Skip to content

Commit

Permalink
Refactored VI-Hacker library to minimize dependencies.
Browse files Browse the repository at this point in the history
  • Loading branch information
rcpacini committed Jan 17, 2023
1 parent 709dc65 commit 9e28dda
Show file tree
Hide file tree
Showing 75 changed files with 45 additions and 250 deletions.
113 changes: 23 additions & 90 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,49 +1,44 @@
# LabVIEW-VI-Hacker

Unlocks password protected LabVIEW VIs

***Disclaimer: This is for demonstration purposes only, not to be used for malicious intent.***

*Note: This does not support VI's in LLB's, copy the VI out of the LLB first.*

Refer to [Tools > VI-Hacker...](/builds/project/README.md) for instructions add this library as a Tools menu addon.

## Getting Started

Open the `/src/Demo.vi`, enter a password protected VI Path (*that's not in an llb*).
Open the `/src/VI-Hacker.vi`, enter a password protected VI Path (*that's not in an llb*).

Run the VI to unlock the password protected VI and preview the content in new VI.

*Note: The original VI remains unmodified.*

You are now able to see what's on the block diagram.
*Note: The original source VI remains unmodified.*

![Demo](/docs/imgs/Demo.png)

## Example

For example, run the `Demo.vi` for the locked `<vi.lib>\Utility\LVClass\Get LV Class Default Value.vi`:

![PasswordProtectedVI](/docs/imgs/PasswordProtectedVI.png)

to unlock and shows the block diagram content:
You are now able to see what's on the block diagram.

![UnlockedVI](docs/imgs/UnlockedVI.png)
## Downloads

## How does it works?
This project is saved in LabVIEW 2022. Older LabVIEW version zips are located in `/builds/`:

This library uses a simplified variation of the [VI-Explorer-VI](https://github.com/tomsoftware/VI-Explorer-VI) brute force algorithm to calculate the MD5 password salt to regenerate and replace the Block Diagram Password (BDPW) block's MD5 password hashes.
- [LabVIEW-VI-Hacker (LabVIEW 2018)](/builds/LabVIEW-VI-Hacker-LV2018.zip)
- [LabVIEW-VI-Hacker (LabVIEW 2014)](/builds/LabVIEW-VI-Hacker-LV2014.zip)
- [LabVIEW-VI-Hacker (Legacy 1.0)](/builds/LabVIEW-VI-Hacker-1.0.zip) - Older VI-Hacker 1.0

![Unlock.vi](/docs/imgs/Unlock.png)

The MD5 of the original password is concatenated with the owning libraries (LIBN) block (as colon delimited qualified library path) and LabVIEW Source (LVSR) block data.
## How does it work?

The VI-Hacker library uses a simplified variation of the [VI-Explorer-VI](https://github.com/tomsoftware/VI-Explorer-VI)
brute force algorithm to calculate the MD5 password salt to regenerate and
replace the Block Diagram Password (BDPW) MD5 password hashes.
The MD5 of the original password is concatenated with the owning libraries (LIBN)
block (as colon delimited qualified library path) and LabVIEW Source (LVSR) data block.
The password salt is then calculated by brute force and checked against the first password hash (`Hash1`).
Once the salt if found, the `BDPW.Password(MD5)` + `LIBN.QualifiedPath` + `LVSR.Content` + `Salt` are concatenated with the uncompressed block diagram heap (BDHc, BDHb, or BDHP) to generate the final hash (`Hash2`).
[ZLib](https://www.zlib.net/) is used to uncompress the block diagram heap (BDHc, BDHb) for the final password hash.

![FindSalt](/docs/imgs/FindSalt.png)

The Block Diagram Password (BDPW) block is then replaced within the VI file:
Once the salt if found, the `BDPW.Password(MD5)` + `LIBN.QualifiedPath` + `LVSR.Content` + `Salt`
are concatenated with the uncompressed block diagram heap (BDHc, BDHb, or BDHP) to generate the final
hash (`Hash2`). [ZLib](https://www.zlib.net/) is used to uncompress the block diagram heap (BDHc, BDHb)
for the final password hash. The Block Diagram Password (BDPW) block is then replaced within the VI file:

```
BDPW:
Expand All @@ -52,77 +47,15 @@ BDPW:
Hash2 (MD5) - 16 bytes
```

![ChangePassword](/docs/imgs/ChangePassword.png)

The VI is saved to a new path and loaded through the VI scripting template.
The VI is saved to a new path and then loaded as a VI scripting template to avoid application content switching.

---

*For the data dorks, read on...*

## VI File Structure

A VI file is a resource binary file (RSRC) that contain “Identifiers" and “Blocks.” Identifiers are chunks of data within the file that hold position and metadata information about the Blocks.
Blocks are named data pairs that define the VI's functions & behaviours (Connector Pane, Front Panel, Block Diagram, Icons, etc.).
Identifiers are positioned sequential at the end of the VI file but Blocks can vary in file offset position and order.
Similar to PNG images, Blocks have a 32-bit human readable ASCII string that define that chunk to data (‘LVSR’, ‘vers’, ‘ICON’, ‘BDHb’, ‘FPHb’).
Unlike PNG images, a Blocks identifier and data are located in different segments of the file and are referenced by relative byte offsets from the resource header definitions throughout the file.

### LabVIEW File Types

```
VI File (*.vi|*.vit|*.vim|*.ctl|*.ctt)
Bytes | Section // Description
-----------------------------------
32 | RSRC_HEADER1 // First resource header
x.. | BLOCK_DATA[] // Data blocks (Positions determined by BLOCK_INFO)
32 | RSRC_HEADER2 // Second resource header (duplicate of first)
20 | RSRC_INFO // Resource information packet
4 | BLOCK_CNT // Number of blocks (Add 1 to count)
12*n | BLOCK_IDS[] // Block identifiers (Array size: BLOCK_CNT + 1)
20*n | BLOCK_INFO[] // Block position information (Array size: BLOCK_CNT + 1)
1*x | VI_NAME // Qualified VI filename (1 byte length + string)
<End Of File>
```

### Order of operation

1. Read the RSRC_HEADER1 to determine the byte offset to RSRC_HEADER2
2. Read RSRC_HEADER2 and verify that RSRC_HEADER1 and RSRC_HEADER2 match (if not the file is corrupt)
3. Next read RSRC_INFO to determine the byte offset to BLOCK_CNT
4. For each block in BLOCK_CNT
5. Read the BLOCK_ID to get the block name and BLOCK_INFO byte offset
6. Read the BLOCK_INFO to determine the byte offset to BLOCK_DATA
7. Return the block name + position metadata
8. Map each block to content data position
9. Unflatten each block into LabVIEW Data Types

### Block Identifiers

Each block has 3 data chunk types: data, identity and information. This library does not parse the VI's binary data but instead keeps track of where each chunk of data is located in the file.
This makes it easier to manipulate the VI file inplace.
To distinguish between the data chunk types, this library appends the data chunk type with a 4-byte human readable type name:

- Block Data = `XXXX_DAT`
- Block Id = `XXXX_BID`
- Block Information = `XXXX_INF`

e.g. Block Diagram Password (BDPW) has: `BDPW_DAT`, `BDPW_BID` and `BDPW_INF` data chunks. LabVIEW Source (LVSR) is `LVSR_DAT`, `LVSR_BID` and `LVSR_INF`.

The resource headers, information and filename start with resource `RSRCxxxx` to ensure they don't conflict with other block names:

- RSRC Header = `RSRCHDR1` and `RSRCHDR2`
- RSRC Information = `RSRCINFO`
- RSRC Filename = `RSRCFNAM`
- Block Count = `RSRC_CNT`

This library maintains the raw VI binary content and create a metadata lookup table to map each data chunk with offset byte position, total byte size and byte size of the length prefix (some use I32 length preview, others life filename only use 1 byte for length).

### Credit

[VI-Explorer-VI](https://github.com/tomsoftware/VI-Explorer-VI) - Salt cracking [LICENSE](/docs/vi-exploer-vi_license.txt)
Ryan Pacini (c) 2023

[ZLib](https://www.zlib.net/) - Uncompress block diagram heap [LICENSE](/docs/zlib_license.txt)
[ZLib](https://www.zlib.net/) - Defalte to uncompress block diagram heap [LICENSE](/docs/zlib_license.txt)

For more information on VI file format, check out my other post: [VI File Format](https://ryanpacini.com/posts/vifileformat/)
[VI-Explorer-VI](https://github.com/tomsoftware/VI-Explorer-VI) - Salt cracking [LICENSE](/docs/vi-exploer-vi_license.txt)
Binary file added builds/LabVIEW-VI-Hacker-1.0.zip
Binary file not shown.
Binary file added builds/LabVIEW-VI-Hacker-LV2014.zip
Binary file not shown.
Binary file added builds/LabVIEW-VI-Hacker-LV2018.zip
Binary file not shown.
Binary file removed builds/VI-Hacker-LabVIEW-2018.zip
Binary file not shown.
Binary file removed builds/VI-Hacker-LabVIEW-2019.zip
Binary file not shown.
Binary file removed builds/VI-Hacker-LabVIEW-2020.zip
Binary file not shown.
Binary file removed builds/VI-Hacker-LabVIEW-2021.zip
Binary file not shown.
18 changes: 0 additions & 18 deletions builds/project/README.md

This file was deleted.

55 changes: 0 additions & 55 deletions builds/project/VI-Hacker-ToolsMenu.lvproj

This file was deleted.

Binary file removed builds/project/VI-Hacker.vi
Binary file not shown.
Binary file removed builds/project/_VI-Hacker/API/Preview.vi
Binary file not shown.
Binary file removed builds/project/_VI-Hacker/API/Unlock.vi
Binary file not shown.
Binary file removed builds/project/_VI-Hacker/Demo.vi
Binary file not shown.
Binary file not shown.
Binary file removed builds/project/_VI-Hacker/SubVIs/Change Password.vi
Binary file not shown.
Binary file removed builds/project/_VI-Hacker/SubVIs/Find Salt.vi
Binary file not shown.
Binary file removed builds/project/_VI-Hacker/SubVIs/Get Block.vi
Binary file not shown.
Binary file removed builds/project/_VI-Hacker/SubVIs/MD5.vi
Binary file not shown.
Binary file removed builds/project/_VI-Hacker/SubVIs/Parse VI.vi
Binary file not shown.
Binary file removed builds/project/_VI-Hacker/SubVIs/Read VI.vi
Binary file not shown.
Binary file removed builds/project/_VI-Hacker/SubVIs/Set Data.vi
Binary file not shown.
Binary file removed builds/project/_VI-Hacker/SubVIs/Unflatten BDPW.vi
Binary file not shown.
Binary file not shown.
Binary file removed builds/project/_VI-Hacker/SubVIs/Unflatten vers.vi
Binary file not shown.
Binary file removed builds/project/_VI-Hacker/SubVIs/Write VI.vi
Binary file not shown.
Binary file removed builds/project/_VI-Hacker/SubVIs/zlib Path.vi
Binary file not shown.
Binary file removed builds/project/_VI-Hacker/SubVIs/zlib Uncompress.vi
Binary file not shown.
Binary file removed builds/project/_VI-Hacker/TypeDefs/Block BDPW.ctl
Binary file not shown.
Binary file removed builds/project/_VI-Hacker/TypeDefs/Block vers.ctl
Binary file not shown.
Binary file removed builds/project/_VI-Hacker/TypeDefs/Block.ctl
Binary file not shown.
Binary file removed builds/project/_VI-Hacker/TypeDefs/Content.ctl
Binary file not shown.
Binary file removed builds/project/_VI-Hacker/TypeDefs/RSRC_Header.ctl
Binary file not shown.
Binary file removed builds/project/_VI-Hacker/TypeDefs/RSRC_Id.ctl
Binary file not shown.
Binary file removed builds/project/_VI-Hacker/TypeDefs/RSRC_Info.ctl
Binary file not shown.
Binary file removed builds/project/_VI-Hacker/VI Tree.vi
Binary file not shown.
43 changes: 0 additions & 43 deletions builds/project/_VI-Hacker/VI-Hacker.lvlib

This file was deleted.

Binary file removed builds/project/_VI-Hacker/zlib.dll
Binary file not shown.
Binary file removed docs/imgs/ChangePassword.png
Binary file not shown.
Binary file modified docs/imgs/Demo.png
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file removed docs/imgs/FindSalt.png
Binary file not shown.
Binary file removed docs/imgs/PasswordProtectedVI.png
Binary file not shown.
Binary file removed docs/imgs/ToolsMenu.png
Binary file not shown.
Binary file removed docs/imgs/Unlock.png
Binary file not shown.
Binary file removed docs/imgs/UnlockedVI.png
Binary file not shown.
Binary file removed src/API/Preview.vi
Binary file not shown.
Binary file removed src/API/Unlock.vi
Binary file not shown.
Binary file removed src/Demo.vi
Binary file not shown.
Binary file added src/MD5.vi
Binary file not shown.
Binary file removed src/SubVIs/Change Lib Password.vi
Binary file not shown.
Binary file removed src/SubVIs/Change Password.vi
Binary file not shown.
Binary file removed src/SubVIs/Find Salt.vi
Binary file not shown.
Binary file removed src/SubVIs/Get Block.vi
Binary file not shown.
Binary file removed src/SubVIs/MD5.vi
Binary file not shown.
Binary file removed src/SubVIs/Parse VI.vi
Binary file not shown.
Binary file removed src/SubVIs/Read VI.vi
Binary file not shown.
Binary file removed src/SubVIs/Set Data.vi
Binary file not shown.
Binary file removed src/SubVIs/Unflatten BDPW.vi
Binary file not shown.
Binary file removed src/SubVIs/Unflatten LIBN.vi
Binary file not shown.
Binary file removed src/SubVIs/Unflatten vers.vi
Binary file not shown.
Binary file removed src/SubVIs/Write VI.vi
Binary file not shown.
Binary file removed src/SubVIs/zlib Path.vi
Binary file not shown.
Binary file removed src/SubVIs/zlib Uncompress.vi
Binary file not shown.
Binary file removed src/TypeDefs/Block BDPW.ctl
Binary file not shown.
Binary file removed src/TypeDefs/Block vers.ctl
Binary file not shown.
Binary file removed src/TypeDefs/Block.ctl
Binary file not shown.
Binary file removed src/TypeDefs/Content.ctl
Binary file not shown.
Binary file removed src/TypeDefs/RSRC_Header.ctl
Binary file not shown.
Binary file removed src/TypeDefs/RSRC_Id.ctl
Binary file not shown.
Binary file removed src/TypeDefs/RSRC_Info.ctl
Binary file not shown.
Binary file removed src/VI Tree.vi
Binary file not shown.
Loading

0 comments on commit 9e28dda

Please sign in to comment.