Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WinRAR 2.50 algorithm #33

Open
teknixstuff opened this issue Aug 21, 2024 · 5 comments
Open

WinRAR 2.50 algorithm #33

teknixstuff opened this issue Aug 21, 2024 · 5 comments

Comments

@teknixstuff
Copy link

Could you also figure out how to generate keys for the WinRAR 2.00 - 2.50 algorithm?

@bitcookies
Copy link
Owner

If you have a key file for winrar 2.x, could you share it? I'm going to look for the old installer to check it out first.

@teknixstuff
Copy link
Author

If you have a key file for winrar 2.x, could you share it? I'm going to look for the old installer to check it out first.

Before WinRAR 2.60, a key file wasn't used. Instead, a more standard name and key system was used. Here is a key I found online:
Name: 01-registered, Key: C4BF18BBEB

@vavavr00m
Copy link
Contributor

vavavr00m commented Aug 23, 2024

Here's the installer for 2.0. The uploader (funnily seems like the dev) also has a bunch of other old versions.

@bitcookies
Copy link
Owner

I tested winrar 2.00 and found that it calls bcryptprimitives.dll and bcrypt.dll and hits ProcessPrng and OptionalHeader.AddressOfEntryPoint respectively.

It is assumed that earlier versions of winrar used cryptographic algorithms or hash functions from the bcrypt library. bcrypt.BCryptHash+BD0 occurs frequently, and probably involves the SHA family of hash algorithms.

You can put breakpoints at the above two places and observe the changes in ECX and EDI.

@DemonGuy664
Copy link

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

5 participants
@vavavr00m @bitcookies @teknixstuff @DemonGuy664 and others