Using Hashed Passwords in Gunz

**Linear88** · 12-02-09

Is it actually possible to encrypt passwords in dbo.Login to make them encrypted through SHA1?

I've been looking around and I've found the HashBytes function.

How do I make Gunz read the encrypted password?

I know it has to be related with some stored procedure and in MatchServer.

**MentaL**

**ThievingSix** · 12-02-09

The only way I know of is to either hash the password as it goes out from Gunz or as it comes into matchserver. Either way you'll have to hook some packets.

**Linear88** · 12-02-09

How do I do that?

**Solaire** · 12-02-09

Either hook MatchLogin (clientsided) or the serversided login function (don't know it for sure). Make it sent the password, but hashed. Or make it hashed serversided.

**CobraCom** · 13-02-09

The way is easy.

- PwInput() //* Remake the password into an md5 hash.

same on register pages. md($password).

Problem is finding it. I managed it once though, but I had to delete the logins on my db to re-design it.

**death4u2** · 13-02-09

yea i wa thinking about that also.

offtopic: Cobra go to msn i think the forum got hacked.

**ThePhailure772** · 13-02-09

Yes it is possible to hash the passwords sent.What everyone is saying is true, but you also have to edit the column value on the Login table.

**Linear88** · 13-02-09

@Phail: I know the column value, its binary(20) for SHA1.

Found a piece of code from the runnable, any idea on what to do with it?

Spoiler:

**ThePhailure772** · 13-02-09

No, the column should be a varchar(128). Also, that's the packet id, you're in the networking protocol for GunZ. If you can do C++, I'll help you write a quick detour on login.

Since I had to reformat and needed to rewrite this...

MD5 Libraries: http://www.md5hashing.com/c++/

Code:

DWORD ZPostLoginAddr = 0x004C3E20;
CDetour ZPostLoginDet;

void __cdecl ZPostLoginHook ( char *szUserID, char *szPassword, DWORD dwVersion, DWORD dwFileList )
{
	md5wrapper md5;
	ZPostLoginDet.Ret ( false );
	ZPostLoginDet.Org ( szUserID, md5.getHashFromString ( szPassword ).c_str( ) , dwVersion , dwFileList );
}

Just use it with Lance Vorgin's detour class.

**ThievingSix** · 13-02-09

Why the hell do you need a md5 library....just the build in windows function..

Code:

const
  ADVAPI32 = 'advapi32.dll';
  function CryptAcquireContext(phProv: PULONG; pszContainer: PAnsiChar; pszProvider: PAnsiChar; dwProvType: DWORD; dwFlags: DWORD): BOOL; stdcall; external ADVAPI32 name 'CryptAcquireContextA';
  function CryptCreateHash(hProv: ULONG; Algid: ULONG; hKey: ULONG; dwFlags: DWORD; phHash: PULONG): BOOL; stdcall; external ADVAPI32 name 'CryptCreateHash';
  function CryptHashData(hHash: ULONG; const pbData: PBYTE; dwDataLen: DWORD; dwFlags: DWORD): BOOL; stdcall; external ADVAPI32 name 'CryptHashData';
  function CryptGetHashParam(hHash: ULONG; dwParam: DWORD; pbData: PBYTE; pdwDataLen: PDWORD; dwFlags: DWORD): BOOL; stdcall; external ADVAPI32 name 'CryptGetHashParam';
  function CryptDestroyHash(hHash: ULONG): BOOL; stdcall; external ADVAPI32 name 'CryptDestroyHash';
  function CryptReleaseContext(hProv: ULONG; dwFlags: DWORD): BOOL; stdcall; external ADVAPI32 name 'CryptReleaseContext';

function MD5(const Input: String): String;
const
  HP_HASHVAL = $0002;
  PROV_RSA_FULL = 1;
  CRYPT_VERIFYCONTEXT = $F0000000;
  CRYPT_MACHINE_KEYSET = $00000020;
  ALG_CLASS_HASH = (4 SHL 13) ;
  ALG_TYPE_ANY = 0;
  ALG_SID_MD5 = 3;
  CALG_MD5 = (ALG_CLASS_HASH Or ALG_TYPE_ANY Or ALG_SID_MD5) ;
var
  hCryptProvider : ULONG;
  hHash : ULONG;
  bHash : Array[0..$7F] Of Byte;
  dwHashLen : DWORD;
  pbContent : PByte;
  cnt : Integer;
begin
  dwHashLen := 16;
  pbContent := Pointer(PChar(Input)) ;
  Result := '';
  If CryptAcquireContext(@hCryptProvider,nil,nil,PROV_RSA_FULL,CRYPT_VERIFYCONTEXT Or CRYPT_MACHINE_KEYSET) Then
    begin
    If CryptCreateHash(hCryptProvider,CALG_MD5,0,0,@hHash) Then
      begin
      If CryptHashData(hHash,pbContent,Length(Input),0) Then
        begin
        If CryptGetHashParam(hHash,HP_HASHVAL,@bHash[0],@dwHashLen,0) Then
          begin
          For cnt := 0 To dwHashLen - 1 Do
            begin
            Result := Result + Format('%.2x',[bHash[cnt]]) ;
          end;
        end;
      end;
      CryptDestroyHash(hHash) ;
    end;
    CryptReleaseContext(hCryptProvider, 0) ;
  end;
  Result := AnsiLowerCase(Result) ;
end;

**Linear88** · 13-02-09

Found a code in OllyDbg.

Code:

Spoiler:

To the CALL:

Spoiler:

And I'm not really sure about how to use C++, didn't really learn it yet.

I have Visual C++ 2005 Express Edition though.

Using Hashed Passwords in Gunz

Thread Tools

Search Thread

Using Hashed Passwords in Gunz

Re: Using Hashed Passwords in Gunz

Re: Using Hashed Passwords in Gunz

Re: Using Hashed Passwords in Gunz

Re: Using Hashed Passwords in Gunz

Re: Using Hashed Passwords in Gunz

Re: Using Hashed Passwords in Gunz

Re: Using Hashed Passwords in Gunz

Re: Using Hashed Passwords in Gunz

Re: Using Hashed Passwords in Gunz

Re: Using Hashed Passwords in Gunz

Advertisement