Flexlm ECC alternate patching methods

[nathan]

Arlequim,

I agree the patching way is the easiest path as long as you can identify the pubkey_verify function. However, as far as I know in the very latest SDK (v11.10) the .map file for the libraries is not included anymore and the obfuscated names are not easily reversable (*). In fact I haven't seen any working "automated" patcher for version 11.10. On the other hand the pubkey substitution is practically SDK independent. The obfuscated pubkey is easily fetched and de-obfuscated by debugging the binary. The hard task is to re-build the pubkey from the binary as it is saved together with a lot of random garbage.

(*) The name randomization function is as follows:

static void randomize(L_STRIP_OPTIONS * options,NAMELIST *np)
{
int i;
int len;
static char *letters = "abcdefghijklmnopqrstuvwxyz";
static char *letters_num = "0123456789abcdefghijklmnopqrstuvwxyz_ABCDEFGHIJKLMNOPQRSTUVWXYZ";
static char *emptyString = "";

if ( np == NULL )
return ;
if (options->zeros)
{
for (i=0 ; np[i].name != NULL ; i++)
if ( np[i].randname == NULL )
np[i].randname = emptyString;
}
else
{
for (i=0 ; np[i].name != NULL ; i++)
{
if ( np[i].randname == NULL && strlen(np[i].name) > 0)
{
int x;

len = strlen(np[i].name);
np[i].randname = (char *)malloc(len + 1);
np[i].randname[0] = letters[rand()%26];
for (x = 1; x < len; x++)
np[i].randname[x] = letters_num[rand()%63];
np[i].randname[len] = '\0'; /* null terminate */
}
}
}
}

[arlequim]

Hi, if you are familiar with FLEXlm, you don't need to know names via .map file, you should be able to "explore" the binary file by recognition of several flow-chart, at least this is my personal approach. Mangled names (= exported functions) are nothing of serious. I didn't update my generic patcher as today ECC is apparently checked out, but the real challenge is TS and activation, alto i have figured out there are several weakness inside binary code but not so easy to find out. Anyway my previous example has been taken from @(#) FLEXnet Licensing v11.10.1.0 build 99220 i86_n3 (lmgr.lib), Copyright (c) 1988-2012 Flexera Software LLC. All Rights Reserved. So nothing has changed, and everything is possible

[nathan]

I haven't worked on Flexm reversing for a while indeed, however, if I recall propelry (correct me if I'm mistakening) activation is an option which is rarely used and uses streams to store the information.
I'm not sure I fully understand TS. I'll be more than willing to collaborate if you think I could be of any help.

[toro]

to find verification function simply search for push21b.
TS and activation is very weak, just 2 patch and you can add any license you want to license manager.
for changing pubkey, the best way is api hooking. every target which compiled with vs 2005 and higher with shared library is possible to hook to change pubkey.

[arlequim]

Sometimes TS is bad implemented through the hook thats talks to the main app, i mean some developers left the front door opened S0lidw0rks by DSS is already a relevant example.
Last time i have mentioned about some weak point. Well, the weakest point of libFNP ASR-based activation is the a Trusted Storage itself. There is an assumption, if something is put into TS it becomes trusted. So, if you inject a tampered ASR into TS via the cracked libFNP library, the original library will treat it as legal.
It is also possible to inject a tampered ASR without any memory or static patches, all that you need is to kill some exceptions with VEH during ASR processing call.
Then you have to write your own routine to obtain the context of trusted storage and make a call to _flxActAddSpecifiedASR with VEH handler set on the custom handler.
Obviously this hacking works for client TS-based activation, the Server TS activation checks SIGN apparently, so it is useless to do the hack, anyway you have to patch ECC check.
Good luck

[zzfeed]

Originally Posted by toro

to find verification function simply search for push21b.
TS and activation is very weak, just 2 patch and you can add any license you want to license manager.
for changing pubkey, the best way is api hooking. every target which compiled with vs 2005 and higher with shared library is possible to hook to change pubkey.

It means two files need to be patched or other things? please expains in details,thanks

[rcer]

Hi Nathan,

I also tried tankers little pubkey tool, on a couple of different binaries, but had the same result and was unable to checkout any licences.
Could it be that somehow the pub/priv key pair is rejected because it was generated using default LMSEED values (0x1111111/0x22222222/0x33333333)?
I there a way to input different LMSEED values into tankers tool?

I also noticed that if you build lmcrypt using the above seed values, and you try to generate a license with SIGN= & SIGN2=; the length of the SIGN Key is 113/163/239 bit (depending on LM_STRENGTH), but the SIGN2 key length = 12 characters (i.e default)

rgds

RCER

[nathan]

Hi RCER,

to be honest I didn't spend so much time on it (good old days when I could spend as much time I could on RCE) and I didn't dig deeper into the issue. I will try on a couple of apps as soon as I can and let you know.

- nathan

[rcer]

Hi Nathan,

thanks

and regards

rcer

Hi, friends.
I just a student, and study Flexlm ECC, hope study updates.

[iconstart]

The Tiger won't give up

[arlequim]

Exactly, that's why here is another interesting tool in attachment, most of time it's still working on traditional victims

[alekine322]

Hi @arlequim

your previous tools, only patch files win 32
You new tools patch files win 64, very good : )
test the tools friend, Thanks

Regards

Good discussion, and I learned a lot from here

[alekine322]

Hi

As background information:

- All my licenses and FlexNet FlexLM both, I made them with version 9.2.
- patch ECC-protected files.
- My Licenses worked.

New software licenses are more complicated and no longer work my licenses.

A friend told me that:
- is not the same FlexLM and FlexNet.
- The Tools for FlexLM, do not work for FlexNet.
- New Tools are required

If this is correct, can you give me feedback (Any subject matter expert of FlexLM and FlexNet):

What are the differences between the previous version (FLEXlm) and the current version (FlexNet):

1. - In encryptadas seed vendor daemon?
2. - In patch, ECC-protected files?
3. - In the preparation of licenses?

Thanks in advance

Regards