[TommyBoy]

Could someone please upload the disc image of TOONZ 4.6 so that it can be downloaded? I'd like to experiment with it. I think that if more people had access to it, eventually someone would probably be able to crack the license and get it to work on IRIX.

[Raion]

If someone wants to work with me, i can see if I can get it up... I'm fucking behind and of course still recovering from my accident, but I'll do my best!

[necron2600]

http://www.darklab.net/unix/irix/toonz/toonz%204.6.tar
the license (missing parts so it is not working):
http://www.darklab.net/unix/irix/toonz/lic.txt

The last license TOONZ_INK_PAINT_TOONZ has a section SIGN2 that appears truncated.. missing the final quote ".. and since another license key has its SIGN2 containing 30 parts.. the final truncated line only has 28. I assume that means it is missing 2 parts.. 4 hex? characters each. You could do some brute force here (and letting a script run over a long time) and discover the missing parts and hope there are no more strings missing. Or someone can find a workaround/patch.

[gijoe77]

http://www.darklab.net/unix/irix/toonz/toonz%204.6.tar
the license (missing parts so it is not working):
http://www.darklab.net/unix/irix/toonz/lic.txt

The last license TOONZ_INK_PAINT_TOONZ has a section SIGN2 that appears truncated.. missing the final quote ".. and since another license key has its SIGN2 containing 30 parts..  the final truncated line only has 28.  I assume that means it is missing 2 parts.. 4 hex? characters each.  You could do some brute force here (and letting a script run over a long time) and discover the missing parts and hope there are no more strings missing.  Or someone can find a workaround/patch.

This is great catch!  I just thought about scripting something for this, but my napkin math for doing a brute force increment by 1 on the missing  32bit value really scares me

correct me if I'm wrong - here is the value (approx) of what we want:

Code:

SIGN2=" \
0D61 55AD A671 37FD 3C30 3925 510E 23EE 18D3 E60B
0473 EF85 B16C 18FE 797E 068D 1B94 EA34 A182 25C5
BDBA 33B0 EF86 5006 CB3F 289B 9E8B 04BA 62A1 EEE6"

here is what we have where last XXXX and YYYY are missing:

Code:

SIGN2="
04C5 A865 877A 3DC9 D86D 425B 5F9B 42C4 A4D3 492A 
E80D 2143 AB67 BEF5 52AF 1372 2C95 728C 4674 006B
BAAE EC66 846C 47FF A0FF 3BC7 08A7 9654 XXXX YYYY

so I was thinking to write a program that starts XXXX YYYY at 0000 0000, increments the license file by 1 (so now it would look like 0000 0001); run the program and see if it fails with a flexlm error, if so increment by 1 and try again (now it would look like 0000 0002).  

For arguments sake, lets say this take 1 second to check each increment.  if my math is right (please correct me if wrong), but it seems FFFF FFFF = 4,294,967,295 - so therefore to check each increment per one second, it would take 4,294,967,295 attempts to brute-force all the possible values

assuming 1 second try per increment,  4,294,967,295 = 136 years

Anyone now of a different method to try to tackle this?  Is my Math way off here?  Sorry I'm super sleepy...

[jan-jaap]

Couple of things:

1. This generation of FlexLM uses ECC cryptography, unlike the older generations which used a symmetric cipher. The "beauty" of symmetric ciphers is that the secret must be embedded in the application software, and can be obscured at best. Once the secret is uncovered, a generic FlexLM SDK can be used to build a keygen. This doesn't work any longer for ECC because the private key is in the vendor's keygen and only the public key is in the application.

2. The usual way to attack such a target is to create a new ECC keypair, and patch the public key of that into the target. Now you can build a keygen using your own private key that will work with the patched target, but not the original software. And vice versa: a valid, original license will no longer work on the patched software.

Now back to this software. I had a brief look at the dist and it includes a keygen. So why try to recover a license file? Just generate a new one... But: the dist contains an IRIX and a Windows version, but the keygen is Windows. No guarantee the IRIX binaries have been patched, in other words, no guarantee that the keygen will work.

NB: The ECC crypto routines in FlexLM are from Certicom, and are what's also used by the Blackberry (remember those?). I checked a while ago, and the best ECC crypto in FlexLM (239bits?) is the equivalent of a much longer (2048bits?) RSA key which still cannot be brute forced unless you work at the NSA maybe.

[ginza]

I made a IRIX patch for this, but will not post it directly here according to the forum rules. As mentioned by jan-jaap, it does not seem possible to generate keys for this directly, which in some ways is good - it makes it easier to spot "warez" versions, if you collect original versions or even wish to contact the company regarding upgrades. It should be possible to patch it to use the older key generation routines, or a bit more advanced to make your own ECC-keys. However, the simplest way is just to patch it to always return OK when checking the license.

[chulofiasco]

Can you share with the class please.  🙏🏼

[Raion]

PM him. We can't share links here about it. You guys know the rules. Yes, I know it makes me look like a nag. I don't like being in this position, but I'm not getting us stabbed in the back with our pants down!

[indigofan]

[gijoe77]

Does anyone have any docs/manuals for toonz?  I was not able to find any, but I did document what I figured out so far - here are my notes

Code:

                             My notes on running Toonz
                 

A. setup file

default setup is /usr/Softimage/Toonz/config/tsetups/std_toonz.setup

to change to the tutorials setup (or any custom setup):

1. go to Toonzsetup module
2. click on Files -> Load
3. navigate to /usr/Softimage/Toonz/toonz_tutorials/tutorials.setup, hit ok

This file seems to save all the various configs - set as you desire,
save your own custom setup if as needed (per project, etc)



B. load up a tutorial file in Inknpaint

note on extenstions:

seems toonz understands these image files:  .tif, .rgb

.plt = palette file (colors used in the scene - can give them specific names, etc)
.tzu = toonz drawing file with no palette/colors applied
.tzp = toonz drawing with palette/colors applied
.tzi = toonz ink? image? raw drawing thats imported?
.xsh = xsheet file
.casm = flash casm

you can view any of these types of files from toonzshell by clicking the "view" button next to the DIR listing

1. Path in Toonzshell should +drawings/ (change to it if not)
2. Navigate to +drawings/ready_made/cleanup/color/
3. click on either piggy..tzu or piggy..tzp - click "view" to view contents of the file
4. click piggy..tzp, then click Inknpaint module - it will load the selected
   file into the Inknpaint module
   
5. some keyboard shortcuts:
    "a" will start/stop the animation
    "z" will zoom in picture
    "x" will zoom out
   mouse middle button is grab and pan/move
   
6. under Tools - fill, draw, brush, erase ink or paint or both
   under Checks - onion skin (see previous frame overlayed), black background
7. Can delete colors, add new colors to palette
8. Can do a lot of cool stuff here, need to play around with all the options



C. load animation in Xsheet

1. Some of the tutorial files are in the wrong dirs
   (i dunno - maybe the proper docs address this?)

cd /usr/Softimage/Toonz/toonz_tutorials
cp -i ready_made/bg/uranus.tif bg/
cp -i ready_made/inknpaint/* inknpaint/

2. click +drawings/ready_made/xsheet/uranus.xsh, click Xsheet
3. click Windows -> Filmstrip
4. click a frame in Filmstrip to populate that frame
5. click Windows -> Preview to load up entire animation in preivew window
   (It will create the rest of the .rgb files for the scene)
6. from the preview window, Save -> Save Movie saves the animation as a .mov file
   (works fine in mediaplayer)

    o2:toonz 25 > file saved_movie_from_xsheet.mov
    saved_movie_from_xsheet.mov:    Apple QuickTime movie file (mdat)
    
7. on Xsheet Module - click Xsheet -> Export to Flash - click save & view


Current items of interest:
-how to create my own animation/drawing within toonz
or
-how to import an image I create into toonz