Cornerstone简介
Cornerstone是Mac上最好用的SVN客户端。
破解过程
打开app,出现一个试用的窗口。二话不说,先用Xcode
附加调试看看:
(lldb) bt
......
frame #17: 0x00000001084e895d LicensingKit`-[ZTrialPeriodLicensingPolicy applyWithUserInterface:] + 173
frame #18: 0x00000001084ec4a7 LicensingKit`-[ZOwnershipLicensingPolicy applyWithUserInterface:] + 647
frame #19: 0x00000001084d0114 LicensingKit`-[ZSubscriptionLicensingPolicy applyWithUserInterface:] + 539
frame #20: 0x00000001084f8c20 LicensingKit`-[ZLicensePackageRegistrationPolicy applyWithUserInterface:] + 191
frame #21: 0x00000001084e7bbe LicensingKit`-[ZPreReleaseLicensingPolicy applyWithUserInterface:] + 221
frame #22: 0x00000001084eb543 LicensingKit`-[ZEULALicensingPolicy applyWithUserInterface:] + 234
frame #23: 0x00000001084ef071 LicensingKit`-[ZStandardLicensingPolicy applyWithUserInterface:] + 57
frame #24: 0x0000000107da5db7 Cornerstone`___lldb_unnamed_symbol596$$Cornerstone + 151
......
明显的责任链模式,在进行逐步验证。
顺带看看调用LicensingKit的地方还干了什么吧:
(lldb) image lookup --address 0x107da5db7
Address: Cornerstone[0x0000000100028db7] (Cornerstone.__TEXT.__text + 160647)
Summary: Cornerstone`___lldb_unnamed_symbol596$$Cornerstone + 151
hopper查看0x100028db7的伪代码:
void -[V4ApplicationDelegate finishLaunch](void * self, void * _cmd) {
r12 = self;
[self setSuppressUI:0x1];
rbx = [loc_1003330d0() retain];
if ((loc_1003331e0(rbx) != 0x0) && (loc_1003334c0(@"LicensingKit.framework", rbx) != 0x0)) {
[rbx release];
rbx = [loc_100276820() retain];
if (rbx != 0x0) {
if ([rbx applyWithUserInterface:0x1] == 0x1) {
[rbx release];
[r12 setup];
[r12 showPreFlightUserInterfaceWithCompletionHandler:__NSConcreteStackBlock];
}
else {
exit(0x0);
}
}
else {
exit(0x0);
}
}
else {
exit(0x0);
}
return;
}
这里做了一大堆验证,用jmp指令直接跳到setup函数处吧,修改0x100028d49处的指令为:
jmp 0x100028dc4
再次查看伪代码,干净多了:
void -[V4ApplicationDelegate finishLaunch](void * self, void * _cmd) {
r12 = self;
[self setSuppressUI:0x1];
[r12 setup];
[r12 showPreFlightUserInterfaceWithCompletionHandler:__NSConcreteStackBlock];
return;
}
因为涉及到文件的读写权限,接下来做重签名。
先读取权限信息:
$ codesign --display --entitlements - Cornerstone.app
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.application-identifier</key>
<string>7MNDD7QHBE.com.zennaware.cornerstone3</string>
<key>com.apple.developer.team-identifier</key>
<string>7MNDD7QHBE</string>
<key>com.apple.security.app-sandbox</key>
<true/>
<key>com.apple.security.files.bookmarks.app-scope</key>
<true/>
<key>com.apple.security.files.downloads.read-write</key>
<true/>
<key>com.apple.security.files.user-selected.read-write</key>
<true/>
<key>com.apple.security.network.client</key>
<true/>
<key>com.apple.security.print</key>
<true/>
</dict>
</plist>
新建一个entitlements.plist文件保存上面的内存,并去掉非权限的信息:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.security.app-sandbox</key>
<true/>
<key>com.apple.security.files.bookmarks.app-scope</key>
<true/>
<key>com.apple.security.files.downloads.read-write</key>
<true/>
<key>com.apple.security.files.user-selected.read-write</key>
<true/>
<key>com.apple.security.network.client</key>
<true/>
<key>com.apple.security.print</key>
<true/>
</dict>
</plist>
重新签名:
$ codesign --force --sign - --entitlements entitlements.plist Cornerstone.app
Cornerstone.app: replacing existing signature
重新打开,破解成功!