appalsap
Moderator
 Reputation: 0
Joined: 27 Apr 2006
Posts: 6753
Location: Pakistan
|
 Posted: Mon Apr 30, 2007 11:02 am Post subject: [C] UNERL |
 |
|
UNERL is an npgl.erl decrypter, a port from uzeils' asm program to C. (with modifications made to make it easier to read and understand) Some credits to Uligor for his leet asm debugging skills.
| Code: |
#include <stdio.h>
#include <windows.h>
DWORD FindKey(BYTE Test);
DWORD i, pKeys[] = {0xC5F1F435, 0x83A3A023, 0x4E626C2E, 0x89818809,
0xCAF2F83A, 0xD2D416C6, 0x9C1D8D91, 0x64264662, 0x39497178, 0x1A0A1218, 0};
int main(int argc, char* argv[])
{
HANDLE hERL; DWORD dwSize, z, k; char *ERLBuf;
if (argc <= 2) {
puts("UNERL Erl-Decryptor. Usage: UNERL [infile] [outfile]");
return 1;
}
if (GetFileAttributes(argv[1]) == -1) {
printf("cannot find %s\n", argv[1]);
return 2;
}
hERL = CreateFile(argv[1], FILE_READ_DATA, 4|1|2, NULL, 3, 128, NULL);
if (hERL == (HANDLE)-1) {
printf("unable to open %s\n", argv[1]);
return 3;
}
dwSize = GetFileSize(hERL, NULL);
if (dwSize == -1) {
puts("file too big!");
CloseHandle(hERL);
return 4;
}
ERLBuf = malloc(dwSize);
if (!ReadFile(hERL, ERLBuf, dwSize, &z, NULL)) {
printf("unable to read from %s\n", argv[1]);
free(ERLBuf);
CloseHandle(hERL);
return 5;
}
k = FindKey(ERLBuf[4]);
if (!k) {
puts("unable to retrieve key");
return 6;
}
for(z = 0; z < 4; ERLBuf[z] = 61, z++);
for(;z < dwSize - 4; z++) {
k = k + (k * 2) + 1; (BYTE)ERLBuf[z] ^= ((BYTE)k + 0x76);
}
CloseHandle(hERL);
hERL = CreateFile(argv[2], FILE_WRITE_DATA, 4|1|2, NULL, 2, 128, NULL);
if (hERL == (HANDLE)-1) {
printf("unable to create new %s\n", argv[1]);
free(ERLBuf);
return 7;
}
if (!WriteFile(hERL, ERLBuf, dwSize, &z, NULL)) {
puts("unable to write decrypted content!");
free(ERLBuf);
return 8;
}
free(ERLBuf);
CloseHandle(hERL);
printf("Successfully decrypted %s\n", argv[1]);
return 0;
}
DWORD FindKey(BYTE Test)
{
for(i = 0; pKeys[i] != 0; i++) {
if (Test ^ ((BYTE)(pKeys[i] + (pKeys[i] * 2) + 1) + 0x76) == '=')
return pKeys[i];
} return 0;
}
|
[code] messed up some brackets, ignore that
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
