFFFFFFF817093D3 call sha256_final_0 .init.text:FFFFFFFF817093D8 lea rdi, [rbp+var_C0] .init.text:FFFFFFFF817093DF call sha256_init_0 .init.text:FFFFFFFF817093E4 mov edx, 1Fh .init.text:FFFFFFFF817093E9 mov rsi, offset byte_FFFFFFFF817932E1 .init.text:FFFFFFFF817093F0 lea rdi, [rbp+var_C0] .init.text:FFFFFFFF817093F7 call sha256_update_0 .init.text:FFFFFFFF817093FC mov edx, 1 .init.text:FFFFFFFF81709401 mov rsi, offset unk_FFFFFFFF817932E0 .init.text:FFFFFFFF81709408 lea rdi, [rbp+var_C0] .init.text:FFFFFFFF8170940F call sha256_update_0 .init.text:FFFFFFFF81709414 lea rsi, [rbp+var_38] .init.text:FFFFFFFF81709418 lea rdi, [rbp+var_C0] .init.text:FFFFFFFF8170941F call sha256_final_0 .init.text:FFFFFFFF81709424 lea rdi, [rbp+var_120] .init.text:FFFFFFFF8170942B mov ecx, 8 .init.text:FFFFFFFF81709430 mov rsi, r12 .init.text:FFFFFFFF81709433 rep movsd |
|
|
这一行报错不太对[WARNING ]: cannot disasm at FF4C6D6DFF4C6E3E 正常地址应该是FFFFFFFF80xxxxxx吧，可以试试改一下脚本指定一下fgt_verifier_pub_key函数的位置 也可能是他github脚本里面的函数名是sha256_update，你这里是sha256_update_0导致识别不出函数 然后我是没有成功恢复符号表的，想跟你交流一下 |
