Question about updating Menasculio's INIdecrypt

[5hoursez]

My question is: Is all I need to edit is the new and current DWORD value?

It's been so long since i have worked with this stuff.. can anyone point me in the right direction of the correct dword, i will be googling for it in the mean-time...


The original post with links to the download is here:


Here is Menasculio's current sourcecode:

unsigned char dane[1024];
DWORD LEN = 1024;

HCRYPTPROV hProvider = NULL;
HCRYPTHASH hHash = NULL;
HCRYPTKEY hKey = NULL;
BOOL bRes;
DWORD ddLen = LEN;

bRes = CryptAcquireContext( &hProvider, NULL, MS_DEF_PROV, 1, 0xF0000000 );
bRes = CryptCreateHash( hProvider, CALG_MD5, NULL, NULL, &hHash );
bRes = CryptHashData( hHash, (BYTE *) "1111", 4, NULL );
bRes = CryptDeriveKey( hProvider, CALG_RC4, hHash, CRYPT_CREATE_SALT, &hKey);
bRes = CryptDestroyHash( hHash );
bRes = CryptDecrypt( hKey, NULL, FALSE, NULL, dane, &LEN );
bRes = CryptDestroyKey( hKey );





and what is ptr to unicode?
CPU Disasm
Address Hex dump Command Comments
77E7F86C FFB6 98F8E777 PUSH DWORD PTR DS:[ESI+77E7F898] ; PTR to UNICODE "ncacn_np"

CPU Dump
Address Hex dump Command Comments
0043202F 696F 6E 4040000 IMUL EBP,DWORD PTR DS:[EDI+6E],4040

^am i in the right direction? ^

[iamabot]

it still works for me
i out the .exe he madei n the ini folder, then just drag the files over the .exe.

works for me ^^

[tux-penguin]

Originally Posted by iamabot

it still works for me
i out the .exe he madei n the ini folder, then just drag the files over the .exe.

works for me ^^

same

[5hoursez]

gah i must be cursed, i will go try it thanks

weird.. musta blocked a process with the new comodo, i reset/purged history of it all and watched carefully as i accepted and blocked this time :P I don't know if that was it, but it is working now.. I also faintly remember now when it wasn't working before a reboot would fix it.. either way it works properly still Thanks again.. will get to work on new info now

[tux-penguin]

just drag the ini onto it and then you have it decrypted.

[tux-penguin]

/closed

seeing as hes got it working now