arti/WindowsXPKg
1
0
Fork 0
mirror of https://github.com/Neo-Desktop/WindowsXPKg synced 2024-12-22 20:40:16 +02:00
Code Issues Packages Projects Releases Wiki Activity

[Server] Successful generation refactor, more to come

Browse Source
This commit is contained in:
Andrew 2023-06-05 15:26:51 +03:00
parent da7e88b970
commit 530e5cdc21
1 changed files with 47 additions and 64 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

111
src/server.cpp
View File

@ -86,12 +86,12 @@ bool verifyServerKey(
SHA1(msgBuffer, 11, msgDigest); SHA1(msgBuffer, 11, msgDigest);
QWORD newHash2 = (QWORD)(BYDWORD(&msgDigest[4]) >> 2 & BITMASK(30)) << 32 | BYDWORD(msgDigest); QWORD newHash = (BYDWORD(&msgDigest[4]) >> 2 & BITMASK(30)) << 32 | BYDWORD(msgDigest);
BIGNUM *x = BN_new(); BIGNUM *x = BN_new();
BIGNUM *y = BN_new(); BIGNUM *y = BN_new();
BIGNUM *s = BN_lebin2bn((BYTE *)&pSignature, sizeof(pSignature), nullptr); BIGNUM *s = BN_lebin2bn((BYTE *)&pSignature, sizeof(pSignature), nullptr);
BIGNUM *e = BN_lebin2bn((BYTE *)&newHash2, 8, nullptr); BIGNUM *e = BN_lebin2bn((BYTE *)&newHash, sizeof(newHash), nullptr);
EC_POINT *u = EC_POINT_new(eCurve); EC_POINT *u = EC_POINT_new(eCurve);
EC_POINT *v = EC_POINT_new(eCurve); EC_POINT *v = EC_POINT_new(eCurve);
@ -165,16 +165,17 @@ void generateServerKey(
BOOL wrong = false; BOOL wrong = false;
QWORD pSignature = 0; QWORD pSignature = 0;
BIGNUM *c = BN_new();
BIGNUM *s = BN_new();
BIGNUM *x = BN_new();
BIGNUM *y = BN_new();
BIGNUM *b = BN_new();
do { do {
wrong = false; wrong = false;
BIGNUM *c = BN_new(); DWORD hash = 0;
BIGNUM *s = BN_new(); QWORD h = 0;
BIGNUM *x = BN_new();
BIGNUM *y = BN_new();
BIGNUM *b = BN_new();
DWORD hash = 0, h[2]{};
memset(bKey, 0, 4); memset(bKey, 0, 4);
@ -187,66 +188,48 @@ void generateServerKey(
// x = r.x; y = r.y; // x = r.x; y = r.y;
EC_POINT_get_affine_coordinates(eCurve, r, x, y, ctx); EC_POINT_get_affine_coordinates(eCurve, r, x, y, ctx);
SHA_CTX hContext; BYTE msgDigest[SHA_DIGEST_LENGTH]{},
BYTE md[SHA_DIGEST_LENGTH]{}, buf[FIELD_BYTES_2003]{}; msgBuffer[SHA_MSG_LENGTH_2003]{},
xBin[FIELD_BYTES_2003]{},
yBin[FIELD_BYTES_2003]{};
// Convert resulting point coordinates to bytes.
BN_bn2lebin(x, xBin, FIELD_BYTES_2003);
BN_bn2lebin(y, yBin, FIELD_BYTES_2003);
// Assemble the SHA message.
// Hash = SHA-1(79 || OS Family || r.x || r.y) // Hash = SHA-1(79 || OS Family || r.x || r.y)
SHA1_Init(&hContext); msgBuffer[0x00] = 0x79;
msgBuffer[0x01] = (pChannelID & 0x00FF);
msgBuffer[0x02] = (pChannelID & 0xFF00) >> 8;
buf[0] = 0x79; memcpy((void *)&msgBuffer[3], (void *)xBin, FIELD_BYTES_2003);
memcpy((void *)&msgBuffer[3 + FIELD_BYTES_2003], (void *)yBin, FIELD_BYTES_2003);
buf[1] = (pChannelID & 0xff); // Retrieve the message digest.
buf[2] = (pChannelID & 0xff00) >> 8; SHA1(msgBuffer, SHA_MSG_LENGTH_2003, msgDigest);
SHA1_Update(&hContext, buf, 3); hash = BYDWORD(msgDigest) & BITMASK(31);
memset(buf, 0, FIELD_BYTES_2003);
BN_bn2bin(x, buf);
endian((BYTE *)buf, FIELD_BYTES_2003);
SHA1_Update(&hContext, buf, FIELD_BYTES_2003);
memset(buf, 0, FIELD_BYTES_2003);
BN_bn2bin(y, buf);
endian((BYTE *)buf, FIELD_BYTES_2003);
SHA1_Update(&hContext, buf, FIELD_BYTES_2003);
SHA1_Final(md, &hContext);
hash = (md[0] | (md[1] << 8) | (md[2] << 16) | (md[3] << 24)) & 0x7fffffff;
// H = SHA-1(5D || OS Family || Hash || Prefix || 00 00) // H = SHA-1(5D || OS Family || Hash || Prefix || 00 00)
SHA1_Init(&hContext); msgBuffer[0x00] = 0x5D;
buf[0] = 0x5D; msgBuffer[0x01] = (pChannelID & 0x00FF);
msgBuffer[0x02] = (pChannelID & 0xFF00) >> 8;
msgBuffer[0x03] = (hash & 0x000000FF);
msgBuffer[0x04] = (hash & 0x0000FF00) >> 8;
msgBuffer[0x05] = (hash & 0x00FF0000) >> 16;
msgBuffer[0x06] = (hash & 0xFF000000) >> 24;
msgBuffer[0x07] = (pAuthInfo & 0x00FF);
msgBuffer[0x08] = (pAuthInfo & 0xFF00) >> 8;
msgBuffer[0x09] = 0x00;
msgBuffer[0x0A] = 0x00;
buf[1] = (pChannelID & 0xff); SHA1(msgBuffer, 11, msgDigest);
buf[2] = (pChannelID & 0xff00) >> 8;
buf[3] = (hash & 0xff);
buf[4] = (hash & 0xff00) >> 8;
buf[5] = (hash & 0xff0000) >> 16;
buf[6] = (hash & 0xff000000) >> 24;
buf[7] = (pAuthInfo & 0xff);
buf[8] = (pAuthInfo & 0xff00) >> 8;
buf[9] = 0x00;
buf[10] = 0x00;
// Input length is 11 BYTEs.
SHA1_Update(&hContext, buf, 11);
SHA1_Final(md, &hContext);
// First word. // First word.
h[0] = md[0] | (md[1] << 8) | (md[2] << 16) | (md[3] << 24); h = (BYDWORD(&msgDigest[4]) >> 2 & BITMASK(30)) << 32 | BYDWORD(msgDigest);
// Second word, right shift 2 bits. BN_lebin2bn((BYTE *)&h, sizeof(h), b);
h[1] = (md[4] | (md[5] << 8) | (md[6] << 16) | (md[7] << 24)) >> 2;
h[1] &= 0x3FFFFFFF;
endian((BYTE *)h, 8);
BN_bin2bn((BYTE *)h, 8, b);
/* /*
* Signature * (Signature * G + H * K) = rG (mod p) * Signature * (Signature * G + H * K) = rG (mod p)
@ -305,18 +288,18 @@ void generateServerKey(
// Pack product key. // Pack product key.
packServer(bKey, pChannelID, hash, pSignature, pAuthInfo); packServer(bKey, pChannelID, hash, pSignature, pAuthInfo);
BN_free(c);
BN_free(s);
BN_free(x);
BN_free(y);
BN_free(b);
} while (HIBYTES(pSignature, sizeof(DWORD)) >= 0x40000000); } while (HIBYTES(pSignature, sizeof(DWORD)) >= 0x40000000);
base24(pKey, (BYTE *)bKey); base24(pKey, (BYTE *)bKey);
std::cout << "attempt pass " << pKey << " key is " << (wrong ? "INVALID" : "VALID") << std::endl; std::cout << "attempt pass " << pKey << " key is " << (wrong ? "INVALID" : "VALID") << std::endl;
BN_free(c);
BN_free(s);
BN_free(x);
BN_free(y);
BN_free(b);
BN_CTX_free(ctx); BN_CTX_free(ctx);
EC_POINT_free(r); EC_POINT_free(r);
} }