imageIn a Comment on my Article “Installing Dell Wireless 5530 HSPA Mini PCI“, Florian asked how to Install Dell’s R298998 driver on non authorized system and card combinations.

I decided to have a look and downloaded this driver. The structure isn’t much different from the R251153 driver I described in my earlier post.

When installing it on a non authorized card/laptop combination the error is similar:

Authentification failed. The Dell Wireless HSPA Mobile Broadband Mini-Card cannot be installed on this computer. Please contact the Dell support for further information.

When the error message appeared I looked into the temp folder and I noticed that just like before 2 folders were created (with a GUID as name). One of these folders contained the file driver_auth.exe which, as I already knew, performs the actual validation.

I loaded driver_auth.exe in Ida and in the Strings windows I searched for “dell_wwan_sysID.dat”. As I described earlier this is an encrypted file that contains the list of authorized combinations.

Ida Strings Window | dell_wwan_sysID.dat

There were only 2 references (Ctrl-X) to this string:

References to dell_wwan_sysID.dat string

This reference (last line in the screenshot below) brings us to the right place because a little above it is a debug output line that says: “Decrypting dell_wwan_sysID.dat into dell_wwan_sysID.txt”:

Ida Code Snippet

A little above in the code is a Switch statement that operations on the first commandline argument:

jmp ds:off_403e44[ecx*4]

On case 68 or 76 a password check (password is expected as 2nd parameter) is done (notice that ASCII 68 = ‘D’ and 76 = ‘L’):

jnz short loc_403B58

We could of course patch jzn (Jump when Not Zero) to jz (Jump when Zero) to accept any password but I used Ida’s integrated debugger to read the password.

Oh you want to know what the password is?

It’s “HELMSLEY” (in capitals).

The following commandlines are possible:

So let’s decrypt the file:

So how do we know what line we need to modify?

Simple,  use the -U switch, in my case I have a D5530 card so I use the following commandline:

SNAGHTML109f370e

So my system has ID 1036, according to the list ONLY the combination of 1036 and Dell 5540 is authorized

So we change it and add the D5530:

Save the file and encrypt it:

And let’s check again:

SNAGHTML10aa79d8

And no more Error:

SNAGHTML10ab69c1

If you are not sure which card you have then use Process Monitor during the installation with the following Filter:

SNAGHTML10b433c4

Use the last parameter in the Commandline:

SNAGHTML10b50371

If this article was helpful to you please leave a comment.