UltraPro AES Tunnel Understanding

Hello Friends.

Trying to understand why my dump only partially works on Ultrapro Dongle. I am not so good at figuring out, but I only want to learn, as emulating this dongle is not important other than for learning.

It seems that Dongle DF07 may use AES tunnel based on old log file I found. How to solve AES key? Or simply need to make Q/R table?

Emulated Dongle sometimes works but have to click read hardware license multiple times. Assuming its because AES or sometime dump provides correct response, so maybe Q/R would work, but how to format in multikey.

Small excerpt of log file.

In> Fn10: KEY_FN_READ_FOR_FIND_UNIT
CellNo: 0x05
Out> Status: 00
CellMem: 0x0000

In> Fn10: KEY_FN_READ_FOR_FIND_UNIT
CellNo: 0x07
Out> Status: 00
CellMem: 0x0251

In> Fn00: KEY_FN_GET_KEYINFO
Out> Status: 00
KeyInfo: 0x0002 0xB203 

In> Fn05: KEY_FN_GET_LICENSE
Out> Status: 00
Parameter1: 0x7C07, Parameter2: 0x0400

In> Fn10: KEY_FN_READ_FOR_FIND_UNIT
CellNo: 0xF7
Out> Status: 00
CellMem: 0x0001

In> Fn2F: KEY_FN_SET_AES
Parameter1: 0x6B00, Parameter2: 0x00
In> Fn2F: KEY_FN_SET_AES
Parameter1: 0xF500, Parameter2: 0x00
In> Fn2F: KEY_FN_SET_AES
Parameter1: 0xC600, Parameter2: 0x00
In> Fn2F: KEY_FN_SET_AES
Parameter1: 0x4B00, Parameter2: 0x00
In> Fn20: Unknown
20 00 F7 D0 4B 3D 
Out> Status: 00
74 00 C2 71 59 E8 

In> Fn11: KEY_FN_READ
CellNo: 0xF7
Out> Status: 00
CellMem: 0x0001, CellType: 0x1

In> Fn11: KEY_FN_READ
CellNo: 0xF1
Out> Status: 00
CellMem: 0x0101, CellType: 0x0

In> Fn11: KEY_FN_READ
CellNo: 0xF0 --> DesignID
Out> Status: 00
CellMem: 0x7D3A, CellType: 0x0

In> Fn10: KEY_FN_READ_FOR_FIND_UNIT
CellNo: 0x01
Out> Status: 00
CellMem: 0xD0F7

In> Fn10: KEY_FN_READ_FOR_FIND_UNIT
CellNo: 0x00
Out> Status: 00
CellMem: 0x608E

In> Fn10: KEY_FN_READ_FOR_FIND_UNIT
CellNo: 0x05
Out> Status: 00
CellMem: 0x0000

In> Fn10: KEY_FN_READ_FOR_FIND_UNIT
CellNo: 0x07
Out> Status: 00
CellMem: 0x0251

In> Fn00: KEY_FN_GET_KEYINFO
Out> Status: 00
KeyInfo: 0x0002 0xB203 

In> Fn05: KEY_FN_GET_LICENSE
Out> Status: 00
Parameter1: 0x7C07, Parameter2: 0x0400

In> Fn10: KEY_FN_READ_FOR_FIND_UNIT
CellNo: 0xF7
Out> Status: 00
CellMem: 0x0001

In> Fn2F: KEY_FN_SET_AES
Parameter1: 0x6B00, Parameter2: 0x00
In> Fn2F: KEY_FN_SET_AES
Parameter1: 0xF500, Parameter2: 0x00
In> Fn2F: KEY_FN_SET_AES
Parameter1: 0xC600, Parameter2: 0x00
In> Fn2F: KEY_FN_SET_AES
Parameter1: 0x4B00, Parameter2: 0x00
In> Fn20: Unknown
20 00 AB F6 9D AB 
Out> Status: 00
EE 00 74 35 ED 58



Dump file

Code:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\MultiKey\Dumps\0000D0F7]
"License"=hex:5c,2e,1a,cf,ab,60,dc,ea,3b,1f,21,56,53,e1,d5,89
"Name"="Valvelink AC to HC"
"CopyLeft"="(c)Elite"
"DongleType"=dword:00000003
"Type"=dword:00000001
"Option"=hex:02,00,03,B2,FF,00,00,00
"CellType"=hex:\
01,01,03,03,03,01,03,01,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,01,\
03,03,01,01,01,00,00,00

"sntMemory"=hex:\
F0,5F,F7,D0,00,00,00,00,00,00,00,00,00,00,51,02,\
01,00,53,01,FA,3F,A3,BF,8C,04,59,0D,0B,3D,ED,C9,\
08,EB,71,76,62,31,AC,3C,E6,FA,EA,2C,50,E1,91,ED,\
ED,F8,6D,07,7B,10,56,2C,69,16,7F,A6,60,03,FB,36,\
52,7F,58,48,F8,92,0C,B5,BE,D6,3B,C4,18,32,0D,C4,\
51,BD,8E,2E,8A,A4,AF,A0,7E,EF,96,8C,4D,D0,09,24,\
F2,BD,8E,2E,8A,A4,AF,A0,7E,EF,96,8C,4D,D0,09,24,\
F2,BD,8E,2E,8A,A4,AF,A0,7E,EF,96,8C,4D,D0,09,24,\
F2,BD,8E,2E,8A,A4,AF,A0,7E,EF,96,8C,4D,D0,09,24,\
F2,BD,8E,2E,8A,A4,AF,A0,7E,EF,96,8C,4D,D0,09,24,\
F2,BD,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
3A,7D,01,01,69,2F,1F,2B,3F,FB,00,00,00,00,01,00,\
00,00,00,00,00,1D,03,00,00,00,00,00,00,00,00,00


I think it need Q/A emulator based for such case.

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\XXXXXX\Queries]

your case will be great to study it.

contact me if can.

I Send PM with details for study. Program is .Net with W32 Dll vl2ih.dll and makeykeys.dll that handle dongle function. Like I say. This dongle is for study, I have no need for solution. I just want to learn from masters of dongle protection  [You must be registered and logged in to see this image.]

Thanks to Ovis25 for explaining some function.

Anyone have newer version of uproeval and sproeval tools can PM link? My versions copyright 2004 and are very old. Do not have GetKeyInfoEx functions.

Anyway enough for fun for now. Back to real work for the next week. Would like to figure out why this dongle not emulated 100% correctly. Still works for where I need.

@psgama: many info you can get from the spromeps.lib and spromeps_dual.lib file. just extract from one .lib to many .obj files. and study aes128.obj.  some aes key inside...

Thank you Bfox. Made much progress today. I believe GetTime is being labelled incorrect with Decodificador program. Should be function x30 not 2f



Need to see what real dongle return to these query

Req : 0x2F 0xA8 0x00 0xE7 0x00 0x00 0x27 0xE3

--------- Request # 58 ----[OUT]----

URB_FUNCTION_VENDOR_INTERFACE

Length: 0x50
USBD Status: USBD_STATUS_SUCCESS (0x0)
TransferFlags: 0x0 ( USBD_TRANSFER_DIRECTION_OUT )
TransferBufferLength: 0x8
TransferBuffer: 0x87FE05C8
TransferBufferMDL: 0x0
UrbLink: 0x0
RequestTypeReservedBits: 0x0
Request: 0x72
Value: 0x5613
Index: 0x0

** Data **
5F 74 A6 B3 B2 6E 27 E3 
--------- Request # 59 ----[IN]----

URB_FUNCTION_CONTROL_TRANSFER

Length: 0x50
USBD Status: USBD_STATUS_PENDING (0x40000000)
EndpointAddress: 0x0
PipeHandle: 0x869CE8FC
TransferFlags: 0xA ( USBD_TRANSFER_DIRECTION_OUT USBD_SHORT_TRANSFER_OK )
TransferBufferLength: 0x0
TransferBuffer: 0x87FE05C8
TransferBufferMDL: 0x89DA7E00
UrbLink: 0x0
SetupPacket: 0x41 0x72 0x13 0x56 0x0 0x0 0x8 0x0 
RequestType: 0x41 (Direction: Host-to-device, Type: Vendor, Recipient: Interface)
Request: 0x72
Value: 0x5613
Index: 0x0
Length: 0x8

I'm think that this function 2F may not be my problem, but for all who offer me the way can confirm that USB trace log is only returning Dongle Status Okay to these function request?

Code:

--------- Request # 153 ----[OUT]----

URB_FUNCTION_VENDOR_INTERFACE

Length: 0x50
USBD Status: USBD_STATUS_SUCCESS (0x0)
TransferFlags: 0x0 ( USBD_TRANSFER_DIRECTION_OUT )
TransferBufferLength: 0x8
TransferBuffer: 0x89FF9488
TransferBufferMDL: 0x0
UrbLink: 0x0
RequestTypeReservedBits: 0x0
Request: 0x80
Value: 0x5613
Index: 0x0

** Data **
F5 FE 8E A7 E4 3A 27 87

--------- Request # 154 ----[OUT]----

URB_FUNCTION_VENDOR_INTERFACE

Length: 0x50
USBD Status: USBD_STATUS_SUCCESS (0x0)
TransferFlags: 0x0 ( USBD_TRANSFER_DIRECTION_OUT )
TransferBufferLength: 0x8
TransferBuffer: 0x89FF9488
TransferBufferMDL: 0x0
UrbLink: 0x0
RequestTypeReservedBits: 0x0
Request: 0x80
Value: 0x5613
Index: 0x0

** Data **
F5 FE 8E A7 E4 3A 27 87

--------- Request # 155 ----[IN]----

URB_FUNCTION_CONTROL_TRANSFER

Length: 0x50
USBD Status: USBD_STATUS_PENDING (0x40000000)
EndpointAddress: 0x0
PipeHandle: 0x869CE8FC
TransferFlags: 0xA ( USBD_TRANSFER_DIRECTION_OUT USBD_SHORT_TRANSFER_OK )
TransferBufferLength: 0x0
TransferBuffer: 0x89FF9488
TransferBufferMDL: 0x88F1B560
UrbLink: 0x0
SetupPacket: 0x41 0x80 0x13 0x56 0x0 0x0 0x8 0x0
RequestType: 0x41 (Direction: Host-to-device, Type: Vendor, Recipient: Interface)
Request: 0x80
Value: 0x5613
Index: 0x0
Length: 0x8

--------- Request # 156 ----[IN]----

URB_FUNCTION_CONTROL_TRANSFER

Length: 0x50
USBD Status: USBD_STATUS_SUCCESS (0x0)
EndpointAddress: 0x0
PipeHandle: 0x869CE8FC
TransferFlags: 0xA ( USBD_TRANSFER_DIRECTION_OUT USBD_SHORT_TRANSFER_OK )
TransferBufferLength: 0x8
TransferBuffer: 0x89FF9488
TransferBufferMDL: 0x88F1B560
UrbLink: 0x0
SetupPacket: 0x41 0x80 0x13 0x56 0x0 0x0 0x8 0x0
RequestType: 0x41 (Direction: Host-to-device, Type: Vendor, Recipient: Interface)
Request: 0x80
Value: 0x5613
Index: 0x0
Length: 0x8

--------- Request # 157 ----[OUT]----

URB_FUNCTION_VENDOR_INTERFACE

Length: 0x50
USBD Status: USBD_STATUS_SUCCESS (0x0)
TransferFlags: 0x0 ( USBD_TRANSFER_DIRECTION_OUT )
TransferBufferLength: 0x8
TransferBuffer: 0x89FF9488
TransferBufferMDL: 0x0
UrbLink: 0x0
RequestTypeReservedBits: 0x0
Request: 0x81
Value: 0x5613
Index: 0x0

** Data **
90 A9 12 AE 87 FB 88 8B

--------- Request # 158 ----[OUT]----

URB_FUNCTION_VENDOR_INTERFACE

Length: 0x50
USBD Status: USBD_STATUS_SUCCESS (0x0)
TransferFlags: 0x0 ( USBD_TRANSFER_DIRECTION_OUT )
TransferBufferLength: 0x8
TransferBuffer: 0x89FF9488
TransferBufferMDL: 0x0
UrbLink: 0x0
RequestTypeReservedBits: 0x0
Request: 0x81
Value: 0x5613
Index: 0x0

** Data **
90 A9 12 AE 87 FB 88 8B

--------- Request # 159 ----[IN]----

URB_FUNCTION_CONTROL_TRANSFER

Length: 0x50
USBD Status: USBD_STATUS_PENDING (0x40000000)
EndpointAddress: 0x0
PipeHandle: 0x869CE8FC
TransferFlags: 0xA ( USBD_TRANSFER_DIRECTION_OUT USBD_SHORT_TRANSFER_OK )
TransferBufferLength: 0x0
TransferBuffer: 0x89FF9488
TransferBufferMDL: 0x88F1B560
UrbLink: 0x0
SetupPacket: 0x41 0x81 0x13 0x56 0x0 0x0 0x8 0x0
RequestType: 0x41 (Direction: Host-to-device, Type: Vendor, Recipient: Interface)
Request: 0x81
Value: 0x5613
Index: 0x0
Length: 0x8

--------- Request # 160 ----[IN]----

URB_FUNCTION_CONTROL_TRANSFER

Length: 0x50
USBD Status: USBD_STATUS_SUCCESS (0x0)
EndpointAddress: 0x0
PipeHandle: 0x869CE8FC
TransferFlags: 0xA ( USBD_TRANSFER_DIRECTION_OUT USBD_SHORT_TRANSFER_OK )
TransferBufferLength: 0x8
TransferBuffer: 0x89FF9488
TransferBufferMDL: 0x88F1B560
UrbLink: 0x0
SetupPacket: 0x41 0x81 0x13 0x56 0x0 0x0 0x8 0x0
RequestType: 0x41 (Direction: Host-to-device, Type: Vendor, Recipient: Interface)
Request: 0x81
Value: 0x5613
Index: 0x0
Length: 0x8

--------- Request # 161 ----[OUT]----

URB_FUNCTION_VENDOR_INTERFACE

Length: 0x50
USBD Status: USBD_STATUS_SUCCESS (0x0)
TransferFlags: 0x0 ( USBD_TRANSFER_DIRECTION_OUT )
TransferBufferLength: 0x8
TransferBuffer: 0x89FF9488
TransferBufferMDL: 0x0
UrbLink: 0x0
RequestTypeReservedBits: 0x0
Request: 0x82
Value: 0x5613
Index: 0x0

** Data **
F5 94 93 7D D5 BE E9 8F

--------- Request # 162 ----[OUT]----

URB_FUNCTION_VENDOR_INTERFACE

Length: 0x50
USBD Status: USBD_STATUS_SUCCESS (0x0)
TransferFlags: 0x0 ( USBD_TRANSFER_DIRECTION_OUT )
TransferBufferLength: 0x8
TransferBuffer: 0x89FF9488
TransferBufferMDL: 0x0
UrbLink: 0x0
RequestTypeReservedBits: 0x0
Request: 0x82
Value: 0x5613
Index: 0x0

** Data **
F5 94 93 7D D5 BE E9 8F

--------- Request # 163 ----[IN]----

URB_FUNCTION_CONTROL_TRANSFER

Length: 0x50
USBD Status: USBD_STATUS_PENDING (0x40000000)
EndpointAddress: 0x0
PipeHandle: 0x869CE8FC
TransferFlags: 0xA ( USBD_TRANSFER_DIRECTION_OUT USBD_SHORT_TRANSFER_OK )
TransferBufferLength: 0x0
TransferBuffer: 0x89FF9488
TransferBufferMDL: 0x895D6A60
UrbLink: 0x0
SetupPacket: 0x41 0x82 0x13 0x56 0x0 0x0 0x8 0x0
RequestType: 0x41 (Direction: Host-to-device, Type: Vendor, Recipient: Interface)
Request: 0x82
Value: 0x5613
Index: 0x0
Length: 0x8

--------- Request # 164 ----[IN]----

URB_FUNCTION_CONTROL_TRANSFER

Length: 0x50
USBD Status: USBD_STATUS_SUCCESS (0x0)
EndpointAddress: 0x0
PipeHandle: 0x869CE8FC
TransferFlags: 0xA ( USBD_TRANSFER_DIRECTION_OUT USBD_SHORT_TRANSFER_OK )
TransferBufferLength: 0x8
TransferBuffer: 0x89FF9488
TransferBufferMDL: 0x895D6A60
UrbLink: 0x0
SetupPacket: 0x41 0x82 0x13 0x56 0x0 0x0 0x8 0x0
RequestType: 0x41 (Direction: Host-to-device, Type: Vendor, Recipient: Interface)
Request: 0x82
Value: 0x5613
Index: 0x0
Length: 0x8

--------- Request # 165 ----[OUT]----

URB_FUNCTION_VENDOR_INTERFACE

Length: 0x50
USBD Status: USBD_STATUS_SUCCESS (0x0)
TransferFlags: 0x0 ( USBD_TRANSFER_DIRECTION_OUT )
TransferBufferLength: 0x8
TransferBuffer: 0x89FF9488
TransferBufferMDL: 0x0
UrbLink: 0x0
RequestTypeReservedBits: 0x0
Request: 0x83
Value: 0x5613
Index: 0x0

** Data **
05 89 A1 61 41 25 4A 93

--------- Request # 166 ----[OUT]----

URB_FUNCTION_VENDOR_INTERFACE

Length: 0x50
USBD Status: USBD_STATUS_SUCCESS (0x0)
TransferFlags: 0x0 ( USBD_TRANSFER_DIRECTION_OUT )
TransferBufferLength: 0x8
TransferBuffer: 0x89FF9488
TransferBufferMDL: 0x0
UrbLink: 0x0
RequestTypeReservedBits: 0x0
Request: 0x83
Value: 0x5613
Index: 0x0

** Data **
05 89 A1 61 41 25 4A 93

--------- Request # 167 ----[IN]----

URB_FUNCTION_CONTROL_TRANSFER

Length: 0x50
USBD Status: USBD_STATUS_PENDING (0x40000000)
EndpointAddress: 0x0
PipeHandle: 0x869CE8FC
TransferFlags: 0xA ( USBD_TRANSFER_DIRECTION_OUT USBD_SHORT_TRANSFER_OK )
TransferBufferLength: 0x0
TransferBuffer: 0x89FF9488
TransferBufferMDL: 0x864FC780
UrbLink: 0x0
SetupPacket: 0x41 0x83 0x13 0x56 0x0 0x0 0x8 0x0
RequestType: 0x41 (Direction: Host-to-device, Type: Vendor, Recipient: Interface)
Request: 0x83
Value: 0x5613
Index: 0x0
Length: 0x8

--------- Request # 168 ----[IN]----

URB_FUNCTION_CONTROL_TRANSFER

Length: 0x50
USBD Status: USBD_STATUS_SUCCESS (0x0)
EndpointAddress: 0x0
PipeHandle: 0x869CE8FC
TransferFlags: 0xA ( USBD_TRANSFER_DIRECTION_OUT USBD_SHORT_TRANSFER_OK )
TransferBufferLength: 0x8
TransferBuffer: 0x89FF9488
TransferBufferMDL: 0x864FC780
UrbLink: 0x0
SetupPacket: 0x41 0x83 0x13 0x56 0x0 0x0 0x8 0x0
RequestType: 0x41 (Direction: Host-to-device, Type: Vendor, Recipient: Interface)
Request: 0x83
Value: 0x5613
Index: 0x0
Length: 0x8

KEY_FN_GET_KEYINFOEX            = 0x2F,
    KEY_FN_GETTIME                    = 0x30