0

So I'm learning Reverse Engineering / Software cracking. I have a program that I am practicing on that requires a dongle in order for the program to start.

From looking through the disassembly of the program I figured out that at some point of the execution the program is calling winscard.dll When the dongle is inserted, in Windows it comes up as a smart card reader.

When there is no dongle inserted, the software gives you a MessageBox stating The dongle not found. I've found this execution point in user32.dll, but I can't figure out at which point does the main software call this.

I'd like to be able to figure out at what point does the software call winscard.dll and what it's looking for as a return. I've tried to figure this out with Ollydbg and also IDA Pro.

Any help for someone trying to learn would be great.

Thanks

Improve this question
3
  • Why don't you set a break point on all MessageBox calls, run the program without the dongle (to trigger the break point) then look at the stack trace to see what functions were called leading up to the current function call.
    – user15338
    Commented Mar 10, 2017 at 13:52
  • That's the thing, I don't know how to proceed.. In ollydbg I select breakpoint--> and put a check on MessageboxW because in IDA I can find it in import, but ollydbg never stops on them.. I look at trace and I have no idea what function is calling MessageBox pastebin.com/FLu1JjQz
    – SoupyLoops
    Commented Mar 10, 2017 at 18:44
  • Learning Reverse Engineering by cracking a dongle is perhaps not the best idea. Cracking a "state of the art" dongle is a rather advanced task. If you really want to do it, you have no choice as to first understand how the hardlock works by using a debugger, and then think about a way to remove the protection. Good luck!
    – josh
    Commented Jun 26, 2021 at 9:07

1 Answer 1

Reset to default
1

First please not that the dongle may be used for cryptographic purposes, so there might be no point in trying to skip the check.

Second, winscard.dll can not be called. Try to set a breakpoint on common methods like SCardEstablishContext and SCardListReaders to find the right check.

For example, if no SmartCard is connected to the system at all, SCardListReaders will return 0x8010002E (SCARD_E_NO_READERS_AVAILABLE).

I'm assuming the second check would involve the mszReaders parameter of the function to check if the right reader is connected.

If you knew the location of the 'success'-path (i.e. the address which is executed when everything is fine) you could try to jump there from these locations, else you will have to go though the next branches as well.

Good luck.

Improve this answer
2
  • Thanks for answering. I don't think it's used for encryption, only to verify the presence of a dongle. If I start the program and remove the dongle, it still works. I will check for those methods.
    – SoupyLoops
    Commented Mar 10, 2017 at 21:42
  • I figured out how to set a breakpoint everytime winscard.dll is located. It seems to be checking this over and over in ntdll.dll pastebin.com/pZD3jiXj
    – SoupyLoops
    Commented Mar 10, 2017 at 22:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.