Unreal Engine Abandoned Fallen Doll [v1.31] [Project Helius]

[drpavelcia]

Like other I'm trying to find a way to crack this but I'm no expert at all. First time that I try on a profesionnal protection.
I played with fiddler but I'm also stuck because I don't have any valid unused license.
I messed a bit with the server answer trying to change the <MaxActivation> but to no use. It's like the client doesn't care about what the server says in the first request.

In the second request I can see <LicenseKey /> in the answer and I guess when the MaxActivation isn't reached, we can get some data here. The best message I could have was "Invalid License Key! (0x003f89)" when trying to fill the empty LicenseKey and changing the error code.
What I'm wondering about is this RegistrationID and RegIDTran and what role they have in the activation process.

Finding a way to force the activation is probably the easiest way because trying to isolate the game from the DRM looks almost impossible.

I still have to reverse Eck32/6420.dll and continue to look for the C# disassembly of deactivation.exe but it's a lot of work.

I think I know what you might be hitting. I believe there's 2 programs making requests: The "Deactivation.exe" and the actual game "Shipping" something exe. Monitor the requests made by the shipping exe, that's the one doing the actual license check to launch the game. The Deactivation exe is only doing a check to see if the license exists or not, and I think that one you can actually bypass with the dnspy tool.

What we basically need to do is tell the shipping exe when it makes a request, "yes, your license key is valid".

 

[Zyrix]

For reversers:

Protection: ElecKey 2.X Internet, Enterprise, or Ultimate.

Very old and unusual protection I have not heard of until now. Simply spoofing the callback upon sending a key to Deactivation.exe will most likely not be enough as there may be another check in FallenDoll.exe. Note that FallenDoll.exe gets the activation app to launch from KCAP.ini. Simply returning "true" in Deactivation.exe was not enough for me from my experiments.

Searching the internet I have been able locate some versions of ElecKey 2.X, however since the protection is not really used that widely, the only two links were from ~2009-2010, and their download link has expired long ago, as expected.

The way I see it is the following 2 options:

Option 1:
Figure out the key generation scheme from how it checks the activation key. From the Deactivation.exe, a keycheck can be found:
this.Kc = new KeyCheck(1721994409u, 1, 0, 0, "KPKWFJ5BLS7L4HQVGLXXTEGF", Application.ExecutablePath);
, where "KPKWFJ5BLS7L4HQVGLXXTEGF" is the "InitLicenseKey", aka. most likely product code.
Using this, it is very likely a proper key can be generated, however the method "buttonActivate_Click" should be patched appropriately to not make a call to the server. I highly doubt any kind of asymmetric key algorithms are used in the process of key generation.

Option 2:
Unpack FallenDoll.exe and patch out the licensing. I do not possess an unpacker that can handle it though.

Either way, regardless of option 1 or 2, patching seems inevitable. Option 1 (from the looks of it) seems to require patching of Deactivation.exe only, whereas option 2 will require patching of FallenDoll.exe.

 

[TheOneAndOnlyBla]

I don't think that generating a key will work. As far as I understand that ElecKey, every key is generated by the guy who made the protected software (Project Helius in this case) and registered in some kind of database of the dev of ElecKey (Sciensoft).
Hope You get what I try to say. English isn't my native language as You may have guessed already^^.

When You purchase a license of ElecKey to use in Your product, You will be sent a unique version of the tools. Unique in the way, that there is a unique key coded into it, where the trial version of ElecKey all use some 1111111-11111 like key. Maybe this "KPKWFJ5BLS7L4HQVGLXXTEGF" Zyrix found is exactly this unique key? If so, maybe it's possible to use the trial version of ElecKey, hex the standard key to the one from Fallen Doll and uncrypt Fallen Doll , thus removing any traces of drm completely.


As for the RegIDTran and RegistrationID sections in the network traffic:
My guess is that they somehow identify the product (Fallen Doll in this case). Since there is no other data pointing out what the request is all about except the key itself. So either every key must be unique worlwide, even between different products using ElecKey or the mentioned sections are just some product code. If we are unlucky, this is some machine identification generated unique to the machine. That would make it impossible to solve the whole thing with a fake server alone. Let's find out!

The ID sent by my machine is
<RegIDTran>EM864EEC5RSUNURB</RegIDTran>

the ID returned by the server is
<RegistrationID>WYZQ03TX71B75RQ2</RegistrationID>

these are the same regardless the key I used (HKV5-754M-XG5B-86I3-7NGH or QE9O-5RSX-3M1L-CPZH-SLK7).
Anyone want to compare these to the ones sent by his own machine pls?


So the <RegistrationID> stuff is based on the file C:\ProgramData\Key-Base\63e70b6f.052\CODE.PKD, which is a 512bytes file generated by FallenDoll.exe at first start and seems to contain a random generated key representing the machine. Also it contains some information about the file system it's generated for to prevent copying of that file to another computer (tested with ram disks mounted to C:\ProgramData\Key-Base). Maybe this file will also contain the key for decrypting FallenDoll.exe once registration is done.

I still have no clue about what <RegIDTran> is for. In my last traffic captures it was another one than posted above, but didn't change during the tests. So it's maybe some date related thing for keeping track of license transactions or something.

 

[xpirad]

Here is a used key i found on the internet, activation time already used up.
5PF6-FU1V-J3B0-FVH0-JK0Y 1.31
GRW9-TZ32-1PLU-WKV1-BZQ5 1.30
Don't know if this will help?

 

[Zyrix]

Here is a used key i found on the internet, activation time already used up.
5PF6-FU1V-J3B0-FVH0-JK0Y 1.31
GRW9-TZ32-1PLU-WKV1-BZQ5 1.30
Don't know if this will help?

Thanks for the keys!

So far, there seems to be one step left. If I possessed a key that did not have its activations used I could most likely have it work.

The very last check is found in Deactivation.exe in "Ekc.KeyCheck.PutLicKey", where the license key is sent to. Basically the whole process is like this:

Step 1: Send the key "5PF6-FU1V-J3B0-FVH0-JK0Y" to the server, get properties back such as MaxActivations, ActivationCount etc.

Step 2: Call "InitLicKey" in "Ekc.KeyCheck", this sets the InitLicenseKey aka. "KPKWFJ5BLS7L4HQVGLXXTEGF" inside of the module "Ekc6420.dll", in function H6A. A variable with the type StringBuilder is also returned, which is set to "this.m_strRegistrationID".

Step 3: Send the key "5PF6-FU1V-J3B0-FVH0-JK0Y" again, but this time, the parameters are a little different as there will be retrieved a "LicenseKey". This key is the one that is crucial for determining if FallenDoll can run or not, and also the part where it will say "Too many activations". Note that because the key has already expired, there will not be returned a license key.

Step 4: Assuming a real license key is returned from step 3, it will now move to "Ekc.KeyCheck.PutLicKey". This is where it calls "KeyCheck.fncPutLicKeyEx64" in the "Ekc6420.dll" module on function H6D to put the license key retrieved from step 3. This, from the looks of it, seems to be the very last step.

 

[TheOneAndOnlyBla]

just started to look at the docs of eleckey. so here it how this all works:

The dev (Project Heliues) buys elecKey and gets a copy with a unique 32bit number assigned to it (1721994409 in this case).
this number is referred to as key id in the docs. All his tools will use it. for every product he wants to license he assigns a product id (0 in this case).


He adds some lines of code to his project and includes some library stuff delivered along with ElecKey (terrible code, You want to vomit looking at it XD).
He then uses the "ElecKey Integrator", a tool that encrypts FallenDoll.exe and adds some Decryption Code to it as well as generating the so called Initial License Key. This key works like a settings file for the whole system (KPKWFJ5BLS7L4HQVGLXXTEGF in this case) (contains Key ID, Program ID, Key Properties, and Key settings).

When FallenDoll.exe is started following happens:

It looks if a license key is present on the system (C:\ProgramData\Key-Base\63e70b6f.052\CODE.PKD).
If not present it creates one. The created key is generated from Hard disk signature as well as CPU/BIOS signature (optional), ethernet adapters aka MAC address (optional) and some random data as well as some crypted data in it. this hash is stored in the above mentioned file.

Registration works like this:
From the key in the file a "registration ID" is generated (16 capital letters), encoding Key ID and Program ID using a one way hash function. This registration id is sent to the registration server, the dev's website or whatever (a server provided by Sciensoft in this case). The server generates a license key from it and sends it back to the user. The license key is then verified by the key system (implemented in Ekag20nt.exe). If it's found valid, the key inside C:\ProgramData\Key-Base\63e70b6f.052\CODE.PKD is updated to a registered state. The next time FallenDoll.exe is started the valid key is found and used to decrypt FallenDoll.exe.


Short version: Fallen doll creates a key file (machine signature). Deactivation.exe sends a registration code created from that key to the registration server, forwarding the response to Ekag20nt.exe. The whole key system stuff is managed by Ekag20nt.exe. The connection between Ekag20nt.exe and FallenDoll.exe/Deactivation.exe is done through Ekc6420.dll.


What I tried so far:
Redirecting all network traffic to a fake server written by myself to simulate a registration. Failed since i can't replicate the key by myself and just sending "OK, everything is fine with the key" from the fake server doesn't work (we need a llicense key suitable to our machine).

Replacing Ekc6420.dll by a self written fake. Doesn't work because FallenDoll tests it's checksum, exiting if it's not the original one. I'm currently testing at this some more.


Well, the good news is:
Theoretically i should be able to "backup" a licensed key, unregister it and "restore the backup" without registering again.
As useless as that is...^^

 

[MysticXcore]

My game doesn't want to start. it says it needs a activation key :/ Can someone help me out? I don't want to pay patreon for that key

 

[yomamasass]

Which link did you used to download?

 

[fiwupubari]

Well, the good news is:
Theoretically i should be able to "backup" a licensed key, unregister it and "restore the backup" without registering again.
As useless as that is...^^

We could make a tool to activate a license, store the valid code somewhere, ask to remove the license, put the valid code back and use a fake server to avoid reactivating it. Will need to modify the host of the user to avoid wrong activation and prevent the game from being launched without the "crack".
It's probably the simplest option but it needs a real license and be sure that people don't activate the original license by mistake. And if the server see multiple register/unregister, the key will probably be blacklisted. Also need a new key for each update.


Otherwise it's patching.

The server generates a license key from it and sends it back to the user. The license key is then verified by the key system (implemented in Ekag20nt.exe). If it's found valid, the key inside C:\ProgramData\Key-Base\63e70b6f.052\CODE.PKD is updated to a registered state.

If I get it, we need to patch the function that looks at the CODE.PKD to make him believe the code is valid.
But the check is probably done in the DLL where there is a checksum verification. Can we patch the checksum in the binary calling the dll functions?

edit:

I think I know what you might be hitting. I believe there's 2 programs making requests: The "Deactivation.exe" and the actual game "Shipping" something exe. Monitor the requests made by the shipping exe, that's the one doing the actual license check to launch the game. The Deactivation exe is only doing a check to see if the license exists or not, and I think that one you can actually bypass with the dnspy tool.

What we basically need to do is tell the shipping exe when it makes a request, "yes, your license key is valid".

Fallendoll.exe calls Ekag20nt.exe (CreateProcess with apparently two parameters "C:\XXX\WindowsNoEditor\EKAG20NT.EXE" 0200D4XXXXBE5A5A 0) and that's the binary which check CODE.PKD (ReadFile). Then Fallendoll.exe start the Deactivation.exe. I guess Ekag20nt.exe communicate with Fallendoll.exe to tell him when the key is alright and in that case it doesn't start deactivation.exe. deactivation.exe doesn't look for the keys nor seems to directly interact with Ekag20nt.exe.

I tried to find any reference to "CODE.PKD" in the strings of Ekag20nt.exe to help pinpoint the location of its opening but to no use. I have multiple XREFs from ReadFile so starting from there could be an option. Or maybe try to setup a ReadFile() hook in a debugger to see where he does that.

We could also start from the CreateProcess of fallendoll.exe to see how they communicate.
The callstack shows us it's coming from H4C+0x2601 in Ekc6420.dll.

edit2:

Really not sure about that but I found functions DdeClientTransaction() and many other like DdeConnect, DdeDisconnect() , DdeAccessData(),DdeUnaccessData() in ekc6420.dll just after the CreateProcessA().
and DdeNameService(), DdeGetData() in Ekag20nt.exe

It could be use to communicate between them. DDE use memory objects to pass data from one application to another.

I'm really not familiar with this library so maybe I'm totally in the wrong here.
But if DDE is used by Ekag20nt.exe to tell FallenDoll.exe thru Ekc6420.dll that the license is not valid, it could be interesting to try to tamper the data to make him believe the key is valid. It would need to be done from Ekag20nt.exe and not Ekc6420.dll if there is a checkum validation. But I doubt it will be as simple as a true/false from Ekag. Maybe it sends some data and Ekc6420.dll does to cryptographic validation or something. Or worse, Ekag20nt.exe sends the PKD file to the dll and he does a verification on it.

 

[TinyTanya]

Well at least the dev's managed to get some ppl interested in learning more about reversing/cracking, good job i guess

 

[TheOneAndOnlyBla]

Got to the idea to fake Ekag20nt.exe yesterday too. Couldn't find the way it communicates to ekc6420.dll and thought it could be memory mapped files. Totally forgot about that DDE stuff. Thanks to fiwupubari for that.

Unfortunately I have absolutely no experience with DDE since I don't have that much experience with windows (Linux doesn't have dde, there are usually used sockets or pipes everywhere). I have my doubts that it will be very easy but I'll take a look at it

short Update: Started to look into it. Didn't find any DDE activity using spy++. Didn't trust this tool and hacked together a simple ugly DDE sniffer myself. And oh wonder! found some activity^^

Deactivation starts Ekag20nt.exe which in return opens DDE channels ("EKAN0200D436F8BE5A5A", "command" and "data"). "0200D436F8BE5A5A" is the parameter which is given to ekag20nt.exe as 1st parameter at process creation. Absolutely looks like some IPC to me. So another Cookie for fiwupubari^^

 

[byran47]

What is this Paralogue 0.1 thing that I'm seeing on the patreon? Is this separate from the main game? And what is it? Apparently it's entering testing, any patreon here that could post what the latest news on that is?

 

[oolong_jonson]

Just wanted to drop in and say that you guys are all cool as shit. Hacking through bullshit drm just to help yourselves and a bunch of other losers like me jerk off to a really good 3d game. You're doing god's work. o7

 

[drpavelcia]

Replacing Ekc6420.dll by a self written fake. Doesn't work because FallenDoll tests it's checksum, exiting if it's not the original one. I'm currently testing at this some more.

I wonder, since you mentioned a checksum, do you know what kind of checksum it's using? If it's using a specific kind, like SHA-256 or something, maybe it's possible to find that checksum in the shipping exe and just replace it.

 

[TheOneAndOnlyBla]

Just wanted to drop in and say that you guys are all cool as shit. Hacking through bullshit drm just to help yourselves and a bunch of other losers like me jerk off to a really good 3d game. You're doing god's work. o7

Actually i won't gain anything from this except satisfaction to have won and having learned something. The game probably won't run on my machine and i actually don't care. It's my hate against DRM that drives me to put all this efford into it^^
But thanks.

I wonder, since you mentioned a checksum, do you know what kind of checksum it's using? If it's using a specific kind, like SHA-256 or something, maybe it's possible to find that checksum in the shipping exe and just replace it.

I'm currently testing at this some more.

Yeah, did't abandon this idea yet

 

[MysticXcore]

Has the 1.31 update got cracked yet? I really want to play it for free

 

[156_163_146_167]

Has the 1.31 update got cracked yet? I really want to play it for free

Not yet. People that are more competent in cracking it than I am have been discussing it.

 

[sadceaser]

Aaannnd what do I do with 'Press Trigger Button to Start', cause I've hit every key on this damn keyboard and mouse, and got nothing.


Aaah. Occulus Rift only. Never mind then.

 

[NukaCola]

Aaannnd what do I do with 'Press Trigger Button to Start', cause I've hit every key on this damn keyboard and mouse, and got nothing.


Aaah. Occulus Rift only. Never mind then.

Look like you download the VR version by accident. Go download non VR version.

 

[Vampiric Dreams]

These guys already have 1.31b VR version patched? I have not checked or downloaded yet. Just came across the link and wanted to share. Downloading through those sites without subscription is at atrocious speeds.

You must be registered to see the links