Good day

I'm quite a beginner regarding FlexLM/FlexNet targets, so please forgive me if I missed the obvious. I'm working on a FlexNet target that comes with lmutil.exe, lmgr.lib and of course the binary including the license file check. In addition to that I have a valid license file.

With lmutil I found out that it uses FlexNet v11.1. I'm in posession of the FlexNet 11.4 sdk. Using IDA on the binary I was able to locate _lc_init and got the vendor name and vendor code struct data.

First question: Using a public tool to generate vendor keys I found out that the calculated vendor keys 1-4 totally differ from the data I got from the vendor code struct. Is that possible or did I just find crap?

I managed to find lc_checkout too, because immediately after failing the checkout, the app shows a messagebox, telling me so, so I just got there by ordinary string search. I created a dummy license file with just one valid feature and version. I know it uses the 12digit sign from the valid license file. Along with the feature name, the feature version and the hardcoded parameters the same vendorcode structure as found for lc_init are passed to lc_checkout.

What I wanted to do next is to recover the encryption seeds. From cracks tutorials I know that these are hidden and it's no longer seed1 = data[0] ^ vc5. I decided to follow the same steps as Dan did in Danflex ("http://www.woodmann.com/crackz/Tutorials/Danflex.htm"). So i placed a memory breakpoint on data[0] and after some copying it took me here:



A similar calculation is performed for data[1]. I was quite excited here and thought I had recovered the encryption seeds. So I edited lm_code.h and put my "recovered seeds", the vendor name and the vendor keys I got from the vendor key maker in there. As my target is using the 12digit sign as said before I put LM_STRENGTH_DEFAULT in there too. Then I recompiled the sdk which worked fine (after editing the vendor name in "makefile" too).

I then signed my dummy license file using lmcrypt.exe which produced a signed license file. But, as you might can imagine, it didn't work. :P

Rechecking lm_code.h I realized that it uses THREE different seeds:

#define LM_SEED1 0x...
#define LM_SEED2 0x...
#define LM_SEED3 0x...

I checked the impact of LM_SEED3 on the license file and it differs if I change the value of LM_SEEED3.

Now I am totally confused.

Do I have to recover three different seeds?

Is the code snippet above even related to seed recovery?

Do the different vendor keys have any impact on calculation of the correct SIGN value? (I think I read in some tutorial that it just depends on the encryption seeds and the vendor keys just have to be valid to be allowed to execute the tools like lmcrypt.exe)

Looking forward to your answers

Okay, I have now learned that recovered seeds have to be put into lmseeds.h as lmcrypt.exe would look there for the encryption seeds. If the cro feature is not used, only the first two (ENCRYPTION_SEED1, ENCRYPTION_SEED2) seeds are used. Usually this file is generated by the sdk from the LM_SEEDX values in lm_code.h, right?

Hi Rose,

I thought it's the other way round: Doesn't lmcyrpt.exe read the seeds out of lmseeds.h to sign the license files?

I do now know that the code snippet I pasted above does NOT reveal the real encryption seeds. The values I get for data[0] and data[1] that are rewritten to the Vendor struct differ with each run. I'm feeling that I am close but looking at the wrong side of the code

The values for data[0] and data[1] in the Vendor struct that gets pushed for lc_checkout are always the same. the values that are inserted into the struct by the code snippet above do always differ.

Update: Reading Dan's Essay again I realized that I hit the exactly correct location. The code snippet I pasted above is the xor code which basically does (quoted from Dan's essay):



Now Dan writes to reveal the real seeds simply make the "random" part 0 and grab the seeds at the end of the procedure. That's what I did and I think I got the correct seeds now. Still, I did not manage to create a valid license using lmcrypt

I'm still not sure where to put the values (lm_code.h or lmseeds.h) and what to recompile and when. In addition to that I totally rely on lmkg11.exe to produce correct vendor codes for my vendorname (which is correct 100%).

I did it

After doing another board search I found out that I have to put the defines for ENCRYPTION_SEED1-ENCRYPTION_SEED4 into lm_code.h (I now do know what you mean Rose ) Recompiling the sdk leads to a lmcrypt.exe that successfully generates correct license files for my target.

Thanks for reading my stuff, probably it's nothing new to you guys. For me I think it was helpful to write down what I found out so far. While posting here, things got a lot clearer to me.