Initial Commit

docs/rsa.md

@@ -0,0 +1,51 @@
+# Passport RSA patch
+
+Replaces the passport login RSA public key so credentials are encrypted
+for the server's `Passport:RsaPrivateKey`. Input: a single-line Base64 DER
+`SubjectPublicKeyInfo` body (no PEM markers), 2048-bit, exponent 65537;
+empty uses the built-in PemukulPaku key.
+
+## Windows (`rsa/windows.rs`)
+
+Target: `BH3_Data/Native/UserAssembly.dll` (x64 PE), after confirming the
+region from `ChannelConfig`.
+
+1. Find the shared XML RSA routine (prefix `CRYPTO`) in the executable
+   `il2cpp` section and the nearby account/password encryption `CALL`
+   pair that targets it. A missing or ambiguous match aborts before any
+   write.
+2. Base64-encode the key's modulus (344 characters).
+3. Append a `.hi3rsa` code section: an `HI3RSA01` header (the two
+   original call RVAs and the routine RVA), the wrapper, and the modulus.
+   Redirect both login `CALL`s into the wrapper; the routine and its
+   other callers are untouched.
+4. Update the section count, code/image sizes and certificate directory
+   offset (the certificate is kept; its signature no longer matches),
+   re-verify the image, and write via `util::replace::verified`.
+
+At runtime the wrapper receives the managed XML key in `RCX`. If the key
+is non-null, 505 UTF-16 chars long, and has the `<Modulus>` tags at the
+expected offsets, it writes the new modulus at byte offset `0xE2`; in
+every case it then calls the original routine.
+
+A repeat run validates the existing `.hi3rsa` section and redirected
+calls and replaces only the modulus. A single known 80-byte `jk98…`
+overlay before the certificate is preserved; other overlays are rejected.
+
+## Android overseas (`rsa/android.rs`)
+
+`…oversea.sdk.internal.shared.crypto.RSAUtils.getRSA_PUBLIC_KEY`
+references three environment keys (398-byte, newline-wrapped 2048-bit) via
+`const-string`. All three are replaced in place with the chosen key;
+wrapping at 63/64/65 characters keeps the strings distinct and in sort
+order. String order is re-validated and checksums are recomputed.
+
+## Android CN (`rsa/cn_android.rs`)
+
+`…account.sdk.utils.RSAUtils` holds a 1024-bit key string. A 398-byte
+wrapped 2048-bit replacement is appended (`format::dex::append_string`),
+the key and its two neighbor string ids are reordered to keep sort order,
+and the field, both `const-string` references and both static values are
+remapped. Checksums are recomputed; unknown layouts are rejected.
+
+An APK containing both CN and overseas SDKs is rejected.