“““
The?MIT?License?（MIT）

Copyright?（c）?2014-2015?Dave?Parsons?&?Sam?Bingner

Permission?is?hereby?granted?free?of?charge?to?any?person?obtaining?a?copy
of?this?software?and?associated?documentation?files?（the?‘Software‘）?to?deal
in?the?Software?without?restriction?including?without?limitation?the?rights
to?use?copy?modify?merge?publish?distribute?sublicense?and/or?sell
copies?of?the?Software?and?to?permit?persons?to?whom?the?Software?is
furnished?to?do?so?subject?to?the?following?conditions:

The?above?copyright?notice?and?this?permission?notice?shall?be?included?in
all?copies?or?substantial?portions?of?the?Software.

THE?SOFTWARE?IS?PROVIDED?‘AS?IS‘?WITHOUT?WARRANTY?OF?ANY?KIND?EXPRESS?OR
IMPLIED?INCLUDING?BUT?NOT?LIMITED?TO?THE?WARRANTIES?OF?MERCHANTABILITY
FITNESS?FOR?A?PARTICULAR?PURPOSE?AND?NONINFRINGEMENT.?IN?NO?EVENT?SHALL?THE
AUTHORS?OR?COPYRIGHT?HOLDERS?BE?LIABLE?FOR?ANY?CLAIM?DAMAGES?OR?OTHER
LIABILITY?WHETHER?IN?AN?ACTION?OF?CONTRACT?TORT?OR?OTHERWISE?ARISING?FROM
OUT?OF?OR?IN?CONNECTION?WITH?THE?SOFTWARE?OR?THE?USE?OR?OTHER?DEALINGS?IN
THE?SOFTWARE.

vSMC?Header?Structure
Offset??Length??struct?Type?Description
----------------------------------------
0x00/00?0x08/08?Q??????ptr??Offset?to?key?table
0x08/08?0x04/4??I??????int??Number?of?private?keys
0x0C/12?0x04/4??I??????int??Number?of?public?keys

vSMC?Key?Data?Structure
Offset??Length??struct?Type?Description
----------------------------------------
0x00/00?0x04/04?4s?????int??Key?name?（byte?reversed?e.g.?#KEY?is?YEK#）
0x04/04?0x01/01?B??????byte?Length?of?returned?data
0x05/05?0x04/04?4s?????int??Data?type?（byte?reversed?e.g.?ui32?is?23iu）
0x09/09?0x01/01?B??????byte?Flag?R/W
0x0A/10?0x06/06?6x?????byte?Padding
0x10/16?0x08/08?Q??????ptr??Internal?VMware?routine
0x18/24?0x30/48?48B????byte?Data
“““

import?os
import?sys
import?struct
import?subprocess

if?sys.version_info?????sys.stderr.write（‘You?need?Python?2.7?or?later\n‘）
????sys.exit（1）

#?Setup?imports?depending?on?whether?IronPython?or?CPython
if?sys.platform?==?‘win32‘?\
????????or?sys.platform?==?‘cli‘:
????from?_winreg?import?*


def?rot13（s）:
????chars?=?‘AaBbCcDdEeFfGgHhIiJjKkLlMmNnOoPpQqRrSsTtUuVvWwXxYyZz‘
????trans?=?chars[26:]?+?chars[:26]
????rot_char?=?lambda?c:?trans[chars.find（c）]?if?chars.find（c）?>?-1?else?c
????return?‘‘.join（rot_char（c）?for?c?in?s）


def?bytetohex（bytestr）:
????return?‘‘.join（[‘%02X?‘?%?ord（x）?for?x?in?bytestr]）.strip（）


def?printkey（i?offset?smc_key?smc_data）:
????print?str（i?+?1）.zfill（3）?\
??????????+?‘?‘?+?hex（offset）?\
??????????+?‘?‘?+?smc_key[0][::-1]?\
??????????+?‘?‘?+?str（smc_key[1]）.zfill（2）?\
??????????+?‘?‘?+?smc_key[2][::-1].replace（‘\x00‘?‘?‘）?\
??????????+?‘?‘?+?‘{0:#0{1}x}‘.format（smc_key[3]?4）?\
??????????+?‘?‘?+?hex（smc_key[4]）?\
??????????+?‘?‘?+?bytetohex（smc_data）


E_CLASS64?=?2
E_SHT_RELA?=?4


def?patchELF（f?oldOffset?newOffset）:
????f.seek（0）