Hi,

I have a target protected with Flexlm 7.2i + four Sentinel LPT Dongle (flexID6) and license file. I haven't dissassembly experience with IDA but I try to do that with CrackZ and Nolan Blender tutorials. But without any success.
I read about flexlm and try generate license with HOSTID=ANY. Orginal license is "permanent uncounted HOSTID=FLEXID=6-1234abcd"
I know all lic features, VendorID so I can generate Vendor Keys using keygen. But I need also encryption seeds to put everythiung into 'lm_code.h' from FlexSDK and generate license. I also try to find encryption seeds with Ollydbg and Haldir Flexlm 7.2 script but Ollydbg generated error and close. Several times I analyze above mentioned tutorials. Loaded program in IDA apply flexlm signatures and finally I can't find l_sg function. Maybe there are some easier way to find this seeds with orginal dongle and license file.

License has old style:
FEATURE feat vendor_daemon 1.0 permanent uncounted 123456789012 VENDOR_STRING=AABBCCDD HOSTID=FLEXID=6-abcd1234

there are no SIGN, CRO keys so no ECC patching is needed. I also try to emulate dongle using edge solver and Sentinel Emulator 2007. Unfortunately under this emu I can only load 1 dng file. I need to load all 4 .dng files and emulate in the same time.

I'm confiused. Are there any solution for this problem, any suggestion are welcome.

Thanks in advance for any help.

regards

Doctor2k

Hiya,

Quick potential solutions regarding seed recovery.

i). Do you have the vendor daemon?. It won't care about whether there is a FLEXID present in the license file so would be a good place to dig them out of without playing with dongle emulators etc, etc.

ii). I'm surprised the license file you are using with the application cares much about the FLEXID string either, however I'm not ruling it out completely as a possibility.

Your problem however might actually be that you just can't dig the seeds out *period*. The tutorials out there are pretty clear on how to do this, you might just need to go back over them.

Regards,

CrackZ.

As always CrackZ - is spot on -

With a target that old you are wasting your time worrying about the FLEXID Dongle, most from that era will accept either HOSTID=ANY or will accept the hard drive serial number, (I can't remember the exact syntax but that is easily researchable).

SiGiNT

Hi

This is simply license as example bellow:

FEATURE feat1 dmn 2003 01-jan-0000 uncounted 123456789012 VENDOR_STRING=vendor HOSTID=FLEXID=6-a6300001
FEATURE feat2 dmn 2003 01-jan-0000 uncounted 123456789013 VENDOR_STRING=vendor HOSTID=FLEXID=6-a6300002
FEATURE feat3 dmn 2003 01-jan-0000 uncounted 123456789014 VENDOR_STRING=vendor HOSTID=FLEXID=6-a6300003
FEATURE feat4 dmn 2003 01-jan-0000 uncounted 123456789015 VENDOR_STRING=vendor HOSTID=FLEXID=6-a6300004
FEATURE feat5 dmn 2003 01-jan-0000 uncounted 123456789016 VENDOR_STRING=vendor HOSTID=FLEXID=6-a6300001

only such a lines is inside. Total 16 lines. I think that should be possible to generate license locked to one flexID or to HOSTID=ANY. This is an old soft from 2001 or 2002 year. I try to do that with tutorial about "Imaris Bitplane v4.0.3" license is this same. But till now no luck. Maybe try to search for 3D4DA1D6h pattern?

sigint33

You are right. Because this is flexlm and old one 7.2. No patching is needed for application and should be working with other hostid. ANY is the best solution. I install FlexlmSDK 7.2 and after put values to 'lm_code.h' file I can generate license witch exactly the same syntax like orginal one. The only problem is with encryption seeds that I insert wrong.

regards

Doctor2k,

This is l_sg from v7.2i, taken straight out of lmgr.lib.



Searching for that 7648B98Eh constant in a hex editor ought to be easy enough to find you this code. Then you can use the existing tutorials to recover the seeds.

If you have any further difficulties privmsg me the vendor name (I've got about 600 vendors in my archives) and I'll see if I can help.

Regards,

CrackZ.

Doctor2k,

Seeds are 0x0000ab93 & 0x000045bc.

Nothing else to see here, its vanilla FLEXlm.

Close the thread ;-).

Regards,

CrackZ.