Hi,

it's me OHPen, man doesn't come along with HASP ;(

I have found a new target, after i have finished the last HASP-Project.

But this one is interesting as well...

You can take a look here:

ftp://63.249.181.10/pub/ARCRenderPro9/ArcRender.zip

This target does't use any HASP-DLL for its protection. Does it be possible that HASP is kinda "statically linked" into the target ?

After installing and starting it the first time you got a message "No protection device is conneted...."

After siceing a bit i found an interesting DLL called GwGenFrm.dll
which seems to be the one from which the HASP is called from.
Only this DLL is used to do the common HASP-Checks.

I found several Ex-Function of interest:

Exported fn(): ?IsHaspPluged@CGRenderFrame@@QAEHXZ - Ord:047Eh
Exported fn(): ?IsRealHaspPluged@CGRenderFrame@@QAEHXZ - Ord:0480h
Exported fn(): ?IsSameHaspConnected@CGRenderFrame@@QAEHXZ - Ord:0481hExported fn(): ?LimitHaspPermission@CGRenderFrame@@QAEHKKK@Z - Ord:0482h

etc...

?IsHaspPluged@CGRenderFrame@@QAEHXZ

this func is called on startup to check for hasp dongle pluged.

Exported fn(): ?IsHaspPluged@CGRenderFrame@@QAEHXZ - Ord:047Eh
:10017900 56 push esi
:10017901 8BF1 mov esi, ecx
* Reference To: GWGENFRM.?HaspInDemoMode@CGRenderFrame@@QAEHXZ
|
:10017903 E8880A0000 call 10018390
:10017908 85C0 test eax, eax
:1001790A 7407 je 10017913

* Possible Reference to String Resource ID=00001: "The application key numbers are Illegal.
Please try again or"
|
:1001790C B801000000 mov eax, 00000001
:10017911 5E pop esi
:10017912 C3 ret

After patch :1001790A 7407 je 10017913 the app believe a dongle is pluged.

Okay very well,
but after patching i have to enter some user information.

HASP S/N:

etc.

Maybe these is a very interesting implemention of hasp, maybe not.

Hope there is someone who can give me some advise.

Thx in advance.

OHPen_Learning HASP

Hiya,

Theres nothing special about ArcRender as an HASP implementation, its straight HASP API in GwGenFrm.dll, actually you'll find a new style HASP API in eusys.dll too, but you won't need to patch it unless you use its functions.

The insert serial number dialog won't appear if you get the contents of the dongles memory correct, as I remember its a few DWORDS read, maths including the serial number to check validity then a read of another word for the expiry. I know a LOT about this program since I remember reversing the dongles contents, this isn't for the faint hearted.

Regards

CrackZ.

Thx for your replay CrackZ,

you mean i should stop trying this target 'cause it's a very advanced one ?

Maybe you are right...

I will try another target,

OHPen

Hello OHPen,

As CrackZ mentioned, have a look the file GwGenFrm.dll, and check the contents of the dongle cells: 00, 01, 05, 06, 07, 08, 0B, and 0C. Cells 00, 01 form the Serial numbers, while the others are checked with some "math functions" (partly check the HASP ID).

Good Luck.

Scorpie