Flexlm ECC alternate patching methods

[nathan]

Arlequim,

I agree the patching way is the easiest path as long as you can identify the pubkey_verify function. However, as far as I know in the very latest SDK (v11.10) the .map file for the libraries is not included anymore and the obfuscated names are not easily reversable (*). In fact I haven't seen any working "automated" patcher for version 11.10. On the other hand the pubkey substitution is practically SDK independent. The obfuscated pubkey is easily fetched and de-obfuscated by debugging the binary. The hard task is to re-build the pubkey from the binary as it is saved together with a lot of random garbage.

(*) The name randomization function is as follows:

static void randomize(L_STRIP_OPTIONS * options,NAMELIST *np)
{
int i;
int len;
static char *letters = "abcdefghijklmnopqrstuvwxyz";
static char *letters_num = "0123456789abcdefghijklmnopqrstuvwxyz_ABCDEFGHIJKLMNOPQRSTUVWXYZ";
static char *emptyString = "";

if ( np == NULL )
return ;
if (options->zeros)
{
for (i=0 ; np[i].name != NULL ; i++)
if ( np[i].randname == NULL )
np[i].randname = emptyString;
}
else
{
for (i=0 ; np[i].name != NULL ; i++)
{
if ( np[i].randname == NULL && strlen(np[i].name) > 0)
{
int x;

len = strlen(np[i].name);
np[i].randname = (char *)malloc(len + 1);
np[i].randname[0] = letters[rand()%26];
for (x = 1; x < len; x++)
np[i].randname[x] = letters_num[rand()%63];
np[i].randname[len] = '\0'; /* null terminate */
}
}
}
}

[arlequim]

Hi, if you are familiar with FLEXlm, you don't need to know names via .map file, you should be able to "explore" the binary file by recognition of several flow-chart, at least this is my personal approach. Mangled names (= exported functions) are nothing of serious. I didn't update my generic patcher as today ECC is apparently checked out, but the real challenge is TS and activation, alto i have figured out there are several weakness inside binary code but not so easy to find out. Anyway my previous example has been taken from @(#) FLEXnet Licensing v11.10.1.0 build 99220 i86_n3 (lmgr.lib), Copyright (c) 1988-2012 Flexera Software LLC. All Rights Reserved. So nothing has changed, and everything is possible