Exetools  

Go Back   Exetools > General > General Discussion
Reload this Page Flexlm ECC alternate patching methods
Register Forum Rules FAQ Calendar

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 05-11-2013, 01:49
nikkapedd nikkapedd is offline
VIP
  
Join Date: Mar 2011
Location: ::Bratva::
Posts: 284
Rept. Given: 275
Rept. Rcvd 153 Times in 67 Posts
Thanks Given: 210
Thanks Rcvd at 284 Times in 116 Posts
nikkapedd Reputation: 100-199 nikkapedd Reputation: 100-199
nathan i tried the tool, but you need also to change the pub key in the crypter, otherwise the new license will be always useless...
Unfortunately the tool does not recognize the pubkey in the crypter.....
Now i see the version is v1.70...
Have you tried to patch the ecc inside the crypter...????
anyway thanks for the new version....
Reply With Quote
The Following User Says Thank You to nikkapedd For This Useful Post:
Indigo (07-19-2019)
  #2  
Old 05-11-2013, 03:13
nathan nathan is offline
Friend
  
Join Date: Jul 2009
Posts: 37
Rept. Given: 4
Rept. Rcvd 5 Times in 4 Posts
Thanks Given: 17
Thanks Rcvd at 27 Times in 17 Posts
nathan Reputation: 5
Quote:
Originally Posted by nikkapedd View Post
nathan i tried the tool, but you need also to change the pub key in the crypter, otherwise the new license will be always useless...
Unfortunately the tool does not recognize the pubkey in the crypter.....
Now i see the version is v1.70...
Have you tried to patch the ecc inside the crypter...????
anyway thanks for the new version....
Well, I'm not that junior in Flexlm ;-). I changed the pubkey in the crypter of course and to be honest I haven't tried to patch the crypter (with a different originating pubkey) but I'll try to do that next ... BTW: lmseeds1=0x1111111 lmseed2=22222222 lmseed3=33333333
Last edited by nathan; 05-11-2013 at 03:22.
Reply With Quote
The Following User Gave Reputation+1 to nathan For This Useful Post:
nikkapedd (05-12-2013)
The Following User Says Thank You to nathan For This Useful Post:
Indigo (07-19-2019)
  #3  
Old 05-21-2013, 03:27
arlequim's Avatar
arlequim arlequim is offline
IBMSecuritySystemsXForce
  
Join Date: Feb 2009
Location: Punta Entinas-Sabinar, ALMERIMAR
Posts: 295
Rept. Given: 52
Rept. Rcvd 317 Times in 104 Posts
Thanks Given: 46
Thanks Rcvd at 193 Times in 63 Posts
arlequim Reputation: 300-399 arlequim Reputation: 300-399 arlequim Reputation: 300-399 arlequim Reputation: 300-399
Why do you all still spend so much time trying to patch this silly Elliptic Curve ?!?!? The best alternate, fastest and working method is to patch the return compare of pubkey verify, isn't it? Here is the solution applied on some well-known flexlm library.

ORIGINAL CODE

.textidx:1015779B loc_1015779B: ; CODE XREF: sub_10157010+73Aj
.textidx:1015779B ; sub_10157010+76Aj
.textidx:1015779B lea ecx, [ebp+var_4]
.textidx:1015779E push ecx
.textidx:1015779F lea edx, [ebp+var_D8]
.textidx:101577A5 push edx
.textidx:101577A6 lea eax, [ebp+Dst]
.textidx:101577A9 push eax
.textidx:101577AA mov ecx, [ebp+Memory]
.textidx:101577B0 add ecx, 44h
.textidx:101577B3 push ecx
.textidx:101577B4 mov edx, [ebp+Memory]
.textidx:101577BA mov eax, [edx+4]
.textidx:101577BD push eax
.textidx:101577BE call sub_100B28B0
.textidx:101577C3 add esp, 14h
.textidx:101577C6 mov [ebp+var_20], eax
.textidx:101577C9 cmp [ebp+var_20], 0
.textidx:101577CD jz short loc_101577EB
.textidx:101577CF ; ---------------------------------------------------------------------------
.textidx:101577CF mov ecx, [ebp+var_20]
.textidx:101577D2 push ecx
.textidx:101577D3 push 2930h
.textidx:101577D8 mov edx, [ebp+arg_0]
.textidx:101577DB push edx
.textidx:101577DC call sub_10129060
.textidx:101577E1 add esp, 0Ch
.textidx:101577E4 mov eax, 0FFFFFF8Dh
.textidx:101577E9 jmp short loc_10157853
.textidx:101577EB ; ---------------------------------------------------------------------------
.textidx:101577EB
.textidx:101577EB loc_101577EB: ; CODE XREF: sub_10157010+7BDj
.textidx:101577EB cmp [ebp+var_4], 0
.textidx:101577EF jnz short loc_10157850

PATCHED CODE

.textidx:1015779B loc_1015779B: ; CODE XREF: sub_10157010+73Aj
.textidx:1015779B ; sub_10157010+76Aj
.textidx:1015779B lea ecx, [ebp+var_4]
.textidx:1015779E push ecx
.textidx:1015779F lea edx, [ebp+var_D8]
.textidx:101577A5 push edx
.textidx:101577A6 lea eax, [ebp+Dst]
.textidx:101577A9 push eax
.textidx:101577AA mov ecx, [ebp+Memory]
.textidx:101577B0 add ecx, 44h
.textidx:101577B3 push ecx
.textidx:101577B4 mov edx, [ebp+Memory]
.textidx:101577BA mov eax, [edx+4]
.textidx:101577BD push eax
.textidx:101577BE call sub_100B28B0
.textidx:101577C3 add esp, 14h
.textidx:101577C6 mov [ebp+var_20], eax
.textidx:101577C9 cmp [ebp+var_20], 0
.textidx:101577CD jmp short loc_101577EB
.textidx:101577CF ; ---------------------------------------------------------------------------
.textidx:101577CF mov ecx, [ebp+var_20]
.textidx:101577D2 push ecx
.textidx:101577D3 push 2930h
.textidx:101577D8 mov edx, [ebp+arg_0]
.textidx:101577DB push edx
.textidx:101577DC call sub_10129060
.textidx:101577E1 add esp, 0Ch
.textidx:101577E4 mov eax, 0FFFFFF8Dh
.textidx:101577E9 jmp short loc_10157853
.textidx:101577EB ; ---------------------------------------------------------------------------
.textidx:101577EB
.textidx:101577EB loc_101577EB: ; CODE XREF: sub_10157010+7BDj
.textidx:101577EB cmp [ebp+var_4], 0
.textidx:101577EF jmp short loc_10157850

After all, you can't achieve the impossible without attempting the absurd
__________________
<<< The L10n won't give up >>>
Last edited by arlequim; 05-21-2013 at 03:37.
Reply With Quote
The Following 4 Users Say Thank You to arlequim For This Useful Post:
chocobo4519 (12-29-2024), Indigo (07-19-2019), synkro (05-07-2015), tonyweb (04-17-2017)
  #4  
Old 07-07-2013, 23:10
ballad88
 
Posts: n/a
The first study Flexlm ECC
Hi, friends.
I just a student, and study Flexlm ECC, hope study updates.
Reply With Quote
Reply

« Previous Thread | Next Thread »

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off

Similar Threads
Thread Thread Starter Forum Replies Last Post
Harmony A library for patching, replacing and decorating .NET and Mono methods during ahmadmansoor Source Code 1 01-12-2024 15:06
Alternate Approach to FlexLM Brute-Force Windoze General Discussion 9 10-21-2020 19:23
Where are the Class methods? 5Alive General Discussion 0 07-28-2005 03:22
Different Detection Methods OHPen General Discussion 0 10-21-2003 10:11


All times are GMT +8. The time now is 11:11.

Aaron's homepage - Top

Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )