Unlock the "secret" in the high-strength file encryption master"

Author: Ice sugar [J.S. T] & [E.S. T]

This article has been published in the 1st Issue of the "black guest XFile" magazine.
After being submitted to the evil gossip Forum by author ice sugar
If you need to reprint the information, please be sure to keep this information

Today, our Community students took a high-intensity file encryption master to give the President a try, saying that this encrypted folder is a good thing, you can put private items in the folder and then encrypt the folder. I was curious and followed up. He also said that it took him a long time to find a good thing, and that there was no better encrypted folder software on the network. I thought, is the broken software for an encrypted folder so powerful? I am curious about the encrypted folder on the president's notebook. The contents of this folder are exactly the materials we will hold for the second computer competition. I believe there are questions in it. I decided to study it. Secretly copied the president's encrypted folder to my computer, and put the so-called "high-strength file encryption master" Down to the computer to prepare for my research. When I get home, I don't forget to turn on my computer. Open the guy under my Down to enter the installation interface. (1)

The next step is a silly "Next" operation. After installing it, right-click our folder and add a "high-strength encryption" option. This is the masterpiece of our encryption master. Create a folder, create a text file in the folder, add some content, (2) encrypt the folder, password: 1

After encryption, we can see that only our unencrypted encryption .exe is available. Others are hidden. After going through my tests, I found that the unencrypted directory .exe, which modifies the System File Settings, is equivalent to hiding the system file. The encrypted file will be replaced with another open method as the system file is hidden. First, choose "Tools"> "Folder Options"> "View"> "hide files and folders"> "show all files and folders) and view-hide protected operating system files, and hide known file extensions (remove the hook )! Purpose: To display the files hidden by the encryption master, that is, the files we encrypt. Open our folder and check that there are two more files. (3)

Desktop. ini is a configuration setting which should not be able to be used in it. Intuition tells me that the encrypted file must be hidden in Thumbs. dn. Open it and find nothing in it. Because it is only a printer task. Are our files missing. However, the article may be hidden in Thumbs. dn. I still don't want to give up. So I read its attributes. Size: 16.0 KB (16,384 bytes) occupied space: 16.0 KB (16,384 bytes)
Guess the file should be in it. In order to prove my guess, do an experiment. Put a txt text in the previous section, which is small enough to prove that the file is in it. Now we use the encryption master to encrypt a large file, if Thumbs. the size in the dn is the same as the size of the file before encryption, so our guess is true! Search the hard disk and find a 1.rm file for an experiment. (4) (encrypt the previous File Information)


We encrypt the information. (5) Did you confirm our guesses. You can focus on this.

In our Thumbs. dn file.
In order to make Thumbs better. experiment on dn, I created another folder, put Thumbs. copy the dn to the folder. First of all, I felt strange about the suffix of this folder. I modified the suffix of this folder and tried to see what changes would happen and ended in failure. Later, I thought of a way to think that the software has its encryption method. Can we use its encryption method to decrypt it so that we can restore the files we need. Assume that the encryption mode of the encryption .exe is run. First, search for files in the folder that have been previously encrypted. If there is an encrypted file, it will generate a Thumbs. dn file (I tested it, desktop. the INI file is useless. verify whether the encrypted file is thumbs. dn, which contains a verification password file and our source file ),
If yes, it prompts you to enter the decryption password; if not, it will pop up and enter the encryption password. If so, how can we extract the files in it? At this time, we will ask our uncle RAR to compress the Thumbs. dn file. Because Thumbs. dn is a folder and it won't let us open it directly, we will use Uncle RAR's open function. Open the compressed package directly after decompression and enter our Thumbs. dn folder. At this time, you can find four files (6) in it)

1. the mem file is our source file. Decompress the package and open all the other three files in Notepad (7)


At this time, we know that 1.mem is our source file and is a encrypted file. We put this file and the unencrypted .exe file in the same folder separately. If it is displayed, we need to enter a password to encrypt the file again and then decrypt it. Can we get the file we want, that is, the source file? (Note: Open 1. the mem file will require you to enter the decryption password, and then compress and decompress RAR files.) Put the two files in a separate folder and run the encryption master, as expected, he requested that you enter the encrypted password and unlock the password. At this time, the encryption master will make an error (8)


There will be two errors, but you don't have to worry about them. Run "unencrypted encryption .exe", enter the encryption password as prompted, and decrypt the password. This decryption will not cause errors, the decrypted file is the source file. Check whether the source file before encryption is the same as the size of the source file after encryption! (9 ).

After repeated experiments, I found that 1. mem. es is the source file 1, 2. mem. es is the source file 2, and so on. Although our file name is damaged during the process, this does not have a great impact on us. As long as the data in it is not damaged, our results will be achieved.
We can use NotePad to open our 1. mem. es to see our previous content. Someone asked, if I didn't store a text file, how can I find out what type of file it is? In fact, you only need to open it with notepad, and there will be related prompts. I 'd like to explain it in 1.rm. I have unlocked my encrypted file.
Now we can use NotePad to open the file header. (10)




PS: A simple cracking attempt. I hope the old bird will not laugh. Just read the article that is boring.