Exetools - Flexlm Common Vendor Daemon Problem

Exetools (https://forum.exetools.com/index.php)

- General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)

- - Flexlm Common Vendor Daemon Problem (https://forum.exetools.com/showthread.php?t=12133)

Flexlm Common Vendor Daemon Problem

This flexlm v11.5 server daemon uses common vendor daemon technology, the primary vendor's seeds are easy to get according to well-know flexlm seeds derived tutorial.

But I find there are also two other vendor daemons can be verified with this common daemon.

I tried common license format with other vendor daemon name, can get two seeds from l_sg route. But strange thing is the esp+4 does not points original vendor daemon name. It seems encrypted name there.

Question is how to derive other vendor daemons seeds from this common daemon?

Comments are always welcome!;)

Update information about this common vendor daemon.

1, three vendor's daemon name and 'encrypted name' can be get inside _l_n36_buff route.

If common vendor daemon technology will be used?

Code:

.text:004AEDA7                 cmp     off_59B3E0, 0

.text:004AEDAE                 jz      short loc_4AEDB6

.text:004AEDB0                 call    off_59B3E0

_l_n36_buff route entry for different daemons.

Code:

.text:004354E6 sub_4354E6      proc near               ; CODE XREF: sub_4AED2F+81p

.text:004354E6                                         ; DATA XREF: .data:off_59B3E0o

.text:004354E6                 mov     eax, off_59C024

.text:004354EB                 and     dword_5C570C, 0

.text:004354F2                 mov     dword_5C5700, eax

.text:004354F7                 mov     eax, off_59DD6C

.text:004354FC                 mov     dword_5C5704, eax

.text:00435501                 mov     eax, off_59D24C

.text:00435506                 mov     dword_5C5708, eax

.text:0043550B                 mov     dword_5C5800, offset dword_5C5700

.text:00435515                 retn

.text:00435515 sub_4354E6      endp

2, three sets seeds can be reverted from _l_sg route with encrypted daemon name and their code and job.
No difference from normal vendor daemon.:rolleyes: