用WSL2安装$家2022 EDA工具过程分享

chenxinkai

joshua2784920 发表于 2025-1-13 17:07
To disassemble all executable binary files in the installed directory, locate the l_pubkey_ver ...

试了一下，安装后的二进制文件用SFK并不能找到你提到的pattern。change 55 to 31是指什么？ 似乎也还是找不到pattern。

Lover_Momo

Mark，感谢分享。

joshua2784920

chenxinkai 发表于 2025-1-14 07:33
试了一下，安装后的二进制文件用SFK并不能找到你提到的pattern。change 55 to 31是指什么？ 似乎也还是找 ...

The pattern is not a binary for verdi .

And .....

It is described as scl_lc_checkout_example.
The term "example" means that it is not actual data.
You need to disassemble Verdi to locate the scl_lc_checkout and l_pubkey_verify routines.
Additionally, 55 refers to the first binary of the respective routine, and 31 represents the binary for ret.
This implies that by returning on the first execution of the scl_lc_checkout and l_pubkey_verify routines, those routines will not be executed.
Therefore, the first binary of the scl_lc_checkout and l_pubkey_verify routines may not always be 55.
Furthermore, the disassembled code of the scl_lc_checkout and l_pubkey_verify routines may vary depending on the executable binary file.
As a result, you need to disassemble all executable binaries, extract the scl_lc_checkout and l_pubkey_verify routines for a fixed length, and create replacement patterns.
The fixed length is necessary to avoid confusion with other executable binaries.
Once all the work is completed and patches have been applied, you should disassemble again and compare the patched disassembled code with the original to ensure that only the scl_lc_checkout and l_pubkey_verify routines have been patched.
If more than one patch occurs in a single file, it means that the patch pattern creation is incorrect, as each file should contain only one scl_lc_checkout routine and one l_pubkey_verify routine.

chenxinkai

感谢您的耐心回答复, 我感觉下面的回复私信比较好。

总结一下您的回复，
1）VCS编译延时是license的SIGN问题，现在无解
2）VCS运行延时需要patch 所有二进制文件中的l_pubkey_verify 和 scl_lc_checkout子程序，使其第1个字节为retn
3)  匹配的二进制代码要足够长，使每个文件只被匹配一次，防止误改了其他子程序

有些问题:
在x86_64架构中，子程序，如果l_pubkey_verify的第1条指令0x55(push rbp)，这是可以理解的(因为子程序要压栈)，但是retn指令是0xC3,  而不是0x31(xor)
应该替换成0xC3而不是0x31吧

Engineerfu

正在头疼如何用一个电脑解决所有问题，就看到了这个完美解决方案，强，如果我有2022的版本一定要试一下，学习了