Log in

View Full Version : Building a Sentinel Pro Clone


Nethacks
November 29th, 2006, 07:04
Does anybody habe a descrition of the Sentinel Pro Protocol, or build a Sentinel Pro Clone?? I will build one with a PIC Micro. I have a original one, that i will emulate with my clone, because in the original one is a battery. If the battery is empty, my dongle data will be lost.

fritzFS
November 29th, 2006, 13:20
Nethacks,

if the point of this thread is saving your dongle data, why not create a software clone (sentinel emulator)? I guess that's much easier to do instead of building hardware (if you don't have experience).

Nethacks
November 30th, 2006, 11:10
The Problem is, the Software works under !pure! Dos. Not in a DOS BOX or VM. The Company of the Software doesnt exist since 4 years.

fritzFS
November 30th, 2006, 11:19
I don't know anything about dongle architecture except that is has ROM, but I guess building the hardware is much harder than breaking the software

Still, I suggest reading the sentinel documentation (cracker perspective) and taking a look at sentinel SDK, etc ... in one word : research.

At least, that's what I would do. It's more documented road than building a hardware clone.

Any sentinel guru here? ;-)

SiGiNT
November 30th, 2006, 18:27
If you search a year or 2 back in this forum, you'll find a thread describing the construction of a self-learning dongle clone - it comes complete with schematic, if I recall, the only thing missing was some component data, not hard to figure out. Also, a couple of months ago I posted a link to company selling blank usb dongles, since you're in DOS that may not help, but perhaps they have a serial/parallel product as well.

SiGiNT

Nethacks
December 5th, 2006, 06:11
Are you sure, it was in this Forum?? I searched , but found nothing. Just Hardlock and HASP Clones :-(

korvak
December 19th, 2006, 11:19
nethacks,

i posted several times on my findings on the "Sentinal SUPER Pro" a while back in my search for how to "clone" this little bugger and what pins where doing what. this should be a starter for you, as you may have found out, there is almost no information on the NET about the "physical" aspects of the dongles. as this is not the "sentinal pro" but the "super pro" that i cloned, the pins may be different, what i found was that the dongle talks to the PC via the parrallel port in a serial protocol. so you really need to only worry about the 3-5 pins that are used for this serial communication. and in that serial protocol, it does NOT use the RS-232 voltage levels... purely 0-5vdc for low/high logic... i can help you on your journey, if that is truely what you are looking for and not just a "here-you-go-this-will-work" package.

once you fully understand what it is doing on the physical layer, the rest is pretty easy. you will start to see the cmds/responses and from there you will be able to design a simply circuit and MPU code to do whatever you need it to do...

hope this helps start you on your path to enlightenment.

Korvak

SiGiNT
December 19th, 2006, 15:28
Nethacks,

Just out of curiosity are you running the software in a DOS window or on a pure dos machine? If you are running it in a window then an emulator would work fine. As to your battery problem, if it's a black dongle with a spot for a coin battery on each side you can safely throw away the battery, I have one just like it and it's never had a battery in it, besides if it loses data when the battery is removed how would you replace it, (the battery)??

@Korvak,

As for the sentinel superpro class, where do I sign up? my soldering iron has been cold for too long.

SiGiNT

korvak
December 19th, 2006, 16:21
hey sigint, classes? hhhmmm... that would be fun, just have to find the time.

i did "clone" the super pro except the alogo (i took the very easy way out), i watched the interaction between the pc and the dongle with a logic analyzer and the created a lookup table, i just did not have the time or "intellect" to actually figure out the alogo... saving the brain cells for drinking...hehe...

i used a PIC microcontroller, crystal, bunch of diodes and a voltage regulator. Maxim-ic has a class of boost regulators to turn the 2.7-3.5vdc from the parrallel port to 4.5-5.0v and then i set the brownout /reset point of the MPU to 2.7v. works pretty good. and i have been running with this dongle for about a year now. sure i guess i could have attempted the software emulator... but sad to say i work MPU assembly, not i386 C/C++... so this was the fastest way i knew how to make my objective.

after watching several dongles for fun, i have found that the alogo is not used in a fashion that you would think... i found for the most part, the alogo function is called once or twice, the value is returned and compared in some routine and the prog is satisfied with its security check and then it never checks again, until the next time it is ran, and it also appears that the implamenters/programmers of the applications are more concerned about there application then securing thier application from hacking. they could make it so much harder to reverse there code by using the dongle alogo routines for jump pointers, or part of an MD5 hash to decrypt parts of the programs, etc, etc... this is also appearant with the tuts for program cracks that use dongles... for the most part..

also the only dongles that i seem to recall that have batteries are the timehasp that uses the battery for the internal clock, dont seem to remember the sentinel pro having a battery of any kind, i do not want to "question" nethacks on his "research" BUT are you sure it is a sentinel pro... the IBUTTON looks like a large watch battery and has a parrellal or serial port carrier that it can plug into... just a question...


korvak

Drigo
December 22nd, 2006, 06:39
@korvak I am also interest on the Sent Super Pro. Can you send me the schemtic and software, please ?

Nethacks
December 28th, 2006, 07:18
I have build a clone. The serial Communication based on a IC2 Protocol.
Simple.

@korvak Iam also interested in the Super Pro Clone.

What is the SP based? I2C , SPI, Microwire ?????

korvak
January 8th, 2007, 22:17
nethacks, the protocol consists of four lines.... GND, CLK, TX, RX...so, basic SPI and from what i have observers and later programmed to emulate, it is half duplex. so what you are looking at is a serial protocol on a parrallel port using 0-5v.

now the trick when watching the signals is to filter out the "noise". this is not a "neat and clean" communication session. there are "rules" but there is also a few "1"s and "0"s that mean nothing in the mix (that will have to be accounted for in your code) they just appear for what ever reason. it will take you a few sessions of watching the lines before you see the patterns, also there is a "reset" line, that i have not seen used on the devices i have watched. i will be going to a facility tomorrow to watch another super pro for a friend to see what is needed to help his cause. maybe i will get lucky and see the "reset" line being used. but so far, i assume it is only used when a printer is connected to the back of the dongle...

and drigo... here is the software, schmatics, name, my SSN, address, checking account numbers and credit card numbers... i sure would not want you to have to do any work on a RCE site...

nethacks, let me how you progess and i will be happy to help where i can.

i will post schematics later, they are fairly straight forward, code will have to be your own creation...

for the MPU, you can use just about any one you are comforable with. i chose Microchip, it had the bells and wistles that would work for this project, along with many others in the pipe... 20Mhz gives me 5 million instructions a second (200nS) which is way more than enough for this device, and alot of times i am having to place large "waits" in the code... i never went back and chaned the design... to much trouble for so little gain. you should look at the 18f87X series, 28pin SOIC... it is what the schematics are wired for... now where did i put those... i will also dig out my hacking notes on this and see what other things to look for....

korvak