Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 07-05-2015, 12:03
TechLord TechLord is offline
Banned User
 
Join Date: Mar 2005
Location: 10 Steps Ahead of You
Posts: 759
Rept. Given: 384
Rept. Rcvd 247 Times in 112 Posts
Thanks Given: 789
Thanks Rcvd at 2,022 Times in 571 Posts
TechLord Reputation: 200-299 TechLord Reputation: 200-299 TechLord Reputation: 200-299
If you can share the files with me, then I will take a look.
The CRC check function for Wibu Codemeter is there mainly in the same file itself and the wrapper code does it.
So generally, the CRC checking function(s) have to be patched, to avoid "failing" the check.
In case of the Wibu's OWN files, like WibuCm32.dll for example, the runtime also checks the digital signatures, as does the Kernel component of the Wibu Codemeter.
Depending on the version of the Codemeter/AxProtector used, the pointer to the CRC of the file is found at a particular location.
See this post and the attached screenshots.

http://forum.exetools.com/showpost.php?p=100098&postcount=21

So you should ensure that the CRC always either comes out to the "passing" value at runtime, OR patch the checking function.

USUALLY this will suffice.

If the RUNTIME etc is checking the digital signature then it's a wee bit more complicated.

I can only say after I actually see the file.
Reply With Quote
  #2  
Old 07-05-2015, 15:54
peterg70 peterg70 is offline
Friend
 
Join Date: Sep 2005
Posts: 30
Rept. Given: 0
Rept. Rcvd 0 Times in 0 Posts
Thanks Given: 7
Thanks Rcvd at 1 Time in 1 Post
peterg70 Reputation: 0
it would seem that axprotect has the capability of monitoring files outside the exe for modification.

Unwrapping and patching can be done on the exe but trying to avoid excessive work for no value.

So chasing patching the licensing DLL for flexlm. Patches work but software in exe detects the modification.

Like I said before someone else has managed to recalculate the hash by modifying 20 byte near the end of the file to make it not detect the modification.

What hashing of externallly protected files does axprotect have?
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Media Descriptor File (MDF/MDS) file format NimDa2k General Discussion 0 03-22-2009 16:49


All times are GMT +8. The time now is 06:21.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )