| from Crypto.Cipher import PKCS1_OAEP | |
| from Crypto.PublicKey import RSA | |
| from Crypto.Cipher import AES | |
| from Crypto.Hash import SHA256, CMAC | |
| from json import loads | |
| from urllib.parse import urlparse | |
| from random import randbytes | |
| from sys import argv | |
| import requests | |
| import zlib |
| <# : | |
| :: I wonder who made Task Manager... | |
| @setlocal DisableDelayedExpansion | |
| @echo off | |
| echo "%*" | find /i "-el" >nul && set _elev=1 | |
| set _PSarg="""%~f0""" -el |
Making public so other people can save the time I wasted. It may apply to other similar boards/PCs with 2011-ish era AMI BIOS as well.
Both guides here need a dump of BIOS ROM.
Same as this guide: https://gist.github.com/en4rab/550880c099b5194fbbf3039e3c8ab6fd
| Name | Min Service Pack | Max Service Pack | BINK | Start | End | Type | Days to Activate | Days Evaluation | |
|---|---|---|---|---|---|---|---|---|---|
| Windows Compute Cluster Server 2003 | 1 | ? | 64 | 1000000 | 1999999 | Evaluation | 14 | 185 | |
| Windows Compute Cluster Server 2003 | 1 | ? | 64 | 2000000 | 2499999 | Evaluation | 14 | 185 | |
| Windows Compute Cluster Server 2003 | 1 | ? | 64 | 2500000 | 2999999 | Evaluation | 14 | 185 | |
| Windows Compute Cluster Server 2003 | 1 | ? | 6A | 5000000 | 14999999 | Evaluation | 14 | 185 | |
| Windows Compute Cluster Server 2003 | 1 | ? | 6A | 101000000 | 110999999 | Evaluation | 14 | 185 | |
| Windows Compute Cluster Server 2003 | 1 | ? | 6A | 112000000 | 113999999 | Evaluation | 120 | 60 | |
| Windows Compute Cluster Server 2003 | 1 | ? | 6A | 114000000 | 133999999 | Evaluation | 14 | 185 | |
| Windows Compute Cluster Server 2003 | 1 | ? | 6A | 134000000 | 135999999 | Evaluation | 120 | 60 | |
| Windows Compute Cluster Server 2003 | 1 | ? | 6A | 136000000 | 145999999 | Evaluation | 14 | 185 |
| from sys import argv | |
| from x64dbg_automate import X64DbgClient | |
| client = X64DbgClient(argv[1]) | |
| client.attach_session(X64DbgClient.list_sessions()[0].pid) | |
| base_addr = client.eval_sync(argv[2])[0] | |
| start_rva = int(argv[3], 16) | |
| end_rva = start_rva + int(argv[4], 16) |
| import subprocess | |
| import tempfile | |
| import struct | |
| import zlib | |
| import sys | |
| import os | |
| import csv | |
| from pydantic import BaseModel | |
| from pydantic.dataclasses import dataclass |
| #include <stdio.h> | |
| #include <windows.h> | |
| #include <winternl.h> | |
| #pragma comment(lib, "bcrypt.lib") | |
| #pragma comment(lib, "ntdll.lib") | |
| typedef struct _FEISTEL64_ROUND_DATA { | |
| DWORD FunctionID; | |
| DWORD Rand0; |
| """ | |
| 4128 - MAC Address | |
| 4130 - NDIS_PHYSICAL_MEDIUM, MAC Address, Adapter Bus | |
| 4112 - IOCTL_STORAGE_QUERY_PROPERTY StorageDeviceProperty -> STORAGE_DEVICE_DESCRIPTOR | |
| 4113 - Serial|Model|Vendor | |
| 4097 - BIOS Vendor | |
| 4098 - SMBIOS Vendor | |
| 4099 - SMBIOS Product Name | |
| 4100 - SMBIOS Version | |
| 4101 - SMBIOS Serial Number |
These are very disorganized because I wrote these as I reversed various bits and pieces. If I'm wrong about something, please let me know so I can forget to update this.
For me this was the Achilles' heel, Crackproof creates a debug log if a certain folder in %temp% is present. The folder name is 12 hex characters long, and different between executables. The easiest way to find it is to break on/hook CreateFileW.
Once you create it, any Crackproofed modules will spit out logs as they unpack. Lines contain status codes, indicating roughly what the unpacker is doing at a given time (see below). Lines with additional debug information are also included, sometimes they can be very handy.
| from fractions import Fraction | |
| def invert(n): | |
| if n == 0: | |
| return None | |
| return Fraction(1, n) | |
| def solve(r, x): | |
| if x == 0 or x is None: |
