福大锐捷更新了新版的。。。也有个linux版rjsupplicant rjsupplicant这个程序分x86和x64两个版本，启动时通过sh判断版本运行。 通过IDA加载x86的试试看，发现有带调试信息。。。一切就简单了。 先试试把多网卡处理掉，有调试信息的话先试试直接找函数看看。 尝试搜索字符串，多网卡就搜索multi试试，发现一个CAdapterDetectThread::MultipleAdaptesOrIPCheck函数 看下F5的

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
int __cdecl CAdapterDetectThread::MultipleAdaptesOrIPCheck(int a1)
{
  int v1; // eax@1
  int v2; // ebx@2
  int v3; // esi@6
  signed int v4; // ecx@6
  char v5; // zf@6
  int v6; // edi@6
  int i; // esi@10
  int *v8; // eax@14
  int v9; // eax@15
  int v11; // \[sp+8h\] \[bp-60h\]@16
  int v12; // \[sp+Ch\] \[bp-5Ch\]@16
  const char *s1; // \[sp+24h\] \[bp-44h\]@2
  void *ptr; // \[sp+28h\] \[bp-40h\]@1
  char dest; // \[sp+30h\] \[bp-38h\]@19
  int *v16; // \[sp+40h\] \[bp-28h\]@19
  int v17; // \[sp+50h\] \[bp-18h\]@19
  int v18; // \[sp+54h\] \[bp-14h\]@19
  int v19; // \[sp+58h\] \[bp-10h\]@15

  v1 = get\_nics\_info(0);
  ptr = (void *)v1;
  if ( !v1 )
    return free\_nics\_info(ptr);
  v2 = v1;
  s1 = (const char *)(a1 + 360);
  while ( !strcmp(s1, (const char *)v2) )
  {
    v3 = v2 + 16;
    CLogFile::AppendText(g\_log\_Wireless, "nic name:%s", s1);
    v4 = 6;
    v5 = a1 == -884;
    v6 = a1 + 884;
    do
    {
      if ( !v4 )
        break;
      v5 = *(\_BYTE *)v3++ == *(\_BYTE *)v6++;
      --v4;
    }
    while ( v5 );
    if ( !v5 )
    {
      CLogFile::AppendText(g\_log\_Wireless, "mac chagedn");
      v12 = 0;
      v11 = 30;
      goto FindMul;
    }
    CLogFile::AppendText(g\_log\_Wireless, "ipv4 count:%d", *(_DWORD *)(v2 + 48));
    for ( i = *(\_DWORD *)(v2 + 52); i; i = *(\_DWORD *)(i + 8) )
      CLogFile::AppendText(
        g\_log\_Wireless,
        (const char *)&unk_810ED8E,
        *(_BYTE *)(i + 3),
        *(_BYTE *)(i + 2),
        *(_BYTE *)(i + 1),
        *(_BYTE *)i);
    if ( *(\_DWORD *)(v2 + 48) > 1 && *(\_BYTE *)(a1 + 890) )
    {
      CLogFile::AppendText(g\_log\_Wireless, "multiple ipsn");
      v12 = 0;
      v11 = 21;
      goto FindMul;
    }
    v8 = *(int **)(v2 + 52);
    if ( !v8 )
    {
      CLogFile::AppendText(g\_log\_Wireless, "ip chaged - no ipn");
      v12 = 0;
      v11 = 31;
      goto FindMul;
    }
    v9 = *v8;
    v19 = v9;
    LOWORD(v9) = \_\_ROR\_\_(v9, 8);
    v9 = \_\_ROR\_\_(v9, 16);
    LOWORD(v9) = \_\_ROR\_\_(v9, 8);
    v5 = *(_DWORD *)(a1 + 880) == v9;
    v19 = v9;
    if ( !v5 )
    {
      CLogFile::AppendText(g\_log\_Wireless, "ip chagedn");
      v12 = 0;
      v11 = 31;
      goto FindMul;
    }
LABEL_4:
    v2 = *(_DWORD *)(v2 + 64);
    if ( !v2 )
      return free\_nics\_info(ptr);
  }
  if ( !*(_BYTE *)(a1 + 890) )
    goto LABEL_4;
  CLogFile::AppendText(g\_log\_Wireless, (const char *)&unk_810EDC9, v2);
  memset(&dest, 0, 0x20u);
  strncpy(&dest, (const char *)v2, 0xFu);
  v16 = &v17;
  v17 = 10;
  v18 = 0;
  if ( ioctl(*(_DWORD *)(a1 + 900), 0x8913u, &dest) < 0 )
  {
    if ( ioctl(*(_DWORD *)(a1 + 900), 0x8946u, &dest) >= 0 && v18 == 1 )
    {
      CLogFile::AppendText(g\_log\_Wireless, "multiple adaptersn");
      v12 = 0;
      v11 = 20;
      goto FindMul;
    }
    goto LABEL_4;
  }
  if ( !((unsigned \_\_int8)v16 & 1) || !((unsigned \_\_int8)v16 & 0x40) )
  {
    CLogFile::AppendText(g\_log\_Wireless, "SIOCGIFFLAGS flags:%4x", (signed __int16)v16);
    goto LABEL_4;
  }
  CLogFile::AppendText(g\_log\_Wireless, "multiple adapters flags:%4x", (signed __int16)v16);
  v12 = 0;
  v11 = 20;
FindMul:
  PostThreadMessage(*(\_DWORD *)(a1 + 872), *(\_DWORD *)(a1 + 876), v11, v12);
  return free\_nics\_info(ptr);
}

真好。。还有输出调试，可以看出如果发现多网卡多IP等情况会跳转到FindMul这个label然后PostMessage，应该是判断出多网卡之后向线程发送一个通知信息。把这个函数nop掉就Patch掉多网卡限制了。 ————割———— 之后是Network-manager服务 查找跟service有关的，找到一个stop_service函数

1
2
3
4
5
6
7
8
9
int \_\_cdecl service\_stop(int a1)
{
  char s; // \[sp+10h\] \[bp-208h\]@1

  memset(&s, 0, 0x200u);
  sprintf(&s, "service %s stop 2>&-", a1);
  system(&s);
  return service_stop2(a1);
}

这个函数作用是通过传入的服务名调用system关闭服务。 查看xrefs引用

都是在EnvironmentCheck中引用。 查看下这个函数发现第一处的引用是关闭Network-Manager的。nop掉他，结束。 x64的也是类似的，就不重复了