Do It by Code

# How IDA Pro's License System Was Defeated With a 1-Byte Patch

## How IDA's licensing works

IDA Pro validates licenses using RSA signature verification. License files (`.hexlic`) are JSON documents containing license details, signed with Hex-Rays' private key. The binary contains a hardcoded 1024-bit RSA public modulus to verify signatures:


signature ^ e mod N == SHA256(license_payload) ?

Without the private key, you can't forge a valid signature. Breaking the original 1024-bit RSA key is computationally infeasible. But the attacker didn't break anything — they replaced the lock.

## The attack: modulus substitution

The attacker modified one byte of the 128-byte RSA modulus embedded in the binary:


Original: ED FD 42 [5C] F9 78 54 6E ...  (124 more identical bytes)
Patched:  ED FD 42 [CB] F9 78 54 6E ...

The critical insight: the resulting number is prime. When N' is prime, phi(N') = N' - 1 is trivially known, so the private key is just:


d = e^(-1) mod (N' - 1)

A single modular inverse — effectively free to compute. No factoring, no brute force, no heavy computation. Standard RSA's security relies on N being a product of two large primes whose factorization is secret. A prime modulus has no trapdoor — there's nothing to "factor," so anyone can derive the private key.

## How hard was this to find?

Not hard at all. For a random 1024-bit odd number, the probability of being prime is roughly 1/355. Scanning all 255 alternative byte values at one position takes under 400ms. Scanning every one-byte mutation across all 128 byte positions (32,640 candidates) takes under 45 seconds and yields 86 usable primes.

The entire computational cost of this attack is less than a minute on a single machine.

## What the keygen does

1. Patches the modulus — a Python bytes.replace() swapping 6 bytes (only 1 actually changes), targeting libida.dylib, libida.so, ida.dll and their 32-bit variants
2. Generates a `.hexlic` license — JSON with all decompiler add-ons enabled (x86, ARM, MIPS, PPC, RISC-V, ARC, V850), Teams, Lumina, 999 seats, valid for 3-10 years
3. Signs it with the derived private key — SHA-256 of the payload, packed into a 128-byte buffer with a custom padding scheme, RSA-signed with the attacker's d

IDA verifies the signature against the patched modulus and sees a perfectly valid license.

## Why it can't really be fixed locally

The verification code itself is fine — the flaw is architectural. The binary trusts an embedded public key, and the attacker can edit the binary. Once the trust anchor is replaced, the cryptographic scheme is irrelevant. Larger keys don't help (twice the bytes but half the prime density — roughly cancels out). Better padding doesn't help. Self-integrity checks can be patched out the same way.

The only robust defense is moving the root of trust outside the patchable binary: online activation, server-side feature gates, or hardware-backed attestation. But IDA Pro is an offline-first desktop tool whose users are world-class at patching binaries — which is why this cat-and-mouse game has been going on for 20+ years.

22 views14:36