The script was written due to boredom and the desire to have a specific book in a retail, ebook format. I've figured out the trees, but I've yet to finish recompilation.īut it was quite lacking in understanding of the format. Not sure whether you've figured out how to read NTrees and XTrees properly, and how to reconstruct the internal files back into a proper XML document so you can extract the correct key instead of trying each. I've since started a rewrite, but there's still more reversal to do. I've addressed this many times - it was my first Python project and my first time reversing a DRM scheme. released a roving license file decryption service on Tor, but you chose to loudly announced at VitalSource telling them "hey we've got your keys, change them all now".Īs for your code, it wasn't really that good. I guess what I'm trying to say is, as much as it's nice to help others, sometimes you should be more prudent and not make things difficult for others in the future. It may have been the first public program (it's actually not, but I can give it to you on technicalities) to operate on the format, but it was quite lacking in understanding of the format. Now it appears to be double encrypted with some colors system they're introducing.Īs for your code, it wasn't really that good.
The license decryption key used to use the same obfuscation, but they added an additional layer of code obfuscation on top of that. But it might be a bit too late for that now.Īs for the keys, the public key you're talking about is the signing verification key, which does not need to be guarded very carefully. If you don't give reason for them to suspect their keys have been compromised, they generally won't change things. I would just release the format specs and some hints that allow interested people to figure things out themselves. Publicly releasing keys might have helped people at the moment, but doing so has made the future unnecessarily difficult. Keys generally lasted for a year or so, until you started releasing them, in which they went through three or four sets of keys in several months with increasingly paranoid protection implementations. I've been following the format since 2014, and they really only started changing keys over a year after I released my side channel tool. I had good reason not to release anything that works on the format directly, but instead work through side channels. Scroll up, and you may notice that I've posted two years ago.
0 kommentar(er)
