Test Foro de elhacker.net SMF 2.1

Buenos dias, compañeros

Gracias de antemano a quienes me ayuden con este gran problema que tengo, primero les contare que es lo que necesito hacer, me dieron unos archivos cifrados que me serviran para unos servidores de juegos, los archivos son pdf unicos, son guias, pero solo se pueden leer en un software y este me los coloca como una imagen, para que los pueda ver pero solo con ese software.

Las guias son bastante completas y serviran para muchas cosas mas en servidores de juegos propios, antes aclaro, el software es de mi propiedad ya que era usado en los servidores, pero no fui yo quien lo diseño sino un amigo, quien fue asesinado hace 2 meses y lamentablemente no me dejo copia de los proyectos, en otro foro explique esto y aun asi me banearon la cuenta y bloquearon todo espero que aqui no sea asi, con net reflector decodifique el codigo de la aplicacion exe y me dio algunos codigos clave, ahi verifique que los archivos estan cifrados, por lo tanto me di a la tarea de tratar de entender el codigo, pero al final tengo dos errores, que marcare a continuacion junto con mi codigo

clase1
Código:


Public Class descifrar



    Public Shared Function DecryptFile(ByVal inFs As Security.Cryptography.CryptoStream, ByVal RijndaelPrivateKey As Security.Cryptography.Rijndael) As Byte()
        Dim buffer As Byte() = New Byte(1 - 1) {}
        Using managed As Security.Cryptography.Rijndael = New Security.Cryptography.RijndaelManaged()
            managed.KeySize = &H100
            managed.BlockSize() = &H80
            managed.Mode = Security.Cryptography.CipherMode.CBC
            Dim buffer2 As Byte() = New Byte(4 - 1) {}
            Dim buffer3 As Byte() = New Byte(4 - 1) {}
            inFs.Seek(0, IO.SeekOrigin.Begin)
            inFs.Seek(0, IO.SeekOrigin.Begin)
            inFs.Read(buffer2, 0, 3)
            inFs.Seek(4, IO.SeekOrigin.Begin)
            inFs.Read(buffer3, 0, 3)
            Dim count As Integer = BitConverter.ToInt32(buffer2, 0)
            Dim num2 As Integer = BitConverter.ToInt32(buffer3, 0)
            Dim num3 As Integer = ((count + num2) + 8)
            Dim num4 As Integer = (CInt(inFs.Length) - num3)
            Dim buffer4 As Byte() = New Byte(count - 1) {}
            Dim buffer5 As Byte() = New Byte(num2 - 1) {}
            inFs.Seek(8, IO.SeekOrigin.Begin)
            inFs.Read(buffer4, 0, count)
            inFs.Seek(CLng((8 + count)), IO.SeekOrigin.Begin)
            inFs.Read(buffer5, 0, num2)
            Dim rgbKey As Byte() = rsaPrivatekey.decryptor(buffer4, False)
            [color=red]Using transform As Security.Cryptography.ICryptoTransform = managed.CreateDecryptor(rgbKey, buffer5)[/color]
                Using stream As IO.MemoryStream = New IO.MemoryStream
                    Dim num5 As Integer = 0
                    Dim num6 As Integer = 0
                    Dim num7 As Integer = (managed.BlockSize / 8)
                    Dim buffer7 As Byte() = New Byte(num7 - 1) {}
                    inFs.Seek(CLng(num3), IO.SeekOrigin.Begin)
                    Using stream2 As Security.Cryptography.CryptoStream = New Security.Cryptography.CryptoStream(stream, transform, Security.Cryptography.CryptoStreamMode.Write)
                        Do
                            num5 = inFs.Read(buffer7, 0, num7)
                            num6 = (num6 + num5)
                            stream2.Write(buffer7, 0, num5)
                        Loop While (num5 > 0)
                        stream2.FlushFinalBlock()
                        stream2.Close()
                    End Using
                    Return stream.ToArray
                End Using
            End Using
        End Using
    End Function
End Class


Dim rgbKey As Byte() = rsaPrivatekey.decryptor(buffer4, False)

El error que me da es el siguiente No se ha declarado el nombre 'rsaPrivatekey'. entiendo que el rsa es otra forma de decodificar pero tratando de resolver el codigo me he dado cuenta que por el metodo rsa no lo podre resolver y por eso lo hice con rijndael.


Boton que ejecutara la desencriptacion del archivo seleccionado


Código:

Imports System.Diagnostics

Imports BitMiracle.Docotic.Pdf
Public Class frmprincipal


    Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
        Dim path As String = "c:\prueba.epp"
        Dim document As New PdfDocument
        Using reader As IO.StreamReader = New IO.StreamReader(path)
         [color=red]  Dim buffer As Byte() = descifrar.DecryptFile(reader.BaseStream, me.cp2)[/color]
            document.Open(buffer)
        End Using

        Using stream As IO.MemoryStream = New IO.MemoryStream
            document.Images.Item(0).Save(stream)
            Me.imgAutoImage.Image = Image.FromStream(stream)
            Me.imgAutoImage.Update()
        End Using
        document.Dispose()

    End Sub

    Private Sub frmprincipal_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load


    End Sub
End Class


  Dim buffer As Byte() = descifrar.DecryptFile(reader.BaseStream, me.cp2)

Aqui el error es que dice la linea, Me.cp2 cuando busco que es el objeto en el formulario que decodifique Me.cp2 me topo que lo unico que tengo es lo siguiente Private cp2 As RSACryptoServiceProvider.

si de algo sirve, el net reflector lanza el codigo de esta forma decodificado

Código:

NET REFLECTOR

Private Sub tvImagenes_AfterSelect(ByVal sender As Object, ByVal e As TreeViewEventArgs)
    If Not Me.tvImagenes.SelectedNode.Tag.ToString.StartsWith("cejilla:") Then
        Dim path As String = Me.tvImagenes.SelectedNode.Tag.ToString
        LicenseManager.AddLicenseData("768EE-1R9O0-VHMLX-5Q57C-1Y0MG")
        Dim document As New PdfDocument
        Using reader As StreamReader = New StreamReader(path)
     [color=red]  Dim buffer As Byte() = VisorDocumentos.DecryptFile(reader.BaseStream, Me.cp2)[/color]
            document.Open(buffer)
        End Using
        Using stream As MemoryStream = New MemoryStream
            document.Images.Item(0).Save(stream)
            Me.imgAutoImage.Image = Image.FromStream(stream)
            Me.imgAutoImage.Update
        End Using
        document.Dispose
    End If
End Sub




Private Shared Function DecryptFile(ByVal inFs As Stream, ByVal rsaPrivateKey As RSACryptoServiceProvider) As Byte()
    Dim buffer As Byte() = New Byte(1  - 1) {}
    Using managed As AesManaged = New AesManaged
        managed.KeySize = &H100
        managed.BlockSize = &H80
        managed.Mode = CipherMode.CBC
        Dim buffer2 As Byte() = New Byte(4  - 1) {}
        Dim buffer3 As Byte() = New Byte(4  - 1) {}
        inFs.Seek(0, SeekOrigin.Begin)
        inFs.Seek(0, SeekOrigin.Begin)
        inFs.Read(buffer2, 0, 3)
        inFs.Seek(4, SeekOrigin.Begin)
        inFs.Read(buffer3, 0, 3)
        Dim count As Integer = BitConverter.ToInt32(buffer2, 0)
        Dim num2 As Integer = BitConverter.ToInt32(buffer3, 0)
        Dim num3 As Integer = ((count + num2) + 8)
        Dim num4 As Integer = (CInt(inFs.Length) - num3)
        Dim buffer4 As Byte() = New Byte(count  - 1) {}
        Dim buffer5 As Byte() = New Byte(num2  - 1) {}
        inFs.Seek(8, SeekOrigin.Begin)
        inFs.Read(buffer4, 0, count)
        inFs.Seek(CLng((8 + count)), SeekOrigin.Begin)
        inFs.Read(buffer5, 0, num2)
        [color=red]Dim rgbKey As Byte() = rsaPrivateKey.Decrypt(buffer4, False)[/color]
        Using transform As ICryptoTransform = managed.CreateDecryptor(rgbKey, buffer5)
            Using stream As MemoryStream = New MemoryStream
                Dim num5 As Integer = 0
                Dim num6 As Integer = 0
                Dim num7 As Integer = (managed.BlockSize / 8)
                Dim buffer7 As Byte() = New Byte(num7  - 1) {}
                inFs.Seek(CLng(num3), SeekOrigin.Begin)
                Using stream2 As CryptoStream = New CryptoStream(stream, transform, CryptoStreamMode.Write)
                    Do
                        num5 = inFs.Read(buffer7, 0, num7)
                        num6 = (num6 + num5)
                        stream2.Write(buffer7, 0, num5)
                    Loop While (num5 > 0)
                    stream2.FlushFinalBlock
                    stream2.Close
                End Using
                Return stream.ToArray
            End Using
        End Using
    End Using
End Function


Agradezco a todo aquel que pueda darme una mano y orientarme un poco con esto ya que de momento me urge resolverlo, tengo dias investigando y aprendiendo pero no logro resolver este problema, gracias si alguien me orienta, quiza no me regale la solucion, pero con que me explique que es lo que esta mal para que yo pueda analizar y obtener una solucion lo agradecere mucho.

Si tienes el ejecutable sin proteccion (packer) y lo ha decodificado con Reflector, porque no usas reflexil para modificar el EXE?

Digo, en la parte donde decodifica los archivos PDFs. Por lo que veo, la funcion (DecryptFile) devuelve un array el cual puedes dumpear facilmente al disco.

No importa si el EXE despues no sigue funcionando, lo importante es decodifcar los PDF's... no?

Gracias, es cierto puedo hacerlo, igual solo quiero los pdf gracias, probare tu sugerencia.

gracias por la ayuda ya me dio un par de ideas mas, gracias nuevamente

Cita de: boreau en 24 Octubre 2012, 21:20 PM
gracias por la ayuda ya me dio un par de ideas mas, gracias nuevamente

No hay por donde...  ;D

Pues si pudieras subir un pdf para probar te podria ayudar!!!

Bien veamos el problema lo intente dumpear y etc y sigue sin funcionar, estoy tratando de seguir el codigo y pues tratando de sacarle mas y mas el jugo ya saque la clave, estoy tratando de verificar como logro sacar el codigo, pero justo ahora que ya practicamente funciona, me tira clave incorrecta.

Pero eso me da el alivio que el codigo ya funciona, subo un ejemplo codificado con extension .epp aunque solo es un archivo similar a los otros ya que los otros son un poco grandes subo este que fue uno de prueba que me dejaron que era mas pequeño.

http://www.filehosting.org/file/details/388811/a1060083-5bce-4bea-93b7-b93778337134.epp

el nuevo codigo quedo asi, solo me marca el error clave incorrecta en la linea

Dim rgbKey As Byte() = rsaPrivateKey.Decrypt(buffer4, False) de la clase descifrar



Imports System.Diagnostics
Imports BitMiracle.Docotic.Pdf
Imports System.Security.Cryptography
Imports System.IO
Imports System.Text
Imports System.Xml

Public Class frmprincipal
   Dim decode As RSACryptoServiceProvider
   Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
       Dim pathdir As String = "C:\0A"
       Dim pathxml As String = Path.Combine(pathdir, "ind.xml")
       Dim ficpruebas As String = pathxml


       Dim pathimg As String = "c:\0A\13ddf979-e4ce-4be6-b1c3-ac65ea36fa5f.epp"
       
       decode = New RSACryptoServiceProvider


       'esta es la clave guardada privada la cual contiene el archivo xml 0x3D5354424C667A57626D76663F3D4E7065766D76743F39505155385B32664F48734B654A59556D5B43775558566D336C74334D42374E4D53515173765A5558564E424C3054527576586D3932507630423038556A473357725B3A44304B63724736717B7977345A5379703650546F4D7774504259506472446871335B385A765759584F59593466794B6D6C6774757579566D4A37753578546767543942375B48463462626B68396C4456354757754B74373974316352506F4B457538687A374F4E3E3D304E7065766D76743F3D467971706F666F753F425242433D30467971706F666F753F3D513F304271715246626E656F70374D2C337962584C5B6E3574726D5A577A5B39645B6D69535A686879595B683A57314674425B684E3A6E6C4745557177352C425B5279454949316559737247776C3A7833427B38673934523E3E3D30513F3D523F3A4C7A54357B5B756D79456246635373716870593A452C394735677071386E34777968704832582C3175777A67645863673046754469463146692C664E475867733A67322C4F4571314B4F74594D746863764C4B63783E3E3D30523F3D45513F6D3853526A39373773593A2C674B45506835654677436F32434F44783078525B523475326D736E463A637177535B50515B756633685B3364774D6C6F4533744777464958623268667032554672587670533A395179523E3E3D3045513F3D45523F48594F5042445B744F65664336332C4F3A784B3879584F517B47384F76357A64375772353756633A433330736947766E756A4E3049536F34425B2C6256397346537056305338657362742C37374F5B724B4537624D783E3E3D3045523F3D4A6F7766737466523F6B32517863653546702C4844563051306E5333596C77524B79454846354D55485351374F694C31356A5548693A507548386338342C72625553775B724270434D6E5A756D4F6F30444F4B46653848685165796A4778423E3E3D304A6F7766737466523F3D453F79554873346D74797330567630783244674D426C30535775494573776E4D64383A77623A7B3735586373385558446834687948536753546F4D55376B2C597A5B474477744F376971646759303668523A7A5469716C46686A3048774E30796F4E452C6772662C6970696A4452537A6D6779323734436A486635706A3A6A73665A726B4C623752676C7672457853706F6231727A4E6935715B5338484B6650353A55496A685449443432786C3E3D30453F3D305354424C667A57626D76663F00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000


       Dim xmlkeys As String = clavesXML(ficpruebas)


       Me.decode.FromXmlString(xmlkeys)

       Dim document As New PdfDocument
       Using reader As IO.StreamReader = New IO.StreamReader(pathimg)
           Dim buffer As Byte() = descifrar.DecryptFile(reader.BaseStream, decode)
           document.Open(buffer)
       End Using

       Using stream As IO.MemoryStream = New IO.MemoryStream
           document.Images.Item(0).Save(stream)
           Me.imgautoimage.Image = Image.FromStream(stream)
           Me.imgautoimage.Update()
       End Using
       document.Dispose()

   End Sub

   Private Sub frmprincipal_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load


   End Sub

   Private Sub imgautoimage_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles imgautoimage.Click

   End Sub

   Private Shared Sub crearXMLclaves(ByVal ficPruebas As String)
       Dim rsa As New RSACryptoServiceProvider()

       Dim xmlKey As String = rsa.ToXmlString(True)

       ' Si no existe el directorio, crearlo
       Dim dirPruebas As String = Path.GetDirectoryName(ficPruebas)

       If Directory.Exists(dirPruebas) = False Then
           Directory.CreateDirectory(dirPruebas)
       End If

       Using sw As New StreamWriter(ficPruebas, False, Encoding.UTF8)
           sw.WriteLine(xmlKey)
           sw.Close()
       End Using

   End Sub

   Private Shared Function clavesXML(ByVal fichero As String) As String
       Dim s As String

       Using sr As New StreamReader(fichero, Encoding.UTF8)
           s = sr.ReadToEnd
           sr.Close()
       End Using

       Return s
   End Function


   Private Sub Button2_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button2.Click
 
   End Sub
End Class









Public Class descifrar



   Public Shared Function DecryptFile(ByVal inFs As System.IO.Stream, ByVal rsaPrivateKey As Security.Cryptography.RSACryptoServiceProvider) As Byte()
       Dim buffer As Byte() = New Byte(1 - 1) {}
       Using managed As Security.Cryptography.AesManaged = New Security.Cryptography.AesManaged
           managed.KeySize = &H100
           managed.BlockSize() = &H80
           managed.Mode = Security.Cryptography.CipherMode.CBC
           Dim buffer2 As Byte() = New Byte(4 - 1) {}
           Dim buffer3 As Byte() = New Byte(4 - 1) {}
           inFs.Seek(0, IO.SeekOrigin.Begin)
           inFs.Seek(0, IO.SeekOrigin.Begin)
           inFs.Read(buffer2, 0, 3)
           inFs.Seek(4, IO.SeekOrigin.Begin)
           inFs.Read(buffer3, 0, 3)
           Dim count As Integer = BitConverter.ToInt32(buffer2, 0)
           Dim num2 As Integer = BitConverter.ToInt32(buffer3, 0)
           Dim num3 As Integer = ((count + num2) + 8)
           Dim num4 As Integer = (CInt(inFs.Length) - num3)
           Dim buffer4 As Byte() = New Byte(count - 1) {}
           Dim buffer5 As Byte() = New Byte(num2 - 1) {}
           inFs.Seek(8, IO.SeekOrigin.Begin)
           inFs.Read(buffer4, 0, count)
           inFs.Seek(CLng((8 + count)), IO.SeekOrigin.Begin)
           inFs.Read(buffer5, 0, num2)
           Dim rgbKey As Byte() = rsaPrivateKey.Decrypt(buffer4, False)
           Using transform As Security.Cryptography.ICryptoTransform = managed.CreateDecryptor(rgbKey, buffer5)
               Using stream As IO.MemoryStream = New IO.MemoryStream
                   Dim num5 As Integer = 0
                   Dim num6 As Integer = 0
                   Dim num7 As Integer = (managed.BlockSize / 8)
                   Dim buffer7 As Byte() = New Byte(num7 - 1) {}
                   inFs.Seek(CLng(num3), IO.SeekOrigin.Begin)
                   Using stream2 As Security.Cryptography.CryptoStream = New Security.Cryptography.CryptoStream(stream, transform, Security.Cryptography.CryptoStreamMode.Write)
                       Do
                           num5 = inFs.Read(buffer7, 0, num7)
                           num6 = (num6 + num5)
                           stream2.Write(buffer7, 0, num5)
                       Loop While (num5 > 0)
                       stream2.FlushFinalBlock()
                       stream2.Close()
                   End Using
                   Return stream.ToArray
               End Using
           End Using
       End Using
   End Function
End Class




Gracias