Flexlm ECC
 

I am trying to reverse a flexlm protected program which uses ECC.
I Managed to find the seeds and features, build lmcrypt, and patched l_pubkey_verifyl
However the program refuses to run, and crashes every time, so I assume that it uses some form of CRC check, and crashes because this value has changed due to patching.
What is the general approach to defeat the CRC check?

how about you show us how to in a tutorial?

someone will help if you serious.

Not sure what you mean with show us how to in a tutorial?
Do you want me to write a tutorial on how to extract the encryption seeds & patching of l_pubkey_verify??

yes please do. not worry 90% are just persons of scripts and automated tool olly plugins.

if very private ask one VIP to move your complete tutorial to VIP area.

long time I not seen such one.

is your target x64?

Yes the target is x64

fishing of encryption seeds, and patching of l_pubkey_verify is common knowledge, so no need to write a tutorial:)

ahmadmansoor ,

why did you ask if my target is x64?

if that common show us !

I want see basic instinct again, reloaded !

Simple,In common way catch CRC checking routine and modify asm code for jmp.

Understood, but I have never dealt with CRC checking routines, so can you give me a hint as how do I find the dll or executable which checks the CRC?

search all Exitprocess call in exe with olly,bookmarks all call,run exe its stop on exitprocess call.its most likely your crc check routine.

First, it is an x64 target so ollyDbg will not work ;) , you need x64dbg.
did you check if it is packed -if yes you will see that the target has many calls out of the .text section with many anti-debug checks -
what you need ( as I remember) is dll inject and huck some API before you use HW-BP to bypass anti-debug, then you apply ur patches.

Well it looks that I have a lot of studying to do, and learn about anti-debug checks, API hooking and dll injecting, because i don't have a clue:D

Can you mention your target name?
Because I already have a target with same protection, I hope it not same yours :)

Agilent N8900 Infiniium SW

For similar products in ARM code Agilent use stripped version of FlexLM and CRC in firmare is custom.

O.K. & I have some homework to do

Do you have any info about agilent ARM customized flexLM ?

Can anyone provide the latest SDKs if possible?

Who can share the most recent sdk?

Unfortunately I have been too busy with other things to do my homework about dll inject and API hooking:o

Hi kangalooj, a while back you sent me a PM asking me if I needed help with reversing Agilent. When I lnoticed your PM, I was already degraded to friend, so I lost the right to PM you. Is there another way I can contact you?

Hi kangalooj

maybe you can contact me on [email protected]

Can anyone help me with this?
I want to generate license for AGILENT products with ARM embedded os.

Have you solved it?:D

What Device model you working on?

N5181A Signal generator