-
Notifications
You must be signed in to change notification settings - Fork 5
/
Copy pathkeyboxGenerator_v2.0.py
195 lines (181 loc) · 8.03 KB
/
keyboxGenerator_v2.0.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
import os
from random import randint, choice
from base64 import b64decode
try:
os.chdir(os.path.abspath(os.path.dirname(__file__)))
except:
pass
EXIT_SUCCESS = 0
EXIT_FAILURE = 1
EOF = (-1)
LB = 2 # the lower bound of the length of the device ID
UB = 12 # the upper bound of the length of the device ID
CHARSET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
keyboxFormatter = """<?xml version="1.0"?>
<AndroidAttestation>
<NumberOfKeyboxes>1</NumberOfKeyboxes>
<Keybox DeviceID="{0}">
<Key algorithm="ecdsa">
<PrivateKey format="pem">
{1}</PrivateKey>
<CertificateChain>
<NumberOfCertificates>1</NumberOfCertificates>
<Certificate format="pem">
{2}</Certificate>
</CertificateChain>
</Key>
<Key algorithm="rsa">
<PrivateKey format="pem">
{3}</PrivateKey>
</Key>
</Keybox>
</AndroidAttestation>
"""
def canOverwrite(flags:list, idx:int, prompts:str|tuple|list|set) -> bool:
if isinstance(flags, list) and isinstance(idx, int) and -len(flags) <= idx < len(flags) and isinstance(prompts, (str, tuple, list, set)):
try:
if isinstance(prompts, str):
print("\"{0}\"".format(prompts))
choice = input("The file mentioned above exists. Overwrite or not [aYn]? ")
else:
print(prompts)
choice = input("At least one of the files mentioned above exists. Overwrite or not [aYn]? ")
if choice.upper() == "A":
for i in range((idx if idx >= 0 else len(flags) + idx), len(flags)): # overwirte the current file and all the following necessary files no matter whether they exist
flags[i] = True
return True
elif choice.upper() == "N":
return False
else:
flags[idx] = True
return True
except BaseException as e:
print(e)
return False
else:
input("#")
return False
def execute(commandline:str) -> int|None:
if isinstance(commandline, str):
print("$ " + commandline)
return os.system(commandline)
else:
return None
def handleOpenSSL(flag:bool = True) -> bool|None:
if isinstance(flag, bool):
errorLevel = execute("openssl version")
if EXIT_SUCCESS == errorLevel:
return True
elif flag: # can try again
execute("sudo apt-get install openssl libssl-dev")
return handleOpenSSL(False)
else:
return False
else:
return None
def pressTheEnterKeyToExit(errorLevel:int|None = None):
try:
print("Please press the enter key to exit ({0}). ".format(errorLevel) if isinstance(errorLevel, int) else "Please press the enter key to exit. ")
input()
except:
pass
def main() -> int:
# Parameters #
failureCount = 0
deviceID = "".join([choice(CHARSET) for _ in range(randint(LB, UB))]) # or specify the device ID manually like "YourDeviceID"
ecPrivateKeyFilePath = "ecPrivateKey.pem"
certificateFilePath = "certificate.pem"
rsaPrivateKeyFilePath = "rsaPrivateKey.pem"
keyboxFilePath = "keybox.xml" # None for no files written
flags = [not (os.path.isfile(ecPrivateKeyFilePath) or os.path.isfile(certificateFilePath)), not os.path.isfile(rsaPrivateKeyFilePath), not os.path.isfile(keyboxFilePath)]
# First-phase Generation #
if flags[0] or canOverwrite(flags, 0, (ecPrivateKeyFilePath, certificateFilePath)):
failureCount += execute("openssl ecparam -name prime256v1 -genkey -noout -out \"{0}\"".format(ecPrivateKeyFilePath)) != 0
if flags[0] or not os.path.isfile(certificateFilePath):
failureCount += execute("openssl req -new -x509 -key \"{0}\" -out {1} -days 3650 -subj \"/CN=Keybox\"".format(ecPrivateKeyFilePath, certificateFilePath)) != 0
if flags[1] or canOverwrite(flags, 1, rsaPrivateKeyFilePath):
failureCount += execute("openssl genrsa -out \"{0}\" 2048".format(rsaPrivateKeyFilePath)) != 0
if failureCount > 0:
print("Cannot generate a sample ``keybox.xml`` file since {0} PEM file{1} not generated successfully. ".format(failureCount, ("s were" if failureCount > 1 else " was")))
pressTheEnterKeyToExit(11)
return 11
# First-phase Reading #
try:
with open(ecPrivateKeyFilePath, "r", encoding = "utf-8") as f:
ecPrivateKey = f.read()
with open(certificateFilePath, "r", encoding = "utf-8") as f:
certificate = f.read()
with open(rsaPrivateKeyFilePath, "r", encoding = "utf-8") as f:
rsaPrivateKey = f.read()
except BaseException as e:
print("Failed to read one or more of the PEM files. Details are as follows. \n{0}".format(e))
pressTheEnterKeyToExit(12)
return 12
# Second-phase Generation #
if flags[1]: # only updates the key content when the original key is newly generated or updating is allowed
if rsaPrivateKey.startswith("-----BEGIN PRIVATE KEY-----") and rsaPrivateKey.rstrip().endswith("-----END PRIVATE KEY-----"):
print("A newer openssl version is used. The RSA private key in the PKCS8 format will be converted to that in the PKCS1 format soon. ")
failureCount += execute("openssl rsa -in \"{0}\" -out \"{0}\" -traditional".format(rsaPrivateKeyFilePath))
if failureCount > 0:
print("Cannot convert the RSA private key in the PKCS8 format to that in the PKCS1 format. ")
pressTheEnterKeyToExit(13)
return 13
else:
print("Finished converting the RSA private key in the PKCS8 format to that in the PKCS1 format. ")
try:
with open(rsaPrivateKeyFilePath, "r", encoding = "utf-8") as f:
rsaPrivateKey = f.read()
except BaseException as e:
print("Failed to update the RSA private key from \"{0}\". Details are as follows. \n{1}".format(rsaPrivateKeyFilePath, e))
pressTheEnterKeyToExit(14)
return 14
elif rsaPrivateKey.startswith("-----BEGIN OPENSSH PRIVATE KEY-----") and rsaPrivateKey.rstrip().endswith("-----END OPENSSH PRIVATE KEY-----"):
print("An OpenSSL private key is detected, which will be converted to the RSA private key soon. ")
failureCount += execute("ssh-keygen -p -m PEM -f \"{0}\" -N \"\"".format(rsaPrivateKeyFilePath))
if failureCount > 0:
print("Cannot convert the OpenSSL private key to the RSA private key. ")
pressTheEnterKeyToExit(15)
return 15
else:
print("Finished converting the OpenSSL private key to the RSA private key. ")
try:
with open(rsaPrivateKeyFilePath, "r", encoding = "utf-8") as f: # the ``ssh-keygen`` overwrites the file though no obvious output filepaths specified
rsaPrivateKey = f.read()
except BaseException as e:
print("Failed to update the RSA private key from \"{0}\". Details are as follows. \n{1}".format(rsaPrivateKeyFilePath, e))
pressTheEnterKeyToExit(16)
return 16
# Brief Checks #
if not (ecPrivateKey.startswith("-----BEGIN EC PRIVATE KEY-----") and ecPrivateKey.rstrip().endswith("-----END EC PRIVATE KEY-----")):
print("An invalid EC private key is detected. Please try to use the latest key generation tools to solve this issue. ")
pressTheEnterKeyToExit(17)
return 17
if not (certificate.startswith("-----BEGIN CERTIFICATE-----") and certificate.rstrip().endswith("-----END CERTIFICATE-----")):
print("An invalid certificate is detected. Please try to use the latest key generation tools to solve this issue. ")
pressTheEnterKeyToExit(18)
return 18
if not (rsaPrivateKey.startswith("-----BEGIN RSA PRIVATE KEY-----") and rsaPrivateKey.rstrip().endswith("-----END RSA PRIVATE KEY-----")):
print("An invalid final RSA private key is detected. Please try to use the latest key generation tools to solve this issue. ")
pressTheEnterKeyToExit(19)
return 19
# Keybox Generation #
keybox = keyboxFormatter.format(deviceID, ecPrivateKey, certificate, rsaPrivateKey)
print("Generated keybox with a length of {0}: ".format(len(keybox)))
print(keybox)
if keyboxFilePath is not None and (flags[2] or canOverwrite(flags, 2, keyboxFilePath)):
try:
with open(keyboxFilePath, "w", encoding = "utf-8") as f:
f.write(keybox)
print("Successfully wrote the keybox to \"{0}\". ".format(keyboxFilePath))
pressTheEnterKeyToExit(EXIT_SUCCESS)
return EXIT_SUCCESS
except BaseException as e:
print("Failed to write the keybox to \"{0}\". Details are as follows. \n{1}".format(keyboxFilePath, e))
pressTheEnterKeyToExit(20)
return 20
else:
print("The keybox has not been written to any files. Please refer to the text above. ")
pressTheEnterKeyToExit(EXIT_FAILURE)
return EXIT_FAILURE
if "__main__" == __name__:
exit(main())