SakuraKooi SakuraKoi

Introduction

This small document will explain how I cracked version 3.3.1 of JNIC. (https://jnic.dev)

Motive

The motive of this crack was simply to test the strength of "DRM" applied to JNIC.

Methodology

Discovering the funny

Upon opening the JNIC JAR in a decompiler, I quickly discovered a 'JNICLoader' class, which contained methods whos first parameter were MethodHandles (all of these methods were named 'invoke').

	import requests
	import threadpool
	from IPy import IP

	def IP_Test(ip):
	try:
	r = requests.get('http://' + ip + '/', timeout=3)
	if 'Direct IP access not allowed' in r.text:
	print('可用:' + ip, flush=True)
	else:

	/**
	* Inspired by @MoOx original script: https://gist.github.com/MoOx/93c2853fee760f42d97f
	* Adds file download per @micalevisk https://gist.github.com/MoOx/93c2853fee760f42d97f#gistcomment-2660220
	*
	* Changes include:
	* - Get the description from the `title` attribute instead of `aria-label` (doesn't exist anymore)
	* - Use style.backgroundColor and parse the rgb(...) to hex (rather than regex parsing of 'style' string)
	* - Downloads labels to a JSON file named after the webpage to know which GitHub repo they came from.
	*
	* Last tested 2019-July-27:

	console.table((function listAllEventListeners() {
	const allElements = Array.prototype.slice.call(document.querySelectorAll('*'));
	allElements.push(document); // we also want document events
	const types = [];
	for (let ev in window) {
	if (/^on/.test(ev)) types[types.length] = ev;
	}

	let elements = [];
	for (let i = 0; i < allElements.length; i++) {

	// OverwolfEmulator.cpp : définit le point d'entrée pour l'application console.
	//

	#include "stdafx.h"
	#include <Windows.h>
	#include <stdint.h>

	#define OVERLAY_MAGIC_NUMBER 0x00000005

	struct OverlayMsgHeader {

	import org.slf4j.Logger;
	import org.slf4j.LoggerFactory;

	import java.io.IOException;
	import java.nio.file.*;

	public class FileWatcher {
	private static final Logger log = LoggerFactory.getLogger(FileWatcher.class);

	private Thread thread;

	# Creates Structures TypeInfo / TypeInfoData
	def initStructures():
	strucId = GetStrucIdByName("TypeInfo")
	if (strucId == BADADDR):
	strucIdInfoData = AddStrucEx(-1, "TypeInfoData", 0)
	AddStrucMember(strucIdInfoData, "m_name", -1, (FF_QWRD\|FF_DATA\|FF_0CHAR), ASCSTR_C, 8)
	ApplyType(GetMemberId(strucIdInfoData, 0), ParseType("char*", 0))

	strucId = AddStrucEx(-1, "TypeInfo", 0)
	AddStrucMember(strucId, "m_infoData", -1, (FF_QWRD\|FF_DATA\|FF_0STRO), 0, 8)

	https://code.google.com/p/android/issues/detail?id=32696#c5

	If you have a certificate that is not
	trusted by Android, when you add it, it goes in the personal cert store.
	When you add a cert in this personal cert store, the system requires a
	higher security level to unlock the device. But if you manage to add your
	cert to the system store then you don't have this requirement. Obviously,
	root is required to add a certificate to the system store, but it is quiet
	easy.

	/* credits to http://blog.techorganic.com/2015/01/04/pegasus-hacking-challenge/ */
	#include <stdio.h>
	#include <unistd.h>
	#include <netinet/in.h>
	#include <sys/types.h>
	#include <sys/socket.h>

	#define REMOTE_ADDR "XXX.XXX.XXX.XXX"
	#define REMOTE_PORT XXX

	/*
	* Auto-generated JNIC implementation file
	*
	*
	*
	*
	*
	*
	*/