I checked MSDN and noted that the first parameter to the function is a DATA_BLOB which holds the plaintext, the second is data description while the third is another DATA_BLOB holding an optional entropy parameter:

I then disassembled the main binary (*./JamUI/Pulse.exe*) with Radare2 and discovered that the client indeed rely on **Windows Data Protection API** (DPAPI) to encrypt credentials. I used procmon to get stack traces prior to calls to *RegSetValueEXW* and discovered that *CryptProtectData* is called just before saving data in the registry. No one ever answered that email since 2014, so it's time to dig into the code ! Static Analysis The only reference to this format I could find is a request on 'John the Ripper' mailing-list asking if anyone looked into this before: To generate licenses, refer to KB40558 - How to install licenses on Pulse One or Workspace The serial number is the Support Reference Number (FULL keys only) S/N sent electronically when a license key is purchasedĮnter the license string in the Find Licenses section. (Dashboard > Select MAG-SMXXX to view details Note: The MAG-SM160 PCS (starts with 0284), MAG-SM360 PCS (starts with 0285) and CM-060 (starts with 0272) service modules include an additional serial number sticker that you can place on the back of the chassis. Top of Metal Case (Will need to remove blade from chassis to see the serial number) Welcome to the Juniper Networks Junos Pulse Secure Access Service Serial Console!Ĭurrent version: 8.0R1:Internal (build 27535) Serial Console to the product, the Serial number will appear prior to showing menu option: In the lower left hand corner, next to Licensed to

Junos pulse secure