XOR Decoder for MuError.log

[fratika]

XOR Decoder for MuError.log

Hello everyone,

I'm excited to share a tool I've developed for decoding MuError.log. This program is designed for maximum efficiency, utilizing asynchronous reading and writing to ensure exceptional speed. Unlike other front-end tools, it has no limitations on file size.

In my tests, the tool successfully decoded a 10MB file in just 9 seconds!

Feel free to give it a try, and I hope you find it useful. Enjoy!

Code Select Expand

HANDLE hEvent;
HANDLE hInput;
HANDLE hOutput;

#define BUF_SIZE (16)
BYTE bKey[BUF_SIZE] = { 0x7C, 0xBD, 0x81, 0x9F, 0x3D, 0x93, 0xE2, 0x56, 0x2A, 0x73, 0xD2, 0x3E, 0xF2, 0x83, 0x95, 0xBF };

int AsyncFileRead()
{
CHAR szBuffer[BUF_SIZE];
DWORD dwBytesToRead = BUF_SIZE;
DWORD dwBytesRead = 0;
DWORD dwBytesWritten = 0;
INT iKeyOffset = 0;
OVERLAPPED stOverlapped = {0};

BOOL bResult = FALSE;
BOOL bContinue = TRUE;

stOverlapped.hEvent = hEvent;

while (bContinue)
{
bContinue = FALSE;

memset(szBuffer, 0x00, sizeof(szBuffer));
bResult = ReadFile(hInput, szBuffer, dwBytesToRead, &dwBytesRead, &stOverlapped);
if (!bResult)
{
BOOL bPending = TRUE;

while (bPending)
{
bPending = FALSE;

bResult = GetOverlappedResult(hInput, &stOverlapped, &dwBytesRead, FALSE);
if (!bResult)
{
bPending = TRUE;
bContinue = TRUE;
}
else
{
ResetEvent(stOverlapped.hEvent);
}
}
}

for (INT i=0; i<(INT)dwBytesToRead; i++)
{
if (i >= (INT)dwBytesRead)
{
break;
}
szBuffer[i] = szBuffer[i] ^ bKey[iKeyOffset];
iKeyOffset++;
if (iKeyOffset >= (INT)dwBytesToRead)
{
iKeyOffset = 0;
}
}

WriteFile(hOutput, szBuffer, dwBytesRead, &dwBytesWritten, NULL);

stOverlapped.Offset += dwBytesRead;
if (stOverlapped.Offset < GetFileSize(hInput, NULL))
{
bContinue = TRUE;
}
else
{
return 1;
}
}

return 0;
}

int _tmain(int argc, _TCHAR* argv[])
{
char szXorFile[MAX_PATH];

SetConsoleTitle("XOR Decoder (by Young)");

printf("|----------------------------------------------------------|\r\n| XOR Decoder for WebZen MuError Log 0.1                   |\r\n| by Young (http://forum.ragezone.com/members/147136.html) |\r\n|----------------------------------------------------------|\r\n\r\n");

printf("Reading xordec.ini... ");
GetPrivateProfileString("DEFAULT", "XorFile", "MuError.log", szXorFile, MAX_PATH, ".//xordec.ini");
if (GetLastError() != ERROR_SUCCESS)
{
printf("ERROR! Using default configuration.\r\n");
}
else
{
printf("DONE!\r\n");
}

printf("Reading %s... ", szXorFile);
hInput = (HANDLE)CreateFile(szXorFile, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_FLAG_OVERLAPPED, NULL);
if (hInput == INVALID_HANDLE_VALUE)
{
printf("File not found or access denied.\r\n", szXorFile);
system("PAUSE");
return 0;
}
printf("DONE!\r\n");

printf("Creating Output.txt... ", szXorFile);
hOutput = (HANDLE)CreateFile("Output.txt", GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
if (hOutput == INVALID_HANDLE_VALUE)
{
printf("Access denied or full disk.\r\n");
system("PAUSE");
return 0;
}
printf("DONE!\r\n");

hEvent = CreateEvent(NULL, TRUE, FALSE, NULL);
if (hEvent == NULL)
{
printf("WOW! Unable to create the event for the async file read.\r\n");
system("PAUSE");
return 0;
}

UINT iTickCount = GetTickCount();
printf("Decoding %s... ", szXorFile);
if (AsyncFileRead() == 0)
{
printf("Unknow error reading/writing the file.\r\n");
system("PAUSE");
return 0;
}
printf("DONE!\r\n\r\nBytes read: %d\r\nElapsed time: %ds\r\n", GetFileSize(hInput, NULL), (GetTickCount() - iTickCount) / 1000);

CloseHandle(hInput);
CloseHandle(hOutput);

ShellExecute(NULL, "open", "notepad.exe", ".//Output.txt", NULL, SW_SHOWNORMAL);

system("PAUSE");
return 0;
}

Download:

You require the following to view this post content:

• You must thank this post to see the content.