USKO Password crypt fonksiyonu

tarafından **EMO** Salı Nis. 10, 2012 4:53 pm

Clientteki fonksiyonu kullanarak encrypt ediyor sifreyi ve şifrenin encrypt edilmis halini sunuyor

Eğer asm bilginiz varsa clientteki fonksiyondan kod cıkartıp kendi encrypt/decrypt fonksiyonunuzu yazabilirsiniz.

C# Fonksiyonu

Kod:: public string sifreDeneme(IntPtr ProcessHandle, string Sifre) { IntPtr Adres1 = VirtualAllocEx(ProcessHandle, IntPtr.Zero, 1024, MEM_COMMIT, PAGE_READWRITE); IntPtr Adres2 = VirtualAllocEx(ProcessHandle, IntPtr.Zero, 1024, MEM_COMMIT, PAGE_READWRITE); IntPtr Adres3 = VirtualAllocEx(ProcessHandle, IntPtr.Zero, 1024, MEM_COMMIT, PAGE_READWRITE); char[] sifreCharDizi = Sifre.ToCharArray(); Byte[] sifreBytelar = System.Text.Encoding.ASCII.GetBytes(sifreCharDizi, 0, 1); WriteProcessMemory(ProcessHandle, Adres2, sifreBytelar, 1, 0); Byte[] sabitSayi = new Byte[] { 0x60, 0x7A, 0x9C, 0x00 }; WriteProcessMemory(ProcessHandle, Adres3, sabitSayi, 4, 0); string pStr = "60B9" + AlignDWORD(Adres1) + "BA" + AlignDWORD(Adres2) + "5168E803000052B9" + AlignDWORD(Adres3) + "BF" + AlignDWORD(new IntPtr(0x0085BAA0)) + "FFD761C3"; // www.neronlineworld.com Byte[] pBytes = ConvHEX2ByteArray(pStr); ExecuteRemoteCode(pBytes, ProcessHandle); Byte[] sonucSifre = new Byte[7]; ReadProcessMemory(ProcessHandle, Adres1, sonucSifre, 7, 0); string sifreString = System.Text.Encoding.ASCII.GetString(sonucSifre); VirtualFreeEx(ProcessHandle, Adres1, 0, MEM_RELEASE); VirtualFreeEx(ProcessHandle, Adres2, 0, MEM_RELEASE); VirtualFreeEx(ProcessHandle, Adres3, 0, MEM_RELEASE); return sifreString; }

ASM Fonksiyonu

Kod:: 03F70025 60 PUSHAD 03F70026 B9 0000F703 MOV ECX,3F70000 03F7002B BA 0000F803 MOV EDX,3F80000 03F70030 51 PUSH ECX 03F70031 68 E8030000 PUSH 3E8 03F70036 52 PUSH EDX 03F70037 B9 607A9C00 MOV ECX,9C7A60 03F7003C E8 5FBA8EFC CALL KnightOn.0085BAA0 03F70041 61 POPAD 03F70042 C3 RET

1860 crypt function offseti

Kod:: 0085BAA0