FlexLM Help

[toro]

hi szy111

depend on flexlm version and its behaviour there are more than one l_string_key. if your question is that you set breakpoint but programs not break, the answer is you must set breakpoint in every of them.

find your target flexlm version with lmtools then open target in olly and scan object file with lmgr.lib or lmgrd.lib and then set breakpoint on every l_string_key. in middle of everyl_string_key you will see 2 call to signed32.

toro.

sorry, my mean is that i can not find l_string_key breakpoint in my target, it report symbol not found !!!

my target is unix program , not win'program , so can not use olly .

[toro]

hi szy111

in windows if have not proper .lib, i serach this sequence of commands for l_string_key.

MOV DWORD PTR SS:[EBP-0B0],8
MOV DWORD PTR SS:[EBP-114],5
MOV DWORD PTR SS:[EBP-20],0A

toro

toro:
thank you very much . i am sorry i can not find l_string_key , i attach it , can you find where it is ?

[toro]

hi szy111

41a1f5
41ea7d
441478
451e08
4870c9
48024c

this is not test.exe. the vendor is "Hamp-Russ" !!!!!! please don't ask me to generate license for you!!!!.

toro

hi toro:
thank you again. i know the vendor name , but it is my first target for crack on win. so i rename it to test . i will set breakpoint at l_string_key , then trace in and watch the value at the adress where call 424410 , it maybe seeds. right? i got the value 00a1b3e8 and 00a19ee8 , it's wrong !!!

[toro]

hi szy111

the function at address 424410 is l_getattr, the address of signed32 is 4422cf. it must be call from l_string_key.

toro

Acutually, the call to signed32 will depend on the behavior of the Flexlm. For example, if the crypt filter is used, the code will skip the call to signed32. They have improved the security in a way, and does not provide compatibility in this special case.
On the other hand, it is a better idea to recover the seed from the job structure, which envolves identify the call to l_sg and record the memory contents. There has been essay's and calc tools to make this very easy. Most important is all the behavior can be defeated in this way. Of course, we are not talking about the ECC.
If you have identified the l_string_key code, you will be able to found the license key information by just looking at the return point of this function. There will be a call to atox, which convert and format the license key in ASCII format, just check the return value in EAX, do a reference to the memory, and dump the key. It is automatically generated for you. There is a easy signature of the atox function, there is a long string 0123456789ABCDEF defined there. Do a search on the code, you will find it easily. Then you can trace back to the point for the key generation. There is no need to recovery seeds, no need to run license generation.