Quote:
Originally Posted by swork3
hi, i searched around but i have not found an answer, i have an app useing
flexlm 9.x, i followed some tutorial and found VENDOR_KEY1-4 and vc.data[0]
and vc.data[1] (the time() and xor table thing) i got ENCRYPTION_SEED1 and 2,
i tested that 3 times - got the same seed1 and 2, so that is correct.
Now the thing i do not understand fully, is VENDOR_KEY5 generated out of
key1-4 and vendor? or how can i find that? thanks
|
You dont need any tools to find out ES1 ES2 and VK5. Just locate the l_sg() procedure as you can see here:
Code:
00417043 |. 8D8D 80FDFFFF LEA ECX,DWORD PTR SS:[EBP-280]
00417049 |. 51 PUSH ECX
0041704A |. 8B95 6CFDFFFF MOV EDX,DWORD PTR SS:[EBP-294]
00417050 |. 81C2 0C030000 ADD EDX,30C
00417056 |. 52 PUSH EDX
00417057 |. 8B85 6CFDFFFF MOV EAX,DWORD PTR SS:[EBP-294]
0041705D |. 50 PUSH EAX
0041705E |. E8 27040100 CALL xxx.0042748A
00417063 |. 83C4 0C ADD ESP,0C
00417066 |. 81BD 84FDFFFF >CMP DWORD PTR SS:[EBP-27C],87654321
00417070 |. 74 0C JE SHORT xxx.0041707E
00417072 |. 81BD 88FDFFFF >CMP DWORD PTR SS:[EBP-278],12345678
inside 0042748A
...
00427563 |. 3355 F4 XOR EDX,DWORD PTR SS:[EBP-C]
00427566 |. 3355 E0 XOR EDX,DWORD PTR SS:[EBP-20]
00427569 |. 3355 E4 XOR EDX,DWORD PTR SS:[EBP-1C]
0042756C |. 8B4D 10 MOV ECX,DWORD PTR SS:[EBP+10]
0042756F |. 8B41 04 MOV EAX,DWORD PTR DS:[ECX+4]
00427572 |. 33C2 XOR EAX,EDX -> ES1 xored by VK5 = real ES1
...
00427596 |. 334D F4 XOR ECX,DWORD PTR SS:[EBP-C]
00427599 |. 334D E0 XOR ECX,DWORD PTR SS:[EBP-20]
0042759C |. 334D E4 XOR ECX,DWORD PTR SS:[EBP-1C]
0042759F |. 8B45 10 MOV EAX,DWORD PTR SS:[EBP+10]
004275A2 |. 8B50 08 MOV EDX,DWORD PTR DS:[EAX+8]
004275A5 |. 33D1 XOR EDX,ECX -> ES2 xored by VK5 = real ES2