HASP Emulation Drivers – by CrackZ

 

What Are They?

 

The following HASP package contains a full set of replacement HASP drivers for 9x and NT systems.  The drivers provide faster emulation than having a conventional dongle connected and also support multiple applications.  Support for additional HASP’s can be easily added via the registry interface (documented at the end of this manual).

 

Additionally, with the logging interface, automatic emulators can be generated for any HASP (including HASP 4) that you own.

 

What’s Included

 

/

 

Hasp.inc – definitions for dump making.

Hasp95dl.vxd – default build of hasp95dl.vxd.

Haspnt.sys – default build of haspnt.sys.

 

/Logger

 

Logger.exe (logging application).

Logger.reg (registry key, add for logging support).

TestLog.reg (example registry key for test logging).

 

/Regs

 

*.reg – Double-click registry files for targets.

 

How To Use

 

It is imperative you follow these instructions very carefully else you may end up with a system that will not boot or blue screens of death, alternatively the drivers may just fail to work.

 

  1. Always remove the original HASP supplied drivers by scanning your HD for the target file ‘hinstall.exe’.  Use its ability to remove itself from the command line, the format is hinstall -r (r for remove).
  2. Install the HASP v4.81 drivers supplied in this package from the command line, the format is hinstall –i (i for install).
  3. Install the pertinent registration data in your registry by double clicking the target you would like the HASP driver to recognise; there shouldn’t be any penalty (performance wise) by installing them all.
  4. Replace the newly installed HASP driver (hasp95dl.vxd for 9x systems, and Haspnt.sys for NT/2K/XP) with those provided, usually these are found in the /system or /system32/drivers directories.  Reboot your system AFTER you have copied over the new file (this is VERY IMPORTANT).
  5. Run your target.

 

Information

 

Creating dumps for the HASP drivers is as simple as customising and exporting a registry key, below I outline the steps you need to take to create a script for a target program.

 

  1. Open one of the registry scripts included in the package in NotePad and right click / edit.
  2. The first task is to fill in the HASP passwords, currently shown as XXXXXXXX, the format is PWD1PWD2 (hexadecimal format), the HASP passwords can be recovered from your target by debugging or disassembling.
  3. Next edit the AppName field; changing it to the name of the application the dump belongs too.
  4. Now change the DriverVer dword to the version this dump supports, the correct version can be recovered either by debugging or by looking through the program binaries for opcodes "66 BA", this is usually the mov dx, DriverVer in the binary (it is not imperative you get this correct).
  5. The HaspData entry contains the contents of the dongles internal memory, in this case anything from 16-512 bytes, I recommend initialising the memory completely to 0xFF as this is the default for unmodified HASP's.  The task of working out what the dongle should contain is yours.
  6. The HASP ID field should be edited to give the desired HASP ID, something prominent like 12345678 is usually fine, some applications may check this so be careful.
  7. The MiscData dword controls various flags and settings on the emulated dongle.  A representation is given below.

 

AA                  BB                   CC                   DD

 

The AA flag can be set to one of 3 options.

 

00 : HASP 3, DecodeData & EncodeData services will call original handler (i.e. fail).

01 : Basic HASP 4 mode, DecodeData & EncodeData services send back 0xFF's (might be good enough to fake some services if you patch the application side checks on the response).

02 : HASP 4 emulation, see the 'Using the Logging Mode' section on creating the required file data.

 

The BB flag controls the HASP memory service behaviour and has 2 options.

00 : Disallow memory writing, the dongles memory will not be written to.

01 : Allow writing, the dongles memory will be written to and changes will be updated in the registry.

 

The CC flag controls the HASP memory size, see Hasp.inc for definitions.

The DD flag controls the HASP type, once again see Hasp.inc for definitions.

  1. Now the process is complete, add your script to the registry and all should hopefully work out fine ;-).

 

** IMPORTANT - If your dump is not found in the registry the driver will call the original HASP service.

 

Using the Logging Mode

 

* Please note, these values can only be modified if you have the source code (of course you could try and find them in my code too but …..) ;-).

 

Logging mode is designed primarily for the HASP 4 envelope, where the protected application can be run with the dongle connected and these drivers installed.  The HASP 4 envelope uses a combination of HaspCode(), HaspEncodeData() & HaspDecodeData() during the loading process, consumption of the log memory is shown below :

 

HaspCode() - 20 bytes.

HaspEncodeData() / HaspDecodeData() - between 20 & 36 bytes per query.

 

Note : |The first 0x40 (64) bytes of the log are for internal use.

 

Currently the drivers are configured using the following equates.

 

HASP_DUMPSIZE

HASPCODE_MAX

HASPCODE_START

HASPENCDEC_MAX

HASPENCDEC_START (shouldn't be modified)

 

HASP_DUMPSIZE

Defines the amount of memory allocated in total for the log, default 0x8000h (32k), in my tests this is probably appropriate for files up to 3Mb's in size.

 

HASPCODE_MAX

Defines the amount of memory allocated for HaspCode() responses, default 0x1C0 (460 bytes), i.e. 23 sets of HaspCode() responses.

 

HASPCODE_START

Defines the starting position in the log file of HaspCode() responses, default 0x40, you probably shouldn't change this.

 

HASPENCDEC_MAX

Defines the amount of memory allocated for HaspEncode/DecodeData responses, default 0x4000h (16k).

 

Logging mode creates the file Hasp4.dat in the /Windows directory.  This is used by the Logger.exe application.

 

1.  Add the registry key Logger.reg to your registry by double-clicking.  Launch Logger.exe and toggle logging mode to ON.  This simply changes a flag in the registry to let the driver know we will now be logging HASP calls (DO NOT CLOSE the logger yet).

 

2.  Launch your HASP application as per usual with the dongle connected; the driver will now log all calls to appropriate HASP services.  In the case of HASP 4, you may notice a slight delay as the driver writes out the decrypted data.

 

3.  It is strongly recommended that you then allow the application to run for 10-15 minutes (perhaps longer), and use as many of the features etc, to ensure any hidden HASP checks or additional checks are performed and logged.  If you are certain the application uses only the envelope as protection you may quit the target as soon as it starts running.

 

4.  Quit your application.  Press the 'Acquire' button and the listbox control should indicate whether or not the data logged can be used.  If it can proceed to step 5, if not you will need to increase the log buffer sizes and reboot.

 

5.  Fill in the application name details and select 'Save'.  Rename Hasp4.dat to PWD1PWD2.dat (where PWD1 and PWD2 = the hexadecimal representations of your HASP passwords, note and convert them from the logger dialog).  Leave the file in your /Windows directory.

 

6.  Quit the logger (logging mode off will automatically be toggled OFF), unplug your dongle and test your application once you have added an appropriate script to the registry (see creating scripts for more information).

 

Distribution

 

All of the files in the main directory should be distributed with any releases along with the relevant registry script for the application.  You should probably also distribute (or substitute) the hinstall.exe.

 

Target Specific Information

 

Enclosed here are some brief details regarding the dumps supplied with this package, this information is provided as is and for information only.  I don't guarantee its accuracy.

 

Accubid Progress Billing 5.0 (words control license count and version number)

Word 6 - Accubid Pro Windows

Word 7 - Quotation Analysis Windows

Word 8 - BWinner Windows

Word 9 - BWinner Plus Windows

Word A - Change Order Windows

Word B - Time & Material Windows

Word C - Progress Billing Windows

Word D - Job Merge Windows

Word E - PowerBid Windows

Word F - Change Order Pro Windows

Word 12 - dbPricer

 

Finally

 

HASP drivers Electronic End-User Software License Agreement

 

THIS PROGRAM IS PROTECTED BY COPYRIGHT LAW AND INTERNATIONAL TREATIES. BREAKING THE FOLLOWING AGREEMENT WILL RESULT IN SEVERE CIVIL AND CRIMINAL PENALTIES AND WILL BE PROSECUTED TO THE MAXIMUM EXTENT POSSIBLE UNDER LAW.

 

THIS AGREEMENT IS A LEGAL DOCUMENT. READ IT CAREFULLY BEFORE USING THE SOFTWARE. IT PROVIDES A LICENSE TO USE THE SOFTWARE. BY INSTALLING THESE DRIVERS AND USING THE SOFTWARE, YOU ARE CONFIRMING ACCEPTANCE OF THE SOFTWARE AND AGREEING TO BECOME BOUND BY THE TERMS OF THIS AGREEMENT. IF YOU DO NOT WISH TO DO SO, DO NOT INSTALL THE SOFTWARE.

 

1. Definitions

"Software" means the drivers supplied by CrackZ herewith.

 

2. License Restrictions

You MAY NOT use these drivers AT ALL.  Using them will be prosecuted to the maximum extent possible under law.  You also may not make or distribute copies of the Software, or electronically transfer the Software from one computer to another or over a network. You may not decompile, reverse engineer, disassemble, or otherwise reduce the Software to a human-perceivable form. You may not rent, lease or sublicense the Software.  You may not modify the Software or create derivative works based upon the Software.

 

3. Ownership

This license gives you NO rights to use the Software. Although you own the media on which the Software is recorded, you do not become the owner of, and CrackZ retains title to the Software. CrackZ reserves all rights including Federal and International Copyrights.

 

4. Limitations of Damages

I SHALL NOT BE LIABLE FOR ANY INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES, EVEN IF I HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND EVEN IF A REMEDY SET FORTH HEREIN IS FOUND TO HAVE FAILED OF ITS ESSENTIAL PURPOSE.

 

You may contact me at CrackZ__@hotmail.com for any other matters (bug reports especially welcome).