python代码破解navicat17.3.x

gxr2010

最近在github上看到一个python代码破解Navicat17.3.x，经测试可以破解最新版的Navicat17.3.6，现分享给大家。

[Python] 纯文本查看 复制代码

import lief, base64, json, time, os
from lief.PE import Binary, Section
from Crypto.PublicKey import RSA
from Crypto.Cipher import PKCS1_v1_5

PE_FILE_PATH = "libcc.dll"

ORIGINAL_BYTECODE = b"".join(
    [
        b"\x48\x8b\xd0\x48\x8b\xcf\xff\xd3\x48\x89\x46\x20\x48\x8b\x55\x10",
        b"\x48\x83\xfa\x0f\x76\x34\x48\xff\xc2\x48\x8b\x4d\xf8\x48\x8b\xc1",
        b"\x48\x81\xfa\x00\x10\x00\x00\x72\x1c\x48\x83\xc2\x27\x48\x8b\x49",
        b"\xf8\x48\x2b\xc1\x48\x83\xc0\xf8\x48\x83",
    ]
)

PATCH_BYTECODE = b"".join(
    [
        b"\x48\x8d\x0d\x00\x00\x00\x00\x48\x89\x08\x48\x89\xc2\x48\x89\xf9",
        b"\xff\xd3\x48\x89\x46\x20\x48\x8b\x55\x10\x90\x90\x90\x90\x90\x90",
        b"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90",
        b"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90",
        b"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90",
    ]
)


def find_bytes(pe_file: str, pattern: bytes) -> int:
    with open(pe_file, "rb") as f:
        data = f.read()
        patch_file_offset = data.find(ORIGINAL_BYTECODE)
        if patch_file_offset == -1:
            raise ValueError("Original bytecode not found in the binary.")
        return patch_file_offset


def add_pkey_section(pe: Binary, public_key: str) -> None:
    pkey_section = Section(".pkey")
    payload = public_key.encode() + b"\0"
    pkey_section.content = list(payload)  # type: ignore
    pkey_section.virtual_size = len(payload)
    pkey_section.characteristics = Section.CHARACTERISTICS.MEM_READ  # type: ignore
    pe.add_section(pkey_section)  # type: ignore


def calc_offset(pe: Binary, patch_file_offset: int) -> int:
    text_scection = pe.get_section(".text")
    pkey_section = pe.get_section(".pkey")

    text_file_offset = text_scection.pointerto_raw_data
    text_virtual_address = text_scection.virtual_address
    pkey_virtual_address = pkey_section.virtual_address
    offset_from_rip = pkey_virtual_address - (text_virtual_address + patch_file_offset - text_file_offset + 7)

    print(".text FOA:", hex(text_file_offset))
    print(".text VA: ", hex(text_virtual_address))
    print(".pkey VA: ", hex(pkey_virtual_address))
    print(f"Patch assembly code: lea rcx, [rip + {hex(offset_from_rip)}]")
    return offset_from_rip


def patch_pe(pe_file: str, patch_file_offset: int) -> None:
    with open(pe_file, "rb+") as f:
        f.seek(patch_file_offset)
        f.write(patch_bytecode)
        print(f"Patched binary written to {pe_file}")


def decrypt_request(reg: str, key: RSA.RsaKey) -> str:
    cipher = PKCS1_v1_5.new(key)
    plain = cipher.decrypt(base64.b64decode(reg), None)
    if plain is None:
        raise ValueError("解密失败，注册信息无效")
    return plain.decode()


def pkcs1_v15_private_pad(message: bytes, key: RSA.RsaKey) -> bytes:
    k = key.size_in_bytes()
    if len(message) > k - 11:
        raise ValueError("message too long for RSA modulus")

    ps_len = k - len(message) - 3
    ps = b'\xFF' * ps_len  # BlockType=1 -> FF 填充
    em = b'\x00\x01' + ps + b'\x00' + message
    return em


def rsa_private_encrypt(message: bytes, key_pem: str) -> str:
    key = RSA.import_key(key_pem)
    em = pkcs1_v15_private_pad(message, key)
    m_int = int.from_bytes(em, 'big')
    c_int = pow(m_int, key.d, key.n)
    return base64.b64encode(c_int.to_bytes(key.size_in_bytes(), 'big')).decode()


if __name__ == "__main__":
    if not os.path.exists(PE_FILE_PATH):
        print(f"PE 文件 {PE_FILE_PATH} 不存在。请在Navicat安装目录下运行此脚本。")
        exit(1)

    print("Navicat 17.3.x 激活补丁脚本")
    print("请先断开网络, 并关闭所有 Navicat 相关进程后再运行此脚本...")
    ask = input("确认继续? (y/n): ").strip().lower()
    if ask != "y" and ask != "yes" and ask != "Y":
        print("操作已取消。")
        exit(0)

    print("开始激活流程...")
    print()

    print("Step 1: 备份源文件")
    backup_path = PE_FILE_PATH + ".bak"
    if not os.path.exists(backup_path):
        os.rename(PE_FILE_PATH, backup_path)
        print(f"已备份为 {backup_path}")
    else:
        print(f"备份文件 {backup_path} 已存在，跳过备份步骤")
    print()

    print("Step 2: 生成自定义密钥对")
    key = RSA.generate(2048)
    priv_pem = key.export_key().decode()
    pub_pem = key.publickey().export_key().decode()
    public_key = "".join(pub_pem.splitlines()[1:-1])
    print("密钥对已生成。")
    print("公钥:")
    print(pub_pem)
    print("私钥:")
    print(priv_pem)
    print()

    print("Step 3: 应用补丁")
    patch_file_offset = find_bytes(backup_path, ORIGINAL_BYTECODE)
    print(f"找到待修补位置: {hex(patch_file_offset)}")
    pe = lief.parse(backup_path)
    assert pe is not None
    assert isinstance(pe, Binary)

    add_pkey_section(pe, public_key)
    offset_from_rip = calc_offset(pe, patch_file_offset)
    patch_bytecode = PATCH_BYTECODE.replace(b"\x00\x00\x00\x00", offset_from_rip.to_bytes(4, byteorder="little"))
    pe.write(PE_FILE_PATH)
    patch_pe(PE_FILE_PATH, patch_file_offset)
    print("补丁应用完成")

    print("Step 4: 不要退出此脚本, 请断网后运行 Navicat, 输入密钥并使用离线激活:")
    print("NAVMIKCHCWNIHS3Q")
    print()
    os.system("start navicat.exe")
    req = input("请输入离线激活请求码:\n").strip()
    plain = decrypt_request(req, key)
    print("解密得到: ", plain)
    print()
    data = json.loads(plain)
    username = input("请输入用户名: ").strip()
    organization = input("请输入组织名: ").strip()
    t = int(time.time())
    data.update({
        "N": username,
        "O": organization,
        "T": t
    })
    msg = json.dumps(data, ensure_ascii=False).encode()
    reg = rsa_private_encrypt(msg, priv_pem).strip()
    print("激活码: \n")
    print(reg)
    print("\n请复制上面的激活码到 Navicat 激活窗口完成激活。")
    os.system("pause")

sdieedu

https://wwqv.lanzout.com/iMumh39bj57a     需要的扩展库离线文件，自行安装

tianyagd

ModuleNotFoundError: No module named 'Crypto'  错误提示
pip install pycryptodome 还是不行

msmvc

navicat要被玩死了

gxr2010

小锤子起钉儿

技术不错，谢谢分享

sk80089009

试试看，谢谢分享！

新颖轻

无限只用也挺好，起码不怕律师函

GaiLun996

技术不错，谢谢分享

千百度

确实可以，厉害了。

a20020414

有时间操作一下，很强。

crystalZ

人均会navicat破解