i'm sorry dave

Starred Gists，GitHub Gist，即时分享代码、笔记与代码片段。关注

	<# :

	:: I wonder who made Task Manager...

	@setlocal DisableDelayedExpansion
	@echo off

	echo "%*" \| find /i "-el" >nul && set _elev=1

	set _PSarg="""%~f0""" -el

	setlocal EnableDelayedExpansion

	>nul fltmc \|\| (
	if not defined _elev powershell "start cmd.exe -arg '/c \"!_PSarg:'=''!\"' -verb runas" && exit /b
	echo.
	echo This script require administrator privileges.
	echo To do so, right click on this script and select 'Run as administrator'.
	pause
	exit /b
	)

	set "psScript=%~f0" & powershell -nop -c "Get-Content """$env:psScript""" -Raw \| iex" & exit /b
	: #>

	$license = '{"payload": "eyJrZXkiOiAiRUVFRUVFRUUtRUVFRS1FRUVFLUVFRUUtRUVFRUVFRUVFRUVFIiwgImVtYWlsSGFzaCI6ICJjODVlYTA2Y2YyOGJhNzhiMzEzZjgyYzIyYTE5YmIxMDNlZjlmODhlYzU5ZWEyN2ZiMzMxYmI2MTIzOGJiOGExIiwgIm1hY2hpbmVJZCI6ICI3ZjBiMWE5YWRhYjZmZTI2NDNkM2JlYzMyMDdhMjhiODdhNTc0ZWU4MTYzZmY2YTIyOWJjMzAzODc2NDZmMjY1IiwgImlzc3VlZEF0IjogNjcsICJ2IjogMSwgIm1heE1ham9yIjogOTksICJhY3RpdmF0aW9uTGltaXQiOiA5OTksICJpbnN0YW5jZUlkIjogIndoeSBkaWQgeW91IHB1dCBkcm0gaW4geW91ciB0YXNrIG1hbmFnZXIgZGF2ZSJ9", "signature": "UxkJR0szWKlG5qp+duwP2V7exn6sYNEyfgcwrKIk6FEeBw3suoFAKYg803n+ZQbhc6ouKWaBL23kZegA/UjeDg=="}'

	function Patch-Exp($DLL) {
	$UserDLL = "$Env:LocalAppData\Programs\$DLL"
	$SystemDLL64 = "$Env:ProgramFiles\$DLL"
	$SystemDLL32 = "${Env:ProgramFiles(x86)}\$DLL"

	$Paths = @()

	if(Test-Path -Path $UserDLL) { $Paths += ,$UserDLL }
	if(Test-Path -Path $SystemDLL64) { $Paths += ,$SystemDLL64 }
	if(Test-Path -Path $SystemDLL32) { $Paths += ,$SystemDLL32 }

	foreach($Path in $Paths) {
	$Backup = "$Path.bak"
	if(Test-Path -Path $Backup) {
	Write-Host "$Path has already been patched! If you wish to restore the unpatched copy, delete $Path and rename $Path.bak to $Path"
	} else {
	Write-Host "Patching $Path"
	Copy-Item -Path $Path -Destination $Backup
	$Bytes = Get-Content $Path -Raw -Encoding Byte
	$String = $Bytes.ForEach('ToString', 'X2') -join ' '

	# Replace Ed25519 public key
	$String = $String -replace '\b49 5B AF 30 E6 68 BB F5 97 AC B8 40 89 32 D2 84 A4 39 C8 69 F1 51 59 3F D3 B4 BA 59 CC 51 9E 8E\b(.*)', '4F 77 EE 17 BE 32 31 7E 1F 57 7B 16 DC 21 CF 44 57 69 38 1D 76 22 B3 22 DC 8A 91 8C 6D 2A 3E 85$1'

	# Replace MachineGuid with MachoneGuid so license can be static
	$String = $String -replace '\b4D 00 61 00 63 00 68 00 69 00 6E 00 65 00 47 00 75 00 69 00 64 00\b(.*)', '4D 00 61 00 63 00 68 00 6F 00 6E 00 65 00 47 00 75 00 69 00 64 00$1'

	[byte[]]$ModifiedBytes = -split $String -replace '^', '0x'
	Set-Content -Path $Path -Value $ModifiedBytes -Encoding Byte
	Write-Host "Patched $Path"
	}
	}
	}

	function Install-License {
	New-Item "HKLM:\Software\Microsoft\Cryptography" -ErrorAction SilentlyContinue \| Out-Null
	Set-ItemProperty -Path "HKLM:\Software\Microsoft\Cryptography" -Name "MachoneGuid" -Value "19f0670d-7bbc-4e8f-9d3d-98638304edb4" -ErrorAction SilentlyContinue
	$license \| Out-File "$Env:LocalAppData\TMOG\license.json" -Encoding ascii
	Write-Host "Installed license"
	}

	Write-Host "Killing process"
	Stop-Process -Name "Task Manager" -ErrorAction SilentlyContinue
	Sleep 1

	Write-Host "Patching EXE"
	Patch-Exp "Task Manager TMOG\Task Manager.exe"

	Write-Host "Installing license"
	Install-License

	Write-Host "Done"
	pause

	from json import dumps
	from base64 import b64encode
	from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey

	privkey = Ed25519PrivateKey.from_private_bytes(bytes.fromhex("ccf956b65cb1724f8d7ade4556cf432dbcc97ae8d36f5af9e01605f2a1fa3209"))

	payload = {
	"key": "EEEEEEEE-EEEE-EEEE-EEEE-EEEEEEEEEEEE",
	"emailHash": "c85ea06cf28ba78b313f82c22a19bb103ef9f88ec59ea27fb331bb61238bb8a1",
	"machineId": "7f0b1a9adab6fe2643d3bec3207a28b87a574ee8163ff6a229bc30387646f265",
	"issuedAt": 67,
	"v": 1,
	"maxMajor": 99,
	"activationLimit": 999,
	"instanceId": "why did you put drm in your task manager dave"
	}
	data = dumps(payload).encode()

	sig = privkey.sign(data)

	license = {
	"payload": b64encode(data).decode(),
	"signature": b64encode(sig).decode()
	}

	with open("license.json", "w") as f:
	f.write(dumps(license))

	print(privkey.public_key().public_bytes_raw().hex())

添加评论

点踩

分享查看原文

参与讨论