Re: Reversing Seeds from Hardlock Key possible

by uc Mon Jul 29, 2013 1:57 am

This set is not working. Maybe I should check all 55?

by nodongle.biz Mon Jul 29, 2013 1:59 am

What is not works?
Upload the ciphered data.

by uc Mon Jul 29, 2013 2:12 am

I entered seeds you provided to, and the program didn't start - no key. When I modify program to replace ref key and ver key with 00 it starts.

by nodongle.biz Mon Jul 29, 2013 3:24 am

Try B156 3479 FA4E

by uc Mon Jul 29, 2013 3:35 am

This works. Confirmed also with Latticino, login successfull!!!

by uc Mon Jul 29, 2013 3:44 am

Can I assume with this seeds the HL_CODE will also work correctly? or it is not obvious.

by nodongle.biz Mon Jul 29, 2013 3:57 am

Exists about 50 another correct seeds for ref/ver, but only one from them will be correct for hl_code.

by uc Mon Jul 29, 2013 4:06 am

OK, I understand. If I find coded data to confirm I will let you know. Thank you for your help!!!!

by mindoverflow Wed Jul 31, 2013 2:37 pm

nodongle.biz wrote:I have such tool.
Post here ref/ver bytes.

Hi,

I would like if you could check the seeds for a hardlock dongle. Those are supposed to be the Ref and VerKeys of the same dongle. I found those seeds 2A3B 30FC CE96 but HL_Code isn't computing right then I'm still in doubt.

Code:: ModAd = 63A9 static BYTE RefKey[8] = {0x43, 0x68, 0x21, 0x6E, 0x40, 0x7E, 0xB0, 0xDF}; static BYTE VerKey[8] = {0x38, 0xE8, 0xF2, 0xA5, 0xD4, 0x02, 0xE9, 0xBC}; static BYTE RefKey[8] = {0x7E, 0x45, 0x2C, 0x35, 0x51, 0x35, 0x3A, 0x29}; static BYTE VerKey[8] = {0x7F, 0x52, 0xB1, 0x7D, 0x0D, 0x35, 0x10, 0xDC}; static BYTE RefKey[8] = {0x58, 0x46, 0x2F, 0x31, 0x39, 0x3E, 0x31, 0x61}; static BYTE VerKey[8] = {0x08, 0xE5, 0x6E, 0x7C, 0xB3, 0x9D, 0xB1, 0x1C}; static BYTE RefKey[8] = {0x33, 0x3C, 0x37, 0x6F, 0x36, 0x37, 0x4F, 0x6E}; static BYTE VerKey[8] = {0x67, 0xF8, 0x98, 0x61, 0xD9, 0xD0, 0xA0, 0x0D}; static BYTE RefKey[8] = {0x21, 0x46, 0x31, 0x65, 0x38, 0x44, 0x39, 0x34}; static BYTE VerKey[8] = {0x9E, 0xD1, 0xC9, 0x3C, 0xA6, 0xEF, 0xAD, 0xDC}; static BYTE RefKey[8] = {0x43, 0x62, 0x49, 0x32, 0x24, 0x25, 0x39, 0x42}; static BYTE VerKey[8] = {0xFA, 0xCC, 0xA1, 0xD6, 0x67, 0xBA, 0x0C, 0x0D}; static BYTE RefKey[8] = {0x33, 0x3C, 0x37, 0x6F, 0x36, 0x37, 0x4F, 0x6E}; static BYTE VerKey[8] = {0x67, 0xF8, 0x98, 0x61, 0xD9, 0xD0, 0xA0, 0x0D};

and if you could do me a favour and calculate the seeds for this hardlock then it would be great.

Code:: ModAd = 6898 static BYTE RefKey[8] = [0x00, 0x35, 0x85, 0x12, 0x86, 0x52, 0x59, 0x89}; static BYTE VerKey[8] = {0xD8, 0xC7, 0xFA, 0x72, 0x14, 0x27, 0xFC, 0xC6}; static BYTE RefKey[8] = {0x48, 0x33, 0x64, 0x31, 0x67, 0x37, 0x74, 0x36}; static BYTE VerKey[8] = {0x6F, 0xBB, 0x0A, 0xF6, 0xD6, 0x88, 0xB2, 0xFD};

I still can't find hl_seed.c I would be gratefull if someone could point me to it.
Many thanks.

by nodongle.biz Wed Jul 31, 2013 10:25 pm

It is correct seeds for modad 63A9: 2A3B 30FC CE96

by mindoverflow Thu Aug 01, 2013 11:31 am

Ok, thanks mate.

But i'm still not getting it to function right, I wounder why.

To clarify the situation, I took the dump from a toro hardlock emulator. I know that toro went tricky to prevent dumping from the emulator. I still can't see a way to bypass it.
1_ I didn't succeed in decrypting the hardlockfilter.sys to debug it.
2_Don't see how the hl_code dumping algorithm works (i'm using the public version)
3_Didn't find the hl_seed or the algorithm to calculate the seeds from the ref/ver key.
I would appreciate if someone could enlighten me more.

thanks.

by nodongle.biz Thu Aug 01, 2013 11:43 am

Seeds for 6898: 1DB2 346E 4302

by mindoverflow Thu Aug 01, 2013 12:00 pm

Thanks, I'll check.

Any idea about the other issues?

by nodongle.biz Thu Aug 01, 2013 12:16 pm

There is no issues under correct emulators. Smile

by mfav Fri Aug 02, 2013 1:44 am

To Bfox & Lomex

I'm in similar situation
got an old dos app protected with hardlock, it works in win xp, also I'm able to log its login\ref\verif data, would any of you guy kindly post that source from SaPu here, so other members can benefit; I did tons of googling with no success

by mindoverflow Fri Aug 02, 2013 11:11 am

nodongle.biz wrote:There is no issues under correct emulators.

What do you mean by good emulator ? Toro's emulator works fine and multikey works great when given the correct emulation data. The problem lays in dumping from the toro emulator.

Any hint ? Or am I wrong somewhere ?

by nodongle.biz Fri Aug 02, 2013 11:15 am

Seems Stoll M1 software can detect TORO and Multikey emulators.

by mindoverflow Fri Aug 02, 2013 11:49 am

I doubt, as it was released before toro and mk went wide spread, unless it was fixed in the later builds. But toro's emulator works fine that leads me to think that the problem is in the dumping process from a toro emulator.

Did anyone succeed in taking a dump from a toro emulated dongle ?

And yet, the software works fine, loads, draws and generate correct programs but if you employ the narrowing feature (ff) the program crashes. It's not that the program doesn't work at all.

by kjms Wed Nov 20, 2013 2:00 am

i need seeds please any one to help.

Spoiler:

by nodongle.biz Wed Nov 20, 2013 2:20 am

5633
86AD
seed3 is different

by kjms Wed Nov 20, 2013 2:55 am

nodongle.biz wrote:5633
86AD
seed3 is different

nodongle.biz thanks thanks, please how could get seed3 ?

by nodongle.biz Wed Nov 20, 2013 3:01 am

It is easy.
Simply calculate it. Smile

by hasp Sun Nov 24, 2013 1:01 am

*************deleted *************

by nodongle.biz Sun Nov 24, 2013 5:39 am

@hasp

Really? Smile

by hasp Sun Nov 24, 2013 5:51 am

this is not my opp... some where xxxx posted! if wrong i edit my post.

by Sponsored content