Skip to content
This repository was archived by the owner on Nov 5, 2023. It is now read-only.

Commit 84fd6cc

Browse files
ViRb3ViRb3
committed
feat: initial
0 parents  commit 84fd6cc

11 files changed

+651
-0
lines changed

‎.github/dependabot.yml

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "github-actions"
4+
directory: "/"
5+
schedule:
6+
interval: "daily"
7+
commit-message:
8+
prefix: "fix"
9+
include: "scope"

‎.github/workflows/release.yml

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
branches: [master, develop]
6+
pull_request:
7+
branches: [master, develop]
8+
9+
jobs:
10+
build:
11+
runs-on: windows-latest
12+
13+
steps:
14+
- name: Checkout with token
15+
if: github.event_name != 'pull_request'
16+
uses: actions/checkout@v2.3.4
17+
with:
18+
token: ${{ secrets.API_GITHUB_TOKEN }}
19+
submodules: true
20+
21+
- name: Checkout without token
22+
if: github.event_name == 'pull_request'
23+
uses: actions/checkout@v2.3.4
24+
with:
25+
submodules: true
26+
27+
- name: Build
28+
run: |
29+
$env:Path = "C:\msys64\mingw32\bin;$env:Path"
30+
mkdir build
31+
cd build
32+
cmake .. -DCMAKE_BUILD_TYPE=Release -G "MinGW Makefiles"
33+
cmake --build .
34+
35+
- name: Version
36+
if: github.event_name != 'pull_request'
37+
uses: cycjimmy/semantic-release-action@v2.5.4
38+
with:
39+
semantic_version: 17.4
40+
env:
41+
GITHUB_TOKEN: ${{ secrets.API_GITHUB_TOKEN }}

‎.gitignore

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
2+
# Created by https://www.toptal.com/developers/gitignore/api/clion+all,cmake,c
3+
# Edit at https://www.toptal.com/developers/gitignore?templates=clion+all,cmake,c
4+
5+
### C ###
6+
# Prerequisites
7+
*.d
8+
9+
# Object files
10+
*.o
11+
*.ko
12+
*.obj
13+
*.elf
14+
15+
# Linker output
16+
*.ilk
17+
*.map
18+
*.exp
19+
20+
# Precompiled Headers
21+
*.gch
22+
*.pch
23+
24+
# Libraries
25+
*.lib
26+
*.a
27+
*.la
28+
*.lo
29+
30+
# Shared objects (inc. Windows DLLs)
31+
*.dll
32+
*.so
33+
*.so.*
34+
*.dylib
35+
36+
# Executables
37+
*.exe
38+
*.out
39+
*.app
40+
*.i*86
41+
*.x86_64
42+
*.hex
43+
44+
# Debug files
45+
*.dSYM/
46+
*.su
47+
*.idb
48+
*.pdb
49+
50+
# Kernel Module Compile Results
51+
*.mod*
52+
*.cmd
53+
.tmp_versions/
54+
modules.order
55+
Module.symvers
56+
Mkfile.old
57+
dkms.conf
58+
59+
### CLion+all ###
60+
# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio, WebStorm and Rider
61+
# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
62+
63+
# User-specific stuff
64+
.idea/**/workspace.xml
65+
.idea/**/tasks.xml
66+
.idea/**/usage.statistics.xml
67+
.idea/**/dictionaries
68+
.idea/**/shelf
69+
70+
# Generated files
71+
.idea/**/contentModel.xml
72+
73+
# Sensitive or high-churn files
74+
.idea/**/dataSources/
75+
.idea/**/dataSources.ids
76+
.idea/**/dataSources.local.xml
77+
.idea/**/sqlDataSources.xml
78+
.idea/**/dynamic.xml
79+
.idea/**/uiDesigner.xml
80+
.idea/**/dbnavigator.xml
81+
82+
# Gradle
83+
.idea/**/gradle.xml
84+
.idea/**/libraries
85+
86+
# Gradle and Maven with auto-import
87+
# When using Gradle or Maven with auto-import, you should exclude module files,
88+
# since they will be recreated, and may cause churn. Uncomment if using
89+
# auto-import.
90+
# .idea/artifacts
91+
# .idea/compiler.xml
92+
# .idea/jarRepositories.xml
93+
# .idea/modules.xml
94+
# .idea/*.iml
95+
# .idea/modules
96+
# *.iml
97+
# *.ipr
98+
99+
# CMake
100+
cmake-build-*/
101+
102+
# Mongo Explorer plugin
103+
.idea/**/mongoSettings.xml
104+
105+
# File-based project format
106+
*.iws
107+
108+
# IntelliJ
109+
out/
110+
111+
# mpeltonen/sbt-idea plugin
112+
.idea_modules/
113+
114+
# JIRA plugin
115+
atlassian-ide-plugin.xml
116+
117+
# Cursive Clojure plugin
118+
.idea/replstate.xml
119+
120+
# Crashlytics plugin (for Android Studio and IntelliJ)
121+
com_crashlytics_export_strings.xml
122+
crashlytics.properties
123+
crashlytics-build.properties
124+
fabric.properties
125+
126+
# Editor-based Rest Client
127+
.idea/httpRequests
128+
129+
# Android studio 3.1+ serialized cache file
130+
.idea/caches/build_file_checksums.ser
131+
132+
### CLion+all Patch ###
133+
# Ignores the whole .idea folder and all .iml files
134+
# See https://github.com/joeblau/gitignore.io/issues/186 and https://github.com/joeblau/gitignore.io/issues/360
135+
136+
.idea/
137+
138+
# Reason: https://github.com/joeblau/gitignore.io/issues/186#issuecomment-249601023
139+
140+
*.iml
141+
modules.xml
142+
.idea/misc.xml
143+
*.ipr
144+
145+
# Sonarlint plugin
146+
.idea/sonarlint
147+
148+
### CMake ###
149+
CMakeLists.txt.user
150+
CMakeCache.txt
151+
CMakeFiles
152+
CMakeScripts
153+
Testing
154+
Makefile
155+
cmake_install.cmake
156+
install_manifest.txt
157+
compile_commands.json
158+
CTestTestfile.cmake
159+
_deps
160+
161+
### CMake Patch ###
162+
# External projects
163+
*-prefix/
164+
165+
# End of https://www.toptal.com/developers/gitignore/api/clion+all,cmake,c

‎.gitmodules

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
[submodule "minhook"]
2+
path = minhook
3+
url = https://github.com/TsudaKageyu/minhook

‎.releaserc.yml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
branches:
3+
- master
4+
plugins:
5+
- "@semantic-release/commit-analyzer"
6+
- "@semantic-release/release-notes-generator"
7+
- #
8+
- "@semantic-release/github"
9+
- successComment: false
10+
failComment: false
11+
assets:
12+
- path: build/zlib1.dll

‎CMakeLists.txt

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
cmake_minimum_required(VERSION 3.16)
2+
project(zlib1 C)
3+
4+
set(CMAKE_C_STANDARD 99)
5+
6+
set(CMAKE_CXX_FLAGS_DEBUG "-g")
7+
set(CMAKE_CXX_FLAGS_RELEASE "-O3")
8+
9+
set(CMAKE_SHARED_LIBRARY_PREFIX "")
10+
set(CMAKE_STATIC_LIBRARY_PREFIX "")
11+
12+
# https://stackoverflow.com/questions/18138635/mingw-exe-requires-a-few-gcc-dlls-regardless-of-the-code
13+
add_link_options(-static -static-libgcc -static-libstdc++)
14+
15+
add_library(zlib1 SHARED proxy.h library.def hook.c)
16+
link_libraries(ws2_32)
17+
18+
add_subdirectory(minhook)
19+
target_compile_options(minhook PUBLIC -w)
20+
target_link_libraries(zlib1 minhook)

‎README.md

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# AltServer Dump Proxy
2+
3+
> A proxy DLL for Windows to dump your developer account certificate from AltServer.
4+
5+
There is no official way to obtain your developer account's certificate in Windows. AltServer does this under the hood, but for (security?) reasons, the certificate never touches your disk unprotected.
6+
7+
This project is a simple patch that will hook into AltServer and dump your certificate and password to your Desktop as AltStore processes them. The patch is completely transparent and will cause no side effects whatsoever.
8+
9+
## Usage
10+
11+
### Installing
12+
13+
1. Download the proxy `zlib1.dll` from the [releases](https://github.com/SignTools/altserver-cert-dumper/releases)
14+
2. Go to your AltServer's installation folder. By default, this is: `C:\Program Files (x86)\AltServer`
15+
3. Inside AltServer's folder, rename the original `zlib1.dll` to `zlib2.dll`
16+
4. Move the proxy `zlib1.dll` that you downloaded from this website inside AltServer's folder. You should end up with both `zlib1.dll` and `zlib2.dll` next to each other, and nothing should have been replaced.
17+
18+
### Dumping
19+
20+
1. Run AltServer as normal
21+
2. You should immediately see a message box saying: `Hooks initialized`. If you don't see this, then you didn't install the proxy correctly.
22+
3. Proceed to install AltStore on your phone as normal. If you already have it installed, you will have to reinstall it.
23+
4. At the end of the process, you will see a message box saying: `Certificate successfully saved to Desktop`. Then, on your desktop, you will find two new files: `AltServer-Cert.p12` and `AltServer-Cert-Pass.txt`. These are your certificate and password, respectively.
24+
25+
### Uninstalling
26+
27+
1. Go to your AltServer's installation folder. By default, this is: `C:\Program Files (x86)\AltServer`
28+
2. Delete the proxy `zlib1.dll`
29+
3. Rename the original `zlib2.dll` back to `zlib1.dll`
30+
31+
## Building
32+
33+
Tested and working is the following setup:
34+
35+
- mingw-w64 7.0.0+ (32-bit)
36+
- CMake 3.16+
37+
38+
## References
39+
40+
Based on [PerfectProxyDLL](https://github.com/ViRb3/PerfectProxyDLL).

‎hook.c

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
#include <Windows.h>
2+
#include <Shlobj.h>
3+
#include "proxy.h"
4+
#include "minhook/include/MinHook.h"
5+
#include <stdio.h>
6+
7+
BOOL passwordSaved = FALSE;
8+
BOOL certSaved = FALSE;
9+
char password[1024];
10+
char certSuffix[] = "\\AltServer-Cert.p12";
11+
char passSuffix[] = "\\AltServer-Cert-Pass.txt";
12+
13+
typedef char *(*sig_PKCS12_create)(char *pass, char *name, char *pkey, char *cert,
14+
char *ca, int nid_key, int nid_cert, int iter,
15+
int mac_iter, int keytype);
16+
typedef size_t (*sig_fwrite)(const void *buffer, size_t size, size_t count, void *stream);
17+
18+
sig_PKCS12_create orig_PKCS12_create = NULL;
19+
sig_fwrite orig_fwrite = NULL;
20+
21+
char *detour_PKCS12_create(char *pass, char *name, char *pkey, char *cert,
22+
char *ca, int nid_key, int nid_cert, int iter,
23+
int mac_iter, int keytype) {
24+
if (!passwordSaved && strlen(pass) > 0) {
25+
passwordSaved = TRUE;
26+
strcpy_s(password, sizeof(password), pass);
27+
}
28+
return orig_PKCS12_create(pass, name, pkey, cert, ca, nid_key, nid_cert, iter, mac_iter, keytype);
29+
}
30+
size_t detour_fwrite(const char *buffer, size_t size, size_t count, void *stream) {
31+
// match P12 magic header bytes
32+
if (passwordSaved && !certSaved && count > 2 && buffer[0] == (char)0x30 && buffer[1] == (char)0x82) {
33+
certSaved = TRUE;
34+
if (MH_DisableHook(MH_ALL_HOOKS) == MH_OK) {
35+
char certPath[1024];
36+
if (SHGetSpecialFolderPathA(HWND_DESKTOP, certPath, CSIDL_DESKTOP, FALSE)) {
37+
char passPath[1024];
38+
strcpy_s(passPath, sizeof(passPath), certPath);
39+
strcat_s(certPath, sizeof(certPath), certSuffix);
40+
strcat_s(passPath, sizeof(passPath), passSuffix);
41+
FILE *pFile;
42+
pFile = fopen(certPath, "wb");
43+
fwrite(buffer, size, count, pFile);
44+
fclose(pFile);
45+
pFile = fopen(passPath, "wb");
46+
fwrite(password, sizeof(char), strlen(password), pFile);
47+
fclose(pFile);
48+
MessageBox(NULL, "Certificate successfully saved to Desktop.", "Success", MB_OK);
49+
} else {
50+
MessageBox(NULL, "Error getting path to Desktop.", "Error", MB_OK);
51+
}
52+
} else {
53+
MessageBox(NULL, "Error disabling hooks.", "Error", MB_OK);
54+
}
55+
}
56+
return orig_fwrite(buffer, size, count, stream);
57+
}
58+
59+
BOOL doHook() {
60+
if (MH_Initialize() != MH_OK) {
61+
return FALSE;
62+
}
63+
if (MH_CreateHookApi(L"libeay32.dll", "PKCS12_create",
64+
(LPVOID)(detour_PKCS12_create),
65+
(LPVOID *)(&orig_PKCS12_create)) != MH_OK) {
66+
return FALSE;
67+
}
68+
if (MH_CreateHookApi(L"ucrtbase.dll", "fwrite",
69+
(LPVOID)(detour_fwrite),
70+
(LPVOID *)(&orig_fwrite)) != MH_OK) {
71+
return FALSE;
72+
}
73+
if (MH_EnableHook(MH_ALL_HOOKS) != MH_OK) {
74+
return FALSE;
75+
}
76+
return TRUE;
77+
}
78+
79+
BOOL WINAPI DllMain(HMODULE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) {
80+
if (fdwReason == DLL_PROCESS_ATTACH) {
81+
SourceInit();
82+
if (doHook()) {
83+
MessageBox(NULL, "Hooks initialized.", "Success", MB_OK);
84+
} else {
85+
MessageBox(NULL, "Something went wrong.", "Error", MB_OK);
86+
}
87+
}
88+
return TRUE;
89+
}

0 commit comments

Comments
 (0)