Shoutbox

Hello.

I just thought I'd post this up here incase it helps anyone. Attached is a tool to encrypt or decrypt log files, I'll bring out a tool which will encrypt/decrypt a whole directory when I have more time.

To decrypt Messenger Plus! log files (C++):


Fileformat of .ple files

First 10 bytes are the same for all log files.
const char standardHeader[] = {0x10,0x01,'M','P','L','E','1','<','<',0};

The next 4 bytes, I'm not sure what they are for, but in all log files I've seen they are
const char unknownbytes[] = {1,0,0,0};

After this is the length of the password check string (4 bytes). This is usually 13
Then comes the encrypted password check string. Ill talk about how to decrypt it later.


All that was the header. For the rest of the file, it is in multiple chunks of data.
Each of these chunks start with the 'signature' :
const char sig[] = {0xE9,0xFF,0xA3,0x00};
After this, there is the length of the following data (4 bytes).
Then there is the encrypted text.



To decrypt text :

Messenger Plus! uses the CryptoAPI to encrypt and decrypt text.
This is set up with the following call
CryptAcquireContextW(&hProv,L"MessengerPlusEncryptProvider",L"Microsoft Enhanced Cryptographic Provider v1.0",1,0);

I discovered that for some reason, the password is scrambled, and that the password is unicode (2 bytes).
The algorithm for this in pseudo code is:

for i = 0 to length of password - 1
        newpassword [i] = password[i] + password [i + 1]
next i
newpassword[last letter] = password[last letter] + password[0]


The calls to continue setting up so that you can decrypt text are:

CryptCreateHash(hProv,0x8003,0,0,&hHash);
CryptHashData(hHash,newpassword,len,0);
CryptDeriveKey(hProv,0x6801,hHash,0x800000,&hKey);

This final call gives you a HCRYPTKEY which you can use in the CryptEncrypt and CryptDecrypt functions on the text

Sorry if this is all a bit confusing, I dont think i formatted it, or explained it very well

Solus


Edit - I replaced the file with one which has the VC runtime library statically linked, so it *should* work now

Edit 2 - Ok, so I converted it all to unicode, and made a few changes so it'll run on computers which haven't got Messenger Plus on.