Re: [Full-disclosure] cloning PC / run in VMware

[endrazine <endrazine@xxxxxxxxx>]

indianz@xxxxxxxxxx wrote:
> Hi there
>
> Thanx for information... Will try my best :)
>
> Have a nice day,
> GreetZ from IndianZ
>
>
>   
>>>> Don't tell me a simple greyed out checkbox can stop you ...
>>>>         
>>> ^---> foudstone's showwin.exe usually does the trick
>>>       
>> Actually, it's a bit harder.
>>
>> At export time, the Crypto provider will check the "non exportable"
>> flag, even if you have "ungreyed" the checkbox.
>>
>> >From here you have 2 choices :
>>
>> - Searching for the private key blob in the process memory.
>>
>> - Patching the Crypto provider to kill the check (harder, because of WFP
>> and some internal checksums inside Crypto providers - e.g. RSAENH.DLL).
>>     

if you're ready to do some reverse engineering, then editing the
resources of the app would be better than using showwin.
if they took the time to add checksums, the first solution you mentioned
will prolly be faster.
</my two cents>

>> I have not heard of any readily usable code on the Internet, but looking
>> at the slides it should not be too hard to reproduce.
>>
>> Regards,
>> - Nicolas RUFF
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>>     
>
>
> GreetZ from IndianZ
>
> mailto:indianz@xxxxxxxxxx
> http://www.indianz.ch
>
>
>   

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/