I have a USB flash drive, with 2 partitions : one is read only and contains a Windows software, and the second is read/write for user data. In order to not damage this precious key, I want to do a working copy of this stick, but of course I face the problem of the protected program on the RO partition : it detects if it is running on an other stick, or on a hard drive.
Exact copy attempts
By using some USB chipset manufacturer tools, I succeeded on copying the original key serial number (16 char) and the volume label (
xxxx-xxxx) to the destination key. I can't change the VID/PID of the new key, the AlcorMP tools seems not supporting this well. The two keys use different chipset (Micron or Alcor). The software partition was cloned by using USB-Image-Tool, and is in RO mode.
So basically, the new key is an almost exact copy of the original one. The only difference I can see is the VID/PID. But maybe I'm missing some other chipset info that should be also copied.
I was wondering what kind of checks the program do on the USB key : serial number and volume labels are the same, disc structure also. It may be some other low-level check, but the program do not require admin rights to works.
Bypass software protection attempts
The .exe of the program is quite small (<300kb) and when I launched it on the copied key, I got a message like "please insert original usb key". When I look at the binary with an hex editor, I can't find this string. I tried to decompile with IDA Free and X64Dbg, but when running the program in these debuggers, it crash after starting a few threads. When I look at the disassembled program, and I execute it step by step, it looks like there is some kind of self modifying code, because I saw the code beiing modified as it executes itself. I suspected some kind of decompiler protection or and anti-debugger feature, but I was not able to deactivate it. I use the HideDebugger feature also. I can attach the debuger after launching the program.
Theorically, it should be feasible to deactivate the program protection by doing some
nop nop nop somewhere on the code (I used to do this at the previous century for an old DOS game), but I got lost because of the program protection.
Do you have any other idea on how to create an exact copy of the key ?