To avoid an internet outage keeping us from being able to scan, we have an internal DNS record for license.seacolt.com that redirects the license check to the Infusion server instead. This could also be achieved by directly modifying the client machine's hosts file (c:\windows\system32\drivers\etc\hosts).

Infusion is running IIS with a plain text file right now (/activate.aspx) that only contains the spoofed response, “CC054B68F2937B3A”. You can update or replace this file by using IIS Manager and going to Sites > Default Web Site and choosing “Content View”.

Update url: www.seacolt.com/downloads/scanupdates.txt (dead as of October 15, 2015)

• License url: http://license.seacolt.com/activate.aspx
• License key used for this example: Q84QX-2SF9S-5Z6DI-ZG72G

The license verification posts arguments as follows to the license url:

• sn=E8A66832C436CB98B54B6E47F147CCC45F7E0C17FB291140
• mid=3899FA41CB952C045359FF7E6D343A4C

SN is the symmetrically encrypted cd key. Mid is an identifier based on the detected hardware on the machine. (Video driver changes affect this.)

A plain text response of CC054B68F2937B3A is an encrypted response which decrypts to RUN and indicates success for that request.

# Copyright (c) 1993-2009 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
#      102.54.94.97     rhino.acme.com          # source server
#       38.25.63.10     x.acme.com              # x client host
 
# localhost name resolution is handled within DNS itself.
#	127.0.0.1       localhost
#	::1             localhost
192.168.0.41  license.seacolt.com # use infusion as if it were seacolt's phone home server

License files:

• download

• Infusion API