Reverse Engineering Team
Unregistered, You must accept the Forum Rules below to be able to use some forum functions.

Read forum rules below...

1. All posts must be written in English.
2. Don't spam/abuse any other member via E-mail or Private Messages.
3. Have phun!

For breaking above rules you may be warned/banned appropriately!

Hardlock seed (without dongle & dump)

View previous topic View next topic Go down

Hardlock seed (without dongle & dump)

Post by mfav on Mon Dec 15, 2014 7:50 am

after searching & reading in this forum I found that it is possible to calculate hardlock seeds using ModAD & ref\ver pair, apparently a tool from Sapu ?!!! but I could not find it anywhere on the net, so can someone calculate this for me:

ref=F0,12,01,43,AA,94,11,90
ver=39,71,F0,10,DA,6E,3D,5B
ModAd = 6ED5 or 6ED6 (software looks for both)


also I was wondering if anybody could post that tool from SaPu for all benefit

thx

mfav

Posts : 3
Points : 5
Reputation : 0
Join date : 2013-08-02

Back to top Go down

Re: Hardlock seed (without dongle & dump)

Post by nodongle.biz on Mon Dec 15, 2014 1:36 pm

Seems something wrong in ref/ver.
From which Conval version you got it?

nodongle.biz

Posts : 308
Points : 359
Reputation : 26
Join date : 2013-05-16
Location : nodongle.biz

http://nodongle.biz

Back to top Go down

Re: Hardlock seed (without dongle & dump)

Post by mfav on Tue Dec 16, 2014 1:26 am

hi
it is version 9; I checked again; here is some code from IDA;

.text:03653FC4                 push    1
.text:03653FC6                 lea     edx, [ebx+3Ch]
.text:03653FC9                 mov     ecx, 6ED5h  <---ModAd
.text:03653FCE                 mov     eax, ebx
.text:03653FD0                 call    Cvhardlock::TCVHardlock::RUSLogin(System::UnicodeString &,int,int)
.text:03653FD5                 mov     esi, eax
.text:03653FD7                 xor     edx, edx
.text:03653FD9                 mov     eax, esi
.text:03653FDB                 call    Flicensemodule::TFormLicenseModule::DongleFound(int,bool)
.text:03653FE0                 test    al, al
.text:03653FE2                 jz      short loc_3653FEF
.text:03653FE4                 mov     word ptr [ebx+9Ah], 6EE0h
.text:03653FED                 jmp     short loc_3654018
.text:03653FEF ; ---------------------------------------------------------------------------
.text:03653FEF
.text:03653FEF loc_3653FEF:
.text:03653FEF                 push    1
.text:03653FF1                 lea     edx, [ebx+3Ch]
.text:03653FF4                 mov     ecx, 6ED6h  <---ModAd
.text:03653FF9                 mov     eax, ebx
.text:03653FFB                 call    Cvhardlock::TCVHardlock::RUSLogin(System::UnicodeString &,int,int)
.text:03654000                 mov     esi, eax
.text:03654002                 xor     edx, edx
.text:03654004                 mov     eax, esi
.text:03654006                 call    Flicensemodule::TFormLicenseModule::DongleFound(int,bool)
.text:0365400B                 test    al, al
.text:0365400D                 jz      short loc_3654018


and call to HLM_LOGIN:

.text:036557B4                 push    ebx             ; SearchStr
.text:036557B5                 push    0               ; RUSOption
.text:036557B7                 push    offset vKey
.text:036557BC                 push    offset VerKey
.text:036557C1                 push    offset RefKey
.text:036557C6                 mov     eax, [ebp+Access]
.text:036557C9                 push    eax
.text:036557CA                 mov     eax, [ebp+ModAd]
.text:036557CD                 push    eax
.text:036557CE                 call    HLM_LOGIN
.text:036557D3                 movzx   eax, ax
.text:036557D6                 mov     [ebp+var_18], eax
.text:036557D9                 cmp     [ebp+var_18], 7
.text:036557DD                 jnz     short loc_365582E
.text:036557DF                 cmp     [ebp+Access], 2
.text:036557E3                 jnz     short loc_365582E


and finally  parameter:

.data:037C28F8 vKey            db  41h,0C6h,0DCh, 23h, 27h, 0Ch,0EFh,0FBh
.data:037C28F8                 db 0A0h, 92h,0B3h, 27h, 5Fh,0ACh,0ACh,   4
.data:037C28F8                 db 0BDh, 94h,0DBh,0CFh, 50h, 43h,0B6h, 66h
.data:037C28F8                 db  19h, 47h, 33h, 9Bh, 70h,   6,0D4h,   1
.data:037C28F8                 db 0B6h, 1Eh, 86h, 40h, 75h,0ACh, 91h,0DDh
.data:037C28F8                 db  7Fh, 2Ch, 6Ch, 7Bh,0EAh,0AAh,0CFh, 90h
.data:037C2928 RefKey          db 0F0h, 12h, 1, 43h, 0AAh, 94h, 11h, 90h
.data:037C2930 VerKey          db 39h, 71h, 0F0h, 10h, 0DAh, 6Eh, 3Dh, 5Bh

mfav

Posts : 3
Points : 5
Reputation : 0
Join date : 2013-08-02

Back to top Go down

Re: Hardlock seed (without dongle & dump)

Post by kjms on Tue Dec 16, 2014 1:36 am

capture the log with toro hasp monitor.haspmon32

kjms

Posts : 186
Points : 239
Reputation : 45
Join date : 2010-09-12

Back to top Go down

Re: Hardlock seed (without dongle & dump)

Post by Sponsored content


Sponsored content


Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum