Last active
June 8, 2019 17:15
-
-
Save MoePus/e2dcb00f5f147acb296005ea9fc41261 to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
""" | |
from waigua.Util import * | |
src = liezao.malloc(8) | |
dst = liezao.malloc(8) | |
liezao.doCall(readU64(0x144B51330),dst) | |
liezao.doCall(readU64(0x144B50FF8),src,"3a85aa1edaae3aaa5aaafaaa5aa5ea7a7aae5aaa3caadaa5feaafaaadaaaadaaaadddaaa6daa5a6e2aadacdabada3aaa") | |
liezao.doCall(0x140EFEB40,src,dst) | |
""" | |
hwid = open("md.hw").read().strip() | |
sbox = [ | |
0x543,0x165,0x123,0x121,0x6779,0x5DEE3,0x5D9A9,0xF6B,0x2F8C7,0xE7471, | |
0x132F,0x2F63,0x6461,0x955,0x68A5,0x347D,0xDB949,0x571,0x6DE,0xDBCD9] | |
def reg_forward_shuffle(plain): | |
size = len(plain) | |
plain = list(plain) | |
for i in range(size): | |
j = (i + sbox[i % 20]) % size | |
a = plain[i] | |
b = plain[j] | |
plain[i] = b | |
plain[j] = a | |
return "".join(plain) | |
def reg_reverse_shuffle(plain): | |
size = len(plain) | |
plain = list(plain) | |
for i in range(size-1, 0-1, -1): | |
j = (i + sbox[i % 20]) % size | |
a = plain[i] | |
b = plain[j] | |
plain[i] = b | |
plain[j] = a | |
return "".join(plain) | |
def reg_replace(plain): | |
trantab = str.maketrans("0123456789abcdef", "afe9c7d5b3084621") | |
return plain.translate(trantab) | |
def reg_pack(plain): | |
cipher = "" | |
for ch in plain: | |
x = ch.encode("utf-16") | |
cipher += "%02x" % x[3] | |
cipher += "%02x" % x[2] | |
return cipher | |
def reg_unpack(cipher): | |
from struct import pack | |
plain = "" | |
for i in range(0,len(cipher),4): | |
plain += pack("H", int(cipher[i:i+4],16)).decode("utf-16") | |
return plain | |
def reg_inverse_transform(cipher): | |
cipher = reg_reverse_shuffle(cipher) | |
cipher = reg_replace(cipher) | |
cipher = reg_unpack(cipher) | |
return cipher | |
def reg_transform(plain): | |
plain = reg_pack(plain) | |
plain = reg_replace(plain) | |
plain = reg_forward_shuffle(plain) | |
return plain | |
def reg_forward(info): | |
plain = " ".join(map(lambda x:reg_transform(x), info.values()))+" " | |
from hashlib import md5 | |
m = md5() | |
m.update(plain.encode()) | |
plain = plain + m.hexdigest() | |
plain = reg_transform(plain) | |
return plain | |
def hwid_decode(hwid): | |
hwid = map(reg_inverse_transform,reg_inverse_transform(hwid).split("^")) | |
return list(hwid) | |
hwid = hwid_decode(hwid) | |
#print(hwid) | |
import datetime | |
now = datetime.datetime.now() | |
regcode = reg_forward({ | |
"username": "MoePus", | |
"password": "a_fake_password", | |
"version": "80", | |
"licensetype": "Enterprise", | |
"hardwareID": hwid[-1].split("[[")[0], | |
"6": "BAADBEEF", | |
"7": "BAADF00D", | |
"TimeStart": now.strftime("%Y-%m-%d %H:%M"), | |
"TimeExpiry": now.strftime("%Y-%m-%d %H:%M"), | |
"MaintenanceStart": now.strftime("%Y-%m-%d %H:%M"), | |
"MaintenanceExpiry": now.strftime("%Y-%m-%d %H:%M"), | |
"12": "00000000" | |
}) | |
open(r"md.lcn","w").write(regcode) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment