I guess 2013 is not compatible with win 8 x64.
thats why I use 2014 version
I know some people already patched 2014 but they wont share.
experts who know how to fix this,they will not share.They just talk
I hope here is different :)
Hi friends,
I need of a bit help please. I want to patch the same target above and finally I found, or hope so, the functions that call the PUBLIC key. This key, as is shown above is in a visible form..MIIB...thus I decided to patch (as also one claims to patched in this way) the function that calls the Pubkey. Indeed I also patched the ECC verify.
Please see here the maps:
http://www.finetopix.com/showthread.php?34233-FlexLM-ECC-Generic-Patcher-Flexlm-targets-%28x86-x64-up-to-version-11-9-x%29&p=236940&viewfull=1#post236940
Then I applied a regular patch as those for I_pubkey_verify, i.e. at the beginning of the function I replaced 3 hex values with 33C0C3 and after that in Ida I see that result is the same as the I_pubkey_verify, which means that I am pushing the function to respond eax=0. Am I correct? This is the patched function:
.text:00416FB0 ; =============== S U B R O U T I N E =======================================
.text:00416FB0
.text:00416FB0
.text:00416FB0 sub_416FB0 proc near ; CODE XREF: sub_417A60+12Fp
.text:00416FB0 xor eax, eax
.text:00416FB2 retn
.text:00416FB2 sub_416FB0 endp
.text:00416FB2
.text:00416FB3 ; ---------------------------------------------------------------------------
.text:00416FB3 and esp, 0FFFFFFF8h
.text:00416FB6 mov eax, 110Ch
.text:00416FBB call __alloca_probe
.text:00416FC0 mov eax, ___security_cookie
.text:00416FC5 xor eax, esp
.text:00416FC7 mov [esp+1108h], eax
.text:00416FCE push ebx
.text:00416FCF push esi
.text:00416FD0 push edi
.text:00416FD1 push 0FFFh
.text:00416FD6 lea eax, [esp+115h]
.text:00416FDD push 0
.text:00416FDF push eax
.text:00416FE0 mov esi, ecx
.text:00416FE2 mov byte ptr [esp+11Ch], 0
I patched all files where the PUBKEY is present and also the same function (55 8B EC 83 E4 F8 B8 0C 11 00 00 in Hex) was present too.
However, the program not "eat" the vendor info /PUBLIC key..and not working. Here is the original file:
https://mega.co.nz/#!alMkCSwI!Y6Xh1-aQ-D1PZ35-w02vtzTs3k8Az8Tb_4xH6Em-6mA
I see also a RSA verity function but ...think that @ericliu showed but the one that patched the claims that this is not necessary to be manipulated.
Thanks in advance!
P.S. As it was described here if you replace just the PUBLIC key (in a simple way with Hex editor) and use the already generated license for the old version, the program works both under Linux and Windows. I just want to add additional features and extend the period of the previous license.
Original function was:
.text:004170F0 ; =============== S U B R O U T I N E =======================================
.text:004170F0
.text:004170F0 ; Attributes: bp-based frame
.text:004170F0
.text:004170F0 sub_4170F0 proc near ; CODE XREF: sub_417270+12Fp
.text:004170F0
.text:004170F0 Buf = byte ptr -1108h
.text:004170F0 var_1008 = byte ptr -1008h
.text:004170F0 Dst = byte ptr -1007h
.text:004170F0 var_4 = dword ptr -4
.text:004170F0
.text:004170F0 push ebp
.text:004170F1 mov ebp, esp
.text:004170F3 and esp, 0FFFFFFF8h
.text:004170F6 mov eax, 110Ch
.text:004170FB call __alloca_probe
.text:00417100 mov eax, ___security_cookie
.text:00417105 xor eax, esp
.text:00417107 mov [esp+110Ch+var_4], eax
.text:0041710E push ebx
.text:0041710F push esi
.text:00417110 push edi
.text:00417111 push 0FFFh ; Size
.text:00417116 lea eax, [esp+111Ch+Dst]
.text:0041711D push 0 ; Val
.text:0041711F push eax ; Dst
.text:00417120 mov esi, ecx
.text:00417122 mov [esp+1124h+var_1008], 0
.text:0041712A call memset
.text:0041712F mov eax, dword_53B928
.text:00417134 add esp, 0Ch
.text:00417137 test eax, eax
.text:00417139 jz short loc_41714E
.text:0041713B push eax
.text:0041713C call RSA_free
.text:00417141 add esp, 4
.text:00417144 mov dword_53B928, 0
.text:0041714E
.text:0041714E loc_41714E: ; CODE XREF: sub_4170F0+49j
.text:0041714E test esi, esi .text:00417150 jz loc_41720D (HERE IS A JUMP TO PUBLIC KEY)
.text:00417156 push offset Mode ; "r"
.text:0041715B push esi
.....
if I patch all the function as shown in previous post it crash...the problem is in the libmmlibs dll ..It not allows such patching, the other files are ok. Here are the lictest.exe and above dll.
Can someone please help, what to be patched in a way than each PUBLIC key to be accepted and hence, if I am not wrong, each vendor info?
Thanks in advance!
https://mega.co.nz/#!79Mj2ISb!1c5sFUyn7abiJTC9eum1LjeXEozW00od_eChn1E02CQ
P.S. In fact suggested for patching function check_ signature and all others are located exactly in this .dll, at least for 2013-1, not in the lictest.exe. I used 2013-1x64 as an initial test.
acekillerf
