Basic Decryption Tutorial

Required : OllyDBG, unpacked runnable, clean MRS.exe

IF IT DOESNT WORK FOR YOU, DON'T BLAME ME.

Step 1


1.Run OllyDBG.exe and open the client you wish to decrypt's unpacked runnable.
2.Hit Ctrl + G and type in 00538691 and hit OK.
It will look like this

Code:

MOV AL,BYTE PTR DS:[ECX]
NOP
NOP
NOP
NOP
NOP
NOP
MOV BYTE PTR DS:[ECX],AL
INC ECX
DEC ESI
JNZ SHORT thedueli.00538691

Using Zephyr's MRS custom encryption method, the decryption code should look like this :

Code:

MOV AL,BYTE PTR DS:[ECX]
ROR AL,X                                // X = 1-7
XOR AL,X                                // X = 1-255
ADD AL,X                                // X = 1-255
XOR AL,X                                // X = 1-255
SUB AL,X                                // X = 1-255
NOP
MOV BYTE PTR DS:[ECX],AL
INC ECX
DEC ESI
JNZ SHORT thedueli.00538691

Okay. We're done here. Leave OllyDBG's window open with the code above.

Step 2

1.Open up MRS.exe in a different OllyDBG window.
2.Hit CTRL + G and type in 00401100 and hit OK.
Result should look like this :

Code:

MOV AL,BYTE PTR DS:[ECX+ESI]
MOV DL,AL
SHR DL,3
SHL AL,5
OR DL,AL
INC ECX
NOT DL
MOV BYTE PTR DS:[ECX+ESI-1],DL
CMP ECX,EDI
JB SHORT mrs2.00401100

3. NOP everything starting from MOV DL,AL to INC ECX, and NOT DL.
4. Change MOV BYTE PTR DS:[ECX+ESI-1],DL to MOV BYTE PTR DS:[ECX+ESI-1],AL
5. Move INC ECX a byte further.
If you have done everything above, it should look like this :

Code:

MOV AL,BYTE PTR DS:[ECX+ESI]
NOP
NOP
NOP
NOP
NOP
NOP
NOP
NOP
NOP
NOP
NOP
INC ECX
NOP
MOV BYTE PTR DS:[ECX+ESI-1],AL
CMP ECX,EDI
JB SHORT mrs2.00401100

Great.
Leave this OllyDBG window open.


Step 3


1.Go to your unpacked runnable opened by OllyDBG on first step.
2.Hit Ctrl + G and type in 00538693 and press OK.
3.Right click that address. You'll get a menu. Select
Binary > Binary Copy.
4.Go to your opened OllyDBG window containing our modded MRS.exe.
5.Hit Ctrl + G and type in 00401103 and press OK.
6.Hit Ctrl + E, uncheck Keep size, and go to HEX +00.
7.Delete everything on HEX +00, and hit Shift + Insert.
8.Press OK.
9.Right click any address, select Copy to Executable > All Modifications. Hit Copy All.
A new window should appear.
Right click any address on the new window, and select Save File.
name your file and save it.

Congrats! You now have your MRS.exe ready for decompiling.