// Script for OllyScript plugin by SHaG - http://ollyscript.apsvans.com
// Second Version of Haldir's Flexlm Seedfinder Script for Ollydbg
// Supported should be every Flexlm version >=7.2
// Remove all BP in the code before running this script
// Codebase is usually 00401000 for .exe or 10001000 for .dll
// In more recent Flexlm versions you need a faked license (like Feature f1 1.000 permanent uncounted HOSTID=ANY SIGN=12345678)
// otherwise it might not work

var jobstruct
var codebase

// start
msgyn "Did you remove all BPs?"
cmp $RESULT,1
je setup
ret


setup:
ask "Enter Codebase of the Flexlm Module"
cmp $RESULT, 0
je cancel
mov codebase, $RESULT
jmp findlsg

cancel:
msg "Please enter Codebase"
ret

// It searches for a cmp with 0x87654321, which is located below a call to l_sg
// Then we calculate the offset for the call and execute to it
findlsg:

var pos
var callpos
find codebase, #81BD????????21436587#
mov pos, $RESULT
cmp pos, 0
je error
mov callpos, pos
sub callpos, 07
sub pos, 03
add pos,[callpos]
eval "l_sg is at: 0x{pos}"
msg $RESULT
go pos
jmp lsg

error:
msg "An unknown error occured"


// The call to l_n36_buff is a call dword ptr, so we calc its offset again and execute to it
lsg:

var pos
var n36pos
mov pos, eip
find pos, #FF15????????#
mov pos, $RESULT
add pos,2
mov n36pos, [pos]
mov pos, [n36pos]
eval "l_n36_buff is at: 0x{pos}"
msg $RESULT
go pos
jmp n36buff

// We patch the Jobstruct at the EB05 jmp shortly above the vendor name loop
n36buff:

var pos
mov pos, eip
find pos, #EB05#
mov pos, $RESULT
go pos
jmp findjobstruct

// We check the registers to find the job struct (we check only edx and ecx (haven't seen anything else yet))
findjobstruct:

var check
mov check, [edx]
cmp check, 66
mov jobstruct, edx
je found
mov check, [ecx]
cmp check, 66
mov jobstruct, ecx
je found
jmp error

// Now we delete the rand() values in the job struct and execute to the end and fish the seeds from there
found:

add jobstruct, 04
fill jobstruct,10,00
rtr
var seed1
var seed2
var struct
var tempstruct
mov struct, ebp
add struct, 10
mov tempstruct, [struct]
add tempstruct,4
mov seed1, [tempstruct]
add tempstruct,4
mov seed2, [tempstruct]
eval "Your seeds are Seed1: 0x{seed1} and Seed2: 0x{seed2}"
msg $RESULT
ret

// [BACK]