Dongles

How do I make a dump of a dongle's eeprom? It is a DESkey-type
one.

I don't know how you can Dump the EPROM of a Dongle.
It's better to ask an Electronic Engineer about that.
But if you will remove the DESKey Protection Code
try the attachmend , it is the DESKey Protection Remover from EXELord , it is old but maybe helps.

I've tried that in "physical way" last year... When i opened the box i found the chip protected with an sort of glue. So i went back and did it by software way...

Sorry, You may understand thah I've read this by software way. NO, I meant I've cracked it.

it can be dumped physically.. quite easilly too.. The epoxy glue is usually on motorolla not the mem..... have fun.

No, I need to dump it software-wise, like HASPGRAB does to HASPs. Isn't there a generic solution?

hm.. thats interesting.. okay well given your not going for a full universal emulator or something if you just want a normal eeprom dump the DK2 has 224 bytes of memory in public/private. 16bytes= public (write read etc) the rest of the bytes are private. You can write to private memory at anytime but you need a 48bit pw. The private memory can be read at anytime with no problem, however, you wil need the seed it is encrypted with. There are 0xFF seeds. There are also 223 addresses but regardless how it is used the address a max of 223 memory is still the cap. There is a very good chance you will need the app to read the memory so you can rip a proper read memory call, like the one below from the app.

UCHAR Memory[209];
DK2ReadMemory( DataReg, DK2Id, 0xff(seed), 0x010(address), Memory, 208(lengthofdata) );

You could also write a quick real time logic analyzer dumper. Because the deskey will return garbage on a inproper seed and address based on the memory you will get a semi to good random looking values. i.e. it would be rare to get certain data sequenced together like 00 00 32 00. because of algo design. So what you do is make a dumper that looks for sequences in data if there are no sequences then ignore that buffer and overwrite with next address/seed. Until you have covered all address/seed. This is only needed if you dont have the app! Keep in mind that this cannot be 100% given the author of the dongle actually uses random data as his eeprom input. .....enjoy. hope that made sense..

Sab, thanks for the details. Can you please post some info about the algorithm string and the random numbers and the Through Encryption functions? I have the DK2 API guide, I am writing a quick'n'dirty emulator in CPP and I am stuck there. How do I capture the "random number area" and calculate the words from the seeds?

not sure what you said above, can you be more specific? what kind of details do u want other then the ones provided in the api guide?

The dongle contains specific numbers, ok? These numbers are
retrieved by the ReadRandomNumbers function and changed
appropriately with the seeds. How do I read the rnd number
area and calculate the values from the seeds?

Or -- how do I read out and write down on a file all the rnd #?

Although I must admit I am still confused Ill try to answer. Dk2ReadRandom numbers is just a rng generator. It produces output by 2 arguments, the length of data and the seed of data.
From what I seen it should allow 0-FF seeds and the asic itself can produce "unlimited" data but it does slow down so theres a point where its to slow to consider a security device worth having. Dk2ReadRandomNumbers is the api your looking for, just use that api with dk2id, seed value (this is 0-FF) and u wont need any special developer codes to access this api.