Reverse engineering 1990s legacy enterprise software licensing

This article explores a software licensing system used in a proprietary enterprise software package from circa 1994, which is no longer supported by the original developers. The licensing system operated on the basis of short alphanumeric licence keys issued to licensees (e.g. ABCD 012345 67890). The software is distributed as a binary executable (say, foo.exe) and accompanied by a number of supporting files. At the outset, we know that foo.exe displays an error message to the effect of ‘Serial number is invalid’ if an invalid serial number is entered. We proceed to static analysis from this starting point. Using Ghidra's Defined Strings view, we see that the error message does not appear in foo.exe, but does appear in a supporting library foores.dll as string ID 1434 (0x59a), surrounded by other serial number-related error messages: foo.exe does not import foores.dll, so we can surmise that foores.dll is dynamically loaded. Indeed, we find that ‘foores.dll’ is a defined string in…