Site bbs.pediy.com also explain most of old version flexlm.
Most of china people use 3D4DA1D6h location and find seed1/seed2.
They say "The default value to clean the seeds variable is 3D4DA1D6h.
A lot of vendors are lazy or foolish and don't change this default value. So, a very easy way is just search the pattern 3D4DA1D6h in disassembled codes.
You'll get a lot of codes like this : mov [ebp-xxxx], 3D4DA1D6h.
Just break on every instance containing this value and ....... run.
If the program is checking the license, write down the value in [ebp-xxxx] when the first breakpoint is reached.
It's your seed1 (not XORed with key5, it's original seed1). The second breakpoint you get, it's seed2.
And trace a little back to the function entry, the keys (1~4) are in the parameters.
Anyway, this method won't work for every case, but for beginner, it's easy to learn. ;-)."
values to find the seeds depends on the version of flexnet to believe that the vendor daemon
7648B98E for flexlm v7.x to v8.C
6F7330B8 for Flexlm v8.D and onwards
Bookmarks