Cracking HASP HL / SafeNet SHK

Either the HaspSRM(including HL) or SHK are both garbage.It only takes me less than 5 minute to crack these dongles if the dongles are available.

[toro]

There are rumors that AES implementation of SHK does not conform to the standards and uses weak shorter keys and algorithms that in theory are extractable

i am not agree, just check packet encryption method, you will find full aes used. so why they don't use full aes for query functions? also as i know they used a commercial implementation of AES and ECC.

To be exact all available software emulators(for HL(SRM) and SHK) are partial and use look-up tables to provide responses corresponding to the encryption algorithms. These emulators can easily be defeated in the consecutive versions of the protected software. Presently there are no third-party "dumpers" for both HASP HL/SRM & SHK that could retrieve the encryption keys from the dongles. All dumpers sniff communication between the dongles and the application to fill their tables with challenge-response pairs...

for many years these kind of emulators work successfully.

And this doomed company constantly sends threats to sites which offer emulators for their "security" devices

i got many emails even from safenet vice president maybe i will attach it here soon, funny letter.

P.S. At least they've bought a better design for their clumsy SHK

better design but very very bad implementation. i can count at least 10 hole in their protection.

Either the HaspSRM(including HL) or SHK are both garbage.It only takes me less than 5 minute to crack these dongles if the dongles are available.

just check wilcom software (hasp hl protected) i think you will need 3 mounts for it. in my opinion dongle is a tool which its benefit is depend on the method you will choose to use it.

[Syoma]

Originally Posted by toro

i am not agree, just check packet encryption method, you will find full aes used. so why they don't use full aes for query functions? also as i know they used a commercial implementation of AES and ECC.

As I know they use standard AES for ShkCellEncryption / ShkCellDecryption. The ShkCellQuery seems based on ShkCellDecryption, but have additional transform over it.

Originally Posted by toro

i can count at least 10 hole in their protection.

Which sort of holes?

Originally Posted by toro

just check wilcom software (hasp hl protected) i think you will need 3 mounts for it. in my opinion dongle is a tool which its benefit is depend on the method you will choose to use it.

A clone can be done within 24 hours (an access to the original dongle is a must) but the service is expensive There are other ways that you don't know of and have nothing to do with the debugging of the software and sniffing the communication to the dongle -- the methods you (and not only you) obviously use to fight protections and these methods are not very productive sometimes .

[toro]

firstly no offense
hardware clone is good method , i can do it for ssp/ulp even w/o access to dongle. if you can do for shk or srm you are very good.
btw in many cases ( at least in my cases) hardware is not in our hands.

THANKS FOR THIS EXPLAIN

[dave_omirora]

Originally Posted by orchid88

Either the HaspSRM(including HL) or SHK are both garbage.It only takes me less than 5 minute to crack these dongles if the dongles are available.

Orchid
If you unpacked the Hasp SRM in 5 minutes then you forget it every protection is not same, wilcom Embroidery studio is get time.

[dave_omirora]

Originally Posted by orchid88

Either the HaspSRM(including HL) or SHK are both garbage.It only takes me less than 5 minute to crack these dongles if the dongles are available.

did you tell me when I run the ollydbg and after I run the hasp SRM protected software he give the (Error 1030 debuger detected) or (Unknown Envelop error (E0031)), how to solved this problems?

I try to use the plugin too (isdebuggerdetected) then problem is not solved.

Please guid here I also request by administrator too.

Best Regards