// Script for OllyScript plugin by SHaG - http://ollyscript.apsvans.com
// Second Version of Haldir's Flexlm Seedfinder Script for Ollydbg 
// Supported should be every Flexlm version >=7.2 
// Remove all BP in the code before running this script 
// Codebase is usually 00401000 for .exe or 10001000 for .dll 
// In more recent Flexlm versions you need a faked license (like Feature f1 1.000 permanent uncounted HOSTID=ANY SIGN=12345678) 
// otherwise it might not work 

var jobstruct 
var codebase 

// start 
msgyn "Did you remove all BPs?" 
cmp $RESULT,1 
je setup 
ret 


setup: 
ask "Enter Codebase of the Flexlm Module" 
cmp $RESULT, 0 
je cancel 
mov codebase, $RESULT 
jmp findlsg 

cancel: 
msg "Please enter Codebase" 
ret 

// It searches for a cmp with 0x87654321, which is located below a call to l_sg 
// Then we calculate the offset for the call and execute to it 
findlsg: 

var pos 
var callpos 
find codebase, #81BD????????21436587# 
mov pos, $RESULT 
cmp pos, 0 
je error 
mov callpos, pos 
sub callpos, 07 
sub pos, 03 
add pos,[callpos] 
eval "l_sg is at: 0x{pos}" 
msg $RESULT 
go pos 
jmp lsg 

error: 
msg "An unknown error occured" 


// The call to l_n36_buff is a call dword ptr, so we calc its offset again and execute to it 
lsg: 

var pos 
var n36pos 
mov pos, eip 
find pos, #FF15????????# 
mov pos, $RESULT 
add pos,2 
mov n36pos, [pos] 
mov pos, [n36pos] 
eval "l_n36_buff is at: 0x{pos}" 
msg $RESULT 
go pos 
jmp n36buff 

// We patch the Jobstruct at the EB05 jmp shortly above the vendor name loop 
n36buff: 

var pos 
mov pos, eip 
find pos, #EB05# 
mov pos, $RESULT 
go pos 
jmp findjobstruct 

// We check the registers to find the job struct (we check only edx and ecx (haven't seen anything else yet)) 
findjobstruct: 

var check 
mov check, [edx] 
cmp check, 66 
mov jobstruct, edx 
je found 
mov check, [ecx] 
cmp check, 66 
mov jobstruct, ecx 
je found 
jmp error 

// Now we delete the rand() values in the job struct and execute to the end and fish the seeds from there 
found: 

add jobstruct, 04 
fill jobstruct,10,00 
rtr 
var seed1 
var seed2 
var struct 
var tempstruct 
mov struct, ebp 
add struct, 10 
mov tempstruct, [struct] 
add tempstruct,4 
mov seed1, [tempstruct] 
add tempstruct,4 
mov seed2, [tempstruct] 
eval "Your seeds are Seed1: 0x{seed1} and Seed2: 0x{seed2}" 
msg $RESULT 
ret

// [BACK] 