FlexLM Help

[toro]

hi szy111

in windows if have not proper .lib, i serach this sequence of commands for l_string_key.

MOV DWORD PTR SS:[EBP-0B0],8
MOV DWORD PTR SS:[EBP-114],5
MOV DWORD PTR SS:[EBP-20],0A

toro

toro:
thank you very much . i am sorry i can not find l_string_key , i attach it , can you find where it is ?

[toro]

hi szy111

41a1f5
41ea7d
441478
451e08
4870c9
48024c

this is not test.exe. the vendor is "Hamp-Russ" !!!!!! please don't ask me to generate license for you!!!!.

toro

hi toro:
thank you again. i know the vendor name , but it is my first target for crack on win. so i rename it to test . i will set breakpoint at l_string_key , then trace in and watch the value at the adress where call 424410 , it maybe seeds. right? i got the value 00a1b3e8 and 00a19ee8 , it's wrong !!!

[toro]

hi szy111

the function at address 424410 is l_getattr, the address of signed32 is 4422cf. it must be call from l_string_key.

toro

hi toro:
thank you again . but in middle of every l_string_key , i can not find 4422cf , why ? only 2 call 424410 !!!

hi toro:
please hlep me !!
i do not know why the address of signed32 is 4422cf ? can you give me detailed information ? thank you .

Acutually, the call to signed32 will depend on the behavior of the Flexlm. For example, if the crypt filter is used, the code will skip the call to signed32. They have improved the security in a way, and does not provide compatibility in this special case.
On the other hand, it is a better idea to recover the seed from the job structure, which envolves identify the call to l_sg and record the memory contents. There has been essay's and calc tools to make this very easy. Most important is all the behavior can be defeated in this way. Of course, we are not talking about the ECC.
If you have identified the l_string_key code, you will be able to found the license key information by just looking at the return point of this function. There will be a call to atox, which convert and format the license key in ASCII format, just check the return value in EAX, do a reference to the memory, and dump the key. It is automatically generated for you. There is a easy signature of the atox function, there is a long string 0123456789ABCDEF defined there. Do a search on the code, you will find it easily. Then you can trace back to the point for the key generation. There is no need to recovery seeds, no need to run license generation.

Guys thanks for the info, iam back to viewing flexlm apps, i did manage to solve my license problem and thanks iam now using the method for l_sg, at all my targets, however i found one target it doenst work for! maybe i maked a mistake, maybe not, anybody can view and see ?

i view the app:
*removed by request*

I got the following information:
Seed1: 38aa43fa
Seed2: 95845bd5
Vendor: Pxxxx

however, putting these into lmcryptgui, and resigning the license file, still results in -8 (Bad Auth)

Any ideas ?

Thanks.

[dirkmill]

@Peter[Pan]:
I just had a quick look at your target and it seems that your seeds are wrong!

I found this:
encseed[0]=6bxxxx58
encseed[1]=9cxxxx2e

You might want to recheck the byte-order of your calcseed-inputs

Dirk