uhh:
char sbuff[MAX_PATH];
lstrcpy(sbuff,str);
also why MAX_PATH? don't pass strings directly to printf like that either.
this is a helpful comment:
return sbuff; //return sbuff
in your function crypt, i is an "unsigned char". if you pass a string > 255 bytes in length it will cause an unlimited loop.
try this:
char *crypt(char *str, int cryptkey)
// ...
int main(void)
{
char crypted[]=
"dwt+`fdeoe{dbk>r}=a~";
int i;
for(i = 0; i < 0xffff; i++)
if(strcmp("ftp.fallenwild.co.uk", crypt(crypted, i)) == 0)
printf("key = %04x\n", i);
return 0;
}
just to show you the pattern, here is the output:
key = 0001
key = 0501
key = 0a01
...
key = eb01
key = f001
key = f501
key = fa01
key = ff01
so it repeats every 500h(1280 decimal), so I know my range to brute... assuming it's not binary data, can slim the results:
int str_isascii(char *p, int len)
{
for(; --len; p++)
if(!isprint(*p) && !isspace(*p))
return 0;
return 1;
}
int main(void)
{
/* 0x01 */
char crypted[]=
"dwt+`fdeoe{dbk>r}=a~";
/* 0x90 */
char crypted2[]=
"\xf9\xf0\xf5\xf1\xce\x85\xde\xc2\xc3\xd9\xdd";
/* 0x123 */
char crypted3[] =
"\x45\x4b\x06\x42\x5e\x4c\x44\x0b\x40\x42"
"\x40\x48\x55\x43\x12\x40\x51\x5b\x42\x52"
"\x56\x5a\x5f\x17\x1c\x5f\x52\x5e\x28\x6d"
"\x62\x21\x28\x24\x2e\x69\x68\x2f\x25\x24"
"\x2e\x2c\x3c\x63\x70\x3b\x37\x24\x3a\x34"
"\x2c\x3e\x76";
int i, count = 0;
char *str;
for(i = 1; i <= 0x500; i++)
{
str = crypt(crypted2, i);
if(str_isascii(str, sizeof(crypted2)))
{
count++;
printf("%03x: %s\n", i, str);
}
}
printf("\ntotal: %d\n", count);
return 0;
}
001: ftp.fallenwild.co.uk
014: qba>usqpzpnqw~+gh(tk
017: |lj
DANH_VM]^T|75v//
03d: ZH4j"% )"3-( r?3r1/
046: #03l'!#"("<#%,y5:z&9
....
44c: ):9f-+)("(6)/&s?0p,3
456: 3 #|713282,35<i%*j6)
total: 45
crypted[] = 20 chars, 45 ascii results
crypted2[] = 11 chars, 64 ascii results
crypted3[] = 54 chars, 1 ascii result
edit: forgot a printf arg & return from main()