Modification instructions:
1. Based on the information provided by UniSoft [EXETOOLS], we tried our best to restore the modified IDA file contents to the leaked version, and then performed the Variable authorization function crack patch (the leaked version only includes x86) and x64 Hex-Rays Decompiler Plugins. We did not package older versions of the plugins for other platforms, and compatibility issues may arise. You can use Github.com/x0rloser/ida_dll_shim to resolve these yourself if necessary.
2. Fixed the LAN authorization limit detection (will not send or receive to LAN) and IDB blacklist detection limit. STORE_USER_INFO is disabled by default.
3. To reduce pressure on the Hex-Rays SA server, IDA has been patched to disable automatic upgrade requests and manual upgrade requests (user MAC address, IP address, KEY, etc. will be uploaded by default when an upgrade verification is requested) that take longer than a week by default. IDA BugReport and Database upload submission functions are also disabled by the patches.
4. To reduce the strain on the Hex-Rays SA server, the IDA Lumina function, including the automatic Lumina analysis option, is disabled by default (Lumina-related function validation, user hostname, IDB path, binary file path, binary MD5, IP, KEY, E-mail, etc.). This article will not go into detail as installing the new version of the Lumina private server is more cumbersome. If you need to use it, configure the relevant proxy via IDA - Options - Lumina - Servers function. For the rest, please check the information yourself. Please be aware of the privacy risks of using the private server.
5. To enhance the Chinese string identification function, make it easier to modify program code and compile results, and find encryption algorithms and constants in the code, the new version of StrongCC v0.3 includes patches and findcrypt plugins.
6. The necessary VC green runtime library has been added.
7. Python produced a green version of 3.11.7 (IDA8.3 doesn't support version 3.12 very well. IDA's own code needs to be modified to support it. We used version 3.11 for security reasons).
8. The functions of Zaitian, the landscaping tools made by Yun, include the following:
a. Use the green version of Python 3.11.7;
b. Set the relationship between the .idb and .i64 database files;
c. Set up the IDA desktop shortcut;
d. Configure the IDA right-click menu;
e. Customize the authorized IDA username (based on the KEYGEN code provided by the CZC [EXETLOOLS] administrator);
f. Supports the removal and cleaning of relevant registry entries as determined by the green version of IDA;
g. GPT, elegant icons and some detailed sensor reminders.
Notes:
1. The green version's release path should not contain Chinese paths or Chinese symbols. This is because IDA uses QT to convert Chinese paths in the LoadLibrary. We tried using file patching, but it involved too many code changes, and a special treatment is not applied as the evasion method is not elegant enough and could cause other language issues. 2. Use the green version of Python to install the plugins.
When using it, navigate to the python311 directory and make sure you use the "-m" parameter to specify pip running in import module mode, for example: a. python.exe -m pip list b. python.exe -m pip install + package name or path
3. If you want to switch to another version of Python, you can use the idapyswitch.exe program in the root directory to specify this (if you are using a specific version of Python, you will need to install the library corresponding to the plugin yourself, otherwise the plugin will not be usable. The current green Win7 version is no longer supported; if necessary, you can install version 3.9.3 yourself).
4. Starting with IDA version 7.7, the acquisition and processing of Chinese system encoding changed, resulting in the default use of UTF-8 encoding (instead of the gb2312 encoding of version 7.6), which ensures that strings in many Chinese programs are correctly recognized. To resolve this issue, @笑一刀 updated the new version of StrongCC v3, which can correct the default encoding used by IDA according to the system language. The Chinese system uses CP936 by default, thus reducing the need for manual encoding change in the vast majority of operations. This function can be configured via the configuration file (/cfg/StrongCC.cfg, CPACP = true or false) to enable or disable it.
If you are using the Chinese system but the string in the program is not GBK encoded, or you cannot determine the language and encoding of the string, you can follow these steps to set it up:
a. Select Options - General - Strings. Open the IDA menu and then set "Default 8 bits" to UTF-8 (or the encoding of the relevant language).
b. To allow IDA to re-analyze the program, select Options - General - Analysis - "Re-analyze program" from the IDA menu.
c. If you have previously analyzed the string, you also need to right-click on the Strings window and select Rebuild to allow IDA to reconstruct the string.
5. The IDA83_SDK_TOOLS.7z file in the root directory is related to the IDA 8.3 SDK and can be deleted if it is not needed and does not affect its use.
[/QUOTE]
thank you so much!
