Running KO's Password Crypt Function in C#

tarafından **Hello EMO** Cuma Şub. 04, 2011 9:12 am

[quote name='new124tan' timestamp='1296413531' post='58']
Many people know that,KO crypt users password then send,like this if user pass is 1234 ko sends this value EHHERP0
some values :

1230 = 63HERP0
1231 = E9FNSP0
1232 = E3HERP0
1233 = M9FNSP0
1234 = EHHERP0
1235 = MNFNSP0
1236 = MHHERP0
1237 = UNFNSP0

i found that crypt function and use here the C# and asm Codes:

C# Codes:

Kod:: public string sifreDeneme(IntPtr ProcessHandle, string Sifre) { IntPtr Adres1 = VirtualAllocEx(ProcessHandle, IntPtr.Zero, 1024, MEM_COMMIT, PAGE_READWRITE); IntPtr Adres2 = VirtualAllocEx(ProcessHandle, IntPtr.Zero, 1024, MEM_COMMIT, PAGE_READWRITE); IntPtr Adres3 = VirtualAllocEx(ProcessHandle, IntPtr.Zero, 1024, MEM_COMMIT, PAGE_READWRITE); char[] sifreCharDizi = Sifre.ToCharArray(); Byte[] sifreBytelar = System.Text.Encoding.ASCII.GetBytes(sifreCharDizi, 0, 1); WriteProcessMemory(ProcessHandle, Adres2, sifreBytelar, 1, 0); Byte[] sabitSayi = new Byte[] { 0x60, 0x7A, 0x9C, 0x00 }; WriteProcessMemory(ProcessHandle, Adres3, sabitSayi, 4, 0); string pStr = "60B9" + AlignDWORD(Adres1) + "BA" + AlignDWORD(Adres2) + "5168E803000052B9" + AlignDWORD(Adres3) + "BF" + AlignDWORD(new IntPtr(0x0085BAA0)) + "FFD761C3"; Byte[] pBytes = ConvHEX2ByteArray(pStr); ExecuteRemoteCode(pBytes, ProcessHandle); Byte[] sonucSifre = new Byte[7]; ReadProcessMemory(ProcessHandle, Adres1, sonucSifre, 7, 0); string sifreString = System.Text.Encoding.ASCII.GetString(sonucSifre); VirtualFreeEx(ProcessHandle, Adres1, 0, MEM_RELEASE); VirtualFreeEx(ProcessHandle, Adres2, 0, MEM_RELEASE); VirtualFreeEx(ProcessHandle, Adres3, 0, MEM_RELEASE); return sifreString; }

and ASM Code

Kod:: 03F70025 60 PUSHAD 03F70026 B9 0000F703 MOV ECX,3F70000 03F7002B BA 0000F803 MOV EDX,3F80000 03F70030 51 PUSH ECX 03F70031 68 E8030000 PUSH 3E8 03F70036 52 PUSH EDX 03F70037 B9 607A9C00 MOV ECX,9C7A60 03F7003C E8 5FBA8EFC CALL KnightOn.0085BAA0 03F70041 61 POPAD 03F70042 C3 RET

for 1860 function adress is 0085BAA0

Thanks
[/quote]