// Script for OllyScript plugin by SHaG - http://ollyscript.apsvans.com// Second Version of Haldir's Flexlm Seedfinder Script for Ollydbg// Supported should be every Flexlm version >=7.2// Remove all BP in the code before running this script// Codebase is usually 00401000 for .exe or 10001000 for .dll// In more recent Flexlm versions you need a faked license (like Feature f1 1.000 permanent uncounted HOSTID=ANY SIGN=12345678)// otherwise it might not workvar jobstructvar codebase// startmsgyn "Did you remove all BPs?"cmp $RESULT,1je setupretsetup:ask "Enter Codebase of the Flexlm Module"cmp $RESULT, 0je cancelmov codebase, $RESULTjmp findlsgcancel:msg "Please enter Codebase"ret// It searches for a cmp with 0x87654321, which is located below a call to l_sg// Then we calculate the offset for the call and execute to itfindlsg:var posvar callposfind codebase, #81BD????????21436587#mov pos, $RESULTcmp pos, 0je errormov callpos, possub callpos, 07sub pos, 03add pos,[callpos]eval "l_sg is at: 0x{pos}"msg $RESULTgo posjmp lsgerror:msg "An unknown error occured"// The call to l_n36_buff is a call dword ptr, so we calc its offset again and execute to itlsg:var posvar n36posmov pos, eipfind pos, #FF15????????#mov pos, $RESULTadd pos,2mov n36pos, [pos]mov pos, [n36pos]eval "l_n36_buff is at: 0x{pos}"msg $RESULTgo posjmp n36buff// We patch the Jobstruct at the EB05 jmp shortly above the vendor name loopn36buff:var posmov pos, eipfind pos, #EB05#mov pos, $RESULTgo posjmp findjobstruct// We check the registers to find the job struct (we check only edx and ecx (haven't seen anything else yet))findjobstruct:var checkmov check, [edx]cmp check, 66mov jobstruct, edxje foundmov check, [ecx]cmp check, 66mov jobstruct, ecxje foundjmp error// Now we delete the rand() values in the job struct and execute to the end and fish the seeds from therefound:add jobstruct, 04fill jobstruct,10,00rtrvar seed1var seed2var structvar tempstructmov struct, ebpadd struct, 10mov tempstruct, [struct]add tempstruct,4mov seed1, [tempstruct]add tempstruct,4mov seed2, [tempstruct]eval "Your seeds are Seed1: 0x{seed1} and Seed2: 0x{seed2}"msg $RESULTret// [BACK]