Legend completely decrypts the receiving and receiving protocols

Source: Internet
Author: User

Data transmission in Legend 2
Port 7000
Send mri152
The recv receives a string of numbers such as 5454564564.


The following general statement
. Data?
SzReadBuffer3 db 35 dup (?)
SzReadBuffer4 db 72 dup (?)
SzReadBuffer6 db 256 dup (?)
SzReadBuffer7 db 256 dup (?)
Jjj dd?

Wpname2 db 256 dup (?)
Wpname db 256 dup (?)
Wpr20 db 256 dup (?)
SzBuffer2 db 256 dup (?)

Myebp4 dd 256 dup (?)
Myebp1 db 256 dup (?)
Myadd db 256 dup (?)
Myadd2 dd?
Sss3 dd?
. Data

R2jf1b db 0, 0
R2jf1a db 0, 0
R2jf14 dd 0, 0
R2jf19 db 0, 0
R2jf18 dd 0, 0
R2jz8 dw 2710 h, 0
R2jf8 dd 0, 0
R2jf4 dd 0, 0
R2jz4 db 4, 0
Kg2 dd 1,0
Kg3 dd 0

Jjj2 dd?
JJ5 dd 007df667h, 0

Jjjjj dd 99990099 h, 0

Wpyh2 dd 0 h, 0
Sss2 db Fi [jpHGGdiZlhWkH> xpGo @ kH> x !, 0; Fi?> KV_JmGBzGo <kHnxmGo <k !, 0
. Const
Dubis db 0123456789 ABCDEF, 0
Kh1 db <
Kh2 db>


Wpyh1 db #, 0
Wpyh3 db <L <J> I @ C <, 0
Wpyhp db/, 0
Wpyhh db !, 0
Xuanz db <D5D78D62DC874A7C0A8B94A3803CD746A4FD83C69A773A17508A1BA2452D>, 0
Xuanj db #3 <BL <, 0

; # <= D> <I _ @ jHOXqG_DlJNtnH_PkIo @ lH> xrIODuHO @ tI!

Wp2s db % s, 0
Wpyong db % s, 0
Wpyong2 db % s % x % s, 0

Szcy db password verification successful, 0



Wp1x db % x, 0

The following is the encryption code used for decryption.
_ Repne1 proc _ hSocket

Inc kg2
. If kg2 = 2


Mov jjj2, 0; dui chen luan ma
Mov esi, offset szReadBuffer3
Mov jjj, esi
Mov esi, offset szReadBuffer2
@@:


Mov al, [esi]
Movzx eax, al
Mov edi, offset dubis
Mov ecx, 17
Repne scasb
Xor eax, eax
Mov al, 16
Sub eax, ecx
Shl eax, 04
Mov ecx, jjj
Mov [ecx], al



Inc esi
Mov al, [esi]
Movzx eax, al
Mov edi, offset dubis
Mov ecx, 17
Repne scasb
Xor eax, eax
Mov al, 16
Sub eax, ecx

Mov ecx, jjj
Or [ecx], al
Inc jjj
Inc esi
Inc jjj2
. If jjj2 = 34
Jmp @ F
. Endif
Jmp @ B
@@:
;__________________________________________________________________________
The above characters are messy.


Mov jjj2, 0
Mov esi, offset szReadBuffer3

Xor ebx, ebx
Mov edi, jjj5
@@:
. If jjj2 = 34
Jmp @ F
. Endif
Mov bl, [esi]
Mov edx, ebx
Movzx ecx, di
Shr ecx, 08

Xor dl, cl
Mov [esi], dl
Mov edx, esi


Xor eax, eax
Mov al, bl
Add di, ax
Imul ax, di, 0ce6dh
Add ax, 58bfh
Mov edi, eax
Inc esi
Inc jjj2
Jmp @ B
@@:
Mov al, 2fh
Mov [esi], al

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
Mov jjj2, 0
Mov esi, offset szReadBuffer3

Xor ebx, ebx
Mov edi, jjj5
@@:
. If jjj2 = 35
Jmp @ F
. Endif
Mov bl, [esi]
Mov edx, ebx
Movzx ecx, di
Shr ecx, 08

Xor dl, cl
Mov [esi], dl



Movzx eax, dl
Add di, ax

Imul ax, di, 0ce6dh
Add ax, 58bfh
Mov edi, eax
Inc esi
Inc jjj2
Jmp @ B
@@:






Mov jjj2, 0
Mov esi, offset szReadBuffer4
Mov al, 60
Mov [esi], al
Inc esi
Mov jjj, esi
Mov esi, offset szReadBuffer3

@@:


Mov al, [esi]
Movzx eax, al

Shr al, 04
Mov edi, offset dubis
Add edi, eax
Mov ecx, jjj
Mov al, [edi]
Mov [ecx], al


Mov al, [esi]
Movzx eax, al
And al, 0fh
Mov edi, offset dubis
Add edi, eax
Inc jjj
Mov ecx, jjj
Mov al, [edi]
Mov [ecx], al

Inc jjj
Inc esi
Inc jjj2
. If jjj2 = 35
Jmp @ F
. Endif
Jmp @ B
@@:
Mov al, 62
Mov [esi + 71], al
Mov

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.