mirror of
https://git.ely.my.id/Tenshi/Hi3-Patcher
synced 2026-11-04 21:46:48 +01:00
52 lines
2.4 KiB
Markdown
52 lines
2.4 KiB
Markdown
# Passport RSA patch
|
|
|
|
Replaces the passport login RSA public key so credentials are encrypted
|
|
for the server's `Passport:RsaPrivateKey`. Input: a single-line Base64 DER
|
|
`SubjectPublicKeyInfo` body (no PEM markers), 2048-bit, exponent 65537;
|
|
empty uses the built-in PemukulPaku key.
|
|
|
|
## Windows (`rsa/windows.rs`)
|
|
|
|
Target: `BH3_Data/Native/UserAssembly.dll` (x64 PE), after confirming the
|
|
region from `ChannelConfig`.
|
|
|
|
1. Find the shared XML RSA routine (prefix `CRYPTO`) in the executable
|
|
`il2cpp` section and the nearby account/password encryption `CALL`
|
|
pair that targets it. A missing or ambiguous match aborts before any
|
|
write.
|
|
2. Base64-encode the key's modulus (344 characters).
|
|
3. Append a `.hi3rsa` code section: an `HI3RSA01` header (the two
|
|
original call RVAs and the routine RVA), the wrapper, and the modulus.
|
|
Redirect both login `CALL`s into the wrapper; the routine and its
|
|
other callers are untouched.
|
|
4. Update the section count, code/image sizes and certificate directory
|
|
offset (the certificate is kept; its signature no longer matches),
|
|
re-verify the image, and write via `util::replace::verified`.
|
|
|
|
At runtime the wrapper receives the managed XML key in `RCX`. If the key
|
|
is non-null, 505 UTF-16 chars long, and has the `<Modulus>` tags at the
|
|
expected offsets, it writes the new modulus at byte offset `0xE2`; in
|
|
every case it then calls the original routine.
|
|
|
|
A repeat run validates the existing `.hi3rsa` section and redirected
|
|
calls and replaces only the modulus. A single known 80-byte `jk98…`
|
|
overlay before the certificate is preserved; other overlays are rejected.
|
|
|
|
## Android overseas (`rsa/android.rs`)
|
|
|
|
`…oversea.sdk.internal.shared.crypto.RSAUtils.getRSA_PUBLIC_KEY`
|
|
references three environment keys (398-byte, newline-wrapped 2048-bit) via
|
|
`const-string`. All three are replaced in place with the chosen key;
|
|
wrapping at 63/64/65 characters keeps the strings distinct and in sort
|
|
order. String order is re-validated and checksums are recomputed.
|
|
|
|
## Android CN (`rsa/cn_android.rs`)
|
|
|
|
`…account.sdk.utils.RSAUtils` holds a 1024-bit key string. A 398-byte
|
|
wrapped 2048-bit replacement is appended (`format::dex::append_string`),
|
|
the key and its two neighbor string ids are reordered to keep sort order,
|
|
and the field, both `const-string` references and both static values are
|
|
remapped. Checksums are recomputed; unknown layouts are rejected.
|
|
|
|
An APK containing both CN and overseas SDKs is rejected.
|