Hasp HL Pro - can't get PW numbers in any way

[Theoristos]

Hello.
I have a piece of software which uses Hasp HL Pro key with such original drivers:

hasplms.exe v. 12.50 (it looks like software connects to key via that web server interface, without it soft displays general HASP error)
hardlock.sys v. 3.67
aksfridge.sys v. 1.56

As a first step, as I understand, I need to get a session passwords.
I tried a lot of software on Win7 and WinXP, but can't get anything or even worse - soft stops to recognize key till reinstalling.

(among the other)
Toro Dongle Monitor v. 3.2 before installing USBFilter drivers can't find any exchange.
After installing USBFilter software fails to find a key, and Toro Monitor didn't show any too.
Also, I saw a recommendation to install v.5.2 HASP driver. But the recommended driver contains hardlock.sys only, so the program can't find a key. If I overwrite v.5.2 hardlock.sys above installed original drivers, the program works ok, but Toro shows nothing as above.

I tried 2 or 3 other loggers - they can't find anything too.

Also, I try to bruteforce connection with some hl-dump.exe - no luck, " Bruteforcing is done. But we did not found MODAD to open your dongle!"

Also, I to log USB and TCP connection with WireShark, but can't understand how to extract PW (if possible) in that "0x000000e900000000" strings.


Can anyone tell me what a root of problem (may that web server interfere with logging soft?) and how to grab PW data and key internals?

[Theoristos]

... also I complete puzzled with which data is needed to connect to key. Different sources tells completely different things for the same HL key ( maybe due to different generations of protection interface? )

hl-dump.exe source code tells about some MODAD number simply in range 0..32768 (less than one word)

Toro and some other dumpers tells about PW1 & PW2 numbers (16-bit word size each)

Official documentation tells that login() function needs not 1 word or 2, but some "vendor_code" structure with a couple of bytes.

Maybe you point me to some documentation on internals of protection and how data flows and works ?

[BfoX]

tell us the vid/pid for this dongle from the usbviewer

[Theoristos]

tell us the vid/pid for this dongle from the usbviewer

HASP HL 3.25
VID 0529
PID 0001

[BfoX]

possible to make screen from http://127.0.0.1:1947/_int_/devices.html ?

VID_0529 & PID_0001 for hasp3/4, hasp hl, hardlock

[Theoristos]

BfoX: sorry can't have key now, have stored a copy-paste from web screen:

#    Location    Vendor        Key ID        Key Type    Configuration    Version    Sessions    Actions
1    Local        45087         nnnnnnnn     HASP HL Pro      -            3.25       2           Products   Features   Sessions   Blink on 
                  (45087)
...
FW Revision : 3.25
HW Revision : 6.1.0
...

The key was definitely Hasp HL Pro (purple)


ps: also, another part of log:

License Manager     Version    20.0 Build 70827
Host Operating System    Windows 7 Professional Build 7601
            Intel64 Family 6 Model 44 Stepping 2
LM Protocols        IPv4, IPv6 (TCP and UDP at port 1947)
Uptime            0 days 2 hours 31 minutes 26 seconds
Template Sets        _int_
Current Template    English 10.0 (28 June 2017 Build 1)
Current Usage        1 logins, 2 sessions
Login Requests        61 (2 peak simultaneous logins)
Requests        255 local, 1 remote, 256 total
Data Volume        198,238 received, 804,657 transmitted
Errors            0 Key related, 0 in Transport
Client Threads        1 (3 peak)
Memory Used        1,300,290 (1,190 blocks)
Run-time        Run-time Installer        7.60 
            Run-time Package        7.60 
            aksusb.sys            3.43 
            akshhl.sys            1.26 
            aksclass.sys        1.31 
            akshasp.sys            4.26 
            hardlock.sys        3.91 
            fridge_lib            1.8 
            aksfridge.sys        1.77

[BfoX]

first scren - yes, hash hl. hasp srm part you can dump without problem, but pw1/2 for hasp hl part you need try to extract from sotware. maybe vendor aes key extraction also possible. 50/50
last screen is standard set of the drivers for license manager

[Theoristos]

first scren - yes, hash hl. hasp srm part you can dump without problem, but pw1/2 for hasp hl part you need try to extract from sotware. maybe vendor aes key extraction also possible. 50/50
last screen is standard set of the drivers for license manager

Yes, I already have dumped srm part, but can't do anything with hl one.
And at this moment spent all the ideas except "try to debug exe and try to catch when and what it sends to prot. software".
Can't find any docs about that at all.

[BfoX]

have the software installer?