Most of the time when I get some MD5 hashes to crack (legally!), I prefer to search online hash sites which hosts lot of hashes and corresponding text. But sometimes it wont just work. So the only alternative is to crack the hashes by our own methods and tools. I use different MD5 crackers and even coded one for specific uses I found a new tool which claims to be the fastest MD5 cracker in the world. It is called BarsWF. It offers the use of multiple CPUs(if you have them) and it also uses the Graphics card (it supports both nVidia and ATi) if avail.
Use of graphics cards in computationally intense tasks are not new, but seeing a freeware that efficiently uses the computing power of GPU makes me happy :). I don't have a decent GPU to check the performance, but I am pretty sure it uses GPU efficiently. BarsWF is available for both nVidia and ATi chipsets. For ATi it still uses the old Brook technology, so it may not support latest HD 5xxx cards. Hope that author will move to OpenCL and we will have much faster MD5 cracker.
Worlds fastest MD5 cracker
VB.NET anomalies!
I have been always a strong follower of C based languages. I work with C, C++, C# for 90% of my time. In these days, I was told to look after some VB.NET code and found 2 anomalies which made me a little crazy for the first time. May be most of the VB.NET guys knows this, but it was pretty new to me( and yeah, I was baffled after I figured out the solution).
First scenario:
Most of us use these kinda code quite often. This works great with C and C#, but lets see if it works with VB.NET
Well, I am not telling you the output, you can just check with VS IDE.
But beware of the usage, they wont work in VB.NET :P
Second scenario:
For this one we require a little math skill :)
You can guess the output, it is 2. We will look into VB.NET code.
If you think the output is 2, you are very wrong!
It is 3 for VB.NET. You will be thinking, how on earth? (at least I thought for first time).
Well, in C and C# when casting from floating point output to integer it "floors" the value.
In VB.NET, it uses another technique known as banker's rounding.
In most cases you can detect it pretty early in coding a routine, but this makes a big mess when you are converting a 3000 line equation solving C/C# code into VB.NET and finally what you see is some random values as output.
I don't like to do much coding in VB.NET. Maybe I am more inclined to C based syntax and maybe my mind always tells me to put semi column after each line of code. Maybe it is just my ignorance about the VB.NET language that made these errors and I suppose most of the VB.NET coders do know about these "anomalies" .
Multi Processor and Execution Speed
I was browsing, and saw a video converter. Just for a curiosity, I downloaded it and tried for couple of times. It worked perfectly, but I was kinda thinking whether the speed is a little slow for a Dual core processor like x2 5600 :P. So I fired up the Task Manger. It shows a 50% CPU usage, while the program says that it will use 100% CPU(There is a settings for that).
Well, the problem is with the code. Seems like most of the small scale softwares are not MP aware. It should have been better if softwares like these ones (which uses a lot of computational time) uses the Multi Core correctly, the whole time spent to convert can be minimized to half(almost!).
As new processors are coming with 4 and 8 cores, it will be great if the softwares are MP aware, and use the processing power to the MAX!
Office 2007 Theme
I haven't written anything for a long time!
Well, I was pretty busy with my work, so not much time to spend on blog.
This topic is regarding the Office 2007 Theme. I was getting bored of the blue color (theme) of Office 2007 in my office and I want a change :). I looked around to find an option but I can’t find any!
Seems like the new Menu structure (Ribbon) has made me confused. So I started to search the menu from top to bottom. After a couple of minutes I found the option button.
And we have three themes to select.
And the themes looks like this:
Black looks promising. Silver is too flashy!
Changed to black until i get bored again!
Mouse at it's 40's
Amazing invention ;)
Gmail Password Stealing Attempt!
I got a mail recently demanding my user name, password and other information in my gmail account from a mail address MAIL ACCOUNT (accountreplypass.account@gmail.com)
It is a nice piece of joke done by some one. Please beware of these kinda craps.
Analysis of malware: E-Card.exe
[Disclaimer]:
I am not a professional malware analyst(It is not my job, i am more of a C# developer working on domains like banking :P). I like to Reverse Engineer malwares, and it is my hobby. Some of the contents may not be perfectly correct.
I got this file some times back. Lets see what it contains :)
Initial Analysis
-----------------
File: E-Card.exe
MD5: B2308378D0311478EFC5AC0D87F51F5D
File Size: 238,592 bytes
File is compiled in Delphi. EP looks like that, and no sign of packing :)
Tracing through the code
-------------------------
Tracing through the initial instructions will show u these piece of interesting codes.
It is decrypting a lot of memory. There are 2 loops and after the two loops we can see 2 MZ headers.
That means, we have 2 other exe's inside our main exe
These 2 exe's are written to temp folder with name scan.exe and finder.exe
Stack SS:[0012FFAC]=00153D38, (ASCII "C:\DOCUME~1\Username\LOCALS~1\Temp\scan.exe")
EDX=00153D58, (ASCII "scan.exe")
e-card.moduleentrypoint+10D
Stack SS:[0012FFA8]=00153D78, (ASCII "C:\DOCUME~1\Username\LOCALS~1\Temp\finder.exe")
EDX=00153D98, (ASCII "finder.exe")
e-card.moduleentrypoint+169
Then these two exes are run from there. I just cut em from there to some other place for the rest of the analysis.
So our main exe (E-Card.exe) acts as a dropper :)
Analysis of 2 new exe's
-----------------------
File: scan.exe
MD5: 07B1A1F3C0F9C7E1009F94835B5C8D59
File Size: 196,096 bytes
File: finder.exe
MD5: 565DEA79362D55D53D8441320D450093
File Size: 27,648 bytes
Aah, we have the .pack32 section in scan.exe
Does this means the same packing as the earlier one(paris Hilton)?
Is it also made by Antivirus-Xp 2008 guys?
Lets see!
Damn! its the same guys, same kinda code, but i think it is new, coz OEP isnt the same :P
So no use in debugging the same stuff. Lets see whats the new exe doing :)
It seems like it has been compressed by UPX, but it is not!
Lets step through the instructions.
It looks like, it is trying to get the base address of kernel32, by subtracting 0x1000 and checking for "MZ"
After getting base address of kernel32, it will surely want to find some main addresses like, addresses of GetProcAddress() and LoadLibrary()
GetProcAddress is found out by going through export table:
Yea! Now it is making a Thread with thread proc at 00402517.
It jumps to 00403000 then jumps to 00403104, where it will decrypt the rest of the code:
Seems like a lot of APIs :P
Now code is looking good, like this:
It will make a directory in the program files, named: "Program Files\Microsoft Common"
Then it will copy the base exe(finder.exe) to this folder with a new name "svchost.exe"
After loading more dlls to memory, and getting more APIs, it calls another function: 00403C61
In that it is loading sfc_os.dll, which is used by the "Windows File Protection"
Lets see what it wants with WFP
Now it is becoming interesting!
Call to 00403572, shows that it is gonna make some big changes to the system directory.
It finds the exact version of windows and makes the NTOSKRNL file name.
It loads "ntkrnlpa.exe" (mine is win xp sp2) to memory. It also loads ntdll.
Bingo!
We have some Ring0 stuffs too???
Looks like it wants our KeServiceDescriptorTable :)
The rest of the things continues and many NT* APIs are loaded.
There was an exception, but i didnt bother to go back for further analysis.
Hopefully i had made a BP on NTDLL, where it calls the Exception handler function.
It safely land to the code, and next thing is we will make a file in "temp", named "rdl5.tmp".
I looked at it wil PEID, Subsytem is NIL and import tables contains export from "ntoskrnl" with NT* and ZW* APIs.
Looks surely like a device driver (sys) file :)
Yep, further calls reveals that, this file may used in services.
Existing file aec.sys is replaced with malwares device driver.
But it doesnt seems to be worked in my system :P donno why :P
ANy way it moves onto loading the device driver using SCManager APIS.
The above code will start a service.
After the service is started, they will replace the original file, which was stored in "temp" folder.
I think, this happens only when they are failed to copy the malware to a sys file.
In my machine, it successfully copied into "asyncmac.sys".
Any way, i just copied the original .sys to drivers to avoid infection.
I will try to disasm the malware device driver after i have dealt with this :)
Seems like, it will just go on continue this, so i just broke from the loop.
After this, it will continue its infection, by making the svchost.exe(the malware) as default debugger.
Then it opens svchost.exe process and injects code using CreateRemoteThread().
Injected code starts from here:
00406A3A /$ 5D POP EBP
00406A3B . 83ED 0F SUB EBP, 0F
After that it ends execution by calling ExitProcess()
Analysis of malware device driver
---------------------------------
It surely tries to hook SSDT. I havnt analysed much, it is almost 1.30AM, and i have to go to office tomorrow(today?).
between, i can see this:
This surely looks like it disables the WriteProtect bit of cr0 (Control Register 0) to write entries to protected memory locations like SSDT. Any ways, i will try to figure it out eventually, till then, see you guys!
