HARDLOCK emulator

Hello Nikita .
Can you send hl_struct structure to me too?
Thanks in advance!

[toro]

hi nikita

i am workin on hl_code. its packet size is 0x138; 0x100 byte is coded and uncoded via enc\dec routins. i tested hl_code with bcnt=4. for one hl_code call only one deviceiocontrol is called with packet size=0x138. that packet only contain first block of data at hl_packet+0x128. at return it contain crypted first block plus a 0x8 byte in hl_packet+0x100 that i gess is hardlock signature. because it seems that encryption of other blocks is performed in programs itself by use of that signiture, is it true?

however i found some of function numbers, but not all of them. can you help me.

tanks
toro.

Originally Posted by toro

seems that encryption of other blocks is performed in programs itself by use of that signiture, is it true?

Only 8 bytes transformed with dongle. On each step internal results stored in result block for ring3. It's used to crypt rest part of data.

Originally Posted by toro

however i found some of function numbers, but not all of them. can you help me.

Just call function you need and look +0x18 field at the driver.

[toro]

hi nikita

Only 8 bytes transformed with dongle. On each step internal results stored in result block for ring3. It's used to crypt rest part of data.

you are right. my question: is it possible to make other hl_code result with this internal result? in another word is this internal result the hardlock signature?

Just call function you need and look +0x18 field at the driver.

again you are right but some function such as hl_meminf call more than one function. for example hl_meminf's function number are 0x17,0x14,0x15. is it true? i want the meaning of this functions if possible.

tanks.
toro

[toro]

hi nikita

are you there?

finally i found an apllication that use version 2 of algo. after compeletion of my emulator when i work with bistro2.5, i see that function numbers are incorect. so i test the calls to driver and find version 2 in hlvdd. i wonder that hlvdd is packed with upx, i unpacked it manually ( is there an unpacker that uncpack upx packed dlls aotumaticlly?).

you don't answer to my last question, previously i read in another forum that for emulation of hl_code function , 8kB of hl_code blocks is needed (meteo), but as i see in hlvdd, a signature is return from driver that the caller can calculate encrypted datablocks by it, is it true?

toro.

Originally Posted by toro

finally i found an apllication that use version 2 of algo. after compeletion of my emulator when i work with bistro2.5, i see that function numbers are incorect. so i test the calls to driver and find version 2 in hlvdd.

Are you surprised that aladdin used latest API in own product? ;)

Originally Posted by toro

previously i read in another forum that for emulation of hl_code function , 8kB of hl_code blocks is needed (meteo), but as i see in hlvdd, a signature is return from driver that the caller can calculate encrypted datablocks by it, is it true?

This 8 byte hash valid only for current block. For another block it would be another. And about 8kb table... yes, HL can be universally emulated with such table. Private function known since 1992.

[toro]

hi nikita

thanks for your reply and forgive me for my questions.
i added version 2 of algo to my driver and it is completed. i deside to start a same project on hasp. can you compair hardlock and hasp from packet encryption point of view?

previously you say that there are 2 version of enc\dec algo for sentinel, are you know there are 3.

toro