HARDLOCK emulator

Originally Posted by toro

seems that encryption of other blocks is performed in programs itself by use of that signiture, is it true?

Only 8 bytes transformed with dongle. On each step internal results stored in result block for ring3. It's used to crypt rest part of data.

Originally Posted by toro

however i found some of function numbers, but not all of them. can you help me.

Just call function you need and look +0x18 field at the driver.

[toro]

hi nikita

Only 8 bytes transformed with dongle. On each step internal results stored in result block for ring3. It's used to crypt rest part of data.

you are right. my question: is it possible to make other hl_code result with this internal result? in another word is this internal result the hardlock signature?

Just call function you need and look +0x18 field at the driver.

again you are right but some function such as hl_meminf call more than one function. for example hl_meminf's function number are 0x17,0x14,0x15. is it true? i want the meaning of this functions if possible.

tanks.
toro

[toro]

hi nikita

are you there?

finally i found an apllication that use version 2 of algo. after compeletion of my emulator when i work with bistro2.5, i see that function numbers are incorect. so i test the calls to driver and find version 2 in hlvdd. i wonder that hlvdd is packed with upx, i unpacked it manually ( is there an unpacker that uncpack upx packed dlls aotumaticlly?).

you don't answer to my last question, previously i read in another forum that for emulation of hl_code function , 8kB of hl_code blocks is needed (meteo), but as i see in hlvdd, a signature is return from driver that the caller can calculate encrypted datablocks by it, is it true?

toro.

Originally Posted by toro

finally i found an apllication that use version 2 of algo. after compeletion of my emulator when i work with bistro2.5, i see that function numbers are incorect. so i test the calls to driver and find version 2 in hlvdd.

Are you surprised that aladdin used latest API in own product? ;)

Originally Posted by toro

previously i read in another forum that for emulation of hl_code function , 8kB of hl_code blocks is needed (meteo), but as i see in hlvdd, a signature is return from driver that the caller can calculate encrypted datablocks by it, is it true?

This 8 byte hash valid only for current block. For another block it would be another. And about 8kb table... yes, HL can be universally emulated with such table. Private function known since 1992.

[toro]

hi nikita

thanks for your reply and forgive me for my questions.
i added version 2 of algo to my driver and it is completed. i deside to start a same project on hasp. can you compair hardlock and hasp from packet encryption point of view?

previously you say that there are 2 version of enc\dec algo for sentinel, are you know there are 3.

toro

Originally Posted by toro

i deside to start a same project on hasp. can you compair hardlock and hasp from packet encryption point of view?

Actually the same, but for some model specific fileds used other routines. In fact it's "union"

Originally Posted by toro

previously you say that there are 2 version of enc\dec algo for sentinel, are you know there are 3.

Hm... May be it's very-very old or the newest one (for example from UltraPro key)... so it would be interesing to see.

[toro]

hi nikita

for sentinel enc\dec version detection, i use (packet+0x4). i saw that in superpro 6.3 this memory address contain 0x7. in last versions i saw 0x6. so i decide to use this memory address for detection of version, am i true?

however in a target that this memory address contain 6, i saw 2 different algo, both of them is in shell.

toro.