首页
社区
课程
招聘
翻译一下 Whats in a SIGN
发表于: 2005-2-17 09:57 7346

翻译一下 Whats in a SIGN

2005-2-17 09:57
7346
Whats in a SIGN?

The tutorial above describes a mechanism by which we can patch the FLEXlm licensing layer to use the license key checkout (this is the oldest and simplest of the FLEXlm validation methods and was chosen purely for simplicity). The basic SIGN attribute was added by Globetrotter at around v7.x (it has only 12 chars) and offers merely an improved algorithm (perhaps more resistance to brute forcing) and better seed hiding, these are about the only 'enhancements' if one wishes to call them that.

These days a lot of customers have switched to using the CRO or TRO (counterfeit/tamper resistant options), really the same thing under a new name. This offers customers the ability to generate the newest style ECC SIGN licenses with strings starting at 58 chars, as far as I know and can verify there have been no successful attacks against ECC FLEXlm which enables either complete recovery of the private key or the LM_SEED's (I do not rule out however that there is enough processing power somewhere to recover them).

The new SIGN length has resulted in most crackers choosing to patch _lm_pubkey_verify() and generating a SIGN= license using their own LM_SEED's. There is however an alternative approach which involves forcing the licensing layer to do the old style SIGN=12 chars checkout and it simply involves patching only the 2nd bad flag we found inside _l_n36_buf() (see above). We can then recover the encryption seeds as before and generate a license using either the SDK or Lmcryptgui available on this site. The patch works by simply telling the licensing layer not to get the address of _lm_pubkey_verify() which is checked shortly after _l_sg().

Another important thing to note, its easy to verify if your target will allow the old style SIGN= checkout, after _l_sg() set a breakpoint on the mangled seeds in the vendor code structure, if it hits the seeds are being recovered and you can generate the old style standard SIGN, if not, you'll need a patch; after a patch a breakpoint on the mangled seeds should hit, just prior to them being recovered.

[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课

收藏
免费 0
支持
分享
最新回复 (6)
雪    币: 339
活跃值: (1510)
能力值: ( LV13,RANK:970 )
在线值:
发帖
回帖
粉丝
2
好像没写明白 SIGN 里有啥。就是SIGN 太长,现在人家不的不打补丁干他
2005-2-17 11:00
0
雪    币: 1310
活跃值: (727)
能力值: ( LV6,RANK:90 )
在线值:
发帖
回帖
粉丝
3
9.x之前的flexlm的sign其实不用搞什么种子,在程序中都有明文密码对照(不同版本的明文对照不同),很容易搞定sign。
最近跟了下,9.x,发现也有明文对照,但是程序只对照了一半的sign,后半部分没有对照下去,结果用跟踪出来的前半部分替换原来的,后半部分不变,再次跟踪对照,结果发现前半部分又不一样了,呵呵。。看样子,还没有找到后半部分的对照。
2005-4-15 17:59
0
雪    币: 1310
活跃值: (727)
能力值: ( LV6,RANK:90 )
在线值:
发帖
回帖
粉丝
4
爆破9.x是很容易的事情,关键就在于修改最后的标志位。前面的一切验证都没用。我爆破了9.2.0的,连许可文件都不需要了,所有feature/inrement都没有问题,呵呵!
2005-4-15 18:02
0
雪    币: 26
活跃值: (10)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
5
最初由 shaoge 发布
爆破9.x是很容易的事情,关键就在于修改最后的标志位。前面的一切验证都没用。我爆破了9.2.0的,连许可文件都不需要了,所有feature/inrement都没有问题,呵呵!

感觉大侠像一个牛人,请问你爆破的是什么软件。其实不同厂商应用flexlm技术是不同的,有些就很难爆破。好像没你说的那么容易。
2005-4-16 17:13
0
雪    币: 1310
活跃值: (727)
能力值: ( LV6,RANK:90 )
在线值:
发帖
回帖
粉丝
6
首先声明,俺非牛人,
不过我碰到的9.2都可以爆破。
2005-4-16 19:58
0
雪    币: 1310
活跃值: (727)
能力值: ( LV6,RANK:90 )
在线值:
发帖
回帖
粉丝
7
9.2的明文对比还没有搞定。多多指教啊
2005-4-16 20:00
0
游客
登录 | 注册 方可回帖
返回
//