How to create an anonymous IDA PRO database (.IDB)
Source: http://www.0xebfe.net/blog/2013/01/13/how-to-create-an-anonymous-ida-pro-database-dot-idb/
Probably it’s not secret for you that every .IDB files contains header with your license information.
There are two “netnodes” in every .IDB file that reveals your identity. Basically “netnode” is block with some data, check: idasdk\include\netnode.hpp for more info.
So there are two netnodes:
”$ user1” - contains plaint text info about your license.
”$ original user” - contains encrypted info about your license.
Actually you can freely delete “$ user1” netnode without any consequences, because IDA doesn’t check it at all. But “$ original user” netnode has strategic meaning for IDA PRO. This netnode contains RSA-1024 encrypted license information, same info that you have in “ida.key” file. When you open .IDB database IDA reads “$ original user” value, decrypts it with public RSA-1024 key and checks your license against MD5 hashes of blacklisted “pirated” licenses.
So what we can do? We can’t delete it, because IDA checks this netnode on every opening. We can’t generate own value, because we don’t have private RSA key. But we can copy this value from another .IDB file :)
I googled and found this .IDB file from Trustwave: here
So let’s dump “$ original user” netnode in source .IDB file with following python script:
netnode_dumper.py
import idaapi
import binascii
print(binascii.hexlify(idaapi.netnode('$ original user', 0, False).supval(0)))
After that insert dumped value into this script and run it in IDA in destination .IDB:
netnode_updater.py
import idaapi
import binascii
dumped_netnode_value ='111insert_your_hex_value_here111'
idaapi.netnode('$ user1', 0, False).kill() # deleting netnode with plain text info
idaapi.netnode('$ original user', 0, False).supset(0, binascii.unhexlify(dumped_netnode_value))
Save, re-open database. Let’s check:
Yep, we have .IDB file from Trustwave now :)
And when IDA shows you this message:
or “Sorry, this database has been created by a pirate version of IDA”.
This means that “$ original user” netnode contains banned license info. But you still can copy this value from legit .IDB with hex editor.
最新文章
- Masonry 创建Button的简单使用
- [CareerCup] 15.1 Renting Apartment 租房
- 【python游戏编程之旅】第二篇--pygame中的IO、数据
- Android EditText截获与监听输入事件
- 基于html5 canvas和js实现的水果忍者网页版
- codeforces 677A A. Vanya and Fence(水题)
- 安卓app开发方式之webApp
- Qt之QtSoap(访问WebService)
- JS操作JSON总结(转)
- J2EE 读取文件路径
- 安利一个十分实用的IDEA插件--RestfulToolkit
- HDFS 开发中的文件配置优先级
- Ext.js项目(一)
- hdu-1176免费馅饼
- ubuntu18.04+ cuda9.0+opencv3.1+caffe-ssd安装
- 【译】Kafka学习之路
- windows virus-search-kill-monitor
- Ubuntu使用Remastersys封装制作系统ISO镜像
- Go 压测
- idea 中如何生成类图