Exetools - Flexlm ECC alternate patching methods

Page 2 of 3

Show 40 post(s) from this thread on one page

Exetools (https://forum.exetools.com/index.php)

- General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)

- - Flexlm ECC alternate patching methods (https://forum.exetools.com/showthread.php?t=12346)

iconstart

07-10-2013 13:27

The Tiger won't give up

arlequim

08-08-2013 23:00

1 Attachment(s)

Exactly, that's why here is another interesting tool in attachment, most of time it's still working on traditional victims ;)

alekine322

08-09-2013 08:42

Hi @arlequim

your previous tools, only patch files win 32
You new tools patch files win 64, very good : )
test the tools friend, Thanks

Regards

nano	11-08-2013 15:51

Good discussion, and I learned a lot from here

alekine322

11-18-2013 02:08

Hi

As background information:

- All my licenses and FlexNet FlexLM both, I made them with version 9.2.
- patch ECC-protected files.
- My Licenses worked.

New software licenses are more complicated and no longer work my licenses.

A friend told me that:
- is not the same FlexLM and FlexNet.
- The Tools for FlexLM, do not work for FlexNet.
- New Tools are required

If this is correct, can you give me feedback (Any subject matter expert of FlexLM and FlexNet):

What are the differences between the previous version (FLEXlm) and the current version (FlexNet):

1. - In encryptadas seed vendor daemon?
2. - In patch, ECC-protected files?
3. - In the preparation of licenses?

Thanks in advance

Regards

xuehuge

11-19-2013 11:00

i try the xf-flexlm patcher ,it seems not work with v11.6.

^o8o^

01-11-2014 00:43

Any hints how to get three public key from our lmcrypt ?
If we have got three public key from lmcrypt & use them to patch the daemon then should we also patch the return compare of the public key verify ?

nikkapedd

01-14-2014 00:15

gurandiL, you can build your vendor using lmseeds
lmseeds1= 0x11111111
lmseeds2= 0x22222222
lmseeds3= 0x33333333
then use your new build as base with the tool "PubKey_Replacer170_win".. But i tried 3, 4 times and the tool does not work..
Other way is to build your vendor, but recovering the handshake 4 seeds with ida.. Then use the PubKey_Replacer170_win only for the right pubkey...

Here is the body of the core that you have to find in the original vendor, then put the seeds in your new build

Code:

In the body of this function find code like this:

code

if ((l_6buff == l_var_3315) && ((l_func_3313 ^ 2296) & 0xff)) l_func_3313 ^= 2296;

if ((l_6buff == (l_var_3315 + 1)) && ((l_func_3313 ^ 7557) & 0xff)) l_func_3313 ^= 7557;

if ((l_6buff == (l_var_3315 + 3)) && ((l_func_3313 ^ 1789) & 0xff)) l_func_3313 ^= 1789;

if ((l_6buff == (l_var_3315 + 2)) && ((l_func_3313 ^ 6361) & 0xff)) l_func_3313 ^= 6361;



The values (not in hex) 2296, 7557, 1789 and 6361 are the 4 seeds for the handshake process.

Find this function in the original vendor daemon and get this values. Replace values
in your lm_new.c file with the values from original vendor daemon.
Tested and working by a master flexlm reverser...!!!!!!!

Quote:

then should we also patch the return compare of the public key verify ?

this part is not necessary if you use your pubkey...

swlepus

01-14-2014 12:50

Quote:

Originally Posted by nikkapedd (Post 89388)

Code:

In the body of this function find code like this:

code

if ((l_6buff == l_var_3315) && ((l_func_3313 ^ 2296) & 0xff)) l_func_3313 ^= 2296;

if ((l_6buff == (l_var_3315 + 1)) && ((l_func_3313 ^ 7557) & 0xff)) l_func_3313 ^= 7557;

if ((l_6buff == (l_var_3315 + 3)) && ((l_func_3313 ^ 1789) & 0xff)) l_func_3313 ^= 1789;

if ((l_6buff == (l_var_3315 + 2)) && ((l_func_3313 ^ 6361) & 0xff)) l_func_3313 ^= 6361;



The values (not in hex) 2296, 7557, 1789 and 6361 are the 4 seeds for the handshake process.

So in this method, we can generate a real key for the original vendor? Is that true?:eek:
as far as I know, this is not possible, case the orignal vendor code is not include priv key at all.
Can you explain some details?

nikkapedd

01-15-2014 00:07

swlepus, I suggest you to read the readme file on the PubKey_Replacer170_win folder, and study the flexlm sdk. I already wrote that second way is working... You need only to know how to work ida pro and how to build the new vendor with VS2008/2010/2012...
Here another part of code from a v11.4 sdk

Code:

                if ((l_6counter == l_2086counter) && ((l_2082buff ^ 12052) & 0xff)) l_2082buff ^= 12052;

                if ((l_6counter == (l_2086counter + 1)) && ((l_2082buff ^ 3205) & 0xff)) l_2082buff ^= 3205;

                if ((l_6counter == (l_2086counter + 3)) && ((l_2082buff ^ 8108) & 0xff)) l_2082buff ^= 8108;

                if ((l_6counter == (l_2086counter + 2)) && ((l_2082buff ^ 8083) & 0xff)) l_2082buff ^= 8083;



The values (not in hex) 12052, 3205, 8108 and 8083 are the 4 seeds for the handshake process.

flexlm

03-16-2014 09:15

Quote:

Originally Posted by nathan (Post 84594)

In the perspective of digging deeper into the pubkey patch approach I would like to share few very useful information for those that intend to spend time on it.

Find attached the Generic pubkey replacer made by Tanker (win + linux). I tested the Win version on a couple of targets (v11.10 and v11.9.1) and it identifies the pubkey correctly (I double checked in the vendorcode struct in memory), however, I didn't manage to produce a working license, yet (work in progress as I may be missing something crucial in the generation).

Also I would like to recommend the follwing discussion which is quite informative IMHO:
http://bbs.pediy.com/showthread.php?t=152615

What am missing: reverse the obsucation algorithm used to store the pubkey in the client binary (any help is appreciated: CrackZ may be have something to say about :)) (note: not the one the scramble it in memory).

Anyone who would like to join the challenge is more than welcome of course. Feel free to test the Pubkey Replacer and feed back with success/unsuccess stories.

Enjoy !

nathan

i cann't download it..

FoxB	04-26-2014 01:40

@bgptlmzyh: RTFM rule before asking =)

NoFlexlm

05-15-2014 21:08

It seems that there are a lot of new things on Flexnet which I need study again.

rcer	05-19-2014 18:59

Hi nikkapedd,

I know how to work IDA & Hexrays decompiler, and tried to locate similar code patterns on a couple of vendor deamons I have on file, but was unable to find anything.

Do you have any tips for me?

rgds

rrer

nikkapedd

05-24-2014 00:33

rcer, if you looking for the handskake seeds, you need the target with the correct signature.. Now load with ida and find the 4/5 references to "handshake". REmember the the values of the seeds are not in hex..
Does anyone know the new obfuscation schema in the new 11.12 fnp that hide the pub and the private key..??? thanks in advance..
Now i'm able to make full working licenses, by building a vendor with my seeds and injecting my pub key...

rcer	05-26-2014 21:47

nikkapedd, thanks, but I think that I don't fully understand your explanation, I have several original vendor daemons, and when I load them in IDA, then decompile the code with Hexrays decompiler and then try to locate the c - code snippets similar to the ones from your previous post I am unable to find any. What is it that am I doing wrong?

FoxB	05-26-2014 22:28

tell us name of the vendor daemon

rcer	05-27-2014 20:45

Fox,

slbsls & scplmd

nikkapedd

05-28-2014 02:32

rcer, Slbsls use the Common vendor technology and is packed with "Virtual protect" like the last version of the slb programs.. You need first to unpack the vendor...
For scplmd is very very easy.. Already can make full licenses with the scplmd vendor..
TRy to build the new vendor with the right seeds, then open the file lm_new.c in the "build" folder. You will see the magic "handshake function".....
Sorry but i do not put any "function" for those 2 vendors....

rcer	05-29-2014 20:29

nikkapedd,

Thanks & I think I have finally grasped it!. Have a look at the PM I sent to you.

Still have one question. which program do I need to use to unpack Slbsls?

rgds

rcer

FoxB	05-29-2014 22:16

@rcer: you can use the dll inject for the online patch any info inside slbsls ;)

alekine322

05-30-2014 09:20

Hi @rcer

slbsls vendor daemon difficult. I think the most difficult
I'm also trying to vendor daemon packed/encrypted/obfuscated

Thanks for your feedback @nikkapedd and @FoxB

rcer	05-30-2014 19:54

Hi FoxB,

Thanks and can you please explain this in a little detail

rgds

rcer

rcer	05-30-2014 19:58

alekine322,

yes slbsls is a tough nut to crack, and we rookies need al the help we can get from the seasoned crackers in this forum

nathan

07-14-2014 17:52

Any chance to get the daemon ?

alekine322

07-17-2014 22:02

Hi

@nathan: Yes, please check you PM

Ultimax Force

07-17-2014 23:37

me to i want daemon to

alekine322

07-19-2014 05:22

Hi

@ultimax Force: Yes, please check you PM

Boot64

08-18-2014 23:26

Quote:

Originally Posted by FoxB (Post 91675)

@rcer: you can use the dll inject for the online patch any info inside slbsls ;)

You are not right. In the previous version of slbsls.exe (SLBLicensing 2013) may be... In the new version of slbsls.exe (SLBLicensing 2014) no.
In the previous version public keys not encrypted (for all three daemons: slbsls, slbfd and lmgrd.slb). In the new version public keys for slbsls daemon is encrypted and public keys for all demons from time to time pass integrity check.

FoxB	08-18-2014 23:37

Boot64: you are boot32? ;) upload 2014 daemon, will see it.

bridgeic

08-20-2014 09:28

Quote:

Originally Posted by nathan (Post 84594)

......
Find attached the Generic pubkey replacer made by Tanker (win + linux). I tested the Win version on a couple of targets (v11.10 and v11.9.1) and it identifies the pubkey correctly (I double checked in the vendorcode struct in memory), however, I didn't manage to produce a working license, yet (work in progress as I may be missing something crucial in the generation).
......
nathan

If use this patch, what we should do at FlexLM SDK side? Which files should be modified? lmprikey.h? or some other files together? How to modify?

bridgeic

08-20-2014 11:51

Quote:

Originally Posted by bridgeic (Post 93820)

If use this patch, what we should do at FlexLM SDK side? Which files should be modified? lmprikey.h? or some other files together? How to modify?

For license with 239bit SIGN2, I see two groups of private keys as below after compiler SDK. Then whether this ecc patch still work? Or should add the 2nd corresponding pubkey into the patcher also?

static unsigned char lm_prikey[2][3][40] = {{{0x0, 0xb2, 0x45, 0x2c, 0xbc, 0x7e, 0x72, 0xc1, 0x3a, 0x39, 0x5e, 0x67, 0x25, 0xce, 0xd9},
{0x2, 0x1c, 0x8f, 0xa2, 0xe4, 0xb6, 0x4f, 0x7a, 0x2c, 0xd2, 0x6, 0x81, 0xb5, 0xd8, 0xf9, 0xf1, 0x81, 0x6, 0x4a, 0x8e, 0x17},
{0x3, 0xa0, 0x58, 0x89, 0xd2, 0x30, 0x22, 0xd8, 0xca, 0x5e, 0xac, 0x59, 0x33, 0xb3, 0x69, 0xdc, 0x30, 0x9b, 0xb6, 0x8d, 0x24, 0x56, 0x60, 0x23, 0xf0, 0x8c, 0x11, 0xb8, 0xc2, 0xba}}
,
{{0x0, 0x5b, 0xd9, 0xeb, 0xa1, 0xb8, 0x16, 0x1f, 0x95, 0xf5, 0x21, 0x5b, 0xf2, 0x2a, 0x68},
{0x1, 0x6f, 0x67, 0xae, 0x86, 0xe0, 0x58, 0x7e, 0x57, 0xd4, 0x85, 0x6f, 0xc8, 0xa9, 0xa1, 0x6e, 0x2b, 0x9, 0xd8, 0xed, 0xb2},
{0xb, 0x7b, 0x3d, 0x74, 0x37, 0x2, 0xc3, 0xf2, 0xbe, 0xa4, 0x2b, 0x7e, 0x45, 0x4d, 0xb, 0x71, 0x58, 0x4e, 0xc7, 0x6d, 0x95, 0xf, 0x34, 0x9c, 0x4, 0xa3, 0x67, 0x57, 0xa6, 0xd1}}
};

alekine322

08-21-2014 05:26

Hi

for slbsls 2013 Licensing.
how hard is to find the encrypted seed. With seeds found, generate my lmcrypt.exe, generate my license. patch files protected by ECC. License fine works
thank you very much

Boot64 (Boot32) you mention the following: for all three daemons: slbsls, slbfd and lmgrd.slb
I've seen licenses with slbsls and slbfd, but never with lmgrd.slb, Application that uses it?
these questions are for my studio

Note: Boot64, Please upload deamon vendor for SLBLicensing 2014 for my studio
Thanks in advance

bridgeic

08-21-2014 17:05

Quote:

Originally Posted by bridgeic (Post 93820)

If use this patch, what we should do at FlexLM SDK side? Which files should be modified? lmprikey.h? or some other files together? How to modify?

License pass check with <1> use the patch <2> compile SDK with setting s below.

#define LM_SEED1 0x11111111
#define LM_SEED2 0x22222222
#define LM_SEED3 0x33333333

Seems the private keys is related with the values LM_SEED1~3, but don't know the relationship, anyone can give some clue?

nikkapedd

08-21-2014 23:06

You need only to change the public key not the private ..
Every time the program check the public key, then authenticate your sign according with the vendor's pubkeys..
But pay attention if the program use also vendor_info or vendor_String certificate to authenticate the license, patching only the pub key is not enough to make a working license...

alekine322, patching only the vendor is not enough to make a working license.. You need to patch also the ECC in the exe/dll files

bridgeic

08-22-2014 17:46

Quote:

Originally Posted by nikkapedd (Post 93932)

You need only to change the public key not the private ..
Every time the program check the public key, then authenticate your sign according with the vendor's pubkeys..

alekine322, patching only the vendor is not enough to make a working license.. You need to patch also the ECC in the exe/dll files

Beside the patch, we still need get lmcrypt that has private/public key paris that match with the patch. Seems compile SDK with setting s below will create private/public keys that consistent with the patch, so I ask
what's the relationship.

#define LM_SEED1 0x11111111
#define LM_SEED2 0x22222222
#define LM_SEED3 0x33333333

alekine322

08-25-2014 02:06

Quote:

Originally Posted by nikkapedd (Post 93932)

alekine322, patching only the vendor is not enough to make a working license.. You need to patch also the ECC in the exe/dll files

YES, is correct

bridgeic

08-28-2014 16:13

Quote:

Originally Posted by nikkapedd (Post 89388)

gurandiL, you can build your vendor using lmseeds
lmseeds1= 0x11111111
lmseeds2= 0x22222222
lmseeds3= 0x33333333
......

@nikkapedd,

What's the relation ship between "lmseeds1,2,3" and ecc public key/private key, how should I do in SDK setting if I want set my own private key?

deltaforce

09-11-2014 19:56

What difference Between Flex V.11.9 and 11.10?
Is this added new security protection?

gemuz

09-16-2014 19:09

If you know how to deal with the protection , there is no difference

All times are GMT +8. The time now is 17:28.

Page 2 of 3

Show 40 post(s) from this thread on one page