Dongles

A tutorial covering a method of bypassing and circumventing KEY-LOK USB Dongle.

PACE/Ilok is mostly loved by the audio industry, and since we crackers don't care too much about hardcore audio apps PACE is not well documented. But this protection is actually quite decent and fun to reverse, it is not especially hard but enough to stop most mediocre crackers. However one aspect could be especially hard for the less determined. That is the driver TPkd.sys, it has some nice features that can stop you dead in your tracks. In this paper I will discuss in my opinion the best aspect of this driver, resolving the int3 stolen calls.

This article discusses the methods of software reverse engineering and the case study of FLEXlm system.

The normal tools were used, IDA, Softice or Olly, a hex editor and also a PE-file editor to patch the .exe file. It was also helpful, but not required, to download the haspman.zip from the manufacturers website just to get an idea of the different calls to the dongle and the expected returns.

It was simple to find the calls to the hasp by searching for the cmp bh, 32 in IDA and then looking close by, just like the tutorials say. The dongle can be called at two places within the program.

This document explains how to unpack the HASP HL Envelope.

In my previous tutorial on HASP SL (6.41.95) I demonstrated how to easily find the OEP, dumping and rebuilding of the target application. The main goal of this tutorial is to do a little more in-depth analysis, how to manually bypass the anti-debug feature and finding out what version you
are dealing with etc. Also this tutorial includes a flash-movie of the manual handy work described in this tutorial. Dodging the anti-debug, finding OEP, dumping and rebuilding. All done in about 2.5 minutes!
Edit: This new version of HASP SL - A Deeper Dig features some new info on the encryption, anti-dumping and how to inline patch it.

Removing Sentinel SuperPro dongle from applications and details on dongle way of cracking.