lava1879

Notes

These are very disorganized because I wrote these as I reversed various bits and pieces. If I'm wrong about something, please let me know so I can forget to update this.

Logging

For me this was the Achilles' heel, Crackproof creates a debug log if a certain folder in %temp% is present. The folder name is 12 hex characters long, and different between executables. The easiest way to find it is to break on/hook CreateFileW.

Once you create it, any Crackproofed modules will spit out logs as they unpack. Lines contain status codes, indicating roughly what the unpacker is doing at a given time (see below). Lines with additional debug information are also included, sometimes they can be very handy.

Physical Store Private Key Derivation

Background

As described in the TSforge blogpost, the AES key needed to decrypt the physical store's contents is encrypted using an RSA whitebox located in a component known as the blackbox/secure processor (spsys.sys on Windows Vista/7, part of sppsvc.exe on Windows 8+). Luckily, with a debugger and a basic understanding of the math behind RSA, the private key of this whitebox can be easily extracted, allowing exploits like ZeroCID to be carried out on an unmodified system.

SpModExpPrv

In the symbols for spsys.sys in Windows 8 build 7850, the whitebox is named SpModExpPrv. This function only implements plain RSA decryption with a constant private key, and other code is used to implement operations such as padding and RSA encryption.

S Mode Escape

Requirements

Access to Administrator-level account
Does not require MS account
Does not require disabling secure boot

	#include <stdio.h>
	#include <windows.h>
	#include <winternl.h>

	#pragma comment(lib, "bcrypt.lib")
	#pragma comment(lib, "ntdll.lib")

	typedef struct _FEISTEL64_ROUND_DATA {
	DWORD FunctionID;
	DWORD Rand0;

	@echo off
	setlocal EnableDelayedExpansion

	fltmc >nul 2>&1
	if errorlevel 1 (
	echo This script needs admin rights.
	powershell -Command "Start-Process cmd -ArgumentList '/c \"%~f0\"' -Verb RunAs"
	exit /b
	)