HaspServicesSpy © 2002, .:hack3r2k:.


Description:

HaspServicesSpy is routine included in HaspDongle.dll shipped along with this
document, and its target is to spy services called by the main program with the
help of haspreg().

To use this function you have to add to the target exe/dll a new import (HaspDongle.HaspServicesSpy). You need also to add to the PE file a new
section (with attributes 60000020) that will contain a call to spy procedure
from the dll.

Ex: call dword ptr [HaspDongle!HaspServicesSpy]
ret

Attention !!!

HaspDongle!HaspServicesSpy represents a 32bit number that corresponds to the address of the import)

In the end you must locate haspreg() call and divert it to our new section that calls the spy routine.

If you followed the steps above after the execution of the hasp protected program a window will popup eachtime when the program tries to execute a hasp service (full support for all kind of hasps).

Report any bugs at : danielciocarlan@hotmail.com

Questions/Help : danielciocarlan@hotmail.com


Features:

- full dump for all regs used by hasp
- the ability to display the type of the dongle and the name of the service called
- all the information is displayed in a window
- the tracing of the calls is now made in minutes without the need of any debugger/disassembler
- can be also used by hasp newbies that often have problems with tracing/hasp type/..(LOL ! I had the same problems some time ago)
- minimum memory requirements
- small size/very fast (is written in 32bit assembly)

To be done:

- regs editing/saving ;will be a very useful feature


F.A.Q :

Q: .:hack3r2k:. how the fuck can I find that damn haspreg() call.
A : Easy ! Disassemble the program (IDA/W32DASM) locate the hasp mark (cmp bh, 32h) and under this look for something similar to push ebp/call 00XXXXXX/pop ebp, call XX000000 represent the call to hasp regs and u must divert it to our new section created in order to be able to call spy routine.

Q: What about all the modif to the PE ??!
A: Use LordPE – RoyalTS (try to get it from www.exetools.com or http://y0da.cjb.net)

Greets fly out to:

CrackZ (thanx for telling me hasp reversing secrets), HypnoticZ/TNT (thanx to you too), goatass (help with reversing)

Hey there hasp reversers !


Any opinions about program ??? (like : it sux, wow cool !, etc.)

You can also post here question and bugs.


AND YES !!! In the non-beta version i will include an installer ...


best regards,
.:hack3r2k:.

Just a suggestion, but in order to use the tool you have to add an import and add a section to your target. That will not work when you reverse applications. The less you mess with them the better. You need to create some kind of driver, application wide hook, or a loader that attaches to the process and monitors it's activity. A tool of this kind should be standalone and portable. Something like FrogsIce, you start it and it does it's job, you don't have to modify the target for it to work, it just does. Follow me?

good work tho....keep it up.

goatass

I don't want to use the word "it sucks" like you suggested yourself but maybe one rather near by.

My reasons for this is the following:

I see the program highly useless because you need to implement some code yourself to make it work. If people are able to do the needed work and able to find the haspreg() function themselves the last problem is just to set a breakpoint and follow which services are sent.

Like Goatass wrote it would be much better to make a generic solution. Another idea could be to do the job you want the user to make themselves. Simply add another section to the file, remap the imports and add your own and then do a search and replace patch and do the needed patching (after all if the user can find the "hasp mark" what stops you from making a generic program to do that).
For now I think the program is more a waste of time then useful since you need to do alot more stuff then just set a breakpoint and follow it in your debugger.

This is not intented to be a flame but rather critisisem which you can hopefully use to improve it.

Hey cyberheg !


I started an *install* program before the release but i didn't had time to finish it at time ...

I will be available in the non-beta version like regs editor too (i feature that will let u to modify regs content and save them).


other opinions now ??


best regards,
.:hack3r2k:.

ps: the program is intented to save time and help newbies and not only to gather the info quickly...

Thanks to your research & hardwork.
Patching target file looks very odd. Try to find method to make/modify device driver files.

Cah...