Jump to content
Tuts 4 You


Popular Content

Showing content with the highest reputation since 08/12/2019 in all areas

  1. 4 points
    If that's the case, that's breakable. For RAR the most efficient attacks are bruteforce, and it's much much faster to bruteforce 6-symbol password than 12... You can try freeware cRARk (http://www.crark.net) or pirated Passware Kit to crack your passwords. Depending on your CPU/GPU, it might take few hours/days but that's certainly doable. EDIT: just to give you an example, my (quite outdated) PC can try 4500 passwords/second using cRARk. For the example, there are 26 capital letters, 26 lowercase letters and 10 numbers. So, 62 different characters. If it's a 4-symbol password, it's 62*62*62*62=14776336 possibilities. To try them all, it would take 3283 seconds, or 54 minutes. If it's a 6-symbol password, it's 62*62*62*62*62*62=56800235584 possibilites. That would be 144 days to try them all. If you know you used a word from dictionary, it's much easier to try all words from dictionary. If you used l33t sp34k, that's also a good information. If you know that you always put first capital letter, that's useful. And so on. Read the manual, make the most efficient rules for bruteforce and just try..
  2. 2 points
    Nice GPU you got there, does it run "mines sweeper" at 60 FPS ?
  3. 2 points
    Using cRARk with my GeForce RTX 2080 Ti, you can get around: So if your password is pretty short, bruteforcing is an option for you... -HooK
  4. 2 points
  5. 1 point
    I Released a way of patching these vm's, here https://github.com/TobitoFatitoNulled/Venturi77CallHijacker but you'll need to manually inject agile for now (will try to fix the issue asap tho. My disc is TobitoFatito#5573
  6. 1 point
    There is quite an extensive documentation available at http://help.x64dbg.com/en/latest/introduction/ConditionalBreakpoint.html, however if you don't feel like reading, just use Break Condition "0", Log Condition "r9 != 0" and uncheck "Fast Resume" (since fast resume will skip logging if break condition != 0).
  7. 1 point
    There are many working keys. One of them is "$^CQE!#(Mrfe%&&$": The key was brute forced using a quickly written C++ executable: The code for the C++ executable is as follows:
  8. 1 point
    [*] Changed the text How I did it? [*] Added +1 to sum factorial How I didt it? For now that the addresses are well know you can easily calculate the string value and change edit these reg values by patching the exe so it always return what ever you want.
  9. 1 point
    At a long enough password length, even with enormous computing power, one is more likely to find a collision than the original password. After more than 2^128 combinations are tried for the example AES-128 HMAC used. However since the character set is limited, its not exactly clear which passwords might have shorter length collisions and using which other character set. As well depending on the decryption algorithm, the collision password may not correctly decrypt. Keep in mind that the verification algorithm and decryption algorithm are 2 different things. The verification part is merely to save the trouble of decrypting garbage data and a mere convenience. Old WinRAR versions would just extract without checking validity. In these cases an automated attack would require knowing something about the decrypted data that could be verified for correctness. Unless pre-image attacks against AES become available or quantum computers then simply an 8 character password dictionary resistant with a good enough character set is enough for most usages. If you are worried about the NSA, then probably you would want to use something completely different given they are famous for backdooring algorithms and AES was standardized in part by them.
  10. 1 point
    hello , you can use " crunch " to generate a custom wordlist then change " rar " files extention to " zip " and finally you can use " fcrackzip " , all what i've mentioned is available on " kali linux OS " Greetz
  11. 1 point
    password: "viva la revolution" How the password verified? Here, check my entered password against the correct one, both encrypted. Obviously, the encrypted password at RVA 00011054 is 18 characters long. But, what is the encryption or decryption algorithm? Don't dive into that, instead I assume the algorithm is symmetrical. This time, I entered the right length password "123456789012345678". At entry of the subroutine, Ecx=004FF534, we can find the entered password at allocated buffer 008F0000: Copy and paste with the correct cipher password from RVA 00011054: 008F0000 12 EC C5 CB AC FC 86 96 23 7C 7D 57 46 5C 43 4F 008F0010 56 2D 2A 00 Run to the end of loop at 01323461, we got: 008F0000 12 76 69 76 61 20 6C 61 20 72 65 76 6F 6C 75 74 .viva la revolut 008F0010 69 6F 6E 00 ion.
  12. 1 point
    Yes it is based on AES-128 and AES-256 so its very secure. Quantum computing may just be a pipe dream - it is still far from guaranteed. Perhaps if cryptanalytic weaknesses are found in AES, it could also change things though its been studied by many mathematicians for many years without much progress. Short passwords especially will become vulnerable however. Remember there are now processor intrinsic for AES (https://en.wikipedia.org/wiki/AES_instruction_set), and if a special GPU-like hardware were fabricated, its possible you could do reasonably serious attacks on AES. Modern nVidia GTX now allow for integer operations in the streaming units so extremely high throughput is already possible there. Furthermore, government agencies may have massive amounts of hardware to do just that. But most people cannot foot the bill for the special hardware let alone the power consumption requirements needed to run it. Certainly I would not believe the absurdly outdated time required information on WinRAR's website (https://www.win-rar.com/enc_faq.html?&L=0#c7723). 100 times faster or 1000 times faster by now without much doubt depending on environment and method.
  13. 1 point
    I think it's more than enough until quantum computing becomes mainstream, most of us will be dust when that happens
  14. 1 point
    It works with the following code, thanks! static int GetRVA(MethodBase mb) { var mdInfo = MetadataInfo.GetMetadataInfo(mb.Module); int table = mb.MetadataToken >> 24; int rid = mb.MetadataToken & 0xffffff; mdInfo.MetaDataTables.GetRow((uint)table, (uint)rid, out var ppRow); return *(int*)ppRow; }
  15. 1 point
    You can use MetadataLocator to get an instance of IMetaDataTables then use https://docs.microsoft.com/en-us/dotnet/framework/unmanaged-api/metadata/imetadatatables-getrow-method
  16. 1 point
    1. Read https://www.oreans.com/ThemidaHelp.pdf 2. Add obfuscation like a ithare::obf 3. Encrypt strings with xorstr https://github.com/JustasMasiulis/xorstr 4. For education read https://github.com/lurumdare/ideas 5. Some tricks https://github.com/lurumdare/DefensiveGuideAgainstCrackers 6. Use embedding objects https://github.com/lurumdare/furikuri_tutorial (I think it is anti-disassembler https://forum.reverse4you.org/t/eset-finfinsher/1127 supported VMProtect, test on Themida and write me PM)
  17. 1 point
    At least they made him look cute!
  18. 1 point
    I won't update my Firefox for one main reasons: is not compatible with KeeFox plugin I'm using. Also the last version of Firefox takes a lot of of memory: 1 GB of memory and is also slow. My laptop is not that good: only Intel i3-2350M 2.30 GHz dual core.
  19. 1 point
  20. 1 point
    I think that the new VMs of Oreans are the best VMs out there. Until then all the VMs were with simple handlers, and the complexity were in other areas (in the obfuscation of the handlers or the obfuscation of the "vm code"). Oreans made vms with auto-generated complex handlers. (and now it isn't even necessary to obfuscate the handlers or the vm code) (As a side note: They protect their newer products with improved version of tiger, which does obfuscate the vm code with their regular obfuscation and using internal vm registers, but beside being annoying it doesn't add much to the protection..) I started working on VMProtect (just had one day to work on it), it looks similar to CISC, but they implement many operations with a small set of simple handlers, which make this vm more complex (than CISC, not the new vms, but I don't have the right to say that until I fully devirtaulize it) And about time consuming - it is enough to just devirtualize one of those new vms, if you do it good. I work on this project as a side project for fun (mostly on weekends), and it took me about two months to fully devirtualize fish. But after that it took me just a week to add support for tiger, and even less to add support for dolphin. I don't make money from this, but I don't share this project because then there won't be a point in this protection
  21. 1 point
    Well, there are few dedicated persons in the world who can do that. Noobs can't. And there are no up-to-date public tools (Deathway's tools are not working for most VMs already). So, after doing simple cost-benefit analysis, Themida guys will sleep really well.
  22. 1 point
    Yep. Yhis dump have the TM sections removed. Could have them on the right place but makes no difference to me. As i know Themida allocate al API's to VM'ed portions of memory outside the main exe. That is why i was so puzzled. Because i see that the redirection was into main exe virtual space and not in upper addresses. The IAT table can be restored via 4 patch points like in LCF-AT script or just bp on acces on a API and them memory bp on write on code section to see where is written. You can with a little patience to restore the IAT table or write a small Odbg script to automate. It remains to add the VM'ed antidumps and i think all is done. In you case. As you can see a dedicated person will UV the VM'ed code so i guess that Oreans cannot sleep well.
  • Newsletter

    Want to keep up to date with all our latest news and information?
    Sign Up
  • Create New...