1

I'm trying to bypass the license validation process of a very old program called COSIMIR. It uses a USB dongle (which we have) however I don't have access to it, because it belongs to my university.

And there is a student version of COSIMIR, the problem is that it isn't compatible with anything we do in the other one, so I copied every file of the Industrial version into my lap and got the installation fixed with olly (because many things where missing). I had to do this because the person who installed this software (and therefore the one with the installer) doesn't work there anymore.

After fixing it up, and being able to execute it from start to end I finally got into the activation failure screen, the problem is, I don't know where to start. I mean, which .dll is used to initialize the dongle? My plan was to avoid its init, and see if I can jump my way though without creating an exception, is my first crack with a dongle, so I don't know if it's the right way to go. Also this is the screen I get popped into:

enter image description here

However, after seeing it, I started wondering if it would be easier to try to bypass one of the other 2 methods, by the way I'm like 80% sure it just uses the dongle for the license. Also, I'm almost sure it uses a Marx Dongle, since the one we have attached in the back of the computer we have licensed looks exactly like this one:

enter image description here

However the one the installation guide of COSIMIR indicates, looks completely different. Also, even though I cannot detach that dongle (because it is secured to the PC mainly because somehow the PC will stop working is we disconnect it, I still can do some fast debugging commands in there lie a run trace or stuff like that.

To keep things short, my main question is: Which library should I put my breakpoint on if I want to avoid the USB access? my main suspects are:

  • COMCTL
  • COMBASE
  • UCRTBASE

and my secondary suspects are

  • CRYPTBASE
  • BCRYPT

Also, I'm going to try to reach the Company by mail as Nordwald suggests, but even if I get a positive response, I would enjoy the help, for learning purposes.

Improve this question
1
  • I also want to create a virtual dongle from my original USB with the COSIMIR license. May you please share the process that Festo shared you to create a pseudo-dongle? Thanks!
    – ggiorgana
    Jan 25, 2022 at 22:30

3 Answers 3

Reset to default
2

Reverse Engineering has always been about finding the right place to start. There are two common options here:

Prevent activation checks

For activation purposes, its most likely the best way to search for references to a string related to activation. In this particular case, I would use a decent decompiler like BinaryNinja, IDA or radare2 to find references to

Please attack an appropriate license connector or license server

This will most likely lead you to the place this window is initialized. Go back from there looking at the conditions checked before invoking the window creation.

Make activation succeed, when it fails

This one is a little bit more tricky, because most likely you will have to patch at serveral places. Try to run any kind of activation, wait until you get an error message (e.g. 'no activation dongle attacked'), find references to this string and start going backwards from there. Most likely you will find a check if the USB dongle is attached. Patch it and continue from there. Could be pretty tedious.

also:

Don't crack software. Any information stated above is purely educational.

You can always try to contact the company:

Adresse: Am Hausbruch 7, 58239 Schwerte

Telefon: 02304 44447

Kind regards

Improve this answer
3
  • ill try to reach them, however it seems like they no longer support that software since is no longer on their website (not even the student version), however the software seeks for a valid license on the startup, and after finding nothing it pops me into that string, the problem is I still dont know where to stop it, after reaching that screen I only have the choice of the internet installation, so im sure it asks for the dongle before poping up that window, specially since before that window there is another one whic is pretty much the same but with the message "searching for a valir license"
    – Lohug
    Oct 11, 2017 at 13:51
  • but also, I found in the referenced strings many "license verification" processes, but eventhough I breakpointed themall, the program ran from start to end without stopping, so my belief is that it checks for a valid connection before entering those cycles.
    – Lohug
    Oct 11, 2017 at 13:52
  • Sorry for the long delay man, I finally done it, it looked like it actually did interfaced with the dongle but just for initiallitation processes in the end i was able to do it, we we able to finally ge an answer from festo and they told us a "way" to make a pseudo-copy of the dongle, they didnt sent one though because they said that it was discontinued software, however since the whole problem was to keep the original safe, with this copy i was finally able to makea kind of executable that had like "virtual dongle" inside the exe compilation, so far in looks like it works
    – Lohug
    Dec 20, 2017 at 8:12
0

USB keys used for software protection are often not that easy to bypass, and the techniques described in the other answer will likely not work. Depending on the implementation, USB key may be used for one of the following purposes:

  • Performing cryptographic calculations, such as RSA/AES. License key is sent to the stick and the response is validated by software. In this case, you can just patch out all the checks but then again, it's unlikely the stick is used just for that;
  • Storing some crucial data in encrypted form. Data is decrypted by using license key and sent to the host;
  • Storing some critical code paths, same as previous except the program literally cannot be executed without decrypting and downloading these code fragments;
  • Executing parts of the code on the stick itself. The program offloads some of its operations to the stick.

So, it all boils down to the implementation. In some cases, the missing code/data can be reimplemented in the host software, and that requires additional RE effort.

Improve this answer
2
  • I know!, and i used to think just like that, but then, why is it that i can activate the software by other ways that dont require a Dongle at all?
    – Lohug
    Oct 11, 2017 at 13:45
  • Good point. You just need to make sure internet activation doesn't pull some crucial code fragments from the server.
    – Vladislav Ivanov
    Oct 12, 2017 at 6:08
0

According to their developer documentation, it could be one of the following dll files:

mpiwin32.dll
CBIOSVB6.DLL
WebLM.dll
CBIOS4NET.dll
CBIOS4NET64.dll

It's always a good idea to go to the dongle's manufacturer website and see if they have document for developers describing their API.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.