车载导航ARM伪代码算法问题
本帖最后由 carson512 于 2021-2-9 21:29 编辑原厂车机内置导航APP 升级后提示需要激活码激活 非安卓车机 是大陆电子开发的
解压升级程序后 获得主程序一枚 QT5.0的主程序 IDA加载后查不到任何中文字符串
在升级包中发现一些资源文件 内容如下 其中的case应该为相应验证码校验部分 但无法跟主程序对应 不知道是否找错了导航的app的主程序
但是对QT5和QML文件完全没接触 看了些文章也毫无头绪
求大佬思路
import QtQuick 2.0
import NavCnLayouts 1.0
import NaviEnums 1.0
import BasicObjects 2.0
import HMIBWEnum 1.0
import Templates 1.0
NAVIGATION_6330Skin {
id: idDRMInputPanel
property int prValidateCodeRet: -1
property string prTextInput: hmi_1138_TextInput_KeyboardField.prEditableLabel.prText
property varprMapParam:navidata.mapParam
property int prValidateState: 0
Connections{ //close panel
target: hmi_1103_Button_ClosePanel
onSgnCMDValidateSingle:{
mapView.setMapStatus(false)
screenHandler.requestHide(prScreenID_Z1_6330)
regAdaptor.recordCmd("autoNaviDRMInput -type close")
}
}
Connections{
target:hmi_1138_TextInput_KeyboardField
onSgnEVHMIEnter:{
hmi_1138_TextInput_KeyboardField.prEditableLabel.focus = true;
}
}
Connections{ //show search result
target: hmi_1145_Button_KeyboardValidation
onSgnCMDValidateSingle:{
logger.logDebugQ("QMLL", "verify activation code:" + prTextInput)
hmi_1138_TextInput_KeyboardField.prEditableLabel.focus = false;
guidance.setContinueGuideRoute(false)
guidance.setResumeGuidance(false)
prValidateCodeRet = mapView.checkValidateCode(prTextInput)
logger.logDebugQ("QMLL", "prValidateCodeRet ret:"+prValidateCodeRet)
switch(prValidateCodeRet)
{
case 0:
{
logger.logDebugQ("QMLL", "注册失败！")
screenHandler.requestShow(prScreenID_Z3_6329)
break;
}
case 1:
{
logger.logDebugQ("QMLL", "注册成功！")
logger.logDebugQ("QMLL", "GNAC_DISPLAY_SHARED_POS =" + prMapParam)
mapView.setMapStatus(true)
mapView.resumeAllSet();
if(prMapParam === true)
{
screenHandler.requestShow(prScreenID_Z3_4519)
//screenHandler.requestHide(prScreenID_Z0_7001)
}
else
{
screenHandler.requestShow(prScreenID_Z0_7001)
}
screenHandler.requestHide(prScreenID_Z1_6330)
break;
}
case 2:
{
logger.logDebugQ("QMLL", "激活码过期！")
screenHandler.requestShow(prScreenID_Z3_6329)
break;
}
case 3:
{
logger.logDebugQ("QMLL", "工厂模式！")
mapView.setMapStatus(true)
mapView.resumeAllSet();
screenHandler.requestShow(prScreenID_Z0_7001)
screenHandler.requestHide(prScreenID_Z1_6330)
break;
}
default:
{
break;
}
}
logger.logDebugQ("QMLL", "prValidateState = "+prValidateState)
regAdaptor.recordCmd("autoNaviDRMInput -type show")
}
}
Connections{ //invisible keyboard
target:idGenericPanelLogic.prKeyboardObject
onSgnEVKeyPressed:{
var cmd = "autoNaviDRMInput -type hideKeyboard -value1 %1"
regAdaptor.recordCmd(cmd.arg(key))
}
}
Connections{ //model match
target: screenManager
onSgnShowing:{
logger.logDebugQ("QMLL", " 6330 showing")
logger.logDebugQ("QMLL", "GNAC_DISPLAY_SHARED_POS =" + prMapParam)
hmi_1138_TextInput_KeyboardField.prEditableLabel.focus = true;
hmi_1138_TextInput_KeyboardField.prLength = 64
}
}
Connections{
target:regAdaptor
onSgnReplayEventCmdStr :{
if(cmdName==="autoNaviDRMInput"){
if(cmdType==="hideKeyboard"){
hmi_1138_TextInput_KeyboardField.prEditableLabel.prText = prTextInput
idGenericPanelLogic.prKeyboardObject.sgnEVKeyPressed(value1)
}
}
}
onSgnReplayEventCmd :{
if(cmdName==="autoNaviDRMInput"){
if(cmdType==="close"){
hmi_1103_Button_ClosePanel.sgnCMDValidateSingle()
}else if(cmdType==="show"){
hmi_1145_Button_KeyboardValidation.sgnCMDValidateSingle()
}
}
}
}
}
目前已得到注册码验证函数段IDA伪代码如下 第一次接触 求各位大佬赐教
signed int __fastcall checkValidatecode(char *a1, char *a2)
{
int v2; // r5
dltLog *v3; // r0
dltLog *v4; // r7
int v5; // r3
int v6; // r0
int v7; // r5
dltLog *v8; // r0
dltLog *v9; // r7
int v10; // r0
dltLog *v11; // r5
int v12; // r0
dltLog *v13; // r0
dltLog *v14; // r10
int v15; // r0
dltLog *v16; // r0
dltLog *v17; // r8
int v18; // r0
dltLog *v19; // r0
dltLog *v20; // r10
int v21; // r0
dltLog *v22; // r0
dltLog *v23; // r10
int v24; // r0
dltLog *v25; // r0
dltLog *v26; // r8
int v27; // r0
signed int v28; // r5
dltLog *v29; // r6
int v30; // r0
dltLog *v32; // r0
dltLog *v33; // r5
int v34; // r0
dltLog *v35; // r0
dltLog *v36; // r6
int v37; // r0
dltLog *v38; // r6
int v39; // r0
dltLog *v40; // r0
dltLog *v41; // r6
int v42; // r0
int v43; // r0
dltLog *v44; // r0
dltLog *v45; // r6
int v46; // r0
dltLog *v47; // r0
dltLog *v48; // r6
int v49; // r0
char v50; //
int v51; //
const char *v52; //
int *v53; //
int v54; //
char *v55; //
char *v56; //
dltLog *v57; //
void *src; //
char s; //
int v60; //
dltLog *v61; //
int v62; //
int v63; //
int v64; //
int v65; //
int v66; //
int v67; //
int v68; //
int v69; //
int v70; //
int v71; //
char v72; //
int v73; //
int v74; //
int v75; //
char s1; //
int v77; //
__int16 v78; //
char v79; //
v2 = 0;
src = a1;
v56 = a2;
v79 = 0;
v77 = 0;
v78 = 0;
memset(s, 0, 0x80u);
strcpy(&s1, "1234567");
v55 = &s1;
v73 = 156;
v75 = 310000;
v74 = 310000;
v3 = (dltLog *)GDBL_GetDataProductDate((int)&v73, (int)s);
v57 = v3;
do
{
v4 = (dltLog *)dltLog::getInstance(v3);
v53 = (int *)v2;
v51 = 3086;
v52 = "checkValidatecode";
v5 = syscall(224);
v6 = *(_DWORD *)&s;
v7 = v2 + 1;
v54 = v6;
v8 = (dltLog *)dltLog::logInfo(v4, "PERS", "%ld:[%d]<%s>:czDate[%d] = %c", v5, 3086, "checkValidatecode", v53, v6);
v9 = (dltLog *)dltLog::getInstance(v8);
v10 = syscall(224);
v53 = (int *)v7;
v51 = 3086;
v52 = "checkValidatecode";
v54 = *(_DWORD *)&s;
v2 = v7 + 1;
v3 = (dltLog *)dltLog::logInfo(v9, "PERS", "%ld:[%d]<%s>:czDate[%d] = %c", v10, 3086, "checkValidatecode", v53, v54);
}
while ( v2 != 32 );
HIBYTE(v78) = v65;
LOBYTE(v77) = v60;
HIBYTE(v77) = v63;
LOBYTE(v78) = v64;
BYTE2(v77) = v62;
BYTE1(v77) = (_BYTE)v61;
v11 = (dltLog *)dltLog::getInstance(v61);
v12 = syscall(224);
v13 = (dltLog *)dltLog::logInfo(v11, "PERS", "%ld:[%d]<%s>:szTime = %s", v12, 3095, "checkValidatecode", &v77);
v14 = (dltLog *)dltLog::getInstance(v13);
v15 = syscall(224);
v16 = (dltLog *)dltLog::logInfo(v14, "PERS", "%ld:[%d]<%s>:rt %d", v15, 3096, "checkValidatecode", v57);
v17 = (dltLog *)dltLog::getInstance(v16);
v18 = syscall(224);
v19 = (dltLog *)dltLog::logInfo(v17, "PERS", "%ld:[%d]<%s>:czDate %s", v18, 3097, "checkValidatecode", s);
v20 = (dltLog *)dltLog::getInstance(v19);
v21 = syscall(224);
v22 = (dltLog *)dltLog::logInfo(v20, "PERS", "%ld:[%d]<%s>:activationcode %s", v21, 3098, "checkValidatecode", src);
v66 = 0;
v67 = 0;
v68 = 0;
v69 = 0;
v70 = 0;
v71 = 0;
v72 = 0;
v23 = (dltLog *)dltLog::getInstance(v22);
v24 = syscall(224);
dltLog::logInfo(v23, "PERS", "%ld:[%d]<%s>:sizeof(tmpActivationCode) %d", v24, 3100, "checkValidatecode", 25);
v25 = (dltLog *)memcpy(&v66, src, 0x19u);
v26 = (dltLog *)dltLog::getInstance(v25);
v27 = syscall(224);
v51 = 3102;
v52 = "checkValidatecode";
v53 = &v66;
dltLog::logInfo(v26, "PERS", "%ld:[%d]<%s>:tmpActivationCode %s", v27, 3102, "checkValidatecode", &v66);
if ( !strcmp(&s1, (const char *)src) )
{
v28 = 3;
dword_2F1FAC = 1;
v29 = (dltLog *)dltLog::getInstance(0);
v30 = syscall(224);
dltLog::logWarn(v29, "PERS", (const char *)&unk_DC780, v30, 3141, "checkValidatecode");
}
else
{
memset(&v50, 0, 0x15u);
v32 = (dltLog *)scGetBrand(&v50, 20);
v33 = (dltLog *)dltLog::getInstance(v32);
v34 = syscall(224);
dltLog::logInfo(v33, "UDEF", "%ld:[%d]<%s>:brand:%s", v34, 3109, "checkValidatecode", &v50);
if ( !strcmp(&v50, "DS") )
v35 = (dltLog *)ValidateCodeCAPSA(src, &v77, v56);
else
v35 = (dltLog *)ValidateCode(src, &v77, v56);
v28 = (signed int)v35;
if ( v35 == (dltLog *)1 )
{
v43 = NaviConfigForMid::getIntance((NaviConfigForMid *)1);
v44 = (dltLog *)NaviConfigForMid::setParam(v43, 15, &v66, 1);
s_bDRDataStatus = 1;
v45 = (dltLog *)dltLog::getInstance(v44);
v46 = syscall(224);
v47 = (dltLog *)dltLog::logInfo(v45, "PERS", (const char *)&unk_DC70C, v46, 3124, "checkValidatecode");
v48 = (dltLog *)dltLog::getInstance(v47);
v49 = syscall(224);
dltLog::logInfo(v48, "PERS", (const char *)&unk_DC728, v49, 3125, "checkValidatecode", v56);
}
else if ( v35 == (dltLog *)2 )
{
v38 = (dltLog *)dltLog::getInstance((dltLog *)2);
v39 = syscall(224);
v40 = (dltLog *)dltLog::logInfo(v38, "PERS", (const char *)&unk_DC744, v39, 3129, "checkValidatecode");
v41 = (dltLog *)dltLog::getInstance(v40);
v42 = syscall(224);
dltLog::logInfo(v41, "PERS", (const char *)&unk_DC728, v42, 3130, "checkValidatecode", v56);
}
else
{
v36 = (dltLog *)dltLog::getInstance(v35);
v37 = syscall(224);
dltLog::logWarn(v36, "PERS", (const char *)&unk_DC764, v37, 3134, "checkValidatecode");
}
}
return v28;
}
页:
[1]