I realize this is a huge question but any insight you can provide will be much appreciated. OK, let's consider a file protected/wrapped by HASP.

What's the general layout of said file? There's a HASP API that's embedded. Is it easily identifiable, i.e. more or less a full module, or is it cut up and distributed throughout the file?

When the file is started, is it decoded in its entirety or does it employ a decode/re-encode scheme? How does it move between layers in the decoder?

What are the passive protections of HASP (e.g. import redirection)?

What are the active protections of HASP (e.g. IsDebuggerPresent())?


i was involved in black-box identification of HASPs some years back (actually when i was student). What we supposed to do was "sniff" the ports to see what data went back-n-forth between the application and the dongle, then try to simulate it or maybe model some function after it. However the basic task was to check the data transference. i remember there were software (HASP testers) which could already do much of this job.

When you have the data map and where in the api these are processed (using a debugger) it could make it easier.

Each applicatioon can use its own way of communicating with the HASP (although there are canned routines and modules also)

Does this help you?

| improve this answer | |
  • MITM is more of a general approach and doesn't really answer any of my questions. Also, I'd imagine it would be difficult to map the entire set of queries/answers by just passively listening in. You would probably need to provoke the more rare queries into being sent to have some decent progress? – ows May 25 '14 at 10:58
  • yes true, as i said this was many years back, maybe someone can post a better answer – Nikos M. May 25 '14 at 18:00
  • There was a book some years back called "Hacking the Xbox", i presume (havent read it) that some techniques there might be useful as it deals with both hardware and software. i am almost sure there are other books on similar topics – Nikos M. May 26 '14 at 15:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.