Reverse Engineering RET Homepage RET Members Reverse Engineering Projects Reverse Engineering Papers Reversing Challenges Reverser Tools RET Re-Search Engine Reverse Engineering Forum Reverse Engineering Links

Go Back   Reverse Engineering Team Board > Reverse Engineering Board > Reverse Code Engineering
FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
Thread Tools Display Modes
  #1  
Old 04-24-2010, 03:40 AM
code.breaker code.breaker is offline
Member
 
Join Date: Mar 2010
Posts: 23
Default SafeNet USB SuperPro/UltraPro

i have 2 dumper for SafeNet USB SuperPro/UltraPro and i have used pva 3.3 dumper without wp and converted with dmp2mkey.exe and used emulator with mk 8.2.3. But this doesn't work. why this doesn't work please let me know.


1. dmp2mkey.exe spro_RNBO_SPN_DRIVER_74d1_0.dmp

Number of Query Cells = 1
0x08

DevID = 0x74D1
Serial = 0x0892
WP = 0x0000

Cell 0x08 : enhanced, sig=6110
**
Descriptor = 0xF99E106A C6 = 0x6D3A

Processing time 1.844 seconds

Writing MultiKey Registry file...

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\MultiK ey\Dumps\74D10000]
"Type"=dword:00000000
"DongleType"=dword:00000003
"Name"="Dump 74D1"
"CellType"=hex:\
01,01,03,03,03,01,03,01,\
03,03,00,00,00,00,00,00,\
00,01,00,00,01,01,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,\
01,01,00,00,00,01,00,00
"sntMemory"=hex:\
92,08,D1,74,00,00,00,00,00,00,00,00,3A,6D,00,00,\
6A,10,9E,F9,72,3A,00,00,00,00,00,00,2A,87,00,00,\
01,00,CC,2B,FF,FF,01,00,00,00,01,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,FF,FF,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
C8,00,00,00,00,00,00,00,00,00,01,00,F4,01,01,00


and

2. dmp2mkey.exe spro_RNBO_SPN_DRIVER_b99a_0.dmp

Number of Query Cells = 4
0x18 0x1A 0x1C 0x1E

DevID = 0xB99A
Serial = 0x2550
WP = 0x0000

Cell 0x18 : enhanced, sig=15491
*
Descriptor = 0xC62AFCEE C6 = 0x2D34

Cell 0x1A : enhanced, sig=7883
*********************
Descriptor = 0xD36209E1 C6 = 0x2D34

Cell 0x1C : standard, sig=0

Cell 0x1C is Inactive (no data in dump)

Cell 0x1E : enhanced, sig=14039
*************
Descriptor = 0xFC1C23B8 C6 = 0x2D34

Processing time 25.829 seconds

Writing MultiKey Registry file...


Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\MultiK ey\Dumps\B99A0000]
"Type"=dword:00000000
"DongleType"=dword:00000003
"Name"="Dump B99A"
"CellType"=hex:\
01,01,03,03,03,01,03,01,\
01,01,01,01,01,01,01,01,\
01,01,01,01,00,00,00,00,\
03,03,03,03,03,03,03,03,\
02,02,02,02,01,01,01,01,\
01,01,01,01,01,01,01,01,\
00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00
"sntMemory"=hex:\
50,25,9A,B9,00,00,00,00,00,00,00,00,34,2D,00,00,\
23,00,78,44,A7,00,63,30,01,00,0A,00,85,CA,B7,10,\
19,00,02,00,3F,00,00,00,7A,65,00,00,00,00,00,00,\
EE,FC,2A,C6,E1,09,62,D3,00,00,00,00,B8,23,1C,FC,\
0A,00,1E,00,32,00,64,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
Reply With Quote
  #2  
Old 04-24-2010, 04:16 AM
P@blo P@blo is offline
Member
 
Join Date: Jan 2009
Posts: 45
Default

If you have ultrapro dongles you need extract q/r pairs for multikey.
This emu support only table emulaton.
Reply With Quote
  #3  
Old 04-24-2010, 04:30 AM
code.breaker code.breaker is offline
Member
 
Join Date: Mar 2010
Posts: 23
Default

Quote:
Originally Posted by P@blo View Post
If you have ultrapro dongles you need extract q/r pairs for multikey.
This emu support only table emulaton.
dump is here you can check if you get anything from dumper and u can get the .reg working for mk 8.2.3

http://www.4shared.com/file/nHXvFOXd/dump_file.html
Reply With Quote
  #4  
Old 04-24-2010, 04:32 AM
gnerogeem gnerogeem is offline
Senior Member
 
Join Date: Aug 2009
Location: Kalimdor
Posts: 553
Default

@code.breaker

Multikey 0.18.2.3 SSPro reg example.

Code:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\MultiKey\Dumps\00006CC1]
"Name"="Sentinel SuperPro dump"
"Copyright"="None"
"Created"="11 Nov 2009"
"DongleType"=dword:00000003
"Type"=dword:00000000
"sntMemory"=hex:\
        C6,2B,C1,6C,00,00,00,00,08,00,00,00,00,00,00,00,\
        15,00,35,0D,24,4E,59,B1,00,00,59,E9,45,1B,00,00,\
        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
        00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
"CellType"=hex:\
        01,01,03,03,03,01,03,01,\
        01,01,01,01,01,01,01,00,\
        01,01,01,01,00,00,00,00,\
        00,00,00,00,00,00,00,00,\
        00,00,00,00,00,00,00,00,\
        00,00,00,00,00,00,00,00,\
        00,00,00,00,00,00,00,00,\
        00,00,00,00,00,00,00,00
Check your reg file again.
__________________
Pink is the new black.

Last edited by gnerogeem : 04-24-2010 at 04:34 AM.
Reply With Quote
  #5  
Old 04-24-2010, 04:39 AM
bassem_16 bassem_16 is offline
Senior Member
 
Join Date: Feb 2010
Posts: 66
Default

for code breaker this is the output for the first one

Code:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\MultiKey\Dumps\74D10000]
"DongleType"=dword:00000003
"Copyright"="None"
"Created"="Sat Apr 24 10:37:42.546 2010"
"Name"="74D1 Sentinel SuperPro Dump"
"Type"=dword:00000000
"CellType"=hex:\ 
    01,01,03,03,03,01,03,01,\ 
    03,03,00,00,00,00,00,00,\ 
    00,01,00,00,01,01,00,00,\ 
    00,00,00,00,00,00,00,00,\ 
    00,00,00,00,00,00,00,00,\ 
    00,00,00,00,00,00,00,00,\ 
    00,00,00,00,00,00,00,00,\ 
    01,01,00,00,00,01,00,00
"sntMemory"=hex:\ 
    92,08,D1,74,00,00,00,00,00,00,00,00,3A,6D,00,00,\ 
    6A,10,9E,F9,72,3A,00,00,00,00,00,00,2A,87,00,00,\ 
    01,00,CC,2B,FF,FF,01,00,00,00,01,00,00,00,00,00,\ 
    00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 
    00,00,00,00,00,00,00,00,00,00,00,00,00,00,FF,FF,\ 
    00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 
    00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\ 
    C8,00,00,00,00,00,00,00,00,00,01,00,F4,01,01,00
Reply With Quote
  #6  
Old 04-24-2010, 05:10 AM
code.breaker code.breaker is offline
Member
 
Join Date: Mar 2010
Posts: 23
Default

[Please DO NOT POST WHOLE MESSAGES. If you do it, I just delete it, so why bother?]

@ bassem_16 Does not work with you .reg..what next

Last edited by Git : 04-24-2010 at 08:16 AM.
Reply With Quote
  #7  
Old 04-24-2010, 05:11 AM
P@blo P@blo is offline
Member
 
Join Date: Jan 2009
Posts: 45
Default

code.breaker
If You want to check reg-file I need your soft.
Send me link PM.
Reply With Quote
  #8  
Old 04-24-2010, 11:41 AM
jabrix jabrix is offline
Senior Member
 
Join Date: Aug 2009
Location: JKT
Posts: 136
Send a message via MSN to jabrix Send a message via Yahoo to jabrix
Default

your reg files for gar**** software.

Search it with google, except you have real dongle and want to solve it by your self.
Reply With Quote
  #9  
Old 04-25-2010, 07:03 AM
jeff5595 jeff5595 is offline
Member
 
Join Date: Apr 2010
Posts: 5
Default ultrapro model

i have the ultrapro model, what would be the process to create the emulation? do I still use the SENTEMUL2007 program or would it be a Reg File? you mention q/r pairs, is the Ultrapro model procedure completly differant the the Superpro? or is it a additional step? Thanks
Reply With Quote
  #10  
Old 04-25-2010, 09:47 AM
Git Git is offline
Super Moderator
 
Join Date: Oct 2007
Location: Torino
Posts: 1,797
Default

You can use MultiKey on Win32. It is a similar procedure, but the query algo cells are different. For the SuperPro the algorithm is known, so you only have to give the emulator the value in cell 6 and a descriptor value for each cell, and it can calculate to Response for *any* Query that a program may send it. For the UltraPro, the algo cell normally uses the AES 256 encryption standard. It is almost impossible to crack without the key and that is very well hidden. So we have to have a way of sending back the correct Response for any Query our program sends to the dongle. The method used is to record Query/response pairs and then put those pairs in the reg file so the emulator can act like the dongle. You must be certain you catch ALL of the Q/R pairs, but be warned, it is quite possible for a program to use an effectively infinite number of random Queries.

People should also be aware that SuperPro+ and SDHK are also capable of using AES cell encryption if the SP_CAPS_AES_ALGO flag is set and I am surprised that we don't see it used more often.

Git
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump





Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2019, Jelsoft Enterprises Ltd.