Oct 30, 2018 01:40 AM
(This post was last modified: Oct 30, 2018 07:54 AM by Kufe.)
I hope someone can help me with this problem, because I am struggling for 4 days (and a few nights) with this one... I decompiled some small VB6 app which checks for license online. It goes to specific url (.php?id=XXXXXX - where XXXX is some generated HW ID) and returns string with 3 parameters (divided with |). I can use host file to change DNS and use my own returned parameters, but I have a problem with 3rd parameter, because I don't know what it should be. The first parameter has to be OK, second is any name (it's just used to display Welcome NAME), third is the one causing me problems - it's some number I think (usually 3 digit). So returned text is something like OK|Mike|701.
*Solved, thank you AbakBarama.
DO NOT DEAL WITH THIS MEMBER
Would be easier if you sent full binary, your decompiled code makes little sense, also, you should just NOP out the license check instead of bothering to replicate a server response.
I don't know how at VB6. It's easy with C# or .NET but here I was only able to decompile with VB decompiler (can modify code and rebuild exe). Full exe is available here - mega.nz/#!KrgkxYIa!4Ipvua_31eV_CsTnqzz4uixRej-6KThmb_9zmTVrKwE
DO NOT DEAL WITH THIS MEMBER
(Oct 30, 2018 02:14 AM)Kufe Wrote: I don't know how at VB6. It's easy with C# or .NET but here I was only able to decompile with VB decompiler (can modify code and rebuild exe). Full exe is available here - mega.nz/#!KrgkxYIa!4Ipvua_31eV_CsTnqzz4uixRej-6KThmb_9zmTVrKwE
Do you have an example of a valid server response with the corresponding HWID?
Can you send it?
Oct 30, 2018 02:31 AM
(This post was last modified: Oct 30, 2018 03:00 AM by Kufe.)
(Oct 30, 2018 02:19 AM)John Doe 5726 Wrote: Do you have an example of a valid server response with the corresponding HWID?
Can you send it? If you send 9A979599C66D9D9D996E9F9A20203356300 returned value is OK|User|703
I think there is something done with second part of that number (20203356300), because first part even if I change in my register it still works.
DO NOT DEAL WITH THIS MEMBER
Oct 30, 2018 03:18 AM
(This post was last modified: Oct 30, 2018 03:21 AM by John Doe 5726.)
(Oct 30, 2018 02:31 AM)Kufe Wrote: If you send 9A979599C66D9D9D996E9F9A20203356300 returned value is OK|User|703
I think there is something done with second part of that number (20203356300), because first part even if I change in my register it still works.
When you try with your hijacked server response and another PC, the number 703 does not work, right?
Oct 30, 2018 03:35 AM
(This post was last modified: Oct 30, 2018 03:38 AM by Kufe.)
It does work.
Also 65976A69686C686365686C6639573726000 correct returned number is 1149.
Also same number for 686C6070626D689B966B9B9439573726000, so I guess the only important part of number where 1149 is generated is 39573726000.
DO NOT DEAL WITH THIS MEMBER
(Oct 30, 2018 03:35 AM)Kufe Wrote: It does work.
Also 65976A69686C686365686C6639573726000 correct returned number is 1149.
Also same number for 686C6070626D689B966B9B9439573726000, so I guess the only important part of number where 1149 is generated is 39573726000.
So what is the problem if it does work?
What could that value be?
Does the program have an expiration date? Several plans for which features are locked/unlocked?
just find out what is accessing the memory of 703
Oct 30, 2018 03:46 AM
(This post was last modified: Oct 30, 2018 03:47 AM by Kufe.)
(Oct 30, 2018 03:41 AM)John Doe 5726 Wrote: So what is the problem if it does work?
What could that value be?
Does the program have an expiration date? Several plans for which features are locked/unlocked?
When it works all is fine. I'm not sure if there is any expiration date - probably not. I just can't figure out how it calculates this number.
(Oct 30, 2018 03:41 AM)vercenta Wrote: just find out what is accessing the memory of 703
How can I do that? I posted code in my first post, but the problem is that I don't know how app checks value if it's correct when it gets it.
DO NOT DEAL WITH THIS MEMBER
Oct 30, 2018 03:52 AM
(This post was last modified: Oct 30, 2018 04:00 AM by John Doe 5726.)
(Oct 30, 2018 03:46 AM)Kufe Wrote: When it works all is fine. I'm not sure if there is any expiration date - probably not. I just can't figure out how it calculates this number.
How can I do that? I posted code in my first post, but the problem is that I don't know how app checks value if it's correct when it gets it.
I'm not on x86 so I can't spin up a Windows VM and debug your app, so you want to figure out what the value is when the program already works?
Yes, I want to know how app does the check, so 3. returned web parameter (1st and 2nd are not important) is received (example: 1149) and than app does the check. If it's wrong number (example: any other number as 1149) it displays error, if it's correct number it displays Welcome message. And from looking the code it has to be generated by second part of HW ID (example 39573726000) - it's information from disk if I am correct (first part if generated by register MachineGuid value - but I changed that and app still worked while checking the returned number).
maybe 703 isn't that relevant lol?? doesn't seem to serve too much purpose of security
if the program accepted 703 two weeks ago and it does still today then it's probably fine
(Oct 30, 2018 03:59 AM)vercenta Wrote: maybe 703 isn't that relevant lol?? doesn't seem to serve too much purpose of security
if the program accepted 703 two weeks ago and it does still today then it's probably fine
Each computer gets different number returned. It's based on sent HWID.
do 0-65535 until it works ; )
|
