3

I have a USB flash drive, with 2 partitions : one is read only and contains a Windows software, and the second is read/write for user data. In order to not damage this precious key, I want to do a working copy of this stick, but of course I face the problem of the protected program on the RO partition : it detects if it is running on an other stick, or on a hard drive.

Exact copy attempts

By using some USB chipset manufacturer tools, I succeeded on copying the original key serial number (16 char) and the volume label (xxxx-xxxx) to the destination key. I can't change the VID/PID of the new key, the AlcorMP tools seems not supporting this well. The two keys use different chipset (Micron or Alcor). The software partition was cloned by using USB-Image-Tool, and is in RO mode.

So basically, the new key is an almost exact copy of the original one. The only difference I can see is the VID/PID. But maybe I'm missing some other chipset info that should be also copied.

I was wondering what kind of checks the program do on the USB key : serial number and volume labels are the same, disc structure also. It may be some other low-level check, but the program do not require admin rights to works.

Bypass software protection attempts

The .exe of the program is quite small (<300kb) and when I launched it on the copied key, I got a message like "please insert original usb key". When I look at the binary with an hex editor, I can't find this string. I tried to decompile with IDA Free and X64Dbg, but when running the program in these debuggers, it crash after starting a few threads. When I look at the disassembled program, and I execute it step by step, it looks like there is some kind of self modifying code, because I saw the code beiing modified as it executes itself. I suspected some kind of decompiler protection or and anti-debugger feature, but I was not able to deactivate it. I use the HideDebugger feature also. I can attach the debuger after launching the program.

Theorically, it should be feasible to deactivate the program protection by doing some nop nop nop somewhere on the code (I used to do this at the previous century for an old DOS game), but I got lost because of the program protection.

Do you have any other idea on how to create an exact copy of the key ?

Improve this question
7
  • 1
    Maybe it's packed .. run it through DIE and see what it can find.
    – Mega Tonnage
    Commented Oct 4, 2022 at 22:19
  • Thanks for the tip on using Detect-It-Easy. It says "PE32 / Overlay:Binary". Heuristic scan reports "eXPressor" and "VMProtect"... Dont know what to do with this.
    – JayMore
    Commented Oct 5, 2022 at 6:49
  • if its VMProtect its almost game over. VMProtect is a really tough obfuscator. They probably use it to make the dongle check hard to see through.
    – masterX244
    Commented Oct 5, 2022 at 8:55
  • After doing some more tests with a debugger, it seems the program use a custom packager, simplier than VMProtect. I could not find a program to unpack it. So, I can run it inside the debugger (thanks to ScyllaHide),. But breakpoints (GetDriveTypeA) are changing from run to run because the prog unpacks itself in different memory segment depending when you launch it. So, every time I start the program, I have to place new breakpoints. I do not find a way to save the unpacked program as a standalone .exe (I follow some tutos, but no luck). Work in progress...
    – JayMore
    Commented Oct 7, 2022 at 7:12
  • @JayMore new locations could also be due to ASLR. Are you certain the offsets of breakpoints change relative to the image base as well?
    – 0xC0000022L ♦
    Commented Oct 7, 2022 at 7:57

1 Answer 1

Reset to default
2

You can use USB sniffer to see if you can spot any difference in communication with USB. If difference is in VID/PID you could buy some cheap MCU development board and make small (<300 kB) mass storage device with it and just copy the correct VID/PID. There should be a lot of examples around for that. There might be some option to create software/virtual USB device, but I couldnt find definite answer if it is possible.

Improve this answer
3
  • One thing you could attempt is to use a device such as GreatFET One with FaceDancer in order to pass through USB traffic (much like the sniffer attempt). Based on that you would be able to either program the GreatFET in a way that allows you to fake the original device or to fake the part of the traffic that differs while using a clones key. Similarly it should be possible to fake a whole (read-only) file system and even "change" its contents on the fly.
    – 0xC0000022L ♦
    Commented Oct 7, 2022 at 9:18
  • 1
    @0xC0000022L GreatFET seems like hardware equivalent of my suggestions. It is rather expensive for my taste, but it should work.
    – Rok Tavčar
    Commented Oct 7, 2022 at 11:13
  • Thank your for this suggestion. I wish I could find some kind of virtual USB flash driver to allow a virtual mount of a USB key (where you can set VID / PID / Serial Num etc), but it seems such kind of software do not exists.
    – JayMore
    Commented Oct 18, 2022 at 7:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.