flexlm and VENDOR_KEY5

[JMI]

Woodmann is already back online. See my Announcement in the Announcement Forum for the way to reach it until the DNS servers spin up with the new ISP.

Regards,

Now the thing i do not understand fully, is VENDOR_KEY5 generated out of
key1-4 and vendor? or how can i find that? thanks

yes, it is derived from key1-4. Its function is used to hide the encode seeds1-2 before version 7.0. But it is now (after version 7.0) useless. The new role is replaced by a dynamic derived number from vendor name, timer, salt,...etc. That dynamic number once before stored inside somewhere of the job structure. Now it moves into an extended area but still inside the job structure. To recover that encode seeds1-2, norland's tutor is still the best up to now. Go to Crackz site to search for it.

Keys1-4 and vendor name are used to derived an original plain key in which stores the keys expired date, supported functions enabled, supported hw-dongles types, and the keys1-4 integrity checksum.

crokeys1-2(trlkeys1-2) are only used for enabling TRL options and the integrity checksum of itself. It has nothing to do with the SIGNx generation.

[arlequim]

to get ES1 ES2 VK5 is really easy, you dont need any tools, just locate the l_sg() function where the seeds are uncovered

00417043  |. 8D8D 80FDFFFF  LEA ECX,DWORD PTR SS:[EBP-280]
00417049  |. 51             PUSH ECX                                 ; /Arg3
0041704A  |. 8B95 6CFDFFFF  MOV EDX,DWORD PTR SS:[EBP-294]           ; |
00417050  |. 81C2 0C030000  ADD EDX,30C                              ; |
00417056  |. 52             PUSH EDX                                 ; |Arg2
00417057  |. 8B85 6CFDFFFF  MOV EAX,DWORD PTR SS:[EBP-294]           ; |
0041705D  |. 50             PUSH EAX                                 ; |Arg1
0041705E  |. E8 27040100    CALL thinkflx.0042748A                   ;  <-- Call l_sg() \thinkflx.0042748A
00417063  |. 83C4 0C        ADD ESP,0C
00417066  |. 81BD 84FDFFFF >CMP DWORD PTR SS:[EBP-27C],87654321
00417070  |. 74 0C          JE SHORT thinkflx.0041707E
00417072  |. 81BD 88FDFFFF >CMP DWORD PTR SS:[EBP-278],12345678

after the call you can locate in [ebp-27c] and [ebp-278] ES1 and ES2, and inside the procedure the correct value of VK5