The tools in this repository are intended for security research purposes only and should not be used in production environments.
Note: Only tested on FortiGate VM appliance.
The "license_old.py" script is used for older versions. eg: FortiGate VM64 v7.4.1
The "license_new.py" script is used for newer versions. eg: FortiGate VM64 v7.4.3
For older versions, executing the command python3 license_old.py will generate the License.lic file. Just import the file into the system.
For newer versions, you need to patch flatkc and init first. Please follow the steps below.
1. Import the ovf template and start the system. Wait for the system to complete initialization
2. Shut down the VM and remove the first vm disk (2GB)
3. Install the vm disk on another Linux system
4. Mount the root partition (FORTIOS) and extract the "flatkc" and "rootfs.gz" files, make sure to backup them
5. Run command: 'python3 decrypt.py -f rootfs.gz -k flatkc' to decrypt the rootfs.gz file
6. Uncompress the rootfs.gz and the bin.tar.xz files, you need to be root when doing this
gzip -d ./dec.gz
mkdir rootfs
cd rootfs && mv ../dec ./
sudo su
cpio -idmv < ./dec
rm -rf ./dec
xz -d ./bin.tar.xz && tar -xvf ./bin.tar && rm -rf ./bin.tar
cd .. && mv ./rootfs/bin/init ./
7. Run command: 'python3 patch.py init' to patch the init file
8. You can add other files (busybox etc) if you want. Then re-compress the rootfs.gz
chmod 755 ./init.patched && mv ./init.patched ./rootfs/bin/init
cd rootfs
tar -cvf bin.tar bin && xz bin.tar && rm -rf bin
find . | cpio -H newc -o > ../rootfs.raw && cd ..
cat ./rootfs.raw | gzip > rootfs.gz
9. Run command: 'python3 patch.py flatkc' to patch the flatkc file
10. Overwrite rootfs.gz and flatkc.patched to the vm disk
11. Uninstall the vm disk from Linux system and install it to the original system
12. Boot the system
After starting the system, run the python3 license_new.py command and import the generated License.lic file to the system.
Note: You may need to change the network adapter IP address again after restarting the system
Please see https://wzt.ac.cn/2024/04/02/fortigate_debug_env2/ for more details.
You need to install libssl-dev first.
Compile: gcc vdom.c -o vdom -lssl -lcrypto -lz
Run: ./vdom FGVMPG0000000000 15
Import the license: execute upd-vd-license xxx
If you see Error: VDOM number (xxx) exceeds limit for this model then your base license does not support too many vdoms.