Log in

View Full Version : FlexLM --> variable job-structure at startup

Bra!NSHiT
October 27th, 2005, 08:53
Hi,

in my FlexLM 7.2a challenge now, i get all what i need, Vendor, vkey-struct but i failed on the job-struct.

On every licensecheck in l_sg i get an other job-struct.

For example :
Quote:

debug624:052CB510 db 66h ; f
debug624:052CB511 db 0
debug624:052CB512 db 0
debug624:052CB513 db 0

debug624:052CB514 db 4Ch ; L
debug624:052CB515 db 0
debug624:052CB516 db 0D0h ; ð
debug624:052CB517 db 0

debug624:052CB518 db 0E0h ; Ó
debug624:052CB519 db 59h ; Y
debug624:052CB51A db 0BCh ; +
debug624:052CB51B db 15h

debug624:052CB51C db 41h ; A
debug624:052CB51D db 0
debug624:052CB51E db 26h ; &
debug624:052CB51F db 0C9h ; +

debug624:052CB520 db 0BEh ; ¥
debug624:052CB521 db 56h ; V
debug624:052CB522 db 53h ; S
debug624:052CB523 db 2Ch ; ,


at the next time i get :

Quote:

debug624:052CB510 db 66h ; f
debug624:052CB511 db 0
debug624:052CB512 db 0
debug624:052CB513 db 0

debug624:052CB514 db 4Ch ; L
debug624:052CB515 db 0
debug624:052CB516 db 0D0h ; ð
debug624:052CB517 db 0

debug632:052CB4F8 db 1Dh
debug632:052CB4F9 db A4h ; ñ
debug632:052CB4FA db 41h ; A
debug632:052CB4FB db E8h ; Þ

debug632:052CB4FC db BCh ; +
debug632:052CB4FD db FDh ; ²
debug632:052CB4FE db DBh ; ¦
debug632:052CB4FF db 34h ; 4


debug632:052CB500 db 43h ; C
debug632:052CB501 db ABh ; ½
debug632:052CB502 db AEh ; «
debug632:052CB503 db D1h ; Ð


Could anybody please tell me why FlexLM generates new job-struct ? Its a extra-feature the autor set ? And if yes, how is the license file format built ?


Regards
nathan
October 27th, 2005, 10:11
For the seeds and vendorkey you should take a look to the vendorcode structure which id pushed onto the stack everytime you call _l_sg (and later when you call _l_user_sg

nathan
Bra!NSHiT
October 27th, 2005, 10:56
Hi,

well i got the following on my vendor-structure:
Quote:

.text:06135B33 mov eax, [ebp+arg_8]
.text:06135B36 push eax
.text:06135B37 mov ecx, [ebp+arg_4]
.text:06135B3A push ecx
.text:06135B3B mov edx, [ebp+arg_0]
.text:06135B3E push edx
.text:06135B3F call _l_sg


arg_8 = vkey-struct
arg_4 = daemon
arg_0 = job-struct

Wich id you mean exactly ?

:/

Edit: I found that the job structure is built of many time-calls.

Quote:

text:0612DCB0 cmp [ebp+arg_0], 0
.text:0612DCB4 jz loc_612DF48
.text:0612DCBA push 0
.text:0612DCBC call time
.text:0612DCC1 add esp, 4
.text:0612DCC4 xor eax, 400024h
nathan
October 28th, 2005, 01:37
For seeds and key you want to look at vkey-struc ... then it's very easy to figure out unencrypted seeds ... read Dan's essay on CracZ site.

nathan