Help with AES 128 encrypted file

[phroyt]

After some time, I got this solved.

The DEC 3.0 library (Delphi Encryption Compedium Part I), allow you to inform one Key in the object creation with any length.

PHP Code:

Key := 'd90cwjipoybs3usoh6bs0yn53jk0nlijyy3eocr1lmp0hbdv8o1u3fer7m8bgcpz';
Cipher := TCipher_Rijndael.Create(Key, nil); 


Behind the TCipher.Create method, it is used a THash_RipeMD256 to create a DigestKey, 32 bytes long.
And the Initialization of Cipher is done too.

I mislead to think that the AES code was wrong, because the result text still scrambled.
But after taking a little more debugging I found a nasty XOR with a fixed key.

Voilá!

Below is the correct code, that has no dependency on DEC Version.
Compiles on D7 to D10.2, only need to change DEC unit names:

PHP Code:

implementation

{$R *.dfm}

uses
  Cipher, Cipher1, Hash;

procedure SimpleXOR(V: PAnsiString; X: PAnsiString);
var
  I,J,K,L: Integer;
begin
  L := 0;
  J := Length(V^);
  if (J > 1) then
  begin
    K := Length(X^);
    for I := 1 to J do
    begin
      Inc(L);
      if (L>K) then
        L := 1;
      V^[I] := AnsiChar(Ord(V^[I]) xor Ord(X^[L]));
    end;
  end;
end;

function DecodeFile(Filename: String): AnsiString;
const
  Code: AnsiString =
    #$CE#$E1#$FB#$BF#$E8#$AE#$F1#$83+
    #$23#$24#$25#$26#$3F#$7D#$2A#$28+
    #$3C#$3E#$5E#$3B#$B4;
  Key: AnsiString =
    'd90cwjipoybs3usoh6bs0yn53jk0nli'+
    'jyy3eocr1lmp0hbdv8o1u3fer7m8bgcpz';
var
  Cipher: TCipher_Rijndael;
  Hash: THash_RipeMD256;
  K: String;
  F1: TFileStream;
  S1: TStringStream;
  Data: AnsiString;

begin
  Result := '';
  if FileExists(Filename) then
  begin
    F1 := TFileStream.Create(Filename, fmOpenRead+fmShareDenyNone);
    S1 := TStringStream.Create('');

    //DEC 3.0
    Cipher := TCipher_Rijndael.Create('', nil);
    Hash := THash_RipeMD256.Create(nil);
    Hash.Init;
    Hash.Calc(PAnsiChar(Key)^, Length(Key));
    Hash.Done;
    Cipher.Init(Hash.DigestKey^, Hash.DigestKeySize, nil);
    Cipher.EncodeBuffer(Hash.DigestKey^, Hash.DigestKey^, Hash.DigestKeySize);
    Cipher.Done;

    F1.Position := 0;
    S1.Size := F1.Size;
    S1.Position := 0;
    Cipher.DecodeStream(F1, S1, F1.Size);
    FreeAndNil(Cipher);

    S1.Position := 0;
    SetLength(Data, S1.Size);
    Data := S1.DataString;
    FreeAndNil(F1);
    FreeAndNil(S1);

    SimpleXOR(PAnsiString(@Data), PAnsiString(@Code));
    Result := Data;
  end;
end;

procedure TForm1.btn1Click(Sender: TObject);
var
  F, P: String;
  F1: TFileStream;
begin
  P := ExtractFilePath(ParamStr(0));
  F := P+'somefile.bin';
  mmo1.Text := DecodeFile(F);
end; 


[phroyt]

Although it compiles on Delphi 10.2 Tokyo, the computed values are messed up.

Using this port works fine:
https://github.com/luizvaz/DelphiEncryptionCompendium

[ziapcland]

Respected sir phroyt,
Your research work is admirable & highly appreciate-able. Very informative for keen researcher of decryption. I am working on a ransomware encrypted data files to decrypt back, your this article give a track to work on.
Regards & respects.

[phroyt]

If you need help, post the target malware in a new thread.

I am sure that some curious minds would help.