Flexlm ECC alternate patching methods

[alekine322]

Hi

As background information:

- All my licenses and FlexNet FlexLM both, I made them with version 9.2.
- patch ECC-protected files.
- My Licenses worked.

New software licenses are more complicated and no longer work my licenses.

A friend told me that:
- is not the same FlexLM and FlexNet.
- The Tools for FlexLM, do not work for FlexNet.
- New Tools are required

If this is correct, can you give me feedback (Any subject matter expert of FlexLM and FlexNet):

What are the differences between the previous version (FLEXlm) and the current version (FlexNet):

1. - In encryptadas seed vendor daemon?
2. - In patch, ECC-protected files?
3. - In the preparation of licenses?

Thanks in advance

Regards

[xuehuge]

i try the xf-flexlm patcher ,it seems not work with v11.6.

Any hints how to get three public key from our lmcrypt ?
If we have got three public key from lmcrypt & use them to patch the daemon then should we also patch the return compare of the public key verify ?

[nikkapedd]

gurandiL, you can build your vendor using lmseeds
lmseeds1= 0x11111111
lmseeds2= 0x22222222
lmseeds3= 0x33333333
then use your new build as base with the tool "PubKey_Replacer170_win".. But i tried 3, 4 times and the tool does not work..
Other way is to build your vendor, but recovering the handshake 4 seeds with ida.. Then use the PubKey_Replacer170_win only for the right pubkey...

Here is the body of the core that you have to find in the original vendor, then put the seeds in your new build

In the body of this function find code like this:
code
if ((l_6buff == l_var_3315) && ((l_func_3313 ^ 2296) & 0xff)) l_func_3313 ^= 2296;
if ((l_6buff == (l_var_3315 + 1)) && ((l_func_3313 ^ 7557) & 0xff)) l_func_3313 ^= 7557;
if ((l_6buff == (l_var_3315 + 3)) && ((l_func_3313 ^ 1789) & 0xff)) l_func_3313 ^= 1789;
if ((l_6buff == (l_var_3315 + 2)) && ((l_func_3313 ^ 6361) & 0xff)) l_func_3313 ^= 6361;

The values (not in hex) 2296, 7557, 1789 and 6361 are the 4 seeds for the handshake process.

Find this function in the original vendor daemon and get this values. Replace values
in your lm_new.c file with the values from original vendor daemon.
Tested and working by a master flexlm reverser...!!!!!!!

then should we also patch the return compare of the public key verify ?

this part is not necessary if you use your pubkey...

[swlepus]

Originally Posted by nikkapedd

gurandiL, you can build your vendor using lmseeds
lmseeds1= 0x11111111
lmseeds2= 0x22222222
lmseeds3= 0x33333333
then use your new build as base with the tool "PubKey_Replacer170_win".. But i tried 3, 4 times and the tool does not work..
Other way is to build your vendor, but recovering the handshake 4 seeds with ida.. Then use the PubKey_Replacer170_win only for the right pubkey...

Here is the body of the core that you have to find in the original vendor, then put the seeds in your new build

In the body of this function find code like this:
code
if ((l_6buff == l_var_3315) && ((l_func_3313 ^ 2296) & 0xff)) l_func_3313 ^= 2296;
if ((l_6buff == (l_var_3315 + 1)) && ((l_func_3313 ^ 7557) & 0xff)) l_func_3313 ^= 7557;
if ((l_6buff == (l_var_3315 + 3)) && ((l_func_3313 ^ 1789) & 0xff)) l_func_3313 ^= 1789;
if ((l_6buff == (l_var_3315 + 2)) && ((l_func_3313 ^ 6361) & 0xff)) l_func_3313 ^= 6361;

The values (not in hex) 2296, 7557, 1789 and 6361 are the 4 seeds for the handshake process.

Find this function in the original vendor daemon and get this values. Replace values
in your lm_new.c file with the values from original vendor daemon.
Tested and working by a master flexlm reverser...!!!!!!!

So in this method, we can generate a real key for the original vendor? Is that true?
as far as I know, this is not possible, case the orignal vendor code is not include priv key at all.
Can you explain some details?

[bridgeic]

Originally Posted by nikkapedd

gurandiL, you can build your vendor using lmseeds
lmseeds1= 0x11111111
lmseeds2= 0x22222222
lmseeds3= 0x33333333
......

@nikkapedd,

What's the relation ship between "lmseeds1,2,3" and ecc public key/private key, how should I do in SDK setting if I want set my own private key?

[nikkapedd]

swlepus, I suggest you to read the readme file on the PubKey_Replacer170_win folder, and study the flexlm sdk. I already wrote that second way is working... You need only to know how to work ida pro and how to build the new vendor with VS2008/2010/2012...
Here another part of code from a v11.4 sdk

		if ((l_6counter == l_2086counter) && ((l_2082buff ^ 12052) & 0xff)) l_2082buff ^= 12052;
		if ((l_6counter == (l_2086counter + 1)) && ((l_2082buff ^ 3205) & 0xff)) l_2082buff ^= 3205;
		if ((l_6counter == (l_2086counter + 3)) && ((l_2082buff ^ 8108) & 0xff)) l_2082buff ^= 8108;
		if ((l_6counter == (l_2086counter + 2)) && ((l_2082buff ^ 8083) & 0xff)) l_2082buff ^= 8083;

The values (not in hex) 12052, 3205, 8108 and 8083 are the 4 seeds for the handshake process.

[rcer]

Hi nikkapedd,

I know how to work IDA & Hexrays decompiler, and tried to locate similar code patterns on a couple of vendor deamons I have on file, but was unable to find anything.

Do you have any tips for me?

rgds

rrer

[FoxB]

@bgptlmzyh: RTFM rule before asking =)

[NoFlexlm]

It seems that there are a lot of new things on Flexnet which I need study again.

[nikkapedd]

rcer, if you looking for the handskake seeds, you need the target with the correct signature.. Now load with ida and find the 4/5 references to "handshake". REmember the the values of the seeds are not in hex..
Does anyone know the new obfuscation schema in the new 11.12 fnp that hide the pub and the private key..??? thanks in advance..
Now i'm able to make full working licenses, by building a vendor with my seeds and injecting my pub key...

[rcer]

nikkapedd, thanks, but I think that I don't fully understand your explanation, I have several original vendor daemons, and when I load them in IDA, then decompile the code with Hexrays decompiler and then try to locate the c - code snippets similar to the ones from your previous post I am unable to find any. What is it that am I doing wrong?

[FoxB]

tell us name of the vendor daemon

[rcer]

Fox,

slbsls & scplmd

[nikkapedd]

rcer, Slbsls use the Common vendor technology and is packed with "Virtual protect" like the last version of the slb programs.. You need first to unpack the vendor...
For scplmd is very very easy.. Already can make full licenses with the scplmd vendor..
TRy to build the new vendor with the right seeds, then open the file lm_new.c in the "build" folder. You will see the magic "handshake function".....
Sorry but i do not put any "function" for those 2 vendors....