* Vendor's private seeds, -- replace with 32-bit numbers that
* you make up.
*/
#define ENCRYPTION_SEED1 0x87654321
#define ENCRYPTION_SEED2 0x12345678
/*
* FLEXlm vendor keys -- enter as received from Globetrotter.
* Changing these keys has NO impact on license files (unlike
* the ENCRYPTION_SEEDs).
*/
/*-
* Generate these keys with: lmvkey -v demo -d (+3 months) -p ALL -c DEMO
* (Use a date approx 3 months out)
*/
I also remembered that the checks for the default seed codes (shipped with the SDK) was a good place to fish the correct
seeds, a simple disassembly search for '87654321' finds this code :-
:00429C4C CMP D, [EBP-34], 87654321 <-- Check for encryption_seed1.
:00429C53 JZ 00429C5E <-- Jump to Error.
:00429C55 CMP D, [EBP-30], 12345678 <-- Check for encryption_seed2.
:00429C5C JNZ 00429C85 <-- Good jump.
:00429C5E MOV EDI, FFFFFFA5 <-- Error Code (-91).
Routines inside Ser85.exe detect bpx type breakpoints and patching of key files, the checking code starts at 0040EFD3, here
you'll see the names of the files that are checked and the rather obvious 'PUSH 7' instructions which produce a cryptic error
message box asking you to call Ansoft for assistance. The files verified should give us a good idea where to look for other
parts of the protection, Ansoft's developers evidently tried (as is good policy) to identify possible points of attack. Using
bpmb style breakpoints we can quickly recover (what we think are valid) encryption_seed1 (0x7CB2B081) & encryption_seed2
(0x2DFE22B6).
.....
/*-
* Also used by flexcrypt -- notify if API changes.
*/
void
l_sg(
LM_HANDLE * job,
char * vendor_id,
VENDORCODE * key) /*- l_sg means "signature vendor_key5" */
{
unsigned long keys[4];
char sig[SIGSIZE] = {'\0'};
/*- If you change this, you must change it also in utils/lmnewgen.c */
/*- unsigned long x = 0xa8f38730; v3.1 */
/*- unsigned long x = 0x7648b98e; v7.0 */
unsigned long x = 0x6f7330b8; /*- v8.x */
extern void (*L_UNIQ_KEY5_FUNC)();
unsigned long d0 = 0, d1 = 0;
int i = SIGSIZE-1;
if (( job->options->flags & LM_OPTFLAG_CUSTOM_KEY5) && L_UNIQ_KEY5_FUNC)
{
(*L_UNIQ_KEY5_FUNC)(job, vendor_id, key);
return;
}
