Log in

View Full Version : some questions about flexlm6.1 on Solaris


HappyWolf
March 23rd, 2001, 09:12
Inspired by thes articles on Zencrack2.cjb.net, I want to crack
Flexlm 6.1 on Solaris. But after two weeks' hard work, I gained
nothing but the two encrypted seeds and the five vendor keys.
My target is SUN C++ Workshop 5.0 whose license is administrated
by Flexlm 6.1. I haven't Flexlm 6.1 SDK on Solaris, but I have it
on Windows. I want to get the license for Sun Workshop 5.0 with
Flexlm SDK 6.1 on Windows. My step as following:

1) I found two files which located in /etc/opt/licenses and whose
names are "lmgrd.ste" and "sunwlicd" respectively. From the
license.dat, I think the sunwlicd is the vendor daemon and the lmgrd
is the the license daemon. I debuged the sunwlicd with adb debugger.
As a result, I can't find the lc_init and lc_checkout symbols which
were used to get the Vendor String, the two encrypted seeds and the
four vendor keys on Windows in the past. At last, I had to debug
lmgrd.ste with adb. I found the above two symbols. With the help of Pilgrim's
essay, I found the vendor string called "lmgrd". I were confused that
why the two symbols appear in the licenses daemon. What's more, I think
the vendor string should be "sunwlicd", but I found there wasn't "sunwlicd"
but "lmgrd" in the lc_init's argument list.

2) From Vyacheslav's essay, I tried to find the snippset as following

ld [%fp - 60], %o0
sethi %hi(0x9e000), %o1
or %o1, 0x244, %o1 ! vendorkeys
call
nop
st %o0, [%fp - 52]
ld [%fp - 48], %i2
ld [%i2 + 4], %i3
ld [%fp - 52], %i4
xor %i3, %i4, %i5
st %i5, [%fp - 40]
ld [%fp - 48], %o0
ld [%o0 + 8], %o1
ld [%fp - 52], %o2
xor %o1, %o2, %o3
st %o3, [%fp - 36]

But I failed. So I tried another way to get the two unencrypted seeds and key5.
Firstly according to Dan's essay, I think the calling sequence in lc_new_job() is
lc_new_job {
call lm_new.unpackage(vname,&vc) (unpackage vendorcode,vendor name)
call lm_new.unpackage(0,0)
call lc_init {
...
call l_sg (alt seed flag not set - return old style vc.d^vk5)
compare seeds to default 12345678 and 87654321
...
}
set alt seed flag
}
and the calling sequence in lc_checkout() is
lc_checkout {
...
good_lic_key {
...
l_sg {
alt seed flag set so,
lm_new.decrypt(job,name,vc) (decrypt and RANDOMIZE!!)
}
extract_date
l_ckout_crypt / -8 test
...
}
...
}
So I set breakpoints on lc_init(), l_sg(), lc_checkout() in lmgrd.ste file. I was very
suprised that the program couldn't stop at lc_checkout and exited directly after l_sg().
If the lc_checkout wasn't executed, where to identify whether the license is right or not?
Of course I hadn't got the two unencrypted seeds and key5 using Dan's methods. Could you
indicate where to find them? Thanks in advance.
3) At last, I used the flextool called lmrecode.exe and the two encrypted seeds and the four
vendor keys which I found in lc_init breakpoint to get the two uncrypted seeds and key5. Then
I modified the lm_code.h on windows and compiled to get the lmcrypt.exe. I used lmcrypt.exe and
the demo license to get license.dat. The result isn't right. I can't explain the case. Could you
give me some advice.

Regards,

Tony

nblender
March 23rd, 2001, 11:36
1) Make sure that the format of your license file is correct, otherwise it won't even try and check out a license.

2) sunwlicd is the right daemon, but it uses crypt filters.

kittykat
March 23rd, 2001, 19:36
Where could I get this Vyacheslav's essay ??
Would like to read it...

HappyWolf
March 23rd, 2001, 21:06
Quote:
kittykat (03-23-2001 16:36):
Where could I get this Vyacheslav's essay ??
Would like to read it...


This article was written in Russia. The website is
http://www.compulog.ru/mac/hackzone/03-98/index.html

At present I didn't understand where lc_init in the sunwlicd file.
Which articles could crack the crypt filter?

nblender
March 24th, 2001, 09:01
Well, I wrote an article on crypt filters for
Intel NT - they were published at tsehp.cjb.net.

Of course, things are very different on the SPARC
machines, but the whole thing can be sussed out with
a bit of time. The basic approach is still the same to crack this program.

roZes
March 25th, 2001, 08:55
If you find it difficult to generate flexlm license on solaris, there is a easier way to make it work, but then it is not reversing, it is patching.

There is a call in daemon(ONLY ONE CALL) which need to be returned 1, when the license data in the license file is valid. You need to find it and patch it to return it 1 always. I have tried this on solaris, linux and Intel platform.

Hint : search for flexlmd.


roZes

HappyWolf
March 25th, 2001, 20:46
Quote:
roZes (03-25-2001 05:55):
If you find it difficult to generate flexlm license on solaris, there is a easier way to make it work, but then it is not reversing, it is patching.

There is a call in daemon(ONLY ONE CALL) which need to be returned 1, when the license data in the license file is valid. You need to find it and patch it to return it 1 always. I have tried this on solaris, linux and Intel platform.

Hint : search for flexlmd.

roZes


As an example, I used your method to crack Sun Workhsop 5.0. I tried your method with adb debugger.
Firstly I want to find the "flexlmd" procedure in
sunwlicd which is the vendor daemon and I can't
get it in sunwlicd file. But I got ls_flexlmd symbol
and the instructs which I can't understand.
ls_flexlmd: unimp 0x0
ls_flexlmd+4: unimp 0x0
ls_flexlmd+8: unimp 0x0
ls_flexlmd+0xc: unimp 0x0
ls_flexlmd+0x10: unimp 0x0
ls_flexlmd+0x14: unimp 0x0
ls_flexlmd+0x18: unimp 0x0
ls_flexlmd+0x1c: unimp 0x0
ls_flexlmd+0x20: unimp 0x0
ls_flexlmd+0x24: unimp 0x0
timer_expired: unimp 0x0
ls_cpu_usage_delta: unimp 0x0
ls_cpu_usage_interval: unimp 0x0
ls_cpu_usage_last_logged: unimp 0x0
ls_cpu_usage_last_logged+4: unimp 0x0
ls_cpu_usage_last_logged+8: unimp 0x0

Then I search the "flexlmd" symbol in lmgrd.ste which is
the license daemon and I got it. But the instructs as
following which I can't understand.
flexlmd: ???
flexlmd+4: unimp 0x7c008
flexlmd+8: unimp 0x0
flexlmd+0xc: unimp 0x0
flexlmd+0x10: unimp 0x0
flexlmd+0x14: unimp 0x0
flexlmd+0x18: unimp 0x0
flexlmd+0x1c: unimp 0x0
flexlmd+0x20: unimp 0x0
flexlmd+0x24: unimp 0x0
flexlmd+0x28: unimp 0x0
flexlmd+0x2c: unimp 0x0
flexlmd+0x30: unimp 0x0
flexlmd+0x34: unimp 0x0
flexlmd+0x38: unimp 0x0
flexlmd+0x3c: unimp 0x0

Could you give me some advice to find the location
of the call in daemon(ONLY ONE CALL) which need to be returned 1.

Thanks in advance.

roZes
March 26th, 2001, 23:29
Use IDA to disassemble the target daemon, then search for string flexlmd..., rest will be clear.

roZes
March 28th, 2001, 09:01
u have to disassemble sunwlicd file

HappyWolf
March 28th, 2001, 19:44
Quote:
roZes (03-28-2001 06:01):
u have to disassemble sunwlicd file


I think your method is the easiest but the most effective. I
adopted your method cracking the Flexlm6.1. Firstly I didn't crack
the software on Windows which is licensed by Flexlm6.1. My purpose
is obvious. Through it, I could find the "flexlmd" string and have
found three location which reference the string. Three pieces of snippet
as following:
1) The first location
00421F78 loc_421F78: ; CODE XREF: sub_421B2E+3FEj
00421F78 add edi, 70h
00421F7B push offset aFlexlmd ; "flexlmd"
00421F80 push edi
00421F81 call _strcmp
00421F86 pop ecx
00421F87 test eax, eax
00421F89 pop ecx
00421F8A jnz short loc_421F93
00421F8C or dword ptr [ebx+18Ch], 8
00421F93
00421F93 loc_421F93: ; CODE XREF: sub_421B2E+C1j
00421F93 ; sub_421B2E+24Ej ...
00421F93 push ebx
00421F94 call nullsub_3
00421F99 mov eax, [ebp+var_4]
00421F9C pop ecx
00421F9D pop edi
00421F9E pop esi
00421F9F pop ebx
00421FA0 leave
00421FA1 retn
00421FA1 sub_421B2E endp

2)The second location
0042F98A push 0Fh
0042F98C push dword_461928
0042F992 call sub_40A999
0042F997 pop ecx
0042F998 cmp eax, 0FEEFh
0042F99D pop ecx
0042F99E jz short loc_42F9F7
0042F9A0 lea eax, [ebp+var_20]
0042F9A3 push offset aFlexlmd ; "flexlmd"
0042F9A8 push eax
0042F9A9 call _strcmp
0042F9AE pop ecx
0042F9AF test eax, eax
0042F9B1 pop ecx
0042F9B2 jz short loc_42F9F7
0042F9B4 push ebx
0042F9B5 push esi
0042F9B6 call sub_43E438
0042F9BB pop ecx
0042F9BC pop ecx
0042F9BD push offset aTheVendorKeysD ; "The vendor keys don't support vendor da"...
0042F9C2 call sub_43E55C
0042F9C7 pop ecx
0042F9C8 push ebx
0042F9C9 push esi
0042F9CA call sub_43E438
0042F9CF mov eax, dword_44E160
0042F9D4 pop ecx
0042F9D5 pop ecx
0042F9D6 push dword ptr [eax+18h]
0042F9D9 push dword ptr [eax+14h]
0042F9DC push dword ptr [eax+10h]
0042F9DF push dword ptr [eax+0Ch]
0042F9E2 push offset aVendorKeysAre0 ; "Vendor keys are:
0x%x
0x%x
0x%x
0x%x
"

3)The third location
00434CCB mov ebp, esp
00434CCD sub esp, 38h
00434CD0 mov eax, dword_45B088
00434CD5 push ebx
00434CD6 xor ebx, ebx
00434CD8 push esi
00434CD9 cmp eax, ebx
00434CDB push edi
00434CDC mov [ebp+var_C], ebx
00434CDF mov [ebp+var_4], offset unk_459878
00434CE6 jz short loc_434CF1
00434CE8 mov [ebp+var_10], offset aFlexlmd ; "flexlmd"
00434CEF jmp short loc_434D00
00434CF1 ;**********************************************************************************
00434CF1
00434CF1 loc_434CF1: ; CODE XREF: sub_434CCA+1Cj
00434CF1 mov ecx, dword_461928
00434CF7 add ecx, 9Ch
00434CFD mov [ebp+var_10], ecx
00434D00
00434D00 loc_434D00: ; CODE XREF: sub_434CCA+25j
00434D00 mov esi, [ebp+arg_4]
00434D03 cmp esi, ebx
00434D05 jnz short loc_434D0E
00434D07 xor eax, eax
00434D09 jmp loc_434E78


As your essey says, there is a call near "flexlmd" string which needs to be returned 1.
I think it may be the mode of "test eax,eax; jump somewhere",so I break at 00421F81 in
the first snippet and at 0042F9A9 in the second one with winice. The program stopped at
00421F81 but not at 0042F9A9. No matter the license file is right or wrong, the return
eax is always FFFFFFFF.
Could you give more detail information to find the location of returning 1. Thanks in
advance.

HappyWolf
March 29th, 2001, 18:54
Quote:
roZes (03-28-2001 06:01):
u have to disassemble sunwlicd file


Dear roZes,

Thank you very much.

Best regards,

Tony