Reverse Engineering Team
Unregistered, You must accept the Forum Rules below to be able to use some forum functions.

Read forum rules below...

1. All posts must be written in English.
2. Don't spam/abuse any other member via E-mail or Private Messages.
3. Have phun!

For breaking above rules you may be warned/banned appropriately!

Protected software recognizes MultiKey and blocks it.

View previous topic View next topic Go down

Protected software recognizes MultiKey and blocks it.

Post by orx12 on Thu Oct 04, 2012 11:24 am

Dear Forum Fellows,
used by me protected software recognizes and blocks MultiKey. What's more, it is not possible to change registry path within MultiKey.sys in order to use different name like MultiKey. Does any of you have solution?

orx12

Posts : 6
Points : 8
Reputation : 0
Join date : 2012-10-04

Back to top Go down

Re: Protected software recognizes MultiKey and blocks it.

Post by hasp on Thu Oct 04, 2012 12:43 pm

yes possible try here to download password pm

hasp

Posts : 445
Points : 600
Reputation : 147
Join date : 2011-12-16

Back to top Go down

Re: Protected software recognizes MultiKey and blocks it.

Post by orx12 on Fri Oct 05, 2012 5:31 am

Thank you, HASP. Unfortunately, something strange happens - registry key working with MultiKey 18.0.3 is not working with Exetools 18.2.4 - I got message 1030: Envelope unknown Error (with drivers 5.50) and Error 7 with drivers 6.50.

orx12

Posts : 6
Points : 8
Reputation : 0
Join date : 2012-10-04

Back to top Go down

Re: Protected software recognizes MultiKey and blocks it.

Post by kjms on Fri Oct 05, 2012 7:00 am

are you edit like this ?
Code:
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Exetools\Dumps\12345678]
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Exetools\Dumps\12345678\DTable]
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Exetools\Dumps\12345678\ETable]

kjms

Posts : 187
Points : 241
Reputation : 45
Join date : 2010-09-12

Back to top Go down

Re: Protected software recognizes MultiKey and blocks it.

Post by orx12 on Fri Oct 05, 2012 7:10 am

Yes, I have done it. I have only two keys, no ETable section.

orx12

Posts : 6
Points : 8
Reputation : 0
Join date : 2012-10-04

Back to top Go down

Re: Protected software recognizes MultiKey and blocks it.

Post by kjms on Fri Oct 05, 2012 7:55 am

post the reg here. Suspect

kjms

Posts : 187
Points : 241
Reputation : 45
Join date : 2010-09-12

Back to top Go down

Re: Protected software recognizes MultiKey and blocks it.

Post by hasp on Fri Oct 05, 2012 11:55 am

multikey 17.0.0 and below reg table like below
Code:
"QTable"=hex:\
9F,35,37,2D,4A,31,82,F2,5D,71,45,AC,CF,BB,E9,85,\
C1,FD,0B,88,C9,A4,8B,B8,77,A1,F7,14,F8,9B,7C,85,\
79,F6,F1,4F,A9,12,7C,F9,9C,D9,75,68,F0,16,00,FF,\
F8,02,4A,36,A9,5C,2B,B1,8E,AA,C1,BF,59,20,52,01,\
F2,4B,34,3C,F8,CC,76,3C,9C,C7,E0,F5,23,99,55,5F,\
6A,A8,06,07,9A,9D,11,7F,FC,01,34,EE,6A,6B,3F,5E,\
79,B4,06,B6,76,DC,1B,81,3F,78,43,00,ED,55,FE,C0,\
8B,CE,4F,AC,2C,B8,9F,32,69,73,F8,95,31,68,BC,48....
"ATable"=hex:\
1B,4B,4F,99,8F,8C,BD,CE,60,1B,91,DB,F7,83,F7,7F,\
C9,BD,7C,81,A3,17,55,64,C9,80,AA,08,DC,6B,B4,D4,\
CB,44,D0,AF,71,B9,2B,DE,A5,46,EB,61,57,A0,08,3D,\
EE,F5,52,43,FC,05,97,79,D6,6D,53,12,70,21,08,DA,\
54,FC,B4,ED,EC,51,23,EF,F4,8F,EC,16,E4,8C,EB,DC,\
B4,13,7D,98,D4,BB,60,AB,07,43,A9,88,1F,C7,C4,1E,\
21,54,3E,FB,8B,B2,41,43,0B,D8,22,99,17,6C,15,43,\
71,0B,D8,E2,BD,70,E0,77,9A,E9,59,2C,94,B1,DD,11,\
10,81,16,73,38,07,DE,FA,64,95,80,16,40,18,76,E1,\
D7,75,7C,82,DE,2D,F1,82,B3,D5,52,EF,90,6F,E1,49....
multikey 18.0.1 and above reg table like below
Code:
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Exetools\Dumps\XXXXXXXX\DTable]
"10:031A79B7A643918C41CD29298C2796F4"=hex:A3,C1,70,E8,8B,D8,AA,04,9E,4E,8B,73,39,44,2D,76
"10:05942A493F3A22F7732C9053CB0FF882"=hex:EE,96,59,E7,61,D0,7C,67,CD,01,B2,EB,EF,B8,D1,0F
"10:101F7833A7E640F2D0E83DDA1B3FD051"=hex:D7,75,7C,82,DE,2D,F1,82,B3,D5,52,EF,90,6F,E1,49
"10:1C1A3304A396705448BA219557D17A48"=hex:D4,4B,77,A0,81,A4,04,AF,68,6E,AB,B5,98,A3,99,34
"10:2DC93262977CB2B89836D579E08B07F2"=hex:A7,FA,7E,3B,6A,E4,29,DB,89,52,08,BC,D5,66,0E,07
"10:342337E7B218D2A4AA6EB3402ABA91A5"=hex:0E,35,2B,36,F9,70,40,51,19,83,E4,96,88,A4,50,11
"20:0583A9B1A78474F8D4C3582726E53834F4C28C39AE617C34BDB2277E9F7CC3CA"=hex:B6,CF,C6,8E,63,A8,E8,72,EB,19,BA,2E,28,E2,5B,3E
"20:1883E103BF28DD790C4ABB970F3537640C329181E9633CC0B412AAB7E9BD0311"=hex:2D,AE,7A,54,2D,D8,79,D8,B0,8A,8B,CE,CF,0E,1D,8B
"20:1CBCEC465E9027ED4266D85D019B36C698A75DCA4D59CE1F7B8E66471F366A4A"=hex:48,4E,DF,0F,8D,F1,29,DC,BF,4A,12,28,0B,DB,DC,84
"20:22E70D8F2BFA71FE3BD6AFC4F1AD26E39465259811D2920F0BC06E8BA9392CEB"=hex:FD,EF,90,48,63,B3,48,A1,4A,A8,EF,BB,8F,18,D4,96
"20:2B752FF0071E21B495A513B70ED38021580935B44DA33AD45773DCAB95906692"=hex:A7,20,E6,BC,A6,57,FF,D6,CE,1E,A0,FC,2C,3C,35,25
"30:0583A9B1A78474F8D4C3582726E53834F4C28C39AE617C34BDB2277E9F7CC3CA"=hex:9F,5D,45,A3,0E,43,06,DA,44,24,10,DC,4B,20,DB,43
"30:1883E103BF28DD790C4ABB970F3537640C329181E9633CC0B412AAB7E9BD0311"=hex:C7,1B,A1,E8,6A,58,28,01,FF,FF,FF,FF,0A,00,00,00
"30:1CBCEC465E9027ED4266D85D019B36C698A75DCA4D59CE1F7B8E66471F366A4A"=hex:16,9A,E1,4A,42,64,56,63,BE,EB,FF,E8,5C,B1,CB,FF
"30:22E70D8F2BFA71FE3BD6AFC4F1AD26E39465259811D2920F0BC06E8BA9392CEB"=hex:34,87,AB,40,37,F3,C8,09,00,00,04,00,0C,50,73,51


Last edited by hasp on Tue Oct 09, 2012 9:52 am; edited 1 time in total

hasp

Posts : 445
Points : 600
Reputation : 147
Join date : 2011-12-16

Back to top Go down

Re: Protected software recognizes MultiKey and blocks it.

Post by orx12 on Fri Oct 05, 2012 3:01 pm

The hey is quite long (2,3 MB) but it looks following:
Code:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\MultiKey\Dumps\XXXXXXXX\DTable]
"10:8A2E3635A32CE7A304110065F264138F"=hex:a6,e4,cb,2e,7f,c1,39,33,eb,4d,78,0e,\
  3a,ea,43,75
"10:21E5F78B2D60FEA20EEA3E4DD24312AF"=hex:2a,83,6c,ed,9b,b6,a6,04,cd,2d,e0,48,\
  ca,0d,05,62
So it seems to be ver 18.1.1+ but is definitelly working with 18.0.3

orx12

Posts : 6
Points : 8
Reputation : 0
Join date : 2012-10-04

Back to top Go down

Re: Protected software recognizes MultiKey and blocks it.

Post by orx12 on Mon Oct 08, 2012 5:12 pm

Dear hasp,
would you mind answering my PM?

orx12

Posts : 6
Points : 8
Reputation : 0
Join date : 2012-10-04

Back to top Go down

Re: Protected software recognizes MultiKey and blocks it.

Post by hasp on Tue Oct 09, 2012 9:52 am

@orx12 you are right mkey support 18>DTable,ETable i edit my post

hasp

Posts : 445
Points : 600
Reputation : 147
Join date : 2011-12-16

Back to top Go down

Re: Protected software recognizes MultiKey and blocks it.

Post by orx12 on Tue Oct 09, 2012 6:43 pm

Thank you hasp, but neverless I have quite strange situation - I have a key working under MK 18.0.3 and not working under MK (or Exetools) 18.2.4. Can anybody help me? This key has only DTable entry, and there are only values beginning with 10:

orx12

Posts : 6
Points : 8
Reputation : 0
Join date : 2012-10-04

Back to top Go down

Re: Protected software recognizes MultiKey and blocks it.

Post by rytisr on Tue Jun 11, 2013 7:04 pm

hasp wrote:yes possible try here to download password pm

Hello, how can i download this?

rytisr

Posts : 1
Points : 1
Reputation : 0
Join date : 2013-06-04

Back to top Go down

Re: Protected software recognizes MultiKey and blocks it.

Post by Sponsored content


Sponsored content


Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum