FlexLM: Finding LM_SEED1-3 or ENCRYPTION_SEED3-4

[CrackZ]

Hiya,

"As a side note, do you think FlexLM will/can become unbreakable?"

Having spent a considerable time taking apart the Certicom code that Macrovision bought in and also a lot of very tedious time labelling up the 1000+ Security Builder functions inside IDA (you don't get much FLIRT out of the Certicom lib), it would seem to me there isn't much hope of recovering enough information to make a key generator.

"Additional question: Is it possible to get the encryptionseed1-2 from the encrypted strings in the license.dat files (providing that you have one)?"

I never tried this but I can probably answer it, the FLEXlm licenses i.e. default license key or SIGN=short key use one of 2 functions to do encryption and formation of the actual license key, in reality both functions create a license buffer of all the pertinent licensing data and then xor/encrypt over it in 8 byte chunks using the seeds.

With a valid license file one would be able to recreate the original licensing buffer used during the generation process, however I'm fairly unconvinced it would be practicle to mount an attack since you have potentially a 64-bit keyspace to search (2 * 32 bit seeds) and to verify any of the key candidates you have to perform the complete FLEXlm encryption to verify the result.

Regards

CrackZ.