Hexalock

i tried it!!:9 it doesnt WORK!! my file is an acrobat!

You’ll have to explain the procedures you took, and tell me any error messages you are having… This does work, you just havn’t used it correctly

Hi, Goldstar. I tried that in several different ways. My hexalock protected disk is a Chemistry book which has a bunch of PDFs.
At first, I tried to use your VB6 soft to replace my acrobat.exe. It didn’t work at all. Seems that the fake acrobat.exe didn’t tricky HCPSmng. So I tried another way.

After I inserted the CD, the content have been opened by Acrobat. (professional 7.0) I tried to use your software to dump the pdf to my hard drive. It didn’t work when the name of the software is acrobat.exe. I was making progress when I rename acrobat to iexplore, as you suggested. It seems that HCPS thought it is really IE and locked it. So I was able to dump some PDF out which is not 0 byte PDF file. But there are all blank without content. The biggest file couldn’t be opened with “damaged” reminding. There is a “An unrecognized token ‘8o’ was found" reminding when I tried to open the dumped introduction PDF file.

I tried to rename it to nescape. It is exactly the same situation. Anyway, those PDF file begin with %PDF-1.5%, which means I am making progress. It is just I am not sure if I do something wrong at this. Could you please give me more suggestions? Thanks.

Ok, lets try this. Put the CD in your computer and wait for it to load. Open my computer, right click the cd drive and click open. Find the program called “start_here.exe” and double click that. Double click on any PDF file and see if the real adobe acrobat reader can open the file. Close out of adobe acrobat reader.

Now, put the program you got from this thread into it’s own folder, and rename acrobat.exe to notepad.exe. Open notepad.exe, click the 1st button you see and select the desktop and click ok. Click the bottom button and choose a PDF file from the cd then click ok. Look on your desktop for the file – it should be there. Open it up and see if adobe reader can read it…

Thanks for the more detail information. I tried exactly what you said. It didn’t work.

If I put the CD into my computer, the start_here.exe would be loaded. Anyway, I tried to load this manually. I can read any pdf by double click. And then, I close the adobe professional 7.

The problem I got from this thread means the problem I got from here, right? I renamed it to notepad.exe. I put this program in another different folder from the real adobe. And then I followed what you told me to do. Those pdf files have been upload to my desktop successfully. But none of them could be opened. It seems that the new created PDF which you just opened would be damaged. (because adobe said that) Those new created PDF which you didn’t open would be blank. I am not sure if I have to use some program to fix those PDFs.

By the way, I have tried to use this problem to dump normal PDFs, I didn’t make it. The new created pdf can’t be opened too. Maybe this is the issue. I have no idea.

the error i encounter say’s string error…sumthing 44???
this is the version
HCPS Loader
2.0.1.4632

I think you are right. Something is wrong with the program itself. I created it very sloppily as it was just an idea.
Or maybe it is the Hexalock protection getting smart. I am uploading a file that will read the first few bytes of the file and tell me what is says, if possible upload a screen shot of the program.

You may need to rename AcroRD32.exe to Acrobat.exe.

PDFTest.zip (4.44 KB)

Thanks. I did that. The program give this back as below:

%PDF-1.4
%忏嫌
91 0 obj
<<
/Linearized 1
/O 96
/H [ 2018 307 ]
/L 190792
/E 112663
/N 6
/T 188854
>>
endobj
xref
91 58
0000000016 00000 n
0000001525 00000 n
0000001673 00000 n
0000001823 00000 n
0000001971 00000 n
0000002325 00000 n
0000002585 00000 n
0000002637 00000 n
0000002814 00000 n
0000002986 00000 n
0000003163 00000 n
0000003341 00000 n
0000003581 00000 n
0000003622 00000 n

This is screen shot.

HCPS Loader
2.01.04538


hir is my result
]¤žƒG:ÓÉG¸¼k7¼¢1Ã¥~ç=£ïDÕGatĪÆ袺êXžîÓjÈÓ3ïaÁþ8Å¡!0¶‚ùÁz›øgè5‚‰IW|Pp(òÂ(~p¼­wyD,p«:ôç¨û®Ú­Ø@¯Îáñ¶^¾Âm9t’ñíú"BqüÑá9Æ’O/)À\eöPµÁùåJˆE’ˆ#‚–üôº;¯ns%ÚžL0
;weGëv›
Ùþì(õŽ5ƒrcŸùa¨áÏô®+FÜ<Š^/ÌÐŒx€ÛÞ¥
ŽÖÁ_ï–ŸÚɪžÎŒqP:_®1™úBƒ]`K€)­ú ÛY]Bbli7H+Ô$êÆåÐ蚸³æ‰ƒó×L|ÁŠÕ÷ŒõäE™@Z¶ŒÜ$°nõvØ\›„Ψ4nÒežnžv¿"B@U®õ±„‹\2—óË7ÀÔû>(¸&¶hTvv/&Ášxe÷#ÁiÜ€]Ù,ª”1Ûaרò#eøÎä
Ɂxs‰ ¹
%¥+çÁ©ËL™¦ˆ’·añ™‚BÖÿ)L‚e_zÓn§"i&_íQà ö
Þ#²ÓÛ“19åúq9Ü¢
!âÛsŒnW Ü\ÐIZÊ\ã-ê\èŸi>‡ü»“‚Œ¨a}“;”äð©!¡TÑ‹Lî݉…>‘F;šÉ•”a×Mœèw6Ñ]g™‹žOœÆŒà †'áñ’ÿ×¼ibm.&†”,ÖÐ2;ßÐeau÷ð¨‰e—ëÊ‚òÎìeê–b“ &
Úö
«ü;ãÏA´$½¡tŠauèÿ
ˆ\ô¿ì(vC•X÷͈ËkÁ¾ÅW#šÀÀ(쾫eËKÅ“Ã’I|‘ú&4ÈFÄeGE¾õýÅ™Á„‡ÎaQ’(‹€±:
Ī^네ñ\+Qƒ”QN¨ÄXγʔ›WýWœIÅõŠÇ˜Xìô½,ªl».¦v¶Ž]^ý ÊoÑêSÁ¬™,Fg¦Ìòåª$t

  • 5ÈîÚ·–Žõóõ’~F1ÞÐß—É÷fL$à ÙäD<:ð^à ”Ï;2<R5c”l®aª·iÓ•÷j[$,à ˆžP㛎èˆÉݬ&â„¢<*ÑeÌ´w<ª4Hoá2\wEèì=Z!?eúZ%Ä“ERmËœP‹×ý0Å gJªÝìoÑ"k°mâ±S®”€J´äSÁ™5JíëÕËÎ¥¿¯ZÊÌô…,ãvt=֟d¢”:Û«SçPž“@—7“GæÀÿ~7 ±» Ô_%ý¨û"ó÷-\ÓHzN9Ò·+û]_?Ö†²ÿ÷leçta¬+cü|?+õ´„È’0£óúà lŽß2A)¬sDÈûÍ…›fï°o


Leorn: I believe you are having problems because the Hexalock protection is not loaded. You said earlier when you opened the “StartHere.exe” program you received an error message. Try taking the disk out and re-inserting it and open the program until you don’t see the message and you can open the disk with normal adobe acrobat reader.

luanyiking: Everything looks like a go from the screen shot I am seeing. I am stumped as to why the pdf files do not open as they should. Give me a few days to come up with a more stable program and I’ll upload it here by wednesday. Can you upload a PDF file my proof of concept program has created? That would help me a lot.

Thanks a lot. I am pretty confused too, since I have no idea about the content of PDF files. Here I uploaded my PDF files. It should be Ok, but unfortunately, it is blank. I will be waiting for your good news.

http://rapidshare.com/files/75401644/upload.rar

Want to say a big THANKS to goldstar, your program worked perfectly.

I was twarted at first by not having the winsock, I got it… installed it and pulled off the needed data from a “hexalocked” CD.

I’m sure others will have issues ,BUT many,many people out there are looking for this solution.

Can I post your program , on other boards, if you get credit???

Sorry for the delay, I know I promised an upgraded solution last wednesday, but reversing is no longer my job, nor was it ever. Please post the proof of concept wherever you feel it will be helpful; I’d like to see somebody turn this idea into an more specific application.

for anyone finding this…

these steps worked perfectly for many hexalocked CDs containing large pdf manuals.

  1. load the disc,in XP disable auto run. Explore the disc & launch the HCPS loader ,likely “hcps.exe”. Minimize this window. Open the folder that contains the unlocker,or create a desk top short cut, minimize. Reopen the CD.

  2. Rt click a file off the CD, open with Acrobat.

  3. Allow Acrobat to load the file.

4 IF the file displays correctly,close Acrobat .Open “unlocker” and click on the “acrobat” file inside.

  1. TWO new windows should appear,one is simply a title for part 2.

  2. Pick a file to “unlock”, select a folder to output. Click the "load file "
    button. NOTE the size of the file , WAIT for any disc activity to take place. The file size will be displayed and they should match. If they do not or you get a “0” file size you have issues with your end not the unlocker.:Z

7 . You could get an error message that you need ms winsock (mswinsck.exe) Google it, you’ll find downloads and the needed registry tweeks.

  1. IF none of the above is an issue, you should see in your new folder a copy of the “unlocked” file. File size must match the original. if not RETRY.
    I have had a few that seemed to go smooth, yet yielded a “0” sized file. On retry they worked fine.

  2. You should have a second pdf reader, I use Foxit Reader, this will not open scrambled or corrupted pdfs. If you launch acrobat, the hexalocked file could be read, and you may think you got a successful copy. I know that my copy is successful if Foxit opens and displays the file correctly.

  3. You may STILL have a password protected pdf, functions in Acrobat can be locked or disabled in the original document, hexalock just passes these on:a.

I cannot offer anymore help/advise than this.

Goodluck

I Have A Set Of Instructional Cd That I Would Like To Backup With Alcohol But I Keep Getting An Error Message Every Time I Try To Use The Backup. I Keep Getting An Error Message That Says Please Insert Original Disk And At The Top Of The Window The Heading ‘hsps Loader’ Appears. Can Anyone Help Me With This. Thanks In Advance.

This is definatly HexaLock, provided you are seeing HCPS Loader and not HSPS Loader. Download my “proof of concept.zip” and follow through the previous posts and see if those instructions work for you.

To make everyone happy…

I have some info from inside Hexalock. Hexalock is dead for about two years. Personal matters between owners doomed the company.

Regarding HCPS…

They had to obey very strict rules:

  1. Not to run any ring0 code.
  2. Work under Guest/Limited credentials.
  3. Not to use assembler whenever possible to make MenInBlack happy.
  4. Not to run any code if no HCPS CD recognized.
  5. Not to connect any IP outside.
  6. Not to use any anti-SoftIce tricks.

A pity You had to use so much time to crack this code. For cool hackers I have another task: try to bit2bit copy any Hexalock protected disk. Go!

P.S. Hexalock proved a possibility to make DVD-R protected a few days before dissolving.

Thank you for the info :stuck_out_tongue: If I get any spare time I will definately take the challenge to figure out what I can, especially now with the clues. I suppose you had some sort of say in the project and I must say congrats to what you and your teammates have accomplished. :slight_smile:

[QUOTE=CrapWriter;1976086]6. Not to use any anti-SoftIce tricks.
[/QUOTE]

So Hexalock was just begging to be cracked? I suppose it was never widespread enough to gain momentum of being disassembled