Flexlm ECC alternate patching methods

[swlepus]

patch the pubkey data is another method.
and as far as i know, patch ECDSA data is the most powerful method. this can defeat any platform and any version FlexLM in second.

[oracle009]

@swlepus:how ro patch ecdsa?

[nikkapedd]

Originally Posted by oracle009

@swlepus:how ro patch ecdsa?

Search in the forum, "arlequim" has made a good patcher for vendors v10.5--11.9...
But in some cases doesn't work.. You need to find manually the flexlm ECC routine inside the vendor/exe/dll.....

[FoxB]

but gulson kill superprivate forum

[nathan]

Yep ... unfortunaltely people not able to keep privacy ;-)

[rcer]

Hi nathan,

could you please send me the link to the discussion as well.

rgds

rcer

[WRP]

2 glucose :

Simply convert base64 code to binary )
h**p://www.motobit.com/util/base64-decoder-encoder.asp

[nathan]

In the perspective of digging deeper into the pubkey patch approach I would like to share few very useful information for those that intend to spend time on it.

Find attached the Generic pubkey replacer made by Tanker (win + linux). I tested the Win version on a couple of targets (v11.10 and v11.9.1) and it identifies the pubkey correctly (I double checked in the vendorcode struct in memory), however, I didn't manage to produce a working license, yet (work in progress as I may be missing something crucial in the generation).

Also I would like to recommend the follwing discussion which is quite informative IMHO:
http://bbs.pediy.com/showthread.php?t=152615

What am missing: reverse the obsucation algorithm used to store the pubkey in the client binary (any help is appreciated: CrackZ may be have something to say about ) (note: not the one the scramble it in memory).

Anyone who would like to join the challenge is more than welcome of course. Feel free to test the Pubkey Replacer and feed back with success/unsuccess stories.

Enjoy !

nathan

Originally Posted by nathan

In the perspective of digging deeper into the pubkey patch approach I would like to share few very useful information for those that intend to spend time on it.

Find attached the Generic pubkey replacer made by Tanker (win + linux). I tested the Win version on a couple of targets (v11.10 and v11.9.1) and it identifies the pubkey correctly (I double checked in the vendorcode struct in memory), however, I didn't manage to produce a working license, yet (work in progress as I may be missing something crucial in the generation).

Also I would like to recommend the follwing discussion which is quite informative IMHO:
http://bbs.pediy.com/showthread.php?t=152615

What am missing: reverse the obsucation algorithm used to store the pubkey in the client binary (any help is appreciated: CrackZ may be have something to say about ) (note: not the one the scramble it in memory).

Anyone who would like to join the challenge is more than welcome of course. Feel free to test the Pubkey Replacer and feed back with success/unsuccess stories.

Enjoy !

nathan

i cann't download it..

[bridgeic]

Originally Posted by nathan

......
Find attached the Generic pubkey replacer made by Tanker (win + linux). I tested the Win version on a couple of targets (v11.10 and v11.9.1) and it identifies the pubkey correctly (I double checked in the vendorcode struct in memory), however, I didn't manage to produce a working license, yet (work in progress as I may be missing something crucial in the generation).
......
nathan

If use this patch, what we should do at FlexLM SDK side? Which files should be modified? lmprikey.h? or some other files together? How to modify?

[bridgeic]

Originally Posted by bridgeic

If use this patch, what we should do at FlexLM SDK side? Which files should be modified? lmprikey.h? or some other files together? How to modify?

For license with 239bit SIGN2, I see two groups of private keys as below after compiler SDK. Then whether this ecc patch still work? Or should add the 2nd corresponding pubkey into the patcher also?

static unsigned char lm_prikey[2][3][40] = {{{0x0, 0xb2, 0x45, 0x2c, 0xbc, 0x7e, 0x72, 0xc1, 0x3a, 0x39, 0x5e, 0x67, 0x25, 0xce, 0xd9},
{0x2, 0x1c, 0x8f, 0xa2, 0xe4, 0xb6, 0x4f, 0x7a, 0x2c, 0xd2, 0x6, 0x81, 0xb5, 0xd8, 0xf9, 0xf1, 0x81, 0x6, 0x4a, 0x8e, 0x17},
{0x3, 0xa0, 0x58, 0x89, 0xd2, 0x30, 0x22, 0xd8, 0xca, 0x5e, 0xac, 0x59, 0x33, 0xb3, 0x69, 0xdc, 0x30, 0x9b, 0xb6, 0x8d, 0x24, 0x56, 0x60, 0x23, 0xf0, 0x8c, 0x11, 0xb8, 0xc2, 0xba}}
,
{{0x0, 0x5b, 0xd9, 0xeb, 0xa1, 0xb8, 0x16, 0x1f, 0x95, 0xf5, 0x21, 0x5b, 0xf2, 0x2a, 0x68},
{0x1, 0x6f, 0x67, 0xae, 0x86, 0xe0, 0x58, 0x7e, 0x57, 0xd4, 0x85, 0x6f, 0xc8, 0xa9, 0xa1, 0x6e, 0x2b, 0x9, 0xd8, 0xed, 0xb2},
{0xb, 0x7b, 0x3d, 0x74, 0x37, 0x2, 0xc3, 0xf2, 0xbe, 0xa4, 0x2b, 0x7e, 0x45, 0x4d, 0xb, 0x71, 0x58, 0x4e, 0xc7, 0x6d, 0x95, 0xf, 0x34, 0x9c, 0x4, 0xa3, 0x67, 0x57, 0xa6, 0xd1}}
};

[bridgeic]

Originally Posted by bridgeic

If use this patch, what we should do at FlexLM SDK side? Which files should be modified? lmprikey.h? or some other files together? How to modify?

License pass check with <1> use the patch <2> compile SDK with setting s below.

#define LM_SEED1 0x11111111
#define LM_SEED2 0x22222222
#define LM_SEED3 0x33333333

Seems the private keys is related with the values LM_SEED1~3, but don't know the relationship, anyone can give some clue?

[nikkapedd]

nathan i tried the tool, but you need also to change the pub key in the crypter, otherwise the new license will be always useless...
Unfortunately the tool does not recognize the pubkey in the crypter.....
Now i see the version is v1.70...
Have you tried to patch the ecc inside the crypter...????
anyway thanks for the new version....

[nathan]

Originally Posted by nikkapedd

nathan i tried the tool, but you need also to change the pub key in the crypter, otherwise the new license will be always useless...
Unfortunately the tool does not recognize the pubkey in the crypter.....
Now i see the version is v1.70...
Have you tried to patch the ecc inside the crypter...????
anyway thanks for the new version....

Well, I'm not that junior in Flexlm ;-). I changed the pubkey in the crypter of course and to be honest I haven't tried to patch the crypter (with a different originating pubkey) but I'll try to do that next ... BTW: lmseeds1=0x1111111 lmseed2=22222222 lmseed3=33333333

[arlequim]

Why do you all still spend so much time trying to patch this silly Elliptic Curve ?!?!? The best alternate, fastest and working method is to patch the return compare of pubkey verify, isn't it? Here is the solution applied on some well-known flexlm library.

ORIGINAL CODE

.textidx:1015779B loc_1015779B: ; CODE XREF: sub_10157010+73Aj
.textidx:1015779B ; sub_10157010+76Aj
.textidx:1015779B lea ecx, [ebp+var_4]
.textidx:1015779E push ecx
.textidx:1015779F lea edx, [ebp+var_D8]
.textidx:101577A5 push edx
.textidx:101577A6 lea eax, [ebp+Dst]
.textidx:101577A9 push eax
.textidx:101577AA mov ecx, [ebp+Memory]
.textidx:101577B0 add ecx, 44h
.textidx:101577B3 push ecx
.textidx:101577B4 mov edx, [ebp+Memory]
.textidx:101577BA mov eax, [edx+4]
.textidx:101577BD push eax
.textidx:101577BE call sub_100B28B0
.textidx:101577C3 add esp, 14h
.textidx:101577C6 mov [ebp+var_20], eax
.textidx:101577C9 cmp [ebp+var_20], 0
.textidx:101577CD jz short loc_101577EB
.textidx:101577CF ; ---------------------------------------------------------------------------
.textidx:101577CF mov ecx, [ebp+var_20]
.textidx:101577D2 push ecx
.textidx:101577D3 push 2930h
.textidx:101577D8 mov edx, [ebp+arg_0]
.textidx:101577DB push edx
.textidx:101577DC call sub_10129060
.textidx:101577E1 add esp, 0Ch
.textidx:101577E4 mov eax, 0FFFFFF8Dh
.textidx:101577E9 jmp short loc_10157853
.textidx:101577EB ; ---------------------------------------------------------------------------
.textidx:101577EB
.textidx:101577EB loc_101577EB: ; CODE XREF: sub_10157010+7BDj
.textidx:101577EB cmp [ebp+var_4], 0
.textidx:101577EF jnz short loc_10157850

PATCHED CODE

.textidx:1015779B loc_1015779B: ; CODE XREF: sub_10157010+73Aj
.textidx:1015779B ; sub_10157010+76Aj
.textidx:1015779B lea ecx, [ebp+var_4]
.textidx:1015779E push ecx
.textidx:1015779F lea edx, [ebp+var_D8]
.textidx:101577A5 push edx
.textidx:101577A6 lea eax, [ebp+Dst]
.textidx:101577A9 push eax
.textidx:101577AA mov ecx, [ebp+Memory]
.textidx:101577B0 add ecx, 44h
.textidx:101577B3 push ecx
.textidx:101577B4 mov edx, [ebp+Memory]
.textidx:101577BA mov eax, [edx+4]
.textidx:101577BD push eax
.textidx:101577BE call sub_100B28B0
.textidx:101577C3 add esp, 14h
.textidx:101577C6 mov [ebp+var_20], eax
.textidx:101577C9 cmp [ebp+var_20], 0
.textidx:101577CD jmp short loc_101577EB
.textidx:101577CF ; ---------------------------------------------------------------------------
.textidx:101577CF mov ecx, [ebp+var_20]
.textidx:101577D2 push ecx
.textidx:101577D3 push 2930h
.textidx:101577D8 mov edx, [ebp+arg_0]
.textidx:101577DB push edx
.textidx:101577DC call sub_10129060
.textidx:101577E1 add esp, 0Ch
.textidx:101577E4 mov eax, 0FFFFFF8Dh
.textidx:101577E9 jmp short loc_10157853
.textidx:101577EB ; ---------------------------------------------------------------------------
.textidx:101577EB
.textidx:101577EB loc_101577EB: ; CODE XREF: sub_10157010+7BDj
.textidx:101577EB cmp [ebp+var_4], 0
.textidx:101577EF jmp short loc_10157850

After all, you can't achieve the impossible without attempting the absurd