how to emulate HASP HL dongle

[vaingum]

I use Bernina Embroidery software V.5 I have HASP dongle

I want to copy for use this software at home


Plz tell me how to copy it



PS: If my language is false I'm sorry I'm Thai I can read English a little T_T

[foffa]

search around forum you could find what you search for :)

[baad]

Check here (http://astalavista.box.sk/cgi-bin/robot?srch=hasp+&submit=+search+)

[justine]

you need
1.dump
2.sataron binary log
3.random pairs table or tables..depends
4.emulator

search the forum

gl

[vaingum]

I have .dmp file

I have binar log from hasploger (but don't have log from DataGather.exe It restart if I run hasploger = =")

I don't know what is random pairs table or tables..depends


And I don't know what I must do next :confused:

[justine]

You can have 5 tables at max depends on implementation.

Your protected exe or dll or whatever use this tables to make reandom query checks.

If you dont have all pairs in your "emulator table" you will be unable to run your software.

1.Use unidmp2reg to convert your dump file to reg

2.Write a tool that can sort your binary log from sataron's loger
or use some other tool available ...fejkus made such a tool...search the forum and you will find it

3.Extract all tables from your protected executable

4.Mix the pairs from step 2 and pairs extracted from your tables and compose final reg file

You can find all about reg structure and emulator here on forum


Read what toro and tyrus said here :

http://www.reteam.org/board/showthread.php?t=644

good luck
andariel

[justine]

as i can see you made emulator/crack for wilcom sp4 ..or just resell toro's emulator ......however if you know something about this specific software that vaingum trying to emulate go and write something usefull for him...

[vaingum]

@smithjsmi

I know you can crack it

I came here to meet someone help me free not to commercial

if I want to pay for crack I found it everywhere on internet


@justine

Thanks for your help I will read that thread

I'm never give up I must crack it finish ha ha


(But if someone help me it will be easy than I do it alone) ^ ^


Sorry If my language is false

maybe I must go to learn english again

[yogi_saw]

download to rapidshare & post links here may b somebody will help u

[vaingum]

@yogi_saw

upload setup file?? oh! file size about 600MB

I try to upload to mediafire last night but it can't to upload

(I add to .rar file with 40MB per one file) :mad:

[Trit0n]

Why do not you use Rapidshare?
http://rapidshare.com/
Maximum upload size 200 MB (Split archives allowed!)
Note: create under "Free Zone" your own Collector's Account
then the file can be downloaded more than 10 times :)

[vaingum]

็Thank you Trit0n

I will try rapidshare tonight

this time I use adsl 512kbps Is very slow :mad:

[SonofabiT]

I have binar log from hasploger (but don't have log from DataGather.exe
@vaingum - If the DataGather.exe is a public dongle loger, Could you please upload it ?

[vaingum]

@vaingum - If the DataGather.exe is a public dongle loger, Could you please upload it ?


That file is in install folder (BIN)

Do you have some idea to use it??


UPDATE & Need help

I can't get full log from Toro Aladdin Dongles Monitor or Hasplogger1.7


It's appear unknow error when I run that program


anybody can tell me why? or how I can get full log?



Thanks for help me :)

[SonofabiT]

I have been emulating my haspHL dongle using multikey 0.16.1.0. When i have been runing the .exe, I have got an Error 1031:Enveloped Unknown error.
Ok, i am extracting the master pair table. Short story the enveloped has been passed. The last error which i 've found :
The instruction at "0x69....." referenced memory at "0x69...". The memory could not be "read.

Questions :
I wonder if i could extract several pair(s) again, my haspHL dongle would emulated properly.
1. Could anyone please point me what should i do next for my above problem ?

I had managed so many Queries-Answers from two large binary file by hand. :mad:
2. Are there any public tools which will be convert a large bytes of binary file into Query-Table registry notations for the use of multikey emulator ?

btw, If i will use Xyrurg&Sataron's hasp Loger 1.71, i could not use "File-->Save dump" menu on the public Xyrurg&Sataron's hasp loger 1.71.
3.Has it been disabled defaultly ?

TIA
SonofabiT

[SonofabiT]

Hello guys
OK, i could extract the master pairs (Decrypt) Table on almost all .exe and these .exe didn't show a Window MessageBox "Error 1031:Envelope unknown error" anymore. :) The next messages which displayed when i have been runing each exe were that a message window "cannot be run in standalone". I think the "Error 1031" has been solved.

Next, i have been tried to run my s/w but i have got another error which tell me that one of .dll file cannot load. :(

Further, i 've found that there is another .exe which stll display "Error 1031:Envelope unknown error" at console/command prompt screen (Not a Window MessageBox). :(

Next, i am reversing this .exe to see if there is a .pair(s) table again which i should extract. Short story, i 've used olly and ready to extract the following block :
00377D6E .. .. .. ..|.. .. .. ..|.. .. .. ..|.. .. .. ..|
00377D7E .. .. .. ..|12 34 56 78|9A BC DE F1|F2 F3 F4 F5| ; Start at 00377D83
........ .. .. .. ..|.. .. .. ..|.. .. .. ..|.. .. .. ..|
0037838E 66 77 88 99|AA BB CC DD|EE FF 55 44|33 22 11 FF|
0037839E 69 00 00 00|00 00 00 00|00 00 00 00|00 00 00 00| ; From 0037839F - 0037899A, all byte are 0x00
003783AE 00 00 00 00|00 00 00 00|00 00 00 00|00 00 00 00|
........ .. .. .. ..|.. .. .. ..|.. .. .. ..|.. .. .. ..|
0037897E 00 00 00 00|00 00 00 00|00 00 00 00|00 00 00 00|
0037898E 00 00 00 00|00 00 00 00|00 00 00 00| | ; Start at 0037899B, there are not next bytes
The problem is i can not get 4096 bytes from this step. :confused:

Any hints please ?

[Git]

Maybe you are looking at the wrong instance of GetTickCount ?. You can try searching the exe/dll for the value of Query shown in the logger, but be very careful of endianism.

Git

[SonofabiT]

WHAT A STUPID I AM !!!! Sory guys .. the above hex were not form the right section. :D Now i 've found the first 16 byte of somethings which Toro's logs given to me. ;) I think i am in the right place and will be back here again if there are another problem.

[zphdt]

thanks ur make a reg file .when i install the MultiKey eum,then the program show a message :Error 1031:Enveloped Unknown error
using hasp hl 3.21
can u give me a help?please
the links is the program & dump &logs files
http://www.4shared-china.com/file/146639958/b4881e2c/dingli_pioneer.html

thanks ..
zphdt

[Git]

Please don't quote such large sections of the original message. It is entirely unnecessary as we can all see the original right in front of us.

[jabrix]

I just dump HASL HL dongle with tyrus dumper.
But when I try to make reg file, show some errorr.

http://img697.imageshack.us/img697/1474/memsize.png
http://img510.imageshack.us/img510/7358/0x87.png
http://img690.imageshack.us/img690/5449/errormb.png

how do I do then

http://rapidshare.com/files/304372598/jabrix3.rar

[gus]

use h5dmp 0x4BE2 0x596F
use toro logger or hasplogger
save log
use multikey 18.1 + LogsToTables

create .reg + Q/A pairs

install multikey 18.1 with reg file

and try.

[KeyMaker]

hi
I can build emulator if u send me dump file of your hasp hl

[mctheRE]

Will haslogger work with win7 64?

[benito]

no it cant work in 64bit os

[SonofabiT]

@all - I am trying to emulate the following s/w :
the links is the program & dump &logs files
http://www.4shared-china.com/file/146639958/b4881e2c/dingli_pioneer.html
I don't know about this s/w and i just want to get more experience in the haspHL emulating. I have used haspHL driver ver 5.22 to get log and extract the master pair table. I have been liberated from "Error 1031:Enveloped Unknown error." Unfortunately, i have got the following message :confused: :
Unable to access HASPSRM Run-time Environment (H033)
I wonder that the error came from a dll file called hardwareID.dll. Any prespective to fix my reg please ?

[jabrix]

Here my dump files with vusbus emul

http://rapidshare.com/files/305764107/VUSB_EMULATOR.rar

none of my reg working.
"HASP Envelope error"
or even "HASP HL not found"

[Trit0n]

That can not work!
Wrong Emu (HLmod), use (HLmod +)
But why you don't use Multikey 18.1 as Gus you recommend?
this is certainly a simpler solution:)

[jabrix]

I did use multikey, program still error.

REGEDIT4
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Multik ey\Dumps\4BE2596F]
"Name"="cute"
"Copyright"="jabrix learn HASP HL"
"Created"="11/11/2009 11:48:17"
"SN"=dword:72D942DA
"DongleType"=dword:00000001
"Type"=dword:000000EA
"Memory"=dword:00000001
"SecTable"=hex:1C,0F,33,23,DC,CF,F3,E3
"NetMemory"=hex:00,00,00,00,00,00,00,00,00,00,FF,FF
"Option"=hex:00,01,02,4A,1F,01,0B,0A,09,01,04,30,22,00
"Data"=hex:\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,\
00,00,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,\
FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,\
FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,\
57,42,50,54,02,00,00,00,10,00,00,00,00,00,D8,BE,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
"ColumnMask"=dword:000000FB
"CryptInitVect"=dword:00000013

REGEDIT4
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Multik ey\Dumps\4BE2596F]
"Name"="cute"
"Copyright"="jabrix learn HASP HL"
"Created"="11/11/2009 11:48:17"
"SN"=dword:72D942DA
"DongleType"=dword:00000001
"Type"=dword:000000EA
"Memory"=dword:00000001
"SecTable"=hex:1C,0F,33,23,DC,CF,F3,E3
"NetMemory"=hex:00,00,00,00,00,00,00,00,00,00,FF,FF
"Option"=hex:00,01,02,4A,1F,01,0B,0A,09,01,04,30,22,00
"Data"=hex:\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,\
00,00,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,\
FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,\
FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,\
57,42,50,54,02,00,00,00,10,00,00,00,00,00,D8,BE,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
"ColumnMask"=dword:000000FB
"CryptInitVect"=dword:00000013

[besoeso]

@JABRIX

¿are you sure protection is hasp hl?

Check again i think can to be hardlock.

[jabrix]

HASP HL.

Will upload installer soon after get better signal HASDPA.

[Trit0n]

Read exactly what Gus has told you
Study the examples (Hasp-HL-112 and Hasp-HL-496)

[besoeso]

You must use hasplogger monitor. You save the log file and upload it.

[SonofabiT]

Read exactly what Gus has told you
Study the examples (Hasp-HL-112 and Hasp-HL-496)
What if we read, read, read,.... and read but the problem still can not be solved ? :)
May be someone will give an answer "Reverse your s/w"... But the meaning of "Reverse your s/w" could be many method.

Could anyone give me little bit specific hints please ?
"HASP Envelope error"
Download a tool called bin2Dtable.exe by Git and then ask to yourself ... why the bin2Dtable have been released. ;) . Find the answer on the whole thread relate to haspHL emulating. Later you will familiar with this kind of error and overcome it by your self. ;)

Notes, Eventhough you can overcome all the enveloped error, there are not guarantee that your s/w will work properly. :)

[jabrix]

here the log.... Toro & logger

very appreciate for your help & knowledge to tech me.

[SonofabiT]

@ All - I saw an AesKey entrie ( containt 16 bytes data ) in the Hasp documentation of multikey 0.18.2.0 manual.
"AesKey"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00, 00
1. Where are these 16 bytes AesKey come from ? :confused:
2. What is the reason that we should add this entrie in our haspHL reg ? :confused:
3. Has anyone experience about solving the problem in this post ?
http://reteam.org/board/showpost.php?p=17199&postcount=26

[Git]

AesKey entry has been there for quite some time. If you happen to know the AES encryption key for your dongle you can use it there rather than table based emulation. If you don't know it, forget about it.

Git

[SonofabiT]

In the case of Enveloped HaspHL (5 Master Pairs at Maximum).
Do you mean that the AesKey-entrie in the hasp-reg able to REDUCE the LARGE size of hasp -reg because we need not write the Q/A Tables ?

btw, What about my question number 3. :D

[benito]

Yes, it will "reduce", because you will not need any table :p
Little problem is that bruteforcing the aes key will take ages...

[Git]

Nah, I reckon with a big enough PC farm you could be done in a few millenia.

sob - if you call zero entries reduced, then yes. If you have the AES key then you don't need a table. The table just emulates a few possible Q/A pairs. The key gives you all of them.

What about your question 3?. The answer is almost certainly yes.

Git

[benito]

Btw Git i still hear somewhere that NSA have know-how of cracking the aes in short time (even 256bit). Do you think it is possible or just bullshit? :)

[CyberGhost]

AES-256 is currently weaker than AES-128:

http://www.schneier.com/blog/archives/2009/07/new_attack_on_a.html

AFAIK multikey does not handle AES hasp emulation properly. Try with DEMOMA keys recently published by Tyrus and compare emulator's results with those of the real hasp hl/sl.

AES probably will not be broken while we exist :)

[ngoksun]

To solve AES key by brute force method almost impossible yet, but to get HASPHL AES key can from other way such as extract it by hidden command or from hardware such as 24C16W or SC51X5XXJDWE is possible.

[CyberGhost]

[please don't quote all of the original, we are staring right at it so it is POINTLESS]

I hate explanations by people who have never done it! Especially from china maina.

[SonofabiT]

AES-256 is currently weaker than AES-128:

http://www.schneier.com/blog/archives/2009/07/new_attack_on_a.html
@ CyberGhost - Thank's for your useful info. :)
I can not download the following pdf-doc :
https://cryptolux.uni.lu/mediawiki/uploads/1/1a/Aes-192-256.pdf

Could you please upload it at another place please ?

@ ngoksun
1. Should we connect our haspHL dongle to extract the AES key form hidden command and from hardware ?
2. could you hint us about extracting from hidden command and from hardware such as 24C16W or SC51X5XXJDWE.

At least point me what is the basic learning/understanding for newbies like me in order to succesfully do that.

Sorry for my all stupid questions. :D

[ngoksun]

Sorry, I'm come from China and sure never done anything but don't want to lead to somebody "hate". This's my last post in this forum and please ban me forever. Thanks.

[Git]

ngoksun - I have seen plenty done by you but I have never seen or heard of anything done by CyberGhost. Please stay - don't let harsh words from one part time member influence you.

Git

[mum_96]

"AesKey"hex:??,??,??,??,??,??,??,??,??,??,??,??,??,??,??,? ? < AesKey I don't Know>
3700C9925B24EDB67F4811DAA36C35FE <--- Question from Software
A2b05a683c507c5644b38e051cc6c31a <--- This asnwer is by Original Dongle

If I use the blanck AesKey put at my emulator then....
"AesKey"hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0 0
3700C9925B24EDB67F4811DAA36C35FE <--- Question from Software
2F77355DD851799B2D9A7DA724297071 <--- This asnwer is appeard

If I use the AesKey this type at my emulator then....
"AesKey"hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,0 1
3700C9925B24EDB67F4811DAA36C35FE <--- Question from Software
4FBD971AC8443F2D1DF21177A3E8BCC6 <--- This asnwer is appeard

Question is this for Get or any senior of this board help me what key I put in Aeskey then answer is this type is done.
"AesKey"hex:??,??,??,??,??,??,??,??,??,??,??,??,??,??,??,? ?
3700C9925B24EDB67F4811DAA36C35FE <--- Question from Software
A2b05a683c507c5644b38e051cc6c31a <--- This asnwer is by Original Dongle

[benito]

If you dont know the key leave it empty. Bruteforcing AES key would take ages ;)

[CyberGhost]

http://www.schneier.com/blog/archives/2009/07/another_new_aes.html

http://eprint.iacr.org/2009/374.pdf

[jerga]

hi my firend,

i have this program: "SEE ELECTRICAL EXPERT V3R7 FR" that use hl dongle but i dont have any dongle and want to use it. how can i crack it my friends? please help help. :confused:

look i saw this post in some forum: "SEE Electrical Expert is protected by HASP, but the protection algorithm is very simple. the last version i used (cracked by me) was 2005 SP4E (only one file must be replaced - C:\Program Files\See Electrical Expert 2005\see_soft\Exe\SeeStencil.dll). I don't know is it works with never versions of SEE.
I uploaded patched version of SeeStencil.dll on rapidshare:

http://rapidshare.com/files/94278174/SeeStencil.dll.html

please help : jerrygajer@yahoo.fr

You can have 5 tables at max depends on implementation.

Your protected exe or dll or whatever use this tables to make reandom query checks.

If you dont have all pairs in your "emulator table" you will be unable to run your software.

1.Use unidmp2reg to convert your dump file to reg

2.Write a tool that can sort your binary log from sataron's loger
or use some other tool available ...fejkus made such a tool...search the forum and you will find it

3.Extract all tables from your protected executable

4.Mix the pairs from step 2 and pairs extracted from your tables and compose final reg file

You can find all about reg structure and emulator here on forum


Read what toro and tyrus said here :

http://www.reteam.org/board/showthread.php?t=644

good luck
andariel

[kenji_tokawa]

hi,

i have already my dump file(size 5kb) and i used unidump2reg to create registry, but when i open my dump file and when i select the option to choose it gives me error..

and can you give step-by-step instruction how to do exatcly to emulate my hasp dongle..

i used edgehasp and it work temporarily, but when i restart my computer and when i open the protected software it will ask for harware key..thats why i need instruction to do exactly to emulate and create virtual usb.

[yogi_saw]

@kenji_tokawa
instruction 2 emulate hasphl has already given in first page seperate thread has been made by y8y8y8y8 step by step hint: search thread created by y8y8y8y8 it will help u
u need put hasphl2007 in automatic mode it will load the emulator after reboot or manually load dng after each reboot to run the emulator