Reverse Engineering RET Homepage RET Members Reverse Engineering Projects Reverse Engineering Papers Reversing Challenges Reverser Tools RET Re-Search Engine Reverse Engineering Forum Reverse Engineering Links

Go Back   Reverse Engineering Team Board > Reverse Engineering Board > Reverse Code Engineering
FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
Thread Tools Display Modes
  #1  
Old 09-11-2008, 10:38 PM
vanity vanity is offline
Member
 
Join Date: Sep 2008
Posts: 5
Default Unidentifyied Dongle

Hello there!

I am relatively new to dongle emulation and reverse engineering, so I'm afraid this is a very basic question, I've searched on the forum but haven't found any answer.

I've done already a Sentinel dongle emulation with the help from the threads here at this forum, and it was quite easy with all the info in here. But this time I'm not sure what brand is the dongle. It seems to me that it could be a protection made by the same company as the software itself.
No drivers are installed, but the program installs its own little "server", which identifies the dongle and sends its info - via TCP (crackable?) - to the application.
I've checked at Process Manager, but it seems that the dongle is identifyied as an Human Interface Device (HID), and its driver is said to be an HID-compilant (generic) device.

So, here are my questions:
1 - Is it possible that the dongle is from any already available emulators? If it is, how could I identify it?
2 - If not, would there be any workaround, such as creating a table myself, and using a vusbus-like program to emulate it? Are there any guidelines to do it?


I'm thinking that maybe intercepting the TCP calls made by this app and creating a fake server would do. What do you think?

Thanks a lot for the help!
Reply With Quote
  #2  
Old 09-12-2008, 08:21 AM
BfoX BfoX is offline
Senior Member
 
Join Date: Aug 2007
Posts: 2,276
Send a message via ICQ to BfoX Send a message via MSN to BfoX Send a message via Yahoo to BfoX
Default

It may be driver less range of the dongle aka
Eutron/SmartKey 3 DL or Rockey4ND...
__________________
... Either you work well or you work much ....
Reply With Quote
  #3  
Old 09-12-2008, 08:22 AM
Git Git is offline
Super Moderator
 
Join Date: Oct 2007
Location: Torino
Posts: 1,797
Default

Could be UniKey

Git
Reply With Quote
  #4  
Old 09-12-2008, 08:28 AM
kodyazan kodyazan is offline
Senior Member
 
Join Date: Jul 2008
Posts: 60
Default

Sometimes a picture tells more.
Reply With Quote
  #5  
Old 09-12-2008, 09:57 AM
BfoX BfoX is offline
Senior Member
 
Join Date: Aug 2007
Posts: 2,276
Send a message via ICQ to BfoX Send a message via MSN to BfoX Send a message via Yahoo to BfoX
Default

Could be SparKey
__________________
... Either you work well or you work much ....
Reply With Quote
  #6  
Old 09-13-2008, 02:34 PM
vanity vanity is offline
Member
 
Join Date: Sep 2008
Posts: 5
Default

Hey Guys!

Thanks for all the replies! I really appreciate your help!

I haven't answered the messages yet because I found this link, which suggests that the program whose dongle I want to emulate (EMME/3) is protected with an Aladdin Hardlock (and it even has its ModAd). So I've been trying all this time to dump it as if it were an Aladdin Hardlock, with no success at all.
I've tried bruteforcing hl-dump twice,one with the dongle server open, and one with it closed, I've tried some two different versions of Toro Monitor, also haSploGer (from sataron and xyrurg), tried SENTEMUL2008 and SENTEMUL2007 (which gives me the blue screen of death). Nothing worked. Not a single blick of identifying it as an Aladdin Hardlock - they all just ignored the presence of the hardlock.

So I'm guessing it's not an Aladdin Hardlock after all...

As for the ones you guys listed here, I'll try them all, but as of now I've only tried Eutron (eudump.exe), that doesn't recognize it at all. I've seen pictures of them all, though, and none of them ressembles the dongle I have.
Actually, since you asked for pictures, here it is.
Sorry for the lack of focus & poor quality, I have no cameras besides a webcam with me right now. But I guess we can see that it is very different from other dongles. (it's weight is also different from others - it is much heavier)


Do you have any ideas? The application itself is small (50mb), so I can upload it if you'd like to examine it.


Maybe it's time to think about actually cracking it. I'll take a look at that option more carefully, but it must be beyond my cracking experience.

Thanks again for the help!
van

Last edited by vanity : 09-13-2008 at 02:39 PM.
Reply With Quote
  #7  
Old 09-13-2008, 03:46 PM
kodyazan kodyazan is offline
Senior Member
 
Join Date: Jul 2008
Posts: 60
Default

Quote:
Originally Posted by vanity View Post
Hey Guys!
The application itself is small (50mb), so I can upload it if you'd like to examine it.
van
The application itself is small (50mb), so if you can upload it we'd like to examine it.
Reply With Quote
  #8  
Old 09-13-2008, 06:41 PM
Git Git is offline
Super Moderator
 
Join Date: Oct 2007
Location: Torino
Posts: 1,797
Default

Do you have a file called inrokey.sys in system32\drivers\ ?

Git
Reply With Quote
  #9  
Old 09-13-2008, 08:29 PM
vanity vanity is offline
Member
 
Join Date: Sep 2008
Posts: 5
Default

@kodyazan
http://rapidshare.com/files/145070640/emme-3.0.41.rar
pass: reboard
@Git
Yes! Indeed I have!!!
Reply With Quote
  #10  
Old 09-14-2008, 10:30 AM
Git Git is offline
Super Moderator
 
Join Date: Oct 2007
Location: Torino
Posts: 1,797
Default

There is your answer. It is an InroKey dongle.

Git
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump





Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2023, Jelsoft Enterprises Ltd.