Reverse Engineering RET Homepage RET Members Reverse Engineering Projects Reverse Engineering Papers Reversing Challenges Reverser Tools RET Re-Search Engine Reverse Engineering Forum Reverse Engineering Links

Go Back   Reverse Engineering Team Board > Reverse Engineering Board > Reverse Code Engineering
FAQ Members List Calendar Search Today's Posts Mark Forums Read

Thread Tools Display Modes
Old 09-14-2008, 11:11 AM
Harleych Harleych is offline
Join Date: May 2008
Posts: 7
Default the inro key doesn't hardlock

inro key doesn't hardlock.

so can't emulate the dongle now.
Reply With Quote
Old 09-14-2008, 12:24 PM
vanity vanity is offline
Join Date: Sep 2008
Posts: 5


so there's no simple way to emulate it?

As I said, I'm quite a newbie in dongle emulation,so maybe what I'm asking may sound foolish, but would it worth trying to create a table using a USB sniffer of the responses the dongle sends, and with that create an emulator?

Any way, there is a long road ahead.
Reply With Quote
Old 09-15-2008, 06:05 AM
kodyazan kodyazan is offline
Senior Member
Join Date: Jul 2008
Posts: 60


What I see, (and you can also see with debugger )

All socket communication. Connect(), Send(), Select(),Recv() functions.

After successfull connect, emma is sending 48 bytes to the server, below is a sample snapshot.

00EEF4A8 A5 AF 01 52 0E 0D 34 43 2F B7 62 26 97 F9 84 FD
00EEF4B8 E5 D3 47 7B 78 99 90 F1 01 6A 1C E4 BD 13 97 1B
00EEF4C8 6B 1B A1 E5 45 9F 7B 02 5B 4B 63 79 59 17 E9 EE

and after a good return from select() , recv() called with following parameters:

buffersize 512.

And returns 31 bytes below:
015BF988 01 32 09 32 09 33 09 30 09 30 09 30 09 70 65 74
015BF998 73 6F 09 30 09 09 32 2E 30 2E 32 09 30 09 00

(Forexample above contains my computer name.)

The crack SOLUTION should be:
1-Succesfull return values (zero or one) of socket functions maybe simulated. They are well-known. (WS2_32.lib). connect returns 0. etc.

2-So running InroKeyServer is not needed.

3-RECV() returns receives number of bytes and fills a memory area with received bytes. TRACKING THOSE BYTES , where they are used/compared may yield a FINAL SOLUTION.

3-If i had a dongle, I could trace where good solution goes in the code, and try to target there step by step.So tracking good responses may take you to solution faster.

Seperate small debugger notes:

-Put a breakpoint on 0070f0b0, where socket communication begins.
-Software is designed with QT. Dont tracein to QT function calls.
-Debugging while INROserver is running does timing errors.(Sometimes.)
-Socket communication is nonblocking.
-It opens atleast 2 threads in memory, they may communicate with shared memory.

I am only free at weekends, so may not look till next week. hope it helps.
Reply With Quote
Old 09-17-2008, 09:48 PM
vanity vanity is offline
Join Date: Sep 2008
Posts: 5


I'd like to kindly thank you! I won't write much right now, as I'm still debugging, and trying to understand the results, but until the weekend I will write a complete message.

Reply With Quote
Old 09-18-2008, 10:11 AM
Harleych Harleych is offline
Join Date: May 2008
Posts: 7
Default can make the emulator can make the emulator for INRO EMME

Last edited by Harleych : 09-19-2008 at 05:47 AM.
Reply With Quote
Old 10-01-2009, 12:19 PM
kapatmalan kapatmalan is offline
Junior Member
Join Date: Jul 2009
Posts: 3
Default rockey4nd

can anyone emuuuuuuu the rockey4nd dungle ??
Reply With Quote
Old 10-01-2009, 12:24 PM
BfoX BfoX is offline
Senior Member
Join Date: Aug 2007
Posts: 2,276
Send a message via ICQ to BfoX Send a message via MSN to BfoX Send a message via Yahoo to BfoX

@kapatmalan: read a previsions post carefull...
... Either you work well or you work much ....
Reply With Quote

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump

Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2023, Jelsoft Enterprises Ltd.