Reverse Engineering Team
Unregistered, You must accept the Forum Rules below to be able to use some forum functions.

Read forum rules below...

1. All posts must be written in English.
2. Don't spam/abuse any other member via E-mail or Private Messages.
3. Have phun!

For breaking above rules you may be warned/banned appropriately!

Join the forum, it's quick and easy

Reverse Engineering Team
Unregistered, You must accept the Forum Rules below to be able to use some forum functions.

Read forum rules below...

1. All posts must be written in English.
2. Don't spam/abuse any other member via E-mail or Private Messages.
3. Have phun!

For breaking above rules you may be warned/banned appropriately!
Reverse Engineering Team
Would you like to react to this message? Create an account in a few clicks or log in to continue.

Protected software recognizes MultiKey and blocks it.

4 posters

Go down

Protected software recognizes MultiKey and blocks it. Empty Protected software recognizes MultiKey and blocks it.

Post by orx12 Thu Oct 04, 2012 11:24 am

Dear Forum Fellows,
used by me protected software recognizes and blocks MultiKey. What's more, it is not possible to change registry path within MultiKey.sys in order to use different name like MultiKey. Does any of you have solution?

orx12

Posts : 6
Points : 8
Reputation : 0
Join date : 2012-10-04

Back to top Go down

Protected software recognizes MultiKey and blocks it. Empty Re: Protected software recognizes MultiKey and blocks it.

Post by hasp Thu Oct 04, 2012 12:43 pm

yes possible try here to download password pm

hasp

Posts : 454
Points : 634
Reputation : 172
Join date : 2011-12-16

Back to top Go down

Protected software recognizes MultiKey and blocks it. Empty Re: Protected software recognizes MultiKey and blocks it.

Post by orx12 Fri Oct 05, 2012 5:31 am

Thank you, HASP. Unfortunately, something strange happens - registry key working with MultiKey 18.0.3 is not working with Exetools 18.2.4 - I got message 1030: Envelope unknown Error (with drivers 5.50) and Error 7 with drivers 6.50.

orx12

Posts : 6
Points : 8
Reputation : 0
Join date : 2012-10-04

Back to top Go down

Protected software recognizes MultiKey and blocks it. Empty Re: Protected software recognizes MultiKey and blocks it.

Post by kjms Fri Oct 05, 2012 7:00 am

are you edit like this ?
Code:
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Exetools\Dumps\12345678]
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Exetools\Dumps\12345678\DTable]
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Exetools\Dumps\12345678\ETable]

kjms

Posts : 194
Points : 201
Reputation : -4
Join date : 2010-09-12

Back to top Go down

Protected software recognizes MultiKey and blocks it. Empty Re: Protected software recognizes MultiKey and blocks it.

Post by orx12 Fri Oct 05, 2012 7:10 am

Yes, I have done it. I have only two keys, no ETable section.

orx12

Posts : 6
Points : 8
Reputation : 0
Join date : 2012-10-04

Back to top Go down

Protected software recognizes MultiKey and blocks it. Empty Re: Protected software recognizes MultiKey and blocks it.

Post by kjms Fri Oct 05, 2012 7:55 am

post the reg here. Suspect

kjms

Posts : 194
Points : 201
Reputation : -4
Join date : 2010-09-12

Back to top Go down

Protected software recognizes MultiKey and blocks it. Empty Re: Protected software recognizes MultiKey and blocks it.

Post by hasp Fri Oct 05, 2012 11:55 am

multikey 17.0.0 and below reg table like below
Code:
"QTable"=hex:\
9F,35,37,2D,4A,31,82,F2,5D,71,45,AC,CF,BB,E9,85,\
C1,FD,0B,88,C9,A4,8B,B8,77,A1,F7,14,F8,9B,7C,85,\
79,F6,F1,4F,A9,12,7C,F9,9C,D9,75,68,F0,16,00,FF,\
F8,02,4A,36,A9,5C,2B,B1,8E,AA,C1,BF,59,20,52,01,\
F2,4B,34,3C,F8,CC,76,3C,9C,C7,E0,F5,23,99,55,5F,\
6A,A8,06,07,9A,9D,11,7F,FC,01,34,EE,6A,6B,3F,5E,\
79,B4,06,B6,76,DC,1B,81,3F,78,43,00,ED,55,FE,C0,\
8B,CE,4F,AC,2C,B8,9F,32,69,73,F8,95,31,68,BC,48....
"ATable"=hex:\
1B,4B,4F,99,8F,8C,BD,CE,60,1B,91,DB,F7,83,F7,7F,\
C9,BD,7C,81,A3,17,55,64,C9,80,AA,08,DC,6B,B4,D4,\
CB,44,D0,AF,71,B9,2B,DE,A5,46,EB,61,57,A0,08,3D,\
EE,F5,52,43,FC,05,97,79,D6,6D,53,12,70,21,08,DA,\
54,FC,B4,ED,EC,51,23,EF,F4,8F,EC,16,E4,8C,EB,DC,\
B4,13,7D,98,D4,BB,60,AB,07,43,A9,88,1F,C7,C4,1E,\
21,54,3E,FB,8B,B2,41,43,0B,D8,22,99,17,6C,15,43,\
71,0B,D8,E2,BD,70,E0,77,9A,E9,59,2C,94,B1,DD,11,\
10,81,16,73,38,07,DE,FA,64,95,80,16,40,18,76,E1,\
D7,75,7C,82,DE,2D,F1,82,B3,D5,52,EF,90,6F,E1,49....
multikey 18.0.1 and above reg table like below
Code:
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Exetools\Dumps\XXXXXXXX\DTable]
"10:031A79B7A643918C41CD29298C2796F4"=hex:A3,C1,70,E8,8B,D8,AA,04,9E,4E,8B,73,39,44,2D,76
"10:05942A493F3A22F7732C9053CB0FF882"=hex:EE,96,59,E7,61,D0,7C,67,CD,01,B2,EB,EF,B8,D1,0F
"10:101F7833A7E640F2D0E83DDA1B3FD051"=hex:D7,75,7C,82,DE,2D,F1,82,B3,D5,52,EF,90,6F,E1,49
"10:1C1A3304A396705448BA219557D17A48"=hex:D4,4B,77,A0,81,A4,04,AF,68,6E,AB,B5,98,A3,99,34
"10:2DC93262977CB2B89836D579E08B07F2"=hex:A7,FA,7E,3B,6A,E4,29,DB,89,52,08,BC,D5,66,0E,07
"10:342337E7B218D2A4AA6EB3402ABA91A5"=hex:0E,35,2B,36,F9,70,40,51,19,83,E4,96,88,A4,50,11
"20:0583A9B1A78474F8D4C3582726E53834F4C28C39AE617C34BDB2277E9F7CC3CA"=hex:B6,CF,C6,8E,63,A8,E8,72,EB,19,BA,2E,28,E2,5B,3E
"20:1883E103BF28DD790C4ABB970F3537640C329181E9633CC0B412AAB7E9BD0311"=hex:2D,AE,7A,54,2D,D8,79,D8,B0,8A,8B,CE,CF,0E,1D,8B
"20:1CBCEC465E9027ED4266D85D019B36C698A75DCA4D59CE1F7B8E66471F366A4A"=hex:48,4E,DF,0F,8D,F1,29,DC,BF,4A,12,28,0B,DB,DC,84
"20:22E70D8F2BFA71FE3BD6AFC4F1AD26E39465259811D2920F0BC06E8BA9392CEB"=hex:FD,EF,90,48,63,B3,48,A1,4A,A8,EF,BB,8F,18,D4,96
"20:2B752FF0071E21B495A513B70ED38021580935B44DA33AD45773DCAB95906692"=hex:A7,20,E6,BC,A6,57,FF,D6,CE,1E,A0,FC,2C,3C,35,25
"30:0583A9B1A78474F8D4C3582726E53834F4C28C39AE617C34BDB2277E9F7CC3CA"=hex:9F,5D,45,A3,0E,43,06,DA,44,24,10,DC,4B,20,DB,43
"30:1883E103BF28DD790C4ABB970F3537640C329181E9633CC0B412AAB7E9BD0311"=hex:C7,1B,A1,E8,6A,58,28,01,FF,FF,FF,FF,0A,00,00,00
"30:1CBCEC465E9027ED4266D85D019B36C698A75DCA4D59CE1F7B8E66471F366A4A"=hex:16,9A,E1,4A,42,64,56,63,BE,EB,FF,E8,5C,B1,CB,FF
"30:22E70D8F2BFA71FE3BD6AFC4F1AD26E39465259811D2920F0BC06E8BA9392CEB"=hex:34,87,AB,40,37,F3,C8,09,00,00,04,00,0C,50,73,51


Last edited by hasp on Tue Oct 09, 2012 9:52 am; edited 1 time in total

hasp

Posts : 454
Points : 634
Reputation : 172
Join date : 2011-12-16

Back to top Go down

Protected software recognizes MultiKey and blocks it. Empty Re: Protected software recognizes MultiKey and blocks it.

Post by orx12 Fri Oct 05, 2012 3:01 pm

The hey is quite long (2,3 MB) but it looks following:
Code:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\MultiKey\Dumps\XXXXXXXX\DTable]
"10:8A2E3635A32CE7A304110065F264138F"=hex:a6,e4,cb,2e,7f,c1,39,33,eb,4d,78,0e,\
  3a,ea,43,75
"10:21E5F78B2D60FEA20EEA3E4DD24312AF"=hex:2a,83,6c,ed,9b,b6,a6,04,cd,2d,e0,48,\
  ca,0d,05,62
So it seems to be ver 18.1.1+ but is definitelly working with 18.0.3

orx12

Posts : 6
Points : 8
Reputation : 0
Join date : 2012-10-04

Back to top Go down

Protected software recognizes MultiKey and blocks it. Empty Re: Protected software recognizes MultiKey and blocks it.

Post by orx12 Mon Oct 08, 2012 5:12 pm

Dear hasp,
would you mind answering my PM?

orx12

Posts : 6
Points : 8
Reputation : 0
Join date : 2012-10-04

Back to top Go down

Protected software recognizes MultiKey and blocks it. Empty Re: Protected software recognizes MultiKey and blocks it.

Post by hasp Tue Oct 09, 2012 9:52 am

@orx12 you are right mkey support 18>DTable,ETable i edit my post

hasp

Posts : 454
Points : 634
Reputation : 172
Join date : 2011-12-16

Back to top Go down

Protected software recognizes MultiKey and blocks it. Empty Re: Protected software recognizes MultiKey and blocks it.

Post by orx12 Tue Oct 09, 2012 6:43 pm

Thank you hasp, but neverless I have quite strange situation - I have a key working under MK 18.0.3 and not working under MK (or Exetools) 18.2.4. Can anybody help me? This key has only DTable entry, and there are only values beginning with 10:

orx12

Posts : 6
Points : 8
Reputation : 0
Join date : 2012-10-04

Back to top Go down

Protected software recognizes MultiKey and blocks it. Empty Re: Protected software recognizes MultiKey and blocks it.

Post by rytisr Tue Jun 11, 2013 7:04 pm

hasp wrote:yes possible try here to download password pm

Hello, how can i download this?

rytisr

Posts : 1
Points : 1
Reputation : 0
Join date : 2013-06-04

Back to top Go down

Protected software recognizes MultiKey and blocks it. Empty Re: Protected software recognizes MultiKey and blocks it.

Post by Sponsored content


Sponsored content


Back to top Go down

Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum