《破解Cornerstone》

Reveal简介

Cornerstone是Mac上最好用的SVN客户端。

破解过程

打开app，出现一个试用的窗口。二话不说，先用Xcode附加调试看看：

(lldb) bt
......
    frame #17: 0x00000001084e895d LicensingKit`-[ZTrialPeriodLicensingPolicy applyWithUserInterface:] + 173
    frame #18: 0x00000001084ec4a7 LicensingKit`-[ZOwnershipLicensingPolicy applyWithUserInterface:] + 647
    frame #19: 0x00000001084d0114 LicensingKit`-[ZSubscriptionLicensingPolicy applyWithUserInterface:] + 539
    frame #20: 0x00000001084f8c20 LicensingKit`-[ZLicensePackageRegistrationPolicy applyWithUserInterface:] + 191
    frame #21: 0x00000001084e7bbe LicensingKit`-[ZPreReleaseLicensingPolicy applyWithUserInterface:] + 221
    frame #22: 0x00000001084eb543 LicensingKit`-[ZEULALicensingPolicy applyWithUserInterface:] + 234
    frame #23: 0x00000001084ef071 LicensingKit`-[ZStandardLicensingPolicy applyWithUserInterface:] + 57
    frame #24: 0x0000000107da5db7 Cornerstone`___lldb_unnamed_symbol596$$Cornerstone + 151
......

明显的责任链模式，在进行逐步验证。
顺带看看调用LicensingKit的地方还干了什么吧：

(lldb) image lookup --address 0x107da5db7
      Address: Cornerstone[0x0000000100028db7] (Cornerstone.__TEXT.__text + 160647)
      Summary: Cornerstone`___lldb_unnamed_symbol596$$Cornerstone + 151

hopper查看0x100028db7的伪代码：

void -[V4ApplicationDelegate finishLaunch](void * self, void * _cmd) {
    r12 = self;
    [self setSuppressUI:0x1];
    rbx = [loc_1003330d0() retain];
    if ((loc_1003331e0(rbx) != 0x0) && (loc_1003334c0(@"LicensingKit.framework", rbx) != 0x0)) {
            [rbx release];
            rbx = [loc_100276820() retain];
            if (rbx != 0x0) {
                    if ([rbx applyWithUserInterface:0x1] == 0x1) {
                            [rbx release];
                            [r12 setup];
                            [r12 showPreFlightUserInterfaceWithCompletionHandler:__NSConcreteStackBlock];
                    }
                    else {
                            exit(0x0);
                    }
            }
            else {
                    exit(0x0);
            }
    }
    else {
            exit(0x0);
    }
    return;
}

这里做了一大堆验证，用jmp指令直接跳到setup函数处吧，修改0x100028d49处的指令为：

jmp 0x100028dc4

再次查看伪代码，干净多了：

void -[V4ApplicationDelegate finishLaunch](void * self, void * _cmd) {
    r12 = self;
    [self setSuppressUI:0x1];
    [r12 setup];
    [r12 showPreFlightUserInterfaceWithCompletionHandler:__NSConcreteStackBlock];
    return;
}

因为涉及到文件的读写权限，接下来做重签名。

先读取权限信息：

$ codesign --display --entitlements - Cornerstone.app
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.application-identifier</key>
    <string>7MNDD7QHBE.com.zennaware.cornerstone3</string>
    <key>com.apple.developer.team-identifier</key>
    <string>7MNDD7QHBE</string>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.files.bookmarks.app-scope</key>
    <true/>
    <key>com.apple.security.files.downloads.read-write</key>
    <true/>
    <key>com.apple.security.files.user-selected.read-write</key>
    <true/>
    <key>com.apple.security.network.client</key>
    <true/>
    <key>com.apple.security.print</key>
    <true/>
</dict>
</plist>

新建一个entitlements.plist文件保存上面的内存，并去掉非权限的信息：

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.security.app-sandbox</key>
    <true/>
    <key>com.apple.security.files.bookmarks.app-scope</key>
    <true/>
    <key>com.apple.security.files.downloads.read-write</key>
    <true/>
    <key>com.apple.security.files.user-selected.read-write</key>
    <true/>
    <key>com.apple.security.network.client</key>
    <true/>
    <key>com.apple.security.print</key>
    <true/>
</dict>
</plist>

重新签名：

$ codesign --force --sign - --entitlements entitlements.plist  Cornerstone.app
Cornerstone.app: replacing existing signature

重新打开，破解成功！