Reverse Engineering RET Homepage RET Members Reverse Engineering Projects Reverse Engineering Papers Reversing Challenges Reverser Tools RET Re-Search Engine Reverse Engineering Forum Reverse Engineering Links

Go Back   Reverse Engineering Team Board > Reverse Engineering Board > .NET Reverse Engineering
FAQ Members List Calendar Search Today's Posts Mark Forums Read

Thread Tools Display Modes
Old 06-12-2012, 05:32 PM
schrodinger schrodinger is offline
Join Date: Oct 2009
Posts: 17
Default retrieve xceed zip decryptor password from a program

I have app which is packed using boxed app
I have it unpacked and extracted dependencies.
The program is written in .net and obfuscated using crypto obfuscator so I cleaned the code and here it is

The program has folder called db which has many .dat files.
These dat files are zip files but we need to change "mc" to "PK" using hex editor and rename file as *.zip. The zip files contain xml files which i want to extracted however they are encrypted.

I launched the app using .net tracer and set BP on reading dat file by changing one of the dat files in the db folder. It seems that it checks for some password to decrypt the zip files
Here is the reflector image

I hope some one help me finding the pass to dat files
Reply With Quote
Old 06-13-2012, 02:03 PM
kao kao is offline
Senior Member
Join Date: Sep 2007
Posts: 184

You've made some progress since last post, congratulations!

You should look into GClass32.smethod_9() - it gets password in one of parameters and then modifies it a bit. Figure out the the modification algorithm.

Then look at the methods which call GClass32.smethod_9() and see what password they use, and where it comes from. I started at GClass30.method_8(), and traced it all the way to GClass32.smethod_9().

It shouldn't take more than an hour to figure how it works.

In case you get stuck, here's a hint: Cnffjbeq sbe "gbp.qng" vf "gbpGBP"
Reply With Quote
Old 06-19-2012, 01:33 PM
schrodinger schrodinger is offline
Join Date: Oct 2009
Posts: 17

Thanks Kao ....
Actually, I tried a shortcut method (didn't bother the algo though)...

I created exception in Dile by inserting a file with wrong pass and checked arguments as it breaks on error while decryption. The arguments have the correct pass
Reply With Quote

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump

Powered by vBulletin® Version 3.6.4
Copyright ©2000 - 2023, Jelsoft Enterprises Ltd.