- Code: Select all
; *****************************************************************
;
; The 1000 iterative loop only ever generates 8 different combinations
; of the password,salt and hash.
;
; Therefore, all of the arithmetic/logical computations are pointless.
; Buffers only have to be initialized once if cracking 1 hash only.
;
pBuffers LABEL DWORD ; initialize all buffers at same time to zero
buf_one dd 16 dup (?)
buf_two dd 16 dup (?)
buf_three dd 16 dup (?)
buf_four dd 16 dup (?)
buf_five dd 16 dup (?)
buf_six dd 16 dup (?)
buf_seven dd 16 dup (?)
buf_eight dd 16 dup (?)
ctx1_buf dd 16 dup (?)
ctx2_buf dd 16 dup (?)
BUFFERS_SIZE EQU $-pBuffers
buf_final dd 4 dup (?)
; *****************************************************************
;
; The logical/arithmetic tests in the main 1000 iterative loop
; can be simplified using a 42 element array.
;
; Each element represents a buffer that will be processed by md5
;
buf_index dd 0,1,2,3,2,1,4
dd 5,2,3,2,1,4,1
dd 6,3,2,1,4,1,2
dd 7,2,1,4,1,2,3
dd 6,1,4,1,2,3,2
dd 5,4,1,2,3,2,1
dd 0
buf_ptr dd offset buf_one ; HASHPASS
dd offset buf_two ; PASSSALTPASSHASH
dd offset buf_three ; HASHSALTPASSPASS
dd offset buf_four ; PASSPASSHASH
dd offset buf_five ; HASHPASSPASS
dd offset buf_six ; PASSSALTHASH
dd offset buf_seven ; HASHSALTPASS
dd offset buf_eight ; PASSHASH
BUF_TWO equ 4*1
BUF_FOUR equ 4*3
BUF_SIX equ 4*5
BUF_EIGHT equ 4*7
; *****************************************************************
;
; Two,four,six and eight are initialized once the password and salt
; lengths have been determined
;
;
buf_ptr2 dd offset buf_one ;
dd ? ; len(pass) + len(salt) + len(pass)
dd offset buf_three ;
dd ? ; len(pass) * 2
dd offset buf_five ;
dd ? ; len(pass) + len(salt)
dd offset buf_seven ;
dd ? ; len(pass)
the 1000 iteration loop
- Code: Select all
mov ebx,1000
mov ebp,42
hash_loop:
mov esi,[buf_index+4*ebp] ; load buffer index
mov edi,[buf_index+4*ebp-4] ; load next buffer index
mov esi,[buf_ptr +4*esi] ; load start of buffer
mov edi,[buf_ptr2+4*edi] ; load next buffer
call md5_block_x86_one ; process input
sub ebp,1 ; decrease buffer index
jnz decrease_loop
mov ebp,42 ; re-initialize index
decrease_loop:
sub ebx,1
jnz hash_loop