rar.txt

关于黑客的论坛的下载资料

                      RAR 档案加密的方法大公开!

经过长久的努力与追踪, 发现RAR 1.5X 对档案加密的方式是把压缩的资料再多加
一重编码手序, 就算将RAR 档案中的encrypted flag 拿掉(拿掉很简单, 只要把
file flag 清为0, 然後把file header 的CRC value 再算一遍就好了), 仍然不能
在没密码的情形下解开加了密码的档案　

在下挖出了RAR 对压缩资料加密的办法, 正在想如何不靠原密码解码时, registration
key password 又回到了我脑海中......啊哈, 一下子就解开了那注册key 档案　
(所以现在是正式合法注册者了)

所以就不再想如何破密码罗　不过, 为了那些手上有加了密码却解不开来的RAR file
的人, 在下就公布一下RAR 是如何对档案加密码的吧　

首先要产生密码的encrypt key (一组32-bit integer), 方法列在下面　
然後再产生32-bit CRC value of password (CRC-32 的程式库很多　很公开,
自己找一找吧), 再参考更下面那一段asm.

有了加密码的方法, 就可以知道怎样不靠原密码解开加了密码的东西吗?
我不晓得, 但是大家以後可以自己对RAR file 加密码, 而不用RAR.EXE 了......
只有压过的档案资料部份才要加密码, CRC value 记得要跟著update.
其他RAR file details 见RAR 附的technote.doc.

讲了半天, 好像是半点用都没有?

=======================================================================
产生密码之encrypt key 的方法: (passwd 放密码, 以Ascii 0 结尾)
tmp0 = 0;
tmp1 = 0;
tmp2 = 0;
ax = 0;
dx = 0;
for i:=0 to strlen(passwd)-1 do
begin
        bl = passwd[i];
        bh = 0;
        tmp0=tmp0 + bl;
        tmp1=tmp1 xor bl;
        tmp2=tmp2 + bl;
        rol tmp2,1
        xor al,bl
        add dx,bx
        shl bx,1
        xor ax,LoEncryptTable[bx]
        add dx,HiEncryptTable[bx]
end;
Result=dx:ax;

压缩後资料加上密码保护的程式:
2C78:05A9 2EA10304       MOV    AX,CS:[0403]      <--- 将密码之32-bit CRC 值
2C78:05AD 2E8B1E0504     MOV    BX,CS:[0405]      <--- 载入BX:AX,
2C78:05B2 2E8B160704     MOV    DX,CS:[0407]      <--- 将密码之encrypt key
2C78:05B7 2E8B2E0904     MOV    BP,CS:[0409]      <--- 载入bp:dx
2C78:05BC 053412         ADD    AX,1234           ｜AX=AX+1234h
2C78:05BF 8BF8           MOV    DI,AX             ｜DI=AX and 1feh
2C78:05C1 81E7FE01       AND    DI,01FE           ｜
2C78:05C5 2E339D0000     XOR    BX,CS:[DI+0000]   ｜BX=BX xor LoCRC[DI shr 1]
2C78:05CA 2E2B950002     SUB    DX,CS:[DI+0200]   ｜DX=DX-HiCRC[DI shr 1]
2C78:05CF 33C2           XOR    AX,DX             ｜
2C78:05D1 D1CD           ROR    BP,1              ｜
2C78:05D3 33EB           XOR    BP,BX             ｜
2C78:05D5 D1CD           ROR    BP,1              ｜
2C78:05D7 33C5           XOR    AX,BP             ｜
2C78:05D9 3024           XOR    [SI],AH           ｜DS:SI 指向压缩过的资料
2C78:05DB 46             INC    SI                ｜
2C78:05DC E2DE           LOOP   05BC              ｜
2C78:05DE 2EA30304       MOV    CS:[0403],AX      ｜将BX:AX 当成新的Crc 值,
2C78:05E2 2E891E0504     MOV    CS:[0405],BX      ｜
2C78:05E7 2E89160704     MOV    CS:[0407],DX      ｜?
2C78:05EC 2E892E0904     MOV    CS:[0409],BP      ｜?

 表(一) LoEncryptTable: array of word;
1778:0000  83 46 FC 14 0B F6 75 E1-5E 8B E5 5D CB 55 8B EC
1778:0010  8B 56 06 81 FA 82 00 7D-09 52 9A A9 0C 29 13 59
1778:0020  EB 02 8B C2 5D CB 55 8B-EC 81 EC 8C 03 56 57 C7
1778:0030  46 F0 00 00 C7 46 EC 00-00 C7 46 EA 00 00 C7 46
1778:0040  E8 00 00 C7 46 E2 00 00-C7 46 E0 00 00 C7 46 DE
1778:0050  00 00 C7 46 DC 00 00 C7-46 DA 00 00 C7 46 D8 00
1778:0060  00 C7 46 D6 00 00 C7 46-D4 00 00 33 C0 50 90 0E
1778:0070  E8 8E 30 59 83 3E 7D 62-00 74 25 B8 04 00 50 1E
1778:0080  B8 43 04 50 1E B8 3D 04-50 90 0E E8 4D 56 83 C4
1778:0090  0A B8 08 00 50 B8 FF FF-50 90 0E E8 07 B8 59 59
1778:00A0  83 3E 18 02 00 74 12 1E-B8 5D 04 50 1E B8 E7 62
1778:00B0  50 90 0E E8 AB 59 83 C4-08 B8 14 80 50 1E B8 E7
1778:00C0  62 50 9A 31 34 29 13 83-C4 06 A3 83 63 3D FF FF
1778:00D0  74 16 90 0E E8 2D 50 90-0E E8 34 78 FF 36 83 63
1778:00E0  90 0E E8 81 53 59 EB 16-83 3E 7F 00 02 74 0F B8
1778:00F0  06 00 50 B8 04 00 50 90-0E E8 A9 B7 59 59 B0 00
1778:0100  88 86 74 FC B4 00 A3 43-63 99 89 16 75 63 A3 73
1778:0110  63 89 16 79 63 A3 77 63-89 16 01 62 A3 FF 61 33
1778:0120  C0 A3 11 62 A3 13 62 33-C0 A3 4C 02 A3 50 64 33
1778:0130  C0 A3 F5 61 A3 F7 61 89-46 E4 89 46 E6 8B 16 94
1778:0140  69 A1 92 69 B9 03 00 BB-80 F0 9A 8E 08 29 13 89
1778:0150  16 09 62 A3 07 62 A1 61-63 8B 16 5F 63 81 C2 80
1778:0160  0F 15 FC FF A3 05 62 89-16 03 62 0B C0 7F 14 7C
1778:0170  06 81 FA 00 40 73 0C C7-06 05 62 00 00 C7 06 03
1778:0180  62 00 00 81 3E 41 63 FF-7F 72 0F 77 07 83 3E 3F
1778:0190  63 FF 76 06 C7 06 4F 63-00 00 A1 41 63 8B 16 3F
1778:01A0  63 83 C2 EC 15 FF FF A3-3D 63 89 16 3B 63 A0 03
1778:01B0  02 B4 00 0B C0 75 0C 1E-B8 61 04 50 90 0E E8 13
1778:01C0  62 59 59 90 0E E8 15 8F-9A DA 02 29 13 89 16 6D
1778:01D0  63 A3 6B 63 B8 14 80 50-1E B8 E7 62 50 9A 31 34
1778:01E0  29 13 83 C4 06 A3 83 63-3D FF FF 74 03 E9 2E 01
1778:01F0  83 3E 7F 00 02 74 03 E9-13 01 B8 20 00 50 1E B8

 表(二) HiEncryptTable: array of word;
1778:0200  E7 62 50 9A D5 2D 29 13-83 C4 06 A3 83 63 3D FF
1778:0210  FF 75 0F B8 02 00 50 B8-05 00 50 90 0E E8 85 B6
1778:0220  59 59 1E B8 E7 62 50 1E-B8 D7 67 50 9A 3A 41 29
1778:0230  13 83 C4 08 83 3E 18 02-00 74 36 FF 36 83 63 9A
1778:0240  A2 17 6D 24 59 A3 43 63-99 3B 16 3D 63 7F 16 7C
1778:0250  06 3B 06 3B 63 73 0E A1-43 63 99 29 06 3B 63 19
1778:0260  16 3D 63 EB 0C C7 06 3D-63 00 00 C7 06 3B 63 00
1778:0270  00 80 3E 9C 01 00 74 2E-80 3E 03 02 00 74 27 83
1778:0280  3E 4F 63 00 74 0D 81 2E-3B 63 3F 01 83 1E 3D 63
1778:0290  00 EB 13 A0 40 64 3A 06-36 64 75 05 B8 01 00 EB
1778:02A0  02 33 C0 A2 9C 01 C7 06-15 62 02 00 B8 0D 00 50
1778:02B0  33 C0 50 1E B8 80 6A 50-9A F7 32 29 13 83 C4 08
1778:02C0  C6 06 82 6A 73 C7 06 85-6A 0D 00 A1 06 02 A3 54
1778:02D0  64 83 3E 54 64 00 74 0C-80 3E A3 00 00 74 05 83
1778:02E0  0E 83 6A 08 FF 36 83 63-B8 72 00 50 90 0E E8 5E
1778:02F0  5E 59 59 FF 36 83 63 B8-73 00 50 90 0E E8 4F 5E
1778:0300  59 59 1E B8 E7 62 50 1E-B8 8C 04 EB 4E B8 06 00
1778:0310  50 B8 04 00 50 90 0E E8-8B B5 59 59 EB 46 90 0E
1778:0320  E8 E1 4D A1 54 64 89 46-E8 83 3E 4F 63 00 74 06
1778:0330  C7 06 47 63 02 00 33 C0-50 90 0E E8 F3 AF 59 0B
1778:0340  C0 74 0F B8 04 00 50 B8-FF FF 50 90 0E E8 55 B5
1778:0350  59 59 1E B8 E7 62 50 1E-B8 A5 04 50 90 0E E8 73
1778:0360  60 83 C4 08 83 26 83 6A-DF C7 06 8B 6A 00 00 C7
1778:0370  06 89 6A 00 00 B8 73 00-50 90 0E E8 62 5E 59 1E
1778:0380  B8 A4 00 50 1E B8 97 66-50 90 0E E8 2F 4F 83 C4
1778:0390  08 A3 7D 63 C7 06 2D 62-00 00 C7 06 2B 62 00 00
1778:03A0  A0 D7 67 B4 00 0B C0 75-2A 1E B8 37 67 50 1E B8
1778:03B0  87 67 50 90 0E E8 05 4F-83 C4 08 A3 81 63 90 0E
1778:03C0  E8 B9 52 90 0E E8 D5 C4-FF 76 E8 90 0E E8 5A 0F
1778:03D0  59 EB 06 A1 83 63 A3 81-63 83 3E 30 02 00 74 0C
1778:03E0  1E B8 8A 04 50 90 0E E8-EA 5F 59 59 83 3E 54 64
1778:03F0  00 75 03 E9 99 00 83 3E-2A 02 00 74 03 E9 8F 00