Bruteforce KLicense Tools Discussion

[tonybologna]

Thanks FinalFight !
I updated the file again... it now should decrypt 4 times faster!!, thanks to a tip from deank!

http://aldostools.org/temp/scetool_0.2.8_bruteforce.7z

It now should also fixes the 8001003C too. So please test and let me know if you find a bug

I know you wouldn't upload any files with viruses. However, my anti-virus is removing the file by web scanning automatically. It's being detected as a trojan. I'm just gonna disable web traffic scanning for a moment to download. Thanks!

[PatrickBatman]

Also out of all these klic's and ELF 64 I compared the key is always exactly on or really close to the ELF64 section headers (usually the offset but sometimes the address)

ELF 64 section headers:
Idx  NameType        Flags  Address     Offset   Size        ES   Align    LK
025 0102 PROGBITS      WA-   000610E0   000510E0 00004778 0000 00000010 000
"000510F0offset of key,line before key for red dead 1.07"

012 0085 PROGBITS      -A-   00025698   00015698 00002C50 0000 00000008 000
"00015750offset actual key DA 2 1.05"

012 0089 PROGBITS      -A-   0001D4B0   0000D4B0 00001720 0000 00000008 000
"CODMW3 key at same spot 1.02"

025 0106 PROGBITS      WA-   00A3D800   00A2D800 0001646C 0000 00000080 000
"00A3B230offset COD black ops 1.11"

So if bruteforce.exe could check the ELF64 address & offsets first and even better within 10,000 (approx) bits of each one both directions I think we'll get the key much faster.

oh also look all of these are either at 012 or 025 index may just be a coincidence. If it isnt that would narrow it down even more to just search ELF64 idx 012 & 025 within 10,000 (approx) bits both directions.

[andreus]

@aldostools
The tool is not working
It's your tool skipping the odd numbers?

[aldostools]

removed post

[andreus]

aldostools, i have an error with your latest "missing scetool.exe"

EDIT: working now with 1.3.1

[PatrickBatman]

For testing purposes the Portal 2 klic key:

19089CBAF948487F9530832BF477B369

This is good one to get you better at working with .sprx

[aldostools]

removed post

[PatrickBatman]

Cool good to know, yeah most klic's I found so far are aligned to 4 or at least even, but not portal 2. Another problem, which is no fault of you Aldos or the original .bat author, but is with scetool.exe, say you wanted to leave run overnight, well after so long (random) an hour or so, scetool.exe will stop working (prolly because it's being used so often and so quickly through the .bat) anyway if it stops working so does the bruteforcing until enter is pressed to make the stopped working message go away. So if you're away from the computer well that wastes alot of time if this happens.

Since its prolly a problem with the scetool.exe tool itself, I could bring this up to naehrwert on the dev irc (prolly wont help), or make an "if" command in the coding where if "scetool.exe stops working" appears or whatever then "enter", so that prompt goes away and bruteforcing can continue without the user being present to press the enter button.

[schraube]

now we need a multithreaded bruteforce tool i wrote one and it's ~4 times faster in finding keys.

[andreus]

@aldostools, the data aligment of each section is described in the last section

So i don't think you need to select the data aligment, i think you could calculate the aligment in the current section with this info (multiples of x from the section start offset), as you can see there are section with an aligment of 80 so it will turn it must faster! I think the aligment is also in hex values.
Please note that when skipping parts you must also validate if the next value to try is in the correct section aligment