I know that this subject has already been beaten to death, but being a reasonably clueless newbie, I have to bring it up once more...

My problem is this: most of essays about FlexLM concentrate on dynamically linked vendor daemons, and while I basicly know what to look for, the fact that my target is staticly linked, leaves me a bit confused... what would be a good way to approach this ? ???
(the daemon is built with 6.1b SDK)

BTW, if some kind soul could point the (apparently) blind ol' me to FlexLM FLIRT signatures, I'd be most grateful.

what would be a good way to approach this ? ???


Maybe the Danīs essay is a good way http://208.50.16.104/crackz/Tutorials/Danflex.htm

to be patient and understand this excelent essay,
iīm sure that help you but too there are other fast way.

Regards.
Perry.

The FLIRT signatures are nice, but they don't always work. Often times, functions will not be identified due to very minor changes between versions that alter the function's signature. I have found that it is better to use "landmarks" to identify functions in statically linked code. For example, you can always find lc_init by searching for a reference to "flex%i.log". lc_checkout can be found by searching for another particular string and looking a few functions up. The best way to get a feel for this is too disassemble the dll for your version of flexlm, locate the functions you want/need to identify, look for these landmark strings or win32 api calls, and then use what you find to identify functions in your target. After a while you get familiar enough with the functions that finding them becomes a snap!

Hope that helps!
Kythen