From 9ed1c79d000d57a3ada411a908ae09677889999b Mon Sep 17 00:00:00 2001 From: David Parsons Date: Mon, 24 Sep 2018 14:49:47 +0200 Subject: [PATCH] Moved ESXi code to new repository. --- .gitignore | 2 + esxi/bin/smctest.sh | 4 - esxi/esxi-build.sh | 3 - esxi/esxi-install.sh | 14 -- esxi/esxi-uninstall.sh | 14 -- esxi/etc/rc.local.d/unlocker.py | 384 -------------------------------- esxi/unlocker-esxi-300.tgz | Bin 4754 -> 0 bytes esxi/unlocker.tgz | Bin 4187 -> 0 bytes osx-install.sh | 28 --- osx-uninstall.sh | 26 --- readme.txt | 45 +--- unlocker.py | 40 +--- 12 files changed, 18 insertions(+), 542 deletions(-) delete mode 100755 esxi/bin/smctest.sh delete mode 100755 esxi/esxi-build.sh delete mode 100755 esxi/esxi-install.sh delete mode 100755 esxi/esxi-uninstall.sh delete mode 100755 esxi/etc/rc.local.d/unlocker.py delete mode 100644 esxi/unlocker-esxi-300.tgz delete mode 100644 esxi/unlocker.tgz delete mode 100755 osx-install.sh delete mode 100755 osx-uninstall.sh diff --git a/.gitignore b/.gitignore index 34af2c0..ef986b0 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,5 @@ tests/ build/ dist/ *.spec +*.pyc + diff --git a/esxi/bin/smctest.sh b/esxi/bin/smctest.sh deleted file mode 100755 index bad83b1..0000000 --- a/esxi/bin/smctest.sh +++ /dev/null @@ -1,4 +0,0 @@ -#!/bin/sh -grep -il \(c\)AppleComputerInc /bin/vmx* -vim-cmd hostsvc/hosthardware | grep smcPresent | cut -d ',' -f 1 | sed 's/^[ \t]*//' -grep useVmxSandbox /etc/vmware/hostd/config.xml | sed 's/^[ \t]*//' diff --git a/esxi/esxi-build.sh b/esxi/esxi-build.sh deleted file mode 100755 index a081ce3..0000000 --- a/esxi/esxi-build.sh +++ /dev/null @@ -1,3 +0,0 @@ -#!/bin/sh -set -e -tar czvf unlocker-esxi-300.tgz unlocker.tgz esxi-install.sh esxi-uninstall.sh diff --git a/esxi/esxi-install.sh b/esxi/esxi-install.sh deleted file mode 100755 index 356d926..0000000 --- a/esxi/esxi-install.sh +++ /dev/null @@ -1,14 +0,0 @@ -#!/bin/sh -set -e -#set -x - -echo VMware Unlocker 3.0.0 -echo =============================== -echo Copyright: Dave Parsons 2011-18 - -# Ensure we only use unmodified commands -export PATH=/bin:/sbin:/usr/bin:/usr/sbin - -echo Installing unlocker.tgz -BootModuleConfig.sh --verbose --add=unlocker.tgz -echo Success - please now restart the server! diff --git a/esxi/esxi-uninstall.sh b/esxi/esxi-uninstall.sh deleted file mode 100755 index bc0e02c..0000000 --- a/esxi/esxi-uninstall.sh +++ /dev/null @@ -1,14 +0,0 @@ -#!/bin/sh -set -e -#set -x - -echo VMware Unlocker 3.0.0 -echo =============================== -echo Copyright: Dave Parsons 2011-18 - -# Ensure we only use unmodified commands -export PATH=/bin:/sbin:/usr/bin:/usr/sbin - -echo Uninstalling unlocker.tgz -BootModuleConfig.sh --verbose --remove=unlocker.tgz -echo Success - please now restart the server! diff --git a/esxi/etc/rc.local.d/unlocker.py b/esxi/etc/rc.local.d/unlocker.py deleted file mode 100755 index 72fd37d..0000000 --- a/esxi/etc/rc.local.d/unlocker.py +++ /dev/null @@ -1,384 +0,0 @@ -#!/usr/bin/env python -""" -The MIT License (MIT) - -Copyright (c) 2014-2018 Dave Parsons & Sam Bingner - -Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the 'Software'), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in -all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -THE SOFTWARE. - -vSMC Header Structure -Offset Length Struct Type Description ----------------------------------------- -0x00/00 0x08/08 Q ptr Offset to key table -0x08/08 0x04/4 I int Number of private keys -0x0C/12 0x04/4 I int Number of public keys - -vSMC Key Data Structure -Offset Length Struct Type Description ----------------------------------------- -0x00/00 0x04/04 4s int Key name (byte reversed e.g. #KEY is YEK#) -0x04/04 0x01/01 B byte Length of returned data -0x05/05 0x04/04 4s int Data type (byte reversed e.g. ui32 is 23iu) -0x09/09 0x01/01 B byte Flag R/W -0x0A/10 0x06/06 6x byte Padding -0x10/16 0x08/08 Q ptr Internal VMware routine -0x18/24 0x30/48 48B byte Data -""" - -from __future__ import print_function -import codecs -import os -import shutil -import struct -import subprocess -import sys - -if sys.version_info < (2, 7): - sys.stderr.write('You need Python 2.7 or later\n') - sys.exit(1) - - -def bytetohex(data): - if sys.version_info > (3, 0): - # Python 3 code in this block - return "".join("{:02X} ".format(c) for c in data) - else: - # Python 2 code in this block - return "".join("{:02X} ".format(ord(c)) for c in data) - - -def joinpath(folder, filename): - return os.path.join(folder, filename) - - -def printkey(i, offset, smc_key, smc_data): - print(str(i + 1).zfill(3) - + ' ' + hex(offset) - + ' ' + smc_key[0][::-1].decode('UTF-8') - + ' ' + str(smc_key[1]).zfill(2) - + ' ' + smc_key[2][::-1].replace(b'\x00', b' ').decode('UTF-8') - + ' ' + '{0:#0{1}x}'.format(smc_key[3], 4) - + ' ' + hex(smc_key[4]) - + ' ' + bytetohex(smc_data)) - - -def set_bit(value, bit): - return value | (1 << bit) - - -def clear_bit(value, bit): - return value & ~(1 << bit) - - -def test_bit(value, bit): - return value & bit - - -E_CLASS64 = 2 -E_SHT_RELA = 4 - - -def patchelf(f, oldoffset, newoffset): - f.seek(0) - magic = f.read(4) - if not magic == b'\x7fELF': - raise Exception('Magic number does not match') - - ei_class = struct.unpack('=B', f.read(1))[0] - if ei_class != E_CLASS64: - raise Exception('Not 64bit elf header: ' + ei_class) - - f.seek(40) - e_shoff = struct.unpack('=Q', f.read(8))[0] - f.seek(58) - e_shentsize = struct.unpack('=H', f.read(2))[0] - e_shnum = struct.unpack('=H', f.read(2))[0] - e_shstrndx = struct.unpack('=H', f.read(2))[0] - - print('e_shoff: 0x{:x} e_shentsize: 0x{:x} e_shnum:0x{:x} e_shstrndx:0x{:x}'.format(e_shoff, e_shentsize, - e_shnum, e_shstrndx)) - - for i in range(0, e_shnum): - f.seek(e_shoff + i * e_shentsize) - e_sh = struct.unpack('=LLQQQQLLQQ', f.read(e_shentsize)) - # e_sh_name = e_sh[0] - e_sh_type = e_sh[1] - e_sh_offset = e_sh[4] - e_sh_size = e_sh[5] - e_sh_entsize = e_sh[9] - if e_sh_type == E_SHT_RELA: - e_sh_nument = int(e_sh_size / e_sh_entsize) - # print 'RELA at 0x{:x} with {:d} entries'.format(e_sh_offset, e_sh_nument) - for j in range(0, e_sh_nument): - f.seek(e_sh_offset + e_sh_entsize * j) - rela = struct.unpack('=QQq', f.read(e_sh_entsize)) - r_offset = rela[0] - r_info = rela[1] - r_addend = rela[2] - if r_addend == oldoffset: - r_addend = newoffset - f.seek(e_sh_offset + e_sh_entsize * j) - f.write(struct.pack('=QQq', r_offset, r_info, r_addend)) - print('Relocation modified at: ' + hex(e_sh_offset + e_sh_entsize * j)) - - -def patchkeys(f, key): - # Setup struct pack string - key_pack = '=4sB4sB6xQ' - # smc_old_memptr = 0 - smc_new_memptr = 0 - - # Do Until OSK1 read - i = 0 - while True: - - # Read key into struct str and data byte str - offset = key + (i * 72) - f.seek(offset) - smc_key = struct.unpack(key_pack, f.read(24)) - smc_data = f.read(smc_key[1]) - - # Reset pointer to beginning of key entry - f.seek(offset) - - if smc_key[0] == b'SKL+': - # Use the +LKS data routine for OSK0/1 - smc_new_memptr = smc_key[4] - print('+LKS Key: ') - printkey(i, offset, smc_key, smc_data) - - elif smc_key[0] == b'0KSO': - # Write new data routine pointer from +LKS - print('OSK0 Key Before:') - printkey(i, offset, smc_key, smc_data) - # smc_old_memptr = smc_key[4] - f.seek(offset) - f.write(struct.pack(key_pack, smc_key[0], smc_key[1], smc_key[2], smc_key[3], smc_new_memptr)) - f.flush() - - # Write new data for key - f.seek(offset + 24) - smc_new_data = codecs.encode('bheuneqjbexolgurfrjbeqfthneqrqcy', 'rot_13') - f.write(smc_new_data.encode('UTF-8')) - f.flush() - - # Re-read and print key - f.seek(offset) - smc_key = struct.unpack(key_pack, f.read(24)) - smc_data = f.read(smc_key[1]) - print('OSK0 Key After:') - printkey(i, offset, smc_key, smc_data) - - elif smc_key[0] == b'1KSO': - # Write new data routine pointer from +LKS - print('OSK1 Key Before:') - printkey(i, offset, smc_key, smc_data) - smc_old_memptr = smc_key[4] - f.seek(offset) - f.write(struct.pack(key_pack, smc_key[0], smc_key[1], smc_key[2], smc_key[3], smc_new_memptr)) - f.flush() - - # Write new data for key - f.seek(offset + 24) - smc_new_data = codecs.encode('rnfrqbagfgrny(p)NccyrPbzchgreVap', 'rot_13') - f.write(smc_new_data.encode('UTF-8')) - f.flush() - - # Re-read and print key - f.seek(offset) - smc_key = struct.unpack(key_pack, f.read(24)) - smc_data = f.read(smc_key[1]) - print('OSK1 Key After:') - printkey(i, offset, smc_key, smc_data) - - # Finished so get out of loop - break - - else: - pass - - i += 1 - return smc_old_memptr, smc_new_memptr - - -def patchsmc(name, sharedobj): - with open(name, 'r+b') as f: - - smc_old_memptr = 0 - smc_new_memptr = 0 - - # Read file into string variable - vmx = f.read() - - print('File: ' + name + '\n') - - # Setup hex string for vSMC headers - # These are the private and public key counts - smc_header_v0 = b'\xF2\x00\x00\x00\xF0\x00\x00\x00' - smc_header_v1 = b'\xB4\x01\x00\x00\xB0\x01\x00\x00' - - # Setup hex string for #KEY key - key_key = b'\x59\x45\x4B\x23\x04\x32\x33\x69\x75' - - # Setup hex string for $Adr key - adr_key = b'\x72\x64\x41\x24\x04\x32\x33\x69\x75' - - # Find the vSMC headers - smc_header_v0_offset = vmx.find(smc_header_v0) - 8 - smc_header_v1_offset = vmx.find(smc_header_v1) - 8 - - # Find '#KEY' keys - smc_key0 = vmx.find(key_key) - smc_key1 = vmx.rfind(key_key) - - # Find '$Adr' key only V1 table - smc_adr = vmx.find(adr_key) - - # Print vSMC0 tables and keys - print('appleSMCTableV0 (smc.version = "0")') - print('appleSMCTableV0 Address : ' + hex(smc_header_v0_offset)) - print('appleSMCTableV0 Private Key #: 0xF2/242') - print('appleSMCTableV0 Public Key #: 0xF0/240') - - if (smc_adr - smc_key0) != 72: - print('appleSMCTableV0 Table : ' + hex(smc_key0)) - smc_old_memptr, smc_new_memptr = patchkeys(f, smc_key0) - elif (smc_adr - smc_key1) != 72: - print('appleSMCTableV0 Table : ' + hex(smc_key1)) - smc_old_memptr, smc_new_memptr = patchkeys(f, smc_key1) - - print() - - # Print vSMC1 tables and keys - print('appleSMCTableV1 (smc.version = "1")') - print('appleSMCTableV1 Address : ' + hex(smc_header_v1_offset)) - print('appleSMCTableV1 Private Key #: 0x01B4/436') - print('appleSMCTableV1 Public Key #: 0x01B0/432') - - if (smc_adr - smc_key0) == 72: - print('appleSMCTableV1 Table : ' + hex(smc_key0)) - smc_old_memptr, smc_new_memptr = patchkeys(f, smc_key0) - elif (smc_adr - smc_key1) == 72: - print('appleSMCTableV1 Table : ' + hex(smc_key1)) - smc_old_memptr, smc_new_memptr = patchkeys(f, smc_key1) - - print() - - # Find matching RELA record in .rela.dyn in ESXi ELF files - # This is temporary code until proper ELF parsing written - if sharedobj: - print('Modifying RELA records from: ' + hex(smc_old_memptr) + ' to ' + hex(smc_new_memptr)) - patchelf(f, smc_old_memptr, smc_new_memptr) - - # Tidy up - f.flush() - f.close() - - -def patchvmkctl(name): - # Patch file - print('smcPresent Patching: ' + name) - f = open(name, 'r+b') - - # Read file into string variable - vmkctl = f.read() - applesmc = vmkctl.find(b'applesmc') - f.seek(applesmc) - f.write(b'vmkernel') - - # Tidy up - f.flush() - f.close() - print('smcPresent Patched: ' + name) - - -def main(): - - # Stop the hostd service - subprocess.call('/etc/init.d/hostd stop', shell=True) - - # Current folder - currdir = os.getcwd() - - # Source files - srcvmx = '/bin/vmx' - srclib32 = '/lib/libvmkctl.so' - srclib64 = '/lib64/libvmkctl.so' - - # Destination files cuurently tmp but may use scratch - basefolder = '/tmp/' - destfolder = joinpath(basefolder, 'unlocker') - destvmx = joinpath(destfolder,'bin/vmx') - destlib32 = joinpath(destfolder,'lib/libvmkctl.so') - destlib64 = joinpath(destfolder,'lib64/libvmkctl.so') - - # Work files to create vmtardisk - # filetgz = joinpath(destfolder, 'custom.tgz') - # filevmtar = joinpath(destfolder, 'custom.vmtar') - # filevgz = joinpath(destfolder, 'custom.vgz') - - # Remove files & folder if they exist - if os.path.isdir(destfolder): - shutil.rmtree(destfolder, True) - - # Create the base folder - os.makedirs(destfolder) - os.chdir(destfolder) - - # Patch the vmx executable - os.makedirs(joinpath(destfolder, 'bin')) - shutil.copy2(srcvmx, destvmx) - patchsmc(destvmx, True) - - # Patch 32-bit libvmkctl to return Apple SMC present - os.makedirs(joinpath(destfolder, 'lib')) - shutil.copy2(srclib32, destlib32) - patchvmkctl(destlib32) - - # Patch 64-bit libvmkctl to return Apple SMC present - if os.path.isfile(srclib64): - os.makedirs(joinpath(destfolder, 'lib64')) - shutil.copy2(srclib64, destlib64) - patchvmkctl(destlib64) - - # Build the gzipped tar file custom.tgz - print('\nCreating custom.tgz...') - subprocess.call('/bin/tar czvf custom.tgz bin lib lib64', shell=True) - - # Build the vmtar file custom.vmtar - print('\nCreating custom.vmtar...') - subprocess.call('/bin/vmtar -v -c custom.tgz -o custom.vmtar', shell=True) - - # Build the gzipped vmtar file custom.vgz - print('\nCreating custom.vgz...') - subprocess.call('/bin/gzip < custom.vmtar > custom.vgz', shell=True) - subprocess.call('/bin/vmtar -v -t < custom.vgz', shell=True) - - # Load the tardisk - subprocess.call('vmkramdisk custom.vgz', shell=True) - - # Return to script folder - os.chdir(currdir) - - # Start the hostd service - subprocess.call('/etc/init.d/hostd start', shell=True) - - -if __name__ == '__main__': - main() diff --git a/esxi/unlocker-esxi-300.tgz b/esxi/unlocker-esxi-300.tgz deleted file mode 100644 index 5f3bef17e1acba58c2918685b1751f540f66ebf3..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 4754 zcmV;D5^e1tiwFP)j(J-E1MQe+R218m$H`!mktE=y2?C9TZkmjMl59YbEP^1Z$#g?E zIfGF>S0*6E-kY*No(L0G6?7_|7$>%?VEF^q4+qQj`0Jyz%Tg%W(|Wp*sd_kk-TWfk?g)XmQPVj zUwcJ1y*X2A<5iH?9!y8>v<9;xj@9lzYO98VDy?@6SVpodt6uf>1Pq)89O&WNQ*l@m zSHC$_biuovPF$fK+xzS@+~cpfH=QlUJ<b_pN~OP1NS#^9!5AO ze5Pob{S+QiXkl1!23$t^eF~Ck ztWF}qNbM^e$ewF6v^25D^V=$Ro^ln+OUAZH$QuY+b@UAP3tkU()C+{zP@F-gr{5M=^5bRY{GYi7BqRFml#@}0tRUAW^wcr`hd~dMikYzqOvIxV3GtjkH zuh!rl&?Jv}0~Ftq^Ke;XrFsd|qYIZ3pOAF;6KABx$%v2f1+LEQSSX1ojaNd^^rQ+* zBv(){dgEuoakY5RfVG&tVXrc_;Ta#>jtDuc3nZO5+BFixGKrTuE8VeZ{`l;B9c2YnZhZRnxn-~ zu!7v|tHX_9a?KM@e{P>}MDZ&FNe8c1m6n*H3@b zPr-}L>B?&XGa;s*@^OV@P6}nD5(~qd@4fcf>Qtz6>Iquy4uxf^P6KHcdfae=u0pvk zKN(HyDo4mi&khUcwhnX0hw3X4vlTo~>nlfQtA>rI+B-liCLZ8AW9D&K-6Fn4F|0ma zmeYN5E8Aqna>esYYHE#m|ia<>-C6jRXs^11fAQSQED5-3`%*V7#flZ z1CweK9)1YrtTD2Htv?2iqi@!|N<5uR&r*+CbqLe<^$c%zZs>X!bkZM{$ayPZ z%vU}1#A&~K-&aVX_i?S&GiQE%dQUY2y?ChJn*vm{5$&*fzvTRYQStQzgE>#(Otm!6 z)SJT!U(ZXd&gznnLmf17jlC6bV-i3I<;gKD69!jCF=F}B7;vGsh=Z|WUg%q@G5>mR4MVMm|PuyCIsRz=$?OOnRlI{ha9zHhBq8Dz^oj}v{KBQ z5|hbN|C6@%$wq(dZZN3Eb(MGda$y{tdJLO0e4*w#0t z=#mOuQU@i4{Z};mT(>LQ@nZ8zkXnpUAW=x%F?fZ4UF+B#F#TiY_pHv(LM5%s) zj6bhEQubrTwFjAk0`q_y-oI6sk}cd3sM`3zQJ)M+qWEok?xz3O>-QIb=tvB-pHumC zSC7~jz%axgf;2W1h=Tg(1D%%j&hJZ}_=e1jPpit%49o+Hq=gb}-v`_B@I@!RiE3h} zzoLek#?!A;@-@3Nnnh4Z4fhYCQYDe(M(PwYzLZu8-RY2fcCupg{NtBo-*U#KrZC(# zp_l5rIq@>dGwW7dg{eGvkqN>!X4rgG8sOqw?xcLDfj0d_ZpFku!dohTcxJxdv5>mn z!!X)8{x?pubJ~0L!YV(pd);S#hb@d)o_tfU$AMq`O7GsDJe~t4+}AYSA%Wfq-!hm0zjU_q?wDYNi)oF-B!EpgIZ@jnO;?8;bV|CDy)FMG}#)7 z&l7O%CbmxYD|6s2V&+sMgXZ+|VTdAK&QS!_48PH=vZTE)wG|Vfv!tN-BKn1sh*M3C z86HtuL&Qp?D>}hAX3CR)oi`tJ(78%<-Ge1)Kh255B`uDRmz#`q`%wQY*=LMFtb!^7 zjfUNWUWRRTze69R`9bC=-TSg?2zzeLyUOKpg*veH`Np;+!_cJLCw-xYrPuiH6dG?I)7Kl-_sr%*jk$UUKZr2;TGhh4b`FlaOm6~0CYuJdh+oJOJ z!;dl&?O28krmXd?BC(zISnjV~2lx9$Z)m+q72zvoJDhKhC(WJ~;9>xzh1h{QxpQ9o z2oX|jdDs6@;d4av*8*&ReAZMm2JjF-XVj1 zS<#;m1D%>p*%Owx_LH45#R>)d3SM6;WV>Cj_}K5jmbD6g{Ul$QCF;0 zH@nNM0w#JsYzY=ae;1gy{Y3M|4&P)ENVrNOywq|Q7T8DAAFMNEQys$WG8OlQwl*qG z3+)){5_@NEn+F$}^qD0^w5sO%=Qi72hr@cc0{|<&w9G8BeM42T zWIMB%XM=d2#9B+-H?=MfEBG3;v9fcm6Vfi#UYmEH-eQL_IfkiiI7|)6*U1-Jd#WVP zz^X;(kkRz~<@8pL$VAR0PByRhn~KE&0vbn(-3%qAYkf>OSb`F37jxI+>09uN_d@wVGiyS7<@}jzl6N&3eFyiBRwXl6 zfH>Pl^T>%NcB;WB_gFWbHOo@_@dMb6maV`V-6TpZOul%v(EIUY7WdTf@Rd49&$CJ# zEf#)`kA?fs&3g}&_re*Ed(Kuz(_?t&TgE?~ILy6TmFOHfa(y%7;BcPw&^Z4f!zyLs z=Ns*+cmj5w4S8?EurloCk9~?Y8sb)sBKT>C=F8qJPkT)G&#U0^PwX=xhOxb_1>sQX zZ7ks6U1V*%{8=uGTs8ULr$OC)mPK}Zua^YOMMjlA(kuI!x zz>4VC!v?Q$27DiH(LbcYWxg^_z6qn7(bt*>e3)|H*>IMKZWmXX8L+~5Ms?FBlyS`P ztC>{pSOuv<=#D;oNs94GT;L2-c8Q7bww9wNb#7f~meJCPY!*sUc|Wm6UR=*&^;{Li zirk{QN8DAb#p>9XA58f@+lRDDGId;EO?mlGMR!)R%XvkS~aNNGcsAN0Ek_$*X zd3)lUrNXzhcq(z6D91?!_xW!epn(d{3Wex2NsslxBPl;~LS<=rfu}pSyls#C-EwDM z#XXjTrxWq!N^El!G!8JfC+=!6tu)yWS6i+SAQ9#V?}{|1rNRf_X7(vnyf-K_iQLV4 zzee7b&F@g#CF!+SN;Ow}aL~pYcks3{9FtjXvUqLbwMF)v<6a`|+#zA1%~QJ6T4Nd4 z!-*fJt!Z9y-OAM!sWK)n565`EtNgb~v+{8EPz>UlRHX^c>wlGAhw5NG5@ z$tTTieP_e-^X}E{?%?M=jQp8H=1sW|iaiblIf%r0qXC0?4B(Q~rNG=9{hlF2tC8Q! zLW$T2g-%~SP$n{miCKOPf!&D~y&uT6&=`z-#`T1k0>%EJ8Dr7gx_44hL-jEPqa7PP zi()j|c)MhPKjwS!pF-_7x<#xqP#ytPaEqrK~v1LHSp{}YJz}3S59DJn%mnr#W-u) zp_y^957>K?SBucu^wXv9tYewmS z*hgE=C7t;cCawg3_fWqrQ-dvs#nRK+E$}`k`>BvX47xMP5}!WM_pr?WMP?c-w`r^( zJpmAM7o=NOc)y{cSg(vRfk>l1EW>`RPG{3~xd}BcbFww~>A)PqlVI4Kpr>9%v3rX) zcIC$kbFQI)%3`)tl6UDXrSbDtwjwRO-u|aR{W+u4tIJmYMcs5<)Z{$3-6MHG>;lUj zn(7`)HpN>B!Xh6Sr99G**g0RN>;A)JL;>o{RjS9#@J{+RN&>aE2BhltyBpq5z+sGy z)}rl+W)G|ZZb~bb)Ac$$Z+btwc;9P_?SgVT3 z%3=RtggU3PX!G;wV)Hri!pB%CJcWO?uyM)%2sql)PS6g4b~Sf&6hhnnDRcbN{lvun zEBy})783#gP5*<4K!9L~Cf>3oxMVgUS91 zSy~wV``HbR68_u8ucp65uKGt#+aYW&hWmGo8=!zhx@sV;+#KPGNQAYW%|+4!1qI#V zC=2Ap%z}dER#vkA>4D!z({;17grm_wL7=lE-2B23f%E{P;J{tDZN{C$6|38EOv-Pk4*PQ-`cK{UJ3F!|1 g|Fj8Qa>*r^Tyn`Jmt1nmCI2t@HK45hb#z-!Sui5 z|B6{f|C_bLYS}zIDnBz!)2x}#zM>?989d z7a`*<&jtauoUMM$EuGncJsZK)55iz+m*{tD@zE!XGx!GxIv7$noCVAaal~GPa4-U` zpuxcyOdJUqJ_e<~{|4{E_dk|On&iF+*z4Jk5_Pwz)DXwPj zRvOQquCKnx#(&ECfAm!UznA~HU37iha*LzVpTqyAX&ly`{QqC@|H8w&TgHp?yYJ=y zig9RGBL5>?1^r(s*UC@p|94vd7XcTGJM)$>zYC|nm)qOh%k`%Wu3CL)J2vwI20A|E zbGb8re#f23Gz8twL)kE^2l&@9oLfr_kFMuDQXU*W$@g^SQx!euoGbacf-vcLr zDdTK-hkb(Og=|!SF=q_?G1%BdOjrRzA1v<<=8R~8KMXC$LrP$Qjl6RR8BUQ*;EzMm za$vgvRuK5MV<9~l`SxOljfWKyzp>-80Q3-*(RvC)%L^tWX1O`X1DcDb;FE&}zjcvRj2t38 z#Kx)s0SyZK7D$hh&#|v@-5gSIP;Q}XBAtLC(dT5)P?;#8kxx^9mes@wa^nT}kR=m1 zBOgsBIDTMuNFxM3_FdQiM5-Xw}w8t)Q(+Vm9JEFc zpS1$KY4tBVulj%x-NtqQEp#rRas3uvw64z!(ERnL+wAqA)6KQ6ZrZITjK;$!2q)o%6Q7IGJ@{x#9O=yah0H;rz; zb@r;==)%pb?oFrHME2)M_PTX_(M2xJtLAmTh+J_Dny>KzdY6rMn^@%eh zo44K8FPD9|?6l9DIC$Db$r`8areuXmowXaSs{))it{T5I1y%>CbaMnIrGqz@O&TJ8 z4gCMC-|AeG8fTsBeit7LsAabwqrPeNngwWdTRk$!MYnTR$dNe_qa%nQ-gQ$_AyY%f zBM3szuX@dxAe=WFZKQ?nxz4x`y}9gNoxvruMvOx*@{jLbQAmRMK_FCdh&l3Ct`BC=XyNabH3({n4dzLWaZl2L_fkjO^- zJ!^(le0YbtaJIzKf%(ablOjBS(R@pV`EB#X^L#Es$6vE#m~bjp6nIKjRFN}O!lQDF zS`p4+$vE7~TBse8R@-C?5U>C!g zzw@+wjK)?@sGGRD=SFNSG!FeKTj}InMSUCpzkyyUfT1AhdLFT=2;D&}ujt+(wUsfH z3?A6qD}L}DPv84eH_E^M4tvG1&u3OhjRoF;P3S@dfyvx}ZQ)e@PdNE}gxogRNjnhA z+zO{UE|O^0f@mfvidQl=KLI!1-= zz&@Dy;%B7h>Xm$~7T~ys|Lp^LNz&Ukt2q2-y#K9UKQP}HF&xoYy7sDnad50{MM1U^ zn)yEBU4DpqIik+l+_h|`54Cq#i*S)1B4GXzOtmjY{kieQ{C)Mi7P%&(UU^@D>V2w5 zK-Kr#Ad*0iEgbm+4K^5J&@U}_fqfO;W}Pa=;UA!z@bk}NS|Qplv-l%We}I2(;L<7U zqfl`IQJMo>_j|os6;7axPrb|jpxbOW@Ua?&l@;1k=8p9-hLt;tBFkf+R8UCr<6^+r zt!_vo&8!KoPA53ZaZT2haWTQMjf*BvfShNM&i1R_dG7-fj6vIH9hQ#8~T(OxE^9VenG^uyx>9d{am^OM@6iVrcy}d+_$}y zScQ~8`N)M>svRoTxPP25-6%xBsbxs{DRS>VBK(*ZJSi45xW%yT_Dj6z@5I7s{CsL1 zqVa)fu1>^#*Z-}6|EAp}s%$Nl@iM04v4^GZg;=8ec4Debbs3#L zinA1PWa41MYK8T9jo%?>KD`vumW$Rx{8a(-9D2C6&Xv1?B&K`XB+xVh4#e0AXeZU+ z6#uWSUTO-J+6J`xV8&*&bvOY-w#+z;CQc74gmWKWdDz-Rr}x4H3MILu#i*aA*cd{e zFR+zO)sQYiik&H1#E)dfA9313jf>od;7E)VMO7YKm$Z<%Ex{@1;_ey4F~2##v!PEEV(u1| zj2FGmhDvWJ!zhKb`b0Jr8&DE!o4BN~*zBJ&)SuP=J)yJmY$U-w7P}|l?kgKfz$I2m z?##WA^BADta({D8^g$EM6Ujxjkay7p-c2p+F-F=aHa(gqJvW3S! zei*Wq?@ktc%<=Z)IGo}j|7hP~iPX3s4$O*nk9AVyW2$P?^hhPU?0~XUlnuE^Kd9rT zdS71}c9(~T;Znv5shyVK|SYumo#H^a~N zbi&zdYyOm3TcY%vWR}$Z!cni00v{&mKY9a(tGVm@^9VQhci0uxeD~siL;SE{Gb{>u?z9%%v19k-ydpuumTvTTCRIKyN9~F zRHsI#dvU8qz0K0%j(DdK0WN2&#APXiDlc6i0omb-jpIIO;ygCRM|Q2)|3)k*t;D+o zdAt#%VEa?-x`58IsTGP|ScpiC-$YJ`V?QyxqDxP)&)t zE|x~t)Z`1OwHjokNhup|><&x?#IsNvY{;U54fvjW2d_=_W-Uz)jhtqwY@Q)@BkC#H z(U1fJ5xg1kRpMCmT_OVZ3GB52WR2*h1hUyP_VTHccMnoyG~z6f@2H@jIZR&nS$-$6 z8+C{lku9kO8aU*k+@D!qfh=!Kk1?iCu4`L7I=~(orT;Epy*O`dl2&TS% zZf@isYDfy3r7*L}j)`O&u}z81Zzr+&EhIKK3i3VSXntKdnj7J0?hZ%uG2v)FG91m# za5T)*YN=YO?UrLBAQ9C-)be9O^5l^YHvcps`K=`W9w8~pt$3|Mi+idZZ z5!>|xre}^4m$O?tboJExUaSl>AuOAI&yxDs{YJSc>Fp#Jdd0NSlSYSzk7y~SFzJp` z^e+^r$X%?j1R$5#p%zW3oL4)OXfzs>d!wO-xQu(uO(aU2ENiaBR1X+{jneu{o6ao9 z)ARL+Lof8_qI(iw_Cvt<(y^tk$p;Wc+j3o96aNqZw;*A0R8ruGtx@aGT=#?yQ)9`` z7MznD@;$s5v~g(UP~!PP5w|b)r??|WIs65;St?lqZp+?Xi~hxf7LB{kuu>K?ct?Mf z(E~pXB3{=DkXm&OC^{r&LFjnt?-T9Cf~3Y4DxA$>xS&_4cl0eG1U4s&3e2GuFsYZ| zfS@JGc!UJwiTJC91RMh{`mk3;1Yt-uWAKDXL5nm`fFs?vf^V23gC`7fAKto+V#mDk z`K_`J=7fz=kBi!J7Fy`b;8p?Ad^q`h4}H+=1xCuOh#*QNi6Y4CLJ~k(wB4MRf>WH= zGx~y3D)EB~Nvfk5_jkZnP7p>fyrXYOoB$&=MLG4>OMWv{oEee2i zA|R8Qb<2=LkY*9h+0!-NxlGj)TOAA;wqo`oY4g)Wx0?ooDLQ3QI?y+zWnE@kA&Ny+ zQKHSg8eP*)ic%>b(7XOPa416534-`{OF%oaxvWT!6cTCOC!`4dLXrh3LDd?On##yo ztA3@NnMk0x(W9D@3WP@~Q>&&=wzjBLs}_<3O|^!bYSFY(>vZ9`a??Bc?9Au%VKF9> zSh|u_ORo&?JQ0uL`{Ed&SS&{0o^6zRsysx~{=6KgPyoltjv!UrTKW^=WPYc`5+e@_ zCO~$HCMh2*;lNHyci?BJ?2<1s-WEA`nQyt*CP2mjm&I$6!Fa l25m5)Ze}o0uNP!%^YqUTpRT9t>H6Qg{srCUk2wHB001uID+K@m diff --git a/osx-install.sh b/osx-install.sh deleted file mode 100755 index 3e31bc0..0000000 --- a/osx-install.sh +++ /dev/null @@ -1,28 +0,0 @@ -#!/bin/bash -set -e - -echo VMware Unlocker 2.1.1 -echo =============================== -echo Copyright: Dave Parsons 2011-17 - -# Ensure we only use unmodified commands -export PATH=/bin:/sbin:/usr/bin:/usr/sbin - -# Make sure only root can run our script -if [[ $EUID -ne 0 ]]; then - echo "This script must be run as root" 1>&2 - exit 1 -fi - -echo Creating backup folder... -rm -rf ./backup -mkdir -p "./backup" -cp -v /Applications/VMware\ Fusion.app/Contents/Library/vmware-vmx ./backup/ -cp -v /Applications/VMware\ Fusion.app/Contents/Library/vmware-vmx-debug ./backup/ -cp -v /Applications/VMware\ Fusion.app/Contents/Library/vmware-vmx-stats ./backup/ -cp -v /Applications/VMware\ Fusion.app/Contents/Frameworks/libvmwarebase.dylib ./backup/ - -echo Patching... -python ./unlocker.py - -echo Finished! diff --git a/osx-uninstall.sh b/osx-uninstall.sh deleted file mode 100755 index 3a07790..0000000 --- a/osx-uninstall.sh +++ /dev/null @@ -1,26 +0,0 @@ -#!/bin/bash -set -e - -echo VMware Unlocker 2.1.1 -echo =============================== -echo Copyright: Dave Parsons 2011-17 - -# Ensure we only use unmodified commands -export PATH=/bin:/sbin:/usr/bin:/usr/sbin - -# Make sure only root can run our script -if [[ $EUID -ne 0 ]]; then - echo "This script must be run as root" 1>&2 - exit 1 -fi - -echo Restoring files... -cp -v ./backup/vmware-vmx /Applications/VMware\ Fusion.app/Contents/Library -cp -v ./backup/vmware-vmx-debug /Applications/VMware\ Fusion.app/Contents/Library -cp -v ./backup/vmware-vmx-stats /Applications/VMware\ Fusion.app/Contents/Library -cp -v ./backup/libvmwarebase.dylib /Applications/VMware\ Fusion.app/Contents/Frameworks/ - -echo Removing backup files... -rm -rf ./backup - -echo Finished! diff --git a/readme.txt b/readme.txt index e715f66..a22b9bf 100644 --- a/readme.txt +++ b/readme.txt @@ -1,4 +1,4 @@ -macOS Unlocker for VMware V2.1 +macOS Unlocker for VMware V3.0 ============================== +-----------------------------------------------------------------------------+ @@ -13,16 +13,15 @@ macOS Unlocker for VMware V2.1 1. Introduction --------------- -Unlocker 2 is designed for Workstation 11/12/14, Player 7/12/14, +Unlocker 3 is designed for Workstation 11/12/14/15, Player 7/12/14/15, and Fusion 7/8/10. If you are using an earlier product please continue using Unlocker 1. -Version 2 has been tested against: +Version 3 has been tested against: -* Workstation 11/12/14 on Windows and Linux -* Workstation Player 7/12/14 on Windows and Linux -* Fusion 7/8/10 on macOS Sierra +* Workstation 11/12/14/15 on Windows and Linux +* Workstation Player 7/12/14/15 on Windows and Linux The patch code carries out the following modifications dependent on the product being patched: @@ -34,9 +33,6 @@ being patched: Note that not all products recognise the darwin.iso via install tools menu item. You will have to manually mount the darwin.iso for example on Workstation 11 and Player 7. -The vmwarebase code does not need to be patched on macOS systems so you will see a -message on those systems telling you that it will not be patched. - In all cases make sure VMware is not running, and any background guests have been shutdown. @@ -45,7 +41,7 @@ The code is written in Python as it makes the Unlocker easier to run and maintai 2. Prerequisites ---------------- -The code requires Python 2.7 to work. Most Linux distros and macOS ship with a compatible +The code requires Python 2.7 to work. Most Linux distros ship with a compatible Python interpreter and should work without requiring any additional software. Windows Unlocker has a packaged version of the Python script using PyInstaller, @@ -62,8 +58,8 @@ Latest Linux products are OK and do not show this problem. | IMPORTANT: | | ========== | | | -| If you create a new VM using version 11, 12 or 13 hardware VMware may stop | -| and create a core dump. There are two options to work around this issue: | +| If you create a new VM VMware may stop and create a core dump. | +| There are two options to work around this issue: | | | | 1. Change the VM to be HW 10 - this does not affect performance. | | 2. Edit the VMX file and add: | @@ -90,24 +86,8 @@ by running chmod +x against the 2 files. lnx-install.sh - patches VMware lnx-uninstall.sh - restores VMware lnx-update-tools.cmd - retrieves latest macOS guest tools - -6. macOS --------- -On macOS you will need to be either root or use sudo to run the scripts. -This is really only needed if you want to use client versions of macOS. - -You may need to ensure the macOS scripts have execute permissions -by running chmod +x against the 2 files. - -osx-install.sh - patches VMware -osx-uninstall.sh - restores VMware - -7. ESXi -------- -ESXi is no longer supported as there are too many errors on newer versions due to -VMware hardening the ESXi image. -8. Thanks +7. Thanks --------- Thanks to Zenith432 for originally building the C++ unlocker and Mac Son of Knife @@ -120,10 +100,7 @@ modified the unlocker code to run on Python 3 in the ESXi 6.5 environment. History ------- -10/10/17 2.1.0 - New version to support ESXi 6.5, Workstation/Player 14 and Fusion 10 - - Removed support for ESXi 6.0 - - Added ESXi boot option to disable unlocker (nounlocker) -11/10/17 2.1.1 - Removed all support for ESXi 6.x +10/10/17 2.1.0 - First release -(c) 2011-2017 Dave Parsons \ No newline at end of file +(c) 2011-2018 Dave Parsons \ No newline at end of file diff --git a/unlocker.py b/unlocker.py index 2085827..2787e65 100755 --- a/unlocker.py +++ b/unlocker.py @@ -44,9 +44,7 @@ Offset Length Struct Type Description from __future__ import print_function import codecs import os -import six import struct -import subprocess import sys if sys.version_info < (2, 7): @@ -56,6 +54,7 @@ if sys.version_info < (2, 7): # Setup imports depending on whether IronPython or CPython if sys.platform == 'win32' \ or sys.platform == 'cli': + # noinspection PyUnresolvedReferences from _winreg import * @@ -349,6 +348,7 @@ def patchvmkctl(name): print('smcPresent Patched: ' + name) +# noinspection PyUnresolvedReferences def main(): # Work around absent Platform module on VMkernel if os.name == 'nt' or os.name == 'cli': @@ -356,19 +356,11 @@ def main(): else: osname = os.uname()[0].lower() - vmwarebase = '' - libvmkctl32 = '' - libvmkctl64 = '' + # vmwarebase = '' vmx_so = False # Setup default paths - if osname == 'darwin': - vmx_path = '/Applications/VMware Fusion.app/Contents/Library/' - vmx = joinpath(vmx_path, 'vmware-vmx') - vmx_debug = joinpath(vmx_path, 'vmware-vmx-debug') - vmx_stats = joinpath(vmx_path, 'vmware-vmx-stats') - - elif osname == 'linux': + if osname == 'linux': vmx_path = '/usr/lib/vmware/bin/' vmx = joinpath(vmx_path, 'vmware-vmx') vmx_debug = joinpath(vmx_path, 'vmware-vmx-debug') @@ -379,15 +371,6 @@ def main(): else: vmwarebase = '/usr/lib/vmware/lib/libvmwarebase.so.0/libvmwarebase.so.0' - elif osname == 'vmkernel': - vmx_path = os.path.dirname(os.path.abspath(__file__)) - vmx = joinpath(vmx_path, '/unlocker/bin/vmx') - vmx_debug = joinpath(vmx_path, '/unlocker/bin/vmx-debug') - vmx_stats = joinpath(vmx_path, '/unlocker/bin/vmx-stats') - vmx_so = True - libvmkctl32 = joinpath(vmx_path, '/unlocker/lib/libvmkctl.so') - libvmkctl64 = joinpath(vmx_path, '/unlocker/lib64/libvmkctl.so') - elif osname == 'windows': reg = ConnectRegistry(None, HKEY_LOCAL_MACHINE) key = OpenKey(reg, r'SOFTWARE\Wow6432Node\VMware, Inc.\VMware Workstation') @@ -409,20 +392,7 @@ def main(): patchsmc(vmx_stats, vmx_so) # Patch vmwarebase for Workstation and Player - # Not required on Fusion or ESXi as table already has correct flags - if vmwarebase != '': - patchbase(vmwarebase) - else: - pass - - # Patch libvmkctl to return Apple SMC present - if osname == 'vmkernel': - # Patch ESXi 6.0 and 6.5 32 bit .so - patchvmkctl(libvmkctl32) - - # Patch ESXi 6.5 64 bit .so - if os.path.isfile(libvmkctl64): - patchvmkctl(libvmkctl64) + patchbase(vmwarebase) if __name__ == '__main__':