前言

  • 文章里的讨论仅限于技术交流,如有需要请 购买正版 !!!
  • 文章里的讨论仅限于技术交流,如有需要请 购买正版 !!
  • 文章里的讨论仅限于技术交流,如有需要请 购买正版

只是为了防河蟹原文

原理

  1. emhttpd 使用 RSA_public_decrypt 去解析 BTRS.key,里面是你的注册信息
  2. 将信息写入 var/state.ini,这样其他人就可以拿到

思路

LD_PRELOAD 拦截 RSA_public_decrypt 函数,做自定义替换

使用方法

  1. 把源码编译一下:gcc -fPIC -shared unraid.c -o BTRS.key,至于名字为什么是 BTRS.key,因为反正这个文件也没什么用了,不如就少个文件少点事情
  2. 编译好的 BTRS.key 文件放到 /boot/config/BTRS.key
  3. 修改一下启动配置文件 /boot/config/go,把
1
/usr/local/sbin/emhttp &

替换成

1
2
3
4
5
export UNRAID_GUID=你优盘的GUID
export UNRAID_NAME=你的名字
export UNRAID_DATE=一个UNIX时间戳
export UNRAID_VERSION=你想要开心的版本比如Pro
LD_PRELOAD=/boot/config/BTRS.key /usr/local/sbin/emhttp &

代码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
#define _GNU_SOURCE
#include <stdio.h>
#include <fcntl.h>
#include <dlfcn.h>
#include <unistd.h>
#include <string.h>
#include <stdlib.h>
#include <stdint.h>
#include <sys/uio.h>
#include <netinet/in.h>

#define RSA void
#define BTRS_FORMAT "regGUID=%s&regTy=%s&regTo=\"%s\"&regTm=%s&regGen=0&regDays=0"

typedef int (*RSA_PUBLIC_DECRYPT_FUNC)(int flen, unsigned char *from, unsigned char *to, RSA *rsa, int padding);
RSA_PUBLIC_DECRYPT_FUNC rsa_public_decrypt;

const char* get_self_exe_name(int full) {
static char buffer[4096] = "";
readlink("/proc/self/exe", buffer, 4096);
if (full) {
return buffer;
}
char* ptr = &buffer[strlen(buffer)];
while (*ptr != '/') --ptr;
return (ptr + 1);
}

int RSA_public_decrypt(int flen, unsigned char *from, unsigned char *to, RSA *rsa, int padding) {
if (!rsa_public_decrypt) {
rsa_public_decrypt = (RSA_PUBLIC_DECRYPT_FUNC)dlsym(RTLD_NEXT, "RSA_public_decrypt");
}
if (!strcmp(get_self_exe_name(0), "emhttpd") || !strcmp(get_self_exe_name(0), "shfs")) {
sprintf(to, BTRS_FORMAT, getenv("UNRAID_GUID"), getenv("UNRAID_VERSION"), getenv("UNRAID_NAME"), getenv("UNRAID_DATE"));
int len = strlen(to);
return len;
} else {
return rsa_public_decrypt(flen, from, to, rsa, padding);
}
}

更新:

UNRAID_UUID 这个变量可以不要了,当然如果测试下来不生效,继续写也是 ok 的

gcc -fPIC -shared udev.c -ludev -ldl -o BTRS.key

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
#define _GNU_SOURCE
#include <dlfcn.h>
#include <fcntl.h>
#include <libudev.h>
#include <netinet/in.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/uio.h>
#include <unistd.h>

#define RSA void
#define DISK_LABEL "UNRAID"
#define BTRS_FORMAT \
"regGUID=%s&regTy=%s&regTo=\"%s\"&regTm=%s&regGen=0&regDays=0"

typedef int (*RSA_PUBLIC_DECRYPT_FUNC)(int flen, unsigned char* from,
unsigned char* to, RSA* rsa,
int padding);

static char* unraid_uuid = NULL;
static char* unraid_name = NULL;
static char* unraid_date = NULL;
static char* unraid_version = NULL;
RSA_PUBLIC_DECRYPT_FUNC rsa_public_decrypt;

int get_dev_path(char* buffer, size_t size);
int get_usb_device(char* buffer, size_t size);
int get_serial_string(char* buffer, size_t size);
void read_file(char* buff_ptr, char* base_ptr, char* file_ptr, char* file);

__attribute__((constructor)) void unraid_init() {
if (!rsa_public_decrypt) {
rsa_public_decrypt =
(RSA_PUBLIC_DECRYPT_FUNC)dlsym(RTLD_NEXT, "RSA_public_decrypt");
}

if (!unraid_uuid) {
unraid_uuid = (char*)malloc(1024);
strcpy(unraid_uuid, "1234-1234-1234-1234567890AB");
int err = get_serial_string(unraid_uuid, 1024);
if (err && getenv("UNRAID_UUID")) {
strcpy(unraid_uuid, getenv("UNRAID_UUID"));
}
unraid_name = getenv("UNRAID_NAME");
unraid_date = getenv("UNRAID_DATE");
unraid_version = getenv("UNRAID_VERSION");
}
}

const char* get_self_exe_name(int full) {
static char buffer[4096] = "";
readlink("/proc/self/exe", buffer, 4096);
if (full) {
return buffer;
}
char* ptr = &buffer[strlen(buffer)];
while (*ptr != '/') --ptr;
return (ptr + 1);
}

int RSA_public_decrypt(int flen, unsigned char* from, unsigned char* to,
RSA* rsa, int padding) {
if (!strcmp(get_self_exe_name(0), "emhttpd") ||
!strcmp(get_self_exe_name(0), "shfs")) {
sprintf(to, BTRS_FORMAT, unraid_uuid, unraid_version, unraid_name,
unraid_date);
int len = strlen(to);
return len;
} else {
return rsa_public_decrypt(flen, from, to, rsa, padding);
}
}

/**** udev stuff ****/
int get_dev_path(char* buffer, size_t size) {
char link_device[1024];
char real_device[1024];

sprintf(link_device, "/dev/disk/by-label/%s", DISK_LABEL);
char* rv = realpath(link_device, real_device);
if (!rv) return 2;

struct udev* udev;
struct udev_device* dev;
struct udev_enumerate* enumerate;
struct udev_list_entry *devices, *dev_list_entry;

int find = -1;

udev = udev_new();
if (!udev) {
return 1;
}

enumerate = udev_enumerate_new(udev);
if (!enumerate) {
return 1;
}

udev_enumerate_add_match_subsystem(enumerate, "block");
udev_enumerate_scan_devices(enumerate);

devices = udev_enumerate_get_list_entry(enumerate);
if (!devices) {
return 1;
}

udev_list_entry_foreach(dev_list_entry, devices) {
const char *path, *tmp;
unsigned long long disk_size = 0;

path = udev_list_entry_get_name(dev_list_entry);
dev = udev_device_new_from_syspath(udev, path);

if (strncmp(udev_device_get_devtype(dev), "partition", 9) != 0 &&
strncmp(udev_device_get_sysname(dev), "loop", 4) != 0) {
const char* devnode = udev_device_get_devnode(dev);
char* ptr = strstr(real_device, devnode);
if (ptr && ptr == real_device) { // prefix
find = 0;
strcpy(buffer, udev_device_get_devpath(dev));
}
}

udev_device_unref(dev);
}

udev_enumerate_unref(enumerate);
udev_unref(udev);

return find;
}

int get_usb_device(char* buffer, size_t size) {
char dev_path[1024];
if (get_dev_path(dev_path, 1024)) {
return 2;
}

int slash_index[1024];
int slash_count = 0;
for (int i = 0; i < strlen(dev_path); ++i) {
if (dev_path[i] == '/') {
slash_index[slash_count++] = i;
}
}

int find = -1;
for (int i = slash_count - 1; i >= 0; --i) {
char usb_device[1024] = "/sys";
strcpy(&dev_path[slash_index[i]], "/serial");
strcat(usb_device, dev_path);
if (!access(usb_device, F_OK | R_OK)) {
strcpy(buffer, usb_device);
buffer[strlen(buffer) - strlen("/serial")] = '\0';
find = 0;
break;
}
}

return find;
}

void read_file(char* buff_ptr, char* base_ptr, char* file_ptr, char* file) {
strcpy(file_ptr, file);
FILE* fp = fopen(base_ptr, "r");
fscanf(fp, "%s", buff_ptr);
fclose(fp);
}

int get_serial_string(char* buffer, size_t size) {
char usb_device[1024];
if (get_usb_device(usb_device, 1024)) {
return 2;
}

char* file_ptr = &usb_device[strlen(usb_device)];
char* buff_ptr = buffer;

read_file(buff_ptr, usb_device, file_ptr, "/idVendor");
strcat(buff_ptr, "-");
buff_ptr += strlen(buff_ptr);

read_file(buff_ptr, usb_device, file_ptr, "/idProduct");
strcat(buff_ptr, "-");
buff_ptr += strlen(buff_ptr);

char serial_buffer[1024]
read_file(serial_buffer, usb_device, file_ptr, "/serial");
strcpy(buff_ptr, serial_buffer);
*(buff_ptr + 4) = '-';
strcpy(buff_ptr + 5, &serial_buffer[4]);

int offset = 'A' - 'a';
for (int i = 0; i < strlen(buffer); ++i) {
if (buffer[i] >= 'a' && buffer[i] <= 'z') {
buffer[i] += offset;
}
}

return 0;
}

int main() {
char serial[1024];
int err = get_serial_string(serial, 1024);
if (!err) {
printf("SERIAL: %s\n", serial);
}
return 0;
}

准备工作

前往Releases · aperezdc/ngx-fancyindex · GitHub下载最新ngx-fancyindex源码.

安装最新的nginx

/etc/apt/source.list添加

1
2
deb [arch=YOURARCH] http://nginx.org/packages/ubuntu/ [codename] nginx
deb-src [arch=YOURARCH] http://nginx.org/packages/ubuntu/ [codename] nginx
1
2
3
4
$ sudo wget http://nginx.org/keys/nginx_signing.key
$ sudo apt-key add nginx_signing.key
$ sudo apt update
$ sudo apt install nginx -y

编译模块

1
$ nginx -V

根据现实的configure,下载对应源码,添加--with-compat --add-dynamic-module=../ngx-fancyindex-0.5.2

1
$ make modules

之后在objs中找到.so文件,移动到/usr/lib/nginx/modules目录

应用模块

/etc/nginx/nginx.conf中添加load_module modules/ngx_http_fancyindex_module.so;

并且在需要的site中添加

1
2
3
4
5
fancyindex on;
fancyindex_exact_size off;
fancyindex_name_length 500;
fancyindex_localtime on;
fancyindex_time_format "%Y-%m-%d %H:%M:%S";
1
$ sudo service nginx restart

我编译的模块文件

1

前往nginx官网下载最新nginx源码.

前往Releases · aperezdc/ngx-fancyindex · GitHub下载最新ngx-fancyindex源码.

2

1
2
3
$ cd nginx-?.?.?
$ ./configure \--prefix=/etc/nginx \--sbin-path=/usr/sbin/nginx \--conf-path=/etc/nginx/nginx.conf \--error-log-path=/var/log/nginx/error.log \--http-log-path=/var/log/nginx/access.log \--pid-path=/var/run/nginx.pid \--lock-path=/var/run/nginx.lock \--http-client-body-temp-path=/var/cache/nginx/client_temp \--http-proxy-temp-path=/var/cache/nginx/proxy_temp \--http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp \--http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp \--http-scgi-temp-path=/var/cache/nginx/scgi_temp \--user=www \--group=www \--with-file-aio \--with-threads \--with-http_addition_module \--with-http_auth_request_module \--with-http_dav_module \--with-http_flv_module \--with-http_gunzip_module \--with-http_gzip_static_module \--with-http_mp4_module \--with-http_random_index_module \--with-http_realip_module \--with-http_secure_link_module \--with-http_slice_module \--with-http_ssl_module \--with-http_stub_status_module \--with-http_sub_module \--with-http_v2_module \--with-mail \--with-mail_ssl_module \--with-stream \--with-stream_realip_module \--with-stream_ssl_module \--with-stream_ssl_preread_module \--add-module=../ngx-fancyindex-?.?.?
$ make && sudo make install

3

1
2
3
$ sudo /usr/sbin/groupadd -f www
$ sudo /usr/sbin/useradd -g www www
$ sudo nginx -t

4

nginx.conf:

1
2
3
4
5
6
7
8
9
10
charset utf-8,gbk;
location / {
    root html/file;
index index.html index.htm;
fancyindex on;
fancyindex_exact_size off;
fancyindex_name_length 500;
fancyindex_localtime on;
fancyindex_time_format "%Y-%m-%d %H:%M:%S";
}

5

1
$ sudo nginx -s reload

with zinit

.zshrc:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
# If you come from bash you might have to change your $PATH.
# export PATH=$HOME/bin:/usr/local/bin:$PATH

# Path to your oh-my-zsh installation.
export ZSH="$HOME/.oh-my-zsh"

# Set name of the theme to load --- if set to "random", it will
# load a random theme each time oh-my-zsh is loaded, in which case,
# to know which specific one was loaded, run: echo $RANDOM_THEME
# See https://github.com/ohmyzsh/ohmyzsh/wiki/Themes
ZSH_THEME="ys"

# Set list of themes to pick from when loading at random
# Setting this variable when ZSH_THEME=random will cause zsh to load
# a theme from this variable instead of looking in $ZSH/themes/
# If set to an empty array, this variable will have no effect.
# ZSH_THEME_RANDOM_CANDIDATES=( "robbyrussell" "agnoster" )

# Uncomment the following line to use case-sensitive completion.
# CASE_SENSITIVE="true"

# Uncomment the following line to use hyphen-insensitive completion.
# Case-sensitive completion must be off. _ and - will be interchangeable.
# HYPHEN_INSENSITIVE="true"

# Uncomment one of the following lines to change the auto-update behavior
# zstyle ':omz:update' mode disabled # disable automatic updates
# zstyle ':omz:update' mode auto # update automatically without asking
# zstyle ':omz:update' mode reminder # just remind me to update when it's time

# Uncomment the following line to change how often to auto-update (in days).
# zstyle ':omz:update' frequency 13

# Uncomment the following line if pasting URLs and other text is messed up.
# DISABLE_MAGIC_FUNCTIONS="true"

# Uncomment the following line to disable colors in ls.
# DISABLE_LS_COLORS="true"

# Uncomment the following line to disable auto-setting terminal title.
# DISABLE_AUTO_TITLE="true"

# Uncomment the following line to enable command auto-correction.
# ENABLE_CORRECTION="true"

# Uncomment the following line to display red dots whilst waiting for completion.
# You can also set it to another string to have that shown instead of the default red dots.
# e.g. COMPLETION_WAITING_DOTS="%F{yellow}waiting...%f"
# Caution: this setting can cause issues with multiline prompts in zsh < 5.7.1 (see #5765)
# COMPLETION_WAITING_DOTS="true"

# Uncomment the following line if you want to disable marking untracked files
# under VCS as dirty. This makes repository status check for large repositories
# much, much faster.
# DISABLE_UNTRACKED_FILES_DIRTY="true"

# Uncomment the following line if you want to change the command execution time
# stamp shown in the history command output.
# You can set one of the optional three formats:
# "mm/dd/yyyy"|"dd.mm.yyyy"|"yyyy-mm-dd"
# or set a custom format using the strftime function format specifications,
# see 'man strftime' for details.
# HIST_STAMPS="mm/dd/yyyy"

# Would you like to use another custom folder than $ZSH/custom?
# ZSH_CUSTOM=/path/to/new-custom-folder

# Which plugins would you like to load?
# Standard plugins can be found in $ZSH/plugins/
# Custom plugins may be added to $ZSH_CUSTOM/plugins/
# Example format: plugins=(rails git textmate ruby lighthouse)
# Add wisely, as too many plugins slow down shell startup.
plugins=()

source $ZSH/oh-my-zsh.sh

# User configuration

# export MANPATH="/usr/local/man:$MANPATH"

# You may need to manually set your language environment
# export LANG=en_US.UTF-8

# Preferred editor for local and remote sessions
# if [[ -n $SSH_CONNECTION ]]; then
# export EDITOR='vim'
# else
# export EDITOR='mvim'
# fi

# Compilation flags
# export ARCHFLAGS="-arch x86_64"

# Set personal aliases, overriding those provided by oh-my-zsh libs,
# plugins, and themes. Aliases can be placed here, though oh-my-zsh
# users are encouraged to define aliases within the ZSH_CUSTOM folder.
# For a full list of active aliases, run `alias`.
#
# Example aliases
# alias zshconfig="mate ~/.zshrc"
# alias ohmyzsh="mate ~/.oh-my-zsh"

### Added by Zinit's installer
if [[ ! -f $HOME/.local/share/zinit/zinit.git/zinit.zsh ]]; then
print -P "%F{33} %F{220}Installing %F{33}ZDHARMA-CONTINUUM%F{220} Initiative Plugin Manager (%F{33}zdharma-continuum/zinit%F{220})…%f"
command mkdir -p "$HOME/.local/share/zinit" && command chmod g-rwX "$HOME/.local/share/zinit"
command git clone https://github.com/zdharma-continuum/zinit "$HOME/.local/share/zinit/zinit.git" && \
print -P "%F{33} %F{34}Installation successful.%f%b" || \
print -P "%F{160} The clone has failed.%f%b"
fi

source "$HOME/.local/share/zinit/zinit.git/zinit.zsh"
autoload -Uz _zinit
(( ${+_comps} )) && _comps[zinit]=_zinit

# Load a few important annexes, without Turbo
# (this is currently required for annexes)
zinit light-mode for \
zdharma-continuum/zinit-annex-as-monitor \
zdharma-continuum/zinit-annex-bin-gem-node \
zdharma-continuum/zinit-annex-patch-dl \
zdharma-continuum/zinit-annex-rust \
zsh-users/zsh-autosuggestions \
zdharma-continuum/fast-syntax-highlighting \
OMZ::plugins/sudo/sudo.plugin.zsh \
OMZ::lib/git.zsh \
OMZ::plugins/git/git.plugin.zsh \
paulirish/git-open \
OMZ::plugins/extract/extract.plugin.zsh

### End of Zinit's installer chunk

export PATH=$PATH:~/Bins
export GPG_TTY=$(tty)

export DRI_PRIME=1

setopt no_nomatch

alias tailscale-up='tailscale up --accept-routes=true'
alias tailscale-down='tailscale down'