PDA

View Full Version : How to reverse license with 'VENDOR_STRING'?


previn
June 8th, 2011, 23:00
Does anyone can give some guideine on how to reverse license with format below?

VENDOR xxxxxx xxxxxxx
INCREMENT XXX daemon 1.0 11-Aug-2008 1 2A9EC78229D7B1526C96 \
VENDOR_STRING="6b206 10362 81034 bc3d4 ba016 61b26 7b46c afaf3 603fe 316" \
ISSUER=TEST NOTICE="Licensed for \
study [PLEASE DO NOT DELETE THIS XXX KEY]" SN=RK:0:0:0 \
START=1-jan-2008

The software use Crypt Filters, it can be reversed following Nolan Blender's essay. Now I got stuck by feature in the licsense example up. Seems this feature use 'vendor defined checkout filters', reference Amante4's essay of 'vendor defined checkout filters' and some friend's suggestion, I search 'push 2D' in 'lic_check' and set bp at 0040A0D3 want to check the content in EAX(it should contain the filter function address?), but 'lic_check' can't break at the set bp point.

.text:0040A0BB loc_40A0BB: ; CODE XREF: sub_409ED0+358j
.text:0040A0BB mov ebp, eax
.text:0040A0BD cmp ebp, edi
.text:0040A0BF jnz short loc_40A0ED
.text:0040A0C1 push dword ptr [esi]
.text:0040A0C3 call dword_5F31BC
.text:0040A0C9 mov eax, dword_5F31B8
.text:0040A0CE cmp eax, edi
.text:0040A0D0 pop ecx
.text:0040A0D1 jz short loc_40A0E0
.text:0040A0D3 push eax
.text:0040A0D4 push 2Dh
.text:0040A0D6 push dword ptr [esi]
.text:0040A0D8 call sub_523870

Anyone can give some suggestion?

lic_check(check the license is right or not): http://www.box.net/shared/jv1bpgpgua

daemon file: http://www.box.net/shared/4926zl7jd6

FoxB
June 9th, 2011, 08:20
.text:0040A0D3 push eax <- hold address of the Vendor-defined checkout filter
.text:0040A0D4 push 2Dh <- LM_A_CHECKOUTFILTER 45 /* Vendor-defined checkout filter */
.text:0040A0D6 push dword ptr [esi] <- job
.text:0040A0D8 call lm_set_attr

previn
June 9th, 2011, 09:18
FoxB,

>> .text:0040A0D3 push eax <- hold address of the Vendor-defined checkout filter

Can you break at this address? I can't break at here with ollydbg.

>> .text:0040A0D8 call lm_set_attr

Which tool you see function 'lm_set_attr'? I use IDA/ollydbg, neither can see this function name, but 'sub_523870', can you help?