Quote:
|
If i remember right they were XOR encrypted
|
To not let this word (XOR) lying around without an explanation I will explain a bit further.
XOR is an assembler command which compares 2 values bit for bit. So we need 2 values in order to make an encryption, one of these values comes from the packet and the other one is saved somewhere in the .exe in a table.
Now lets say we have 2 hexvalues 7 and 4, the first value comes from the server in a packet and the second is stored in your .exe.
Because the command compares only bits we need to convert our hex value into a binary value. You can do this by using the microsoft calculator.
(From now on I will mark hex values with a h like 7h and binary with a b like 111b)
7h=111b
4h=100b
XOR takes now 111b and 100b and compares them if both bits are the same it does not return 1 (true) but 0 (false), if both bits are different it will return 1.
Ok now lets compare them:
111b (7h)
100b (4h)
011b
(false)(true)(true)
Now go to the microsoft calculator and put in 011.
It will tell you that 011b is 3h.
So what does this means?
The server sent you 7h (encrypted) but the real decrypted value is 3h.
I hope I could clear this fancy word a bit. :)