The Forum is up for sale: XeNTaX Forum looking for new owner
Globel Agenda
-
chrrox
- Moderator
- Posts: 2602
- Joined: Sun May 18, 2008 3:01 pm
- Has thanked: 57 times
- Been thanked: 1411 times
-
aluigi
- VVIP member
- Posts: 1916
- Joined: Thu Dec 08, 2005 12:26 pm
- Location: www.ZENHAX.com
- Has thanked: 4 times
- Been thanked: 661 times
- Contact:
Re: Globel Agenda
uhmm a bad format because it doesn't have a real format.
it's only a chunk based sequence of data composed by a zip file at the beginning and unknown content (probably encrypted with CryptEncrypt) from offset 0x34AC59.
so till offset 0x34AC59 you can extract all the files in that chunked zip archive simply adding the following lines:in the loop of zip.bms and setting the "name" variable to "" because all the files have the name "zip".
but from that offset starts the encryption.
I have also tried to use the password "FA00CDF5-8D87-4a76-BEE1-D9E483220C13" but seems (judging the usage of wscat) that it's appended to a string passed to the Create.Cryptography function of the dll.
debugger's job
it's only a chunk based sequence of data composed by a zip file at the beginning and unknown content (probably encrypted with CryptEncrypt) from offset 0x34AC59.
so till offset 0x34AC59 you can extract all the files in that chunked zip archive simply adding the following lines:
Code: Select all
findloc offset string "PK\x03\x04"
goto offsetbut from that offset starts the encryption.
I have also tried to use the password "FA00CDF5-8D87-4a76-BEE1-D9E483220C13" but seems (judging the usage of wscat) that it's appended to a string passed to the Create.Cryptography function of the dll.
debugger's job