Luigi Auriemma

aluigi.org (ARCHIVE-ONLY FORUM!)
It is currently 19 Jul 2012 13:45

All times are UTC [ DST ]





Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 4 posts ] 
Author Message
 Post subject: Please could you help me locate the encrypted password
PostPosted: 20 May 2009 21:53 

Joined: 19 Apr 2009 23:01
Posts: 13
hi aluigi,

i have located "Phrase" in my clientregistry.blob file and include the hex section


Code:
00019540  00 00 50 68 72 61 73 65 01 50 7E 00 00 00 00 00    ..Phrase.P~.....
00019550  00 00 04 00 04 00 00 00 01 00 00 00 02 00 00 00    ................
00019560  04 00 5C 00 00 00 02 00 00 00 43 37 35 36 41 33    ..\.......C756A3
00019570  31 41 30 38 32 46 42 33 45 30 31 34 46 41 34 37    1A082FB3E014FA47
00019580  42 41 37 32 41 41 42 43 38 41 35 46 38 31 32 37    BA72AABC8A5F8127
00019590  44 39 35 43 34 32 43 45 46 45 37 30 39 42 43 45    D95C42CEFE709BCE
000195A0  31 46 35 37 34 30 37 32 35 39 44 36 34 31 35 33    1F57407259D64153
000195B0  46 44 34 46 30 41 32 35 43 43 31 42 33 34 39 38    FD4F0A25CC1B3498
000195C0  30 38 45 31 30 33 12 00 2A 00 00 00 43 6C 6F 63    08E103..*...Cloc



as i understand it,
Code:
C756A31A082FB3E014FA47BA72AABC8A5F8127D95C42CEFE709BCE1F57407259D64153FD4F0A25CC1B349808E103

is my encrypted password?

Thank you


Top
 Profile  
 
 
 Post subject: Re: Please could you help me locate the encrypted password
PostPosted: 20 May 2009 22:11 

Joined: 19 Apr 2009 23:01
Posts: 13
I am getting the registry values using this delphi procedure i found:

procedure GetRegistryValues;
var
Reg: TRegistry;
strProductID: String;
strMachineGuid: String;
strHalfLifeIO: String;
begin
Reg:= TRegistry.Create;
try
Reg.Rootkey:= HKEY_LOCAL_MACHINE; //should this be HKEY_CURRENT_USER?
Reg.Openkey('SOFTWARE\Microsoft\Windows\CurrentVersion', FALSE);
strProductID := Reg.ReadString('ProductId');
Reg.CloseKey;
Reg.Openkey('SOFTWARE\Microsoft\Cryptography', FALSE);
strMachineGuid := Reg.ReadString('MachineGuid');
Reg.CloseKey;
Reg.Rootkey := HKEY_CURRENT_USER;
Reg.Openkey('\Software\Valve\Half-Life\Settings', FALSE);
strHalfLifeIO := Reg.ReadString('io');
Reg.CloseKey;
finally
Reg.Free;
// complete := PChar(strProductID+strMachineGuid+strHalfLifeIO);
showmessage(PChar(strProductID+strMachineGuid+strHalfLifeIO));
end;
end;

as i understand, the string shown at the end of that procedure should be my decryption key?

Now that i have my encrypted password and my decryption key, how would i go about getting the actual password

Thank you


Top
 Profile  
 
 Post subject: Re: Please could you help me locate the encrypted password
PostPosted: 20 May 2009 23:40 

Joined: 13 Aug 2007 21:44
Posts: 4068
Location: http://aluigi.org
for the first post, yes that one is your encrypted password.

and for the second post, yes the concatenation of those 3 values is your decryption key.
the whole process for decrypting the steam password is available in the source code of my steampwd tool so the answer is there (then in any case I know only C so any of my explanation is exactly the same of my source code)


Top
 Profile  
 
 Post subject: Re: Please could you help me locate the encrypted password
PostPosted: 24 May 2009 13:33 

Joined: 19 Apr 2009 23:01
Posts: 13
thanks luigi, have finished my steam decrypter in delphi now

source here:
steam-decrypter-in-delphi-by-counterstrikewi-t883.html

it turns out that i didnt need the decryption key in the end just the encrypted password and then to call the funtion DecryptDatafor this Machine which is located in the Steam.dll file

thanks again

counterstrikewi


Top
 Profile  
 
Display posts from previous:  Sort by  
Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 4 posts ] 

All times are UTC [ DST ]


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for: