码迷,mamicode.com
首页 > 其他好文 > 详细

chrome配置文件校验初始化隐含参数的逆向

时间:2015-08-17 19:39:38      阅读:119      评论:0      收藏:0      [点我收藏+]

标签:chrome startup_url

 这篇文章接上一篇文章进一步升华:花了4个小时获得该信息的计算方式
比如在 chrome目录下的
\Chrome\User Data\Default目录下的Secure Preferences,需要设置"startup_urls":["http://www.baidu.com/"]改参数时,chrome会在该文件中生成"startup_urls":"651507D384340BD7A56E3D3D7646C797AB1593B15400B397908EF95BD2D4CB16"该校验信息,
该校验信息就是上一篇文章中所计算的hash sha256值怎么计算呢

chrome会组合这样的参数 
ASCII "0A52ED0B71E75641568A87D0663A83205BA78F88FC2363B9D0session.startup_urls
["http://www.baidu.com/"]" ,对该字符窜计算sha256 就会生成 startup_urls":"651507D384340BD7A56E3D3D7646C797AB1593B15400B397908EF95BD2D4CB16"这样的hash校验值,
注意  红色的字符窜中 
0A52ED0B71E75641568A87D0663A83205BA78F88FC2363B9是如何生成的呢
 计算方法如下:
 1.先获得用户电脑名称
2.然后对该用户去取的Security id 即sid
3.对获得sid进行标准的sha1 hash值
由于简单我直接贴代码: 代码相当简单
bool GetComputerSecurityId( wchar_t security_id[64] )
{
wchar_t account_name[MAX_PATH] = {0};
unsigned long account_len = MAX_PATH;
wchar_t sid[MAX_PATH] = {0};
char sid_buffer[24] = {0};
if ( GetComputerNameW( 
account_name,
&account_len ))
{
if( AddAccessRights( account_name , &sid , 2*MAX_PATH ))
{
ConvertSidToStringSidW( &sid,
  (LPWSTR *)sid_buffer );
if ( security_id && (*(unsigned long*)sid_buffer) )
{
memcpy( security_id , (const void *)(*(unsigned long*)sid_buffer) , MAX_PATH );

LocalFree( (HLOCAL)(*(unsigned long*)sid_buffer) );
}
}
}

return false;
}


bool AddAccessRights(wchar_t* lpAccountName,
PSID Sid,
unsigned long cb_sid_len )
{
wchar_t* account_name = (wchar_t*)HeapAlloc( GetProcessHeap(),0, 2*MAX_PATH );
unsigned long cchReferencedDomainName ;
SID_NAME_USE peUse;
unsigned long cbSid;
BOOLisSuccess = 0;

cbSid = cb_sid_len;
cchReferencedDomainName = 2*MAX_PATH;
if ( account_name )
{
isSuccess = LookupAccountNameW( 
NULL, 
lpAccountName,
Sid, 
&cbSid, 
account_name,
&cchReferencedDomainName, 
&peUse );



if ( !isSuccess )
{
if ( GetLastError() == 122 )
{
if ( cbSid <= cb_sid_len )
{
if ( cchReferencedDomainName > 128 )
{
cchReferencedDomainName = 2 * cchReferencedDomainName;
}

isSuccess = LookupAccountNameW(
NULL,
lpAccountName,
Sid,
&cbSid,
account_name,
&cchReferencedDomainName,
&peUse);
}
}
}
}


if ( account_name )
{
HeapFree( GetProcessHeap() , 0 , account_name );
account_name = NULL;
}

return isSuccess;
}

bool GetVolumeSerialNumber( unsigned long* serial )
{
char root_name[MAX_PATH] = {0};
char* root_disk = 0;
unsigned long VolumeSerialNumber = 0;
if( GetSystemDirectory( root_name ,
MAX_PATH ) && serial )
{
if ( root_disk = strstr( root_name, "\\") )
{
root_disk[1] = 0;
*serial = 0;
if ( GetVolumeInformation(
&root_name[0],
0,
0,
&VolumeSerialNumber,
0,
0,
0,
0) )
{
*serial = VolumeSerialNumber;
return true;
}

}
}

return false;
}


bool GetComputerHashSha1(char* hash_id )
{
wchar_t wcSid[200] = {0};
unsigned long SerialNumber = 0;

GetComputerSecurityId( wcSid );
GetVolumeSerialNumber(&SerialNumber);

char szhashId[40] = {0};
base::SHA1HashBytes( (const unsigned char *)wcSid , 2*lstrlenW(wcSid) , (unsigned char *)szhashId );
return true;
} 
 

2.第二个隐含数据
第二个隐含数据是在目录下resources.pak文件鼠标框的位置,取64个字节,放入sha256的计算第一个字符窜参数
 


技术分享

技术分享

版权声明:本文为博主原创文章,未经博主允许不得转载。

chrome配置文件校验初始化隐含参数的逆向

标签:chrome startup_url

原文地址:http://blog.csdn.net/basketwill/article/details/47728481

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!