Bypass USB key activation of a software

Question

(The software is Chinese and contains malware. I do not know if I could upload it here, so temporarily, please let me describe it)

I am asked by a spa store to "do something" to make a software that looks like from 2003 for them to use, the name is "Ehang skin analysis system". The spa store gave me an usb key (a dongle usb), which they borrowed from another store, and they have to return it when they have a copy.

I could not find any information about the software on google. Plus, the usb key does not appear anywhere on the computer, from emulators to rufus, not even on Linux, so that I do not figure out how to clone it, or find out if it is sentinel or HASP. So the only way is to reverse it. I am using x64dbg.

The software uses VMProtect, I passed it by using Scyllahide.

But I am stuck at this step, below is when I did not insert the USB key

The start of the software

after clicking "play" 3 times

Play 4 times, please note that the pointer is at another line, 00478E56 to 00474E91

Play 5 times

At the 6th play, a message appeared asks to insert USB key

I restarted it and insert the USB key, and at the 6th play this time, at the same line 0047A868 just like the very above, but this time the code turned into:

Click one more play and the software worked. Still at the same line 0047A868

I have tried dozen times, but before and after inserting the USB key, everything just "turned into" other codes, not that they jump from code A to code B, popfd just turned into ret without any step. I have tried with step into and step over and animate. The pointer stand still at the same line but only the code is changed. So I do not know where to jump into the code that makes the software work.

So, how to make it turn into the working code without the USB key?

Answer 1

As expected, the USB was indeed detected but due that Linux has no idea how to deal with it without a proper driver, it only parses its hardware related parameters (Vendor and Product IDs) and stops there.

Here are the USB device's entries in usb-devices and lsusb commands respectively:

# usb-devices
[...]
T:  Bus=01 Lev=02 Prnt=05 Port=00 Cnt=01 Dev#=  8 Spd=1.5 MxCh= 0
D:  Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 8 #Cfgs=  1
P:  Vendor=3689 ProdID=8762 Rev=02.00
S:  Manufacturer=USBKey
S:  Product=USBKey
C:  #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=50mA
I:  If#= 0 Alt= 0 #EPs= 1 Cls=03(HID  ) Sub=01 Prot=00 Driver=usbhid
[...]

# lsusb
[...]
Bus 001 Device 008: ID 3689:8762
[...]

I came to the conclusion that this is the USB device because these are the only differences between the two files *with_usb* and *without_usb* using the commands lsusb and usb-devices.

So now, I would start sniffing the bytes sent from the USB to the OS as soon as the USB is plugged in, mostly won't be able to make any sense of them, but maybe writing a driver that emulates the device's communication behavior would be the quickest and easiest approach to bypass the mandatory protection policy of running the software with the USB device plugged in.

For the sniffing part, you can use anything based on libusb, or of course a wrapper for it in any scripting language. Myself, I'm a fan of Python, so here is a little script using Python's PyUSB library:

#!/usr/bin/env python3
try:
    import usb.core
    import usb.util
except ImportError:
    print("Couldn't find 'pyusb' library!")
    exit(-1)

# The 'Vendor' and 'Product' IDs from 'lsusb' or 'usb-devices' entries
vendorID  = 0x3689
productID = 0x8762

# Assuming the first interface
usbIF = 0

# Find the USB device
# The USB must be plugged in before running the script
device = usb.core.find(idVendor=vendorID, idProduct=productID)

# Check if device exists
if device == None:
    print("Device doesn't exist!")
    exit(0)

# Check if device is attached, detach it
if device.is_kernel_driver_active(usbIF):
    device.detach_kernel_driver(usbIF)

# Now you will want to fuzz a bit the USB endpoints
(inputCmds, outputCmds) = device[0][usbIF,0].endpoints()

If emulating the USB packets worked, that would be a much easier approach to work on the application without the USB device plugged in, without the need to reverse a VMProtect software.