hack_fix_idb.py

# import idaapi
# print(idaapi)
# import binascii

# # print(binascii.hexlify(idaapi.netnode('$ original user', 0, False).supval(0)))
# dumped_netnode = 'ca75b28848ea06bcae409699fa2510a03bbaf43bd167eecb17d52918187133a793ebf8d3270230c7164d7a79b53c2c3edd611ede975690784cf2c254abe8b587140d19a3f46b2be109bde1da1b7ed4d7c9f7b58135f2c296db4e86ad29b6f0b999b5599d40c3bae8b29d2cc06ecef63cba0e1b9a9505c1efe9019a7020127e100000000000000000000000000000000000000000000000000000000000000000'



import binascii
import struct
import sys
import zlib

infn = sys.argv[1]
outfn = sys.argv[2]

with open(infn, 'rb') as inf:
    data = inf.read()

# print(data)
values = struct.unpack_from("<4sH6LH6L", data, 0)
print(values)
assert values[0] == b'IDA1'
assert values[7] == 0xaabbccdd

fileversion = values[8]
print(fileversion)
assert fileversion == 1

offsets = list(values[2:7])
checksums = list(values[10:15])
idsofs, idscheck = struct.unpack_from("<LH" if fileversion == 1 else "<LL", data, 56)
offsets.append(idsofs)
checksums.append(idscheck)

print(offsets, checksums)

assert offsets[3] == 0
assert offsets[5] == 0

id0hdr = struct.unpack_from("<BL", data, offsets[0])
id0data = data[offsets[0] + 5:offsets[0] + 5 + id0hdr[1]]
# print(id0data)
id1hdr = struct.unpack_from("<BL", data, offsets[1])
id1data = data[offsets[1] + 5:offsets[1] + 5 + id1hdr[1]]
namhdr = struct.unpack_from("<BL", data, offsets[2])
namdata = data[offsets[2] + 5:offsets[2] + 5 + namhdr[1]]
tilhdr = struct.unpack_from("<BL", data, offsets[4])
tildata = data[offsets[4] + 5:offsets[4] + 5 + tilhdr[1]]

# Unpack section id0
if id0hdr[0] == 2:
    id0data = zlib.decompress(id0data, 15)
    id0hdr = (0, len(id0data))

blacklisted_key = binascii.unhexlify(b'00e475d5f91775bbbcdd5ee4a206e8edd6d760f62f240e9eee9eaa96747ab732568f32a07d8f836889ed4af973d28ea30aaacb7f7a824fcd59ba92ca97cef3a98afc343c51de71e23711ee816c1d05e265493d330c98b45f5dc451f083e55073533babfaed108c5faad6dd43050b325c0a7082354a117974f2d74098b097a3270000000000000000000000000000000000000000000000000000000000000000')
ok_key = binascii.unhexlify(b'ca75b28848ea06bcae409699fa2510a03bbaf43bd167eecb17d52918187133a793ebf8d3270230c7164d7a79b53c2c3edd611ede975690784cf2c254abe8b587140d19a3f46b2be109bde1da1b7ed4d7c9f7b58135f2c296db4e86ad29b6f0b999b5599d40c3bae8b29d2cc06ecef63cba0e1b9a9505c1efe9019a7020127e100000000000000000000000000000000000000000000000000000000000000000')

off_bad_key = id0data.find(blacklisted_key)
print(off_bad_key)
id0data = id0data[:off_bad_key] + ok_key + id0data[off_bad_key+len(blacklisted_key):]

# id0page0hdr = id0data[:64]
# print(id0page0hdr)
# assert id0page0hdr[19:].startswith(b"B-tree v 1.6 (C) Pol 1990")
# firstfree, pagesize, firstindex, reccount, pagecount = struct.unpack_from("<LHLLL", id0page0hdr, 0)
# print(firstfree, pagesize, firstindex, reccount, pagecount)

# pn = 1
# while True:
#     if pn * pagesize == len(id0data):
#         break
#     page = id0data[pn * pagesize:(pn + 1) * pagesize]
#     # print(pn, page)
#     print(pn)
#     preceeding, count = struct.unpack_from("<LH", page, 0)
#     print(preceeding, count)

#     if preceeding == 0:
#         print("leaf")

#     pn += 1

with open(outfn, 'wb') as outf:
    outf.write(b'\x00' * 0x3e)

    id0off = outf.tell()
    outf.write(struct.pack("<BL", id0hdr[0], id0hdr[1]))
    outf.write(id0data)
    id1off = outf.tell()
    outf.write(struct.pack("<BL", id1hdr[0], id1hdr[1]))
    outf.write(id1data)
    namoff = outf.tell()
    outf.write(struct.pack("<BL", namhdr[0], namhdr[1]))
    outf.write(namdata)
    tiloff = outf.tell()
    outf.write(struct.pack("<BL", tilhdr[0], tilhdr[1]))
    outf.write(tildata)

    outf.seek(0)
    outf.write(struct.pack("<4sH6LH6L",
        values[0],
        values[1],
        id0off,
        id1off,
        namoff,
        0,
        tiloff,
        values[7],
        values[8],
        values[9],
        values[10],
        values[11],
        values[12],
        values[13],
        values[14],))