首先分析一下JIRA的内部机Ӟ与注册相关的对象都放在com.atlassian.license包下面，其中publickey的文件名是bug.class,在com\atlassian\jira\issue下面Q其中WEB-INF\classes和atlassian-extras-0.7.10.jar中各有一个。利用下面代码就可以dpublickey的内容了Q?BR>
InputStream keyfis=new FileInputStream(pubfilename); byte encKey[] = new byte[keyfis.available()]; keyfis.read(encKey); keyfis.close(); X509EncodedKeySpec pubKeySpec = new X509EncodedKeySpec(encKey); KeyFactory keyFactory = KeyFactory.getInstance("DSA"); PublicKey pubkey=keyFactory.generatePublic(pubKeySpec); DSAPublicKeySpec pubkeyspec=(DSAPublicKeySpec) keyFactory.getKeySpec(pubkey, DSAPublicKeySpec.class); System.out.println("P="+pubkeyspec.getP()); System.out.println("Q="+pubkeyspec.getQ()); System.out.println("G="+pubkeyspec.getG()); System.out.println("Y="+pubkeyspec.getY());q行l果如下Q?BR>
P=178011905478542266528237562450159990145232156369120674273274450314442865788737020770612695252123463079567156784778466449970650770920727857050009668388144034129745221171818506047231150039301079959358067395348717066319802262019714966524135060945913707594956514672855690606794135837542707371727429551343320695239Q=864205495604807476120572616017955259175325408501G=174068207532402095185811980123523436538604490794561350978495831040599953488455823147851597408940950725307797094915759492368300574252438761037084473467180148876118103083043754985190983472601550494691329488083395492313850000361646482644608492304078721818959999056496097769368017749273708962006689187956744210730Y=104878378611578608516131988304241730575226860461304117604293580069983220227094632807881557460560834347944389679413307090500106772833435437017122610074687673247552012771759005247409187709312922876281831426019398155097541955193653855246734321859930303643524786168850036251099739995507172205951987756012523624501如果有兴可以从q里入手L寻privatekey的X,隑ֺ可想而知Q但是在|上可以下蝲的注册机中就有X,不管你是否相信，真让人怀疑DSA的安全性，值如下：
X=240907294874328356661328650403099424255880489796
q下可以很方便的生成注册码了：
明文QlicenseTypeCode ^ dateCreated ^ datePurchased ^ organisation
其中licenseTypeCode =267是JIRA Enterprise: Commercial Server
dateCreated =datePurchased =new Date()可以了
organisation随便
代码如下Q?BR>
import com.atlassian.license.LicensePair;import java.math.BigInteger;import java.security.KeyFactory;import java.security.Signature;import java.security.interfaces.DSAPrivateKey;import java.security.spec.DSAPrivateKeySpec;import java.util.Date;
public class JIRAKeyGen 
{
public static void main(String[] args) {
Date dt = new Date(); long d = dt.getTime(); BigInteger x = new BigInteger("240907294874328356661328650403099424255880489796"); BigInteger p = new BigInteger("178011905478542266528237562450159990145232156369120674273274450314442865788737020770612695252123463079567156784778466449970650770920727857050009668388144034129745221171818506047231150039301079959358067395348717066319802262019714966524135060945913707594956514672855690606794135837542707371727429551343320695239"); BigInteger q = new BigInteger("864205495604807476120572616017955259175325408501"); BigInteger g = new BigInteger("174068207532402095185811980123523436538604490794561350978495831040599953488455823147851597408940950725307797094915759492368300574252438761037084473467180148876118103083043754985190983472601550494691329488083395492313850000361646482644608492304078721818959999056496097769368017749273708962006689187956744210730"); try { DSAPrivateKeySpec keyspec = new DSAPrivateKeySpec(x, p, q, g); KeyFactory keyFactory = KeyFactory.getInstance("DSA"); DSAPrivateKey prikey = (DSAPrivateKey) keyFactory.generatePrivate(keyspec); String messageString = "267^" + d + "^" + d + "^blogjava"; //生成{hash Signature signature = Signature.getInstance("SHA1withDSA"); signature.initSign(prikey); signature.update(messageString.getBytes()); byte[] lichash = signature.sign(); //~码 LicensePair pair = new LicensePair(messageString.getBytes(), lichash); System.out.println(pair.toString()); } catch (Exception ex) { ex.printStackTrace();
} }
}当然q有另外一U方法，自己生成DSA法的keyQ然后覆盖原来的bug.class,利用与上面相同的办法可以生成license了?BR>CZ代码如下Q?BR>
public void genDSAKey() { try { //生成DSA key KeyPairGenerator gen = KeyPairGenerator.getInstance("DSA"); KeyPair kp = gen.genKeyPair(); DSAPublicKey pubkey = (DSAPublicKey) kp.getPublic(); DSAPrivateKey prikey = (DSAPrivateKey) kp.getPrivate(); saveEncodedData(pubkey.getEncoded(), "bug.class"); saveEncodedData(prikey.getEncoded(), "privatekey.key"); //{计算Q下ơ需要直接从文g中读取privatekey.key,初始化prikey Signature signature = Signature.getInstance("SHA1withDSA"); signature.initSign(prikey); Date dt=new Date(); long d = dt.getTime(); String messageString = "267^" + d + "^" + d + "^blogjava"; System.out.println(dt.getTime()); signature.initSign(prikey); signature.update(messageString.getBytes()); byte[] lichash=signature.sign(); LicensePair pair=new LicensePair(messageString.getBytes(),lichash); System.out.println(pair.toString()); } catch (Exception ex) { ex.printStackTrace(); } } public boolean saveEncodedData(byte[] data, String filename) { boolean res = true; try { FileOutputStream fs = new FileOutputStream(filename); fs.write(data); fs.close(); } catch (Exception ex) { res = false; ex.printStackTrace(); } return res; }注意上面的代码需要调用atlassian-extras-0.7.10,在WEB-INF\lib目录下面可以扑ֈ
]]>