.text:0065c880                 mov     cl, [edi]    .text:0065c882                 mov     dl, cl    .text:0065c884                 xor     cl, 5    .text:0065c887                 xor     dl, 0afh    .text:0065c88a                 shr     dl, 4    .text:0065c88d                 shl     cl, 4    .text:0065c890                 or      dl, cl    .text:0065c892                 mov     [edi], dl    .text:0065c894                 inc     edi    .text:0065c895                 dec     eax    .text:0065c896                 jnz     short loc_65c880    .text:0065c898                 jmp     loc_4de7e6

void sqlpasswd(char * enp,char* dnp){    int i;    unsigned char a1;    unsigned char a2;    for(i=0;i<128;i++)    {        if(enp[i]==0)            break;        a1 = enp[i]^5;        a1 = a1 << 4;        a2 = enp[i]^0xaf;        a2 = a2 >> 4;        dnp[i]=a1|a2;    }    dnp[i]=0;    dnp[i+1]=0;    wprintf(l"passwd:%s/n",(const wchar_t *)dnp);}

2個字節的頭0x0100(固定）  4個字節的hash加秘key20個字節的hash120個字節的hash2

fx:0x0100 1751857f dfdec4fb618d8d18eba5a27f615639f607cd46be dfdec4fb618d8d18eba5a27f615639f607cd46be    固定    補充key   hash1                          hash2口令是：123456

cryptacquirecontextw(&hprov,null,l("microsoft base cryptographic provider v1.0"),1,0xf0000000);    cryptcreatehash(hprov,0x8004,null,null,&hhash);    cryptcreatehash(hprov,0x8004,null,null,&hhash);005f9dfe：    crypthashdata(hhash,passwdbuf,0x12,null);passwdbuf是小寫的passwd緩沖區,然后附加一個key，如上例子就是對    {'1','2''3''4''5''6',0x17,0x51,0x85,0x7f}這樣的一個字串進行hash加密    crypthashdata(hhash,passwdbuf,0x12,null);passwdbuf是大寫的passwd緩沖區,然后附加一個key 005f9e3e：    cryptgethashparam(hhash,2,&passwdout,&outlen,0);取出passwdbuf是小寫的passwd的加密值    cryptgethashparam(hhash,2,&passwdout,&outlen,0);