Reverse Engineering for Beginners

CHAPTER 78. DONGLES CHAPTER 78. DONGLES

here, too, and 16 bit values are returned and compared with others.

So that is how Sentinel Pro is accessed via ports. The output port address is usually 0x378, i.e., the printer port, where

the data to the old printers in pre-USB era was passed to. The port is uni-directional, because when it was developed, no

one imagined that someone will need to transfer information from the printer^4. The only way to get information from the

printer is a status register on port 0x379, which contains such bits as “paper out”, “ack”, “busy”—thus the printer may signal

to the host computer if it is ready or not and if paper is present in it. So the dongle returns information from one of these

bits, one bit at each iteration.

_in_port_2contains the address of the status word (0x379) and_in_port_1contains the control register address
(0x37A).

It seems that the dongle returns information via the “busy” flag atseg030:00B9: each bit is stored in theDIregister,

which is returned at the end of the function.

What do all these bytes sent to output port mean? Hard to say. Probably commands to the dongle. But generally speaking,

it is not necessary to know: it is easy to solve our task without that knowledge.

Here is the dongle checking routine:

00000000 struct_0 struc ; (sizeof=0x1B)

00000000 field_0 db 25 dup(?) ; string(C)

00000019 _A dw?

0000001B struct_0 ends

dseg:3CBC 61 63 72 75+_Q struct_0 <'hello', 01122h>

dseg:3CBC 6E 00 00 00+ ; DATA XREF: check_dongle+2Eo

... skipped ...

dseg:3E00 63 6F 66 66+ struct_0 <'coffee', 7EB7h>

dseg:3E1B 64 6F 67 00+ struct_0 <'dog', 0FFADh>

dseg:3E36 63 61 74 00+ struct_0 <'cat', 0FF5Fh>

dseg:3E51 70 61 70 65+ struct_0 <'paper', 0FFDFh>

dseg:3E6C 63 6F 6B 65+ struct_0 <'coke', 0F568h>

dseg:3E87 63 6C 6F 63+ struct_0 <'clock', 55EAh>

dseg:3EA2 64 69 72 00+ struct_0 <'dir', 0FFAEh>

dseg:3EBD 63 6F 70 79+ struct_0 <'copy', 0F557h>

seg030:0145 check_dongle proc far ; CODE XREF: sub_3771D+3EP

seg030:0145

seg030:0145 var_6 = dword ptr -6

seg030:0145 var_2 = word ptr -2

seg030:0145

seg030:0145 C8 06 00 00 enter 6, 0

seg030:0149 56 push si

seg030:014A 66 6A 00 push large 0 ; newtime

seg030:014D 6A 00 push 0 ; cmd

seg030:014F 9A C1 18 00+ call _biostime

seg030:0154 52 push dx

seg030:0155 50 push ax

seg030:0156 66 58 pop eax

seg030:0158 83 C4 06 add sp, 6

seg030:015B 66 89 46 FA mov [bp+var_6], eax

seg030:015F 66 3B 06 D8+ cmp eax, _expiration

seg030:0164 7E 44 jle short loc_35B0A

seg030:0166 6A 14 push 14h

seg030:0168 90 nop

seg030:0169 0E push cs

seg030:016A E8 52 00 call near ptr get_rand

seg030:016D 59 pop cx

seg030:016E 8B F0 mov si, ax

seg030:0170 6B C0 1B imul ax, 1Bh

seg030:0173 05 BC 3C add ax, offset _Q

seg030:0176 1E push ds

seg030:0177 50 push ax

seg030:0178 0E push cs

seg030:0179 E8 C5 FE call near ptr sent_pro

seg030:017C 83 C4 04 add sp, 4

(^4) If we consider Centronics only. The following IEEE 1284 standard allows the transfer of information from the printer.