/*
 *  MSN Messenger v7.5 Password Decrypter Source Code for Windows XP & 2003
 *  (Compiled - VC++ 2005, Tested on WinXP SP2, MSN Messenger v7.5.0324)
 *      - Gregory R. Panakkal
 *        http://www.infogreg.com/
 */

#include <windows.h>
#include <wincrypt.h>
#include <stdio.h>
#include <WinCred.h>
#include <tchar.h>

#pragma comment(lib, "Crypt32.lib")

void showBanner()
{
    _tprintf(_T("MSN Messenger v7.5 Password Decrypter for Windows XP/2003\n"));
    _tprintf(_T("   - Gregory R. Panakkal, http://www.infogreg.com \n\n"));
}

////////////////////////////////////////////////////////////////////
int main()
{
    PCREDENTIAL* CredentialCollection = NULL;
    DATA_BLOB blobCrypt;
    DATA_BLOB blobPlainText;
    DATA_BLOB blobEntropy;
    DATA_BLOB blobDynEntropy;
    HKEY hKeyDynSalt = NULL;
    HKEY hKeyCreds = NULL;
    HKEY hKeyUserCred = NULL;
    DWORD dwRet = 0;
    DWORD dwType = 0;
    DWORD dwDataSize = 0;
    DWORD dwTemp = 0;
    PBYTE pDynamicSalt = NULL;
    PBYTE pEncPassword = NULL;
    TCHAR szMsgrUserName[MAX_PATH];
    DWORD dwCount = 0;
    REGSAM RegSAM = KEY_READ;
    WCHAR szEntropy[] = L"%GKP$^%^&LL(%^$^O&TR$^%^GV6;lxzd";

    ZeroMemory(&blobCrypt, sizeof(blobCrypt) );
    ZeroMemory(&blobPlainText, sizeof(blobPlainText) );
    ZeroMemory(&blobEntropy, sizeof(blobEntropy) );
    ZeroMemory(&blobDynEntropy, sizeof(blobDynEntropy) );

    showBanner();

    do
    {
        //
        // Allocate some memory!
        //
        pEncPassword = (PBYTE)malloc( MAX_PATH );

        if(NULL == pEncPassword)
        {
            _tprintf(_T("ERROR: malloc failed!"));
            break;
        }


        //
        // Fetch & Calculate Dynamic Salt
        //
        dwRet = RegOpenKeyEx(
                    HKEY_CURRENT_USER,
                    _T("SOFTWARE\\MICROSOFT\\IdentityCRL\\Dynamic Salt"),
                    0,
                    RegSAM,
                    &hKeyDynSalt
                    );

        if(ERROR_SUCCESS != dwRet)
        {
            _tprintf(_T("ERROR: Cannot opening dynamic salt reg key!"));
            break;
        }

        dwTemp = sizeof(dwDataSize);

        dwRet = RegQueryValueEx(
                    hKeyDynSalt,
                    _T("Size"),
                    NULL,
                    &dwType,
                    (LPBYTE)&dwDataSize,
                    &dwTemp
                    );

        if( ERROR_SUCCESS != dwRet ||
            REG_DWORD != dwType ||
            sizeof(DWORD) != dwTemp )
        {
            _tprintf(_T("ERROR: Cannot fetch dynamic salt data size!"));
            break;
        }

        pDynamicSalt = (PBYTE)malloc( dwDataSize );

        if(NULL == pDynamicSalt)
        {
            _tprintf(_T("ERROR: malloc failed!"));
            break;
        }

        dwTemp = dwDataSize;

        dwRet = RegQueryValueEx(
                    hKeyDynSalt,
                    _T("Value"),
                    NULL,
                    &dwType,
                    (LPBYTE)pDynamicSalt,
                    &dwTemp);


        if( ERROR_SUCCESS != dwRet ||
            REG_BINARY != dwType ||
            dwDataSize != dwTemp )
        {
            _tprintf(_T("ERROR: Cannot fetch dynamic salt data!"));
            break;
        }

        //Initial Crypt Blob
        blobCrypt.pbData = (LPBYTE)pDynamicSalt;
        blobCrypt.cbData = dwDataSize;


        //Initialize Entropy Blob
        blobEntropy.pbData = (LPBYTE)&szEntropy;
        blobEntropy.cbData = 0x40;

        if(FALSE == CryptUnprotectData(
                            &blobCrypt,
                            NULL,
                            &blobEntropy,
                            NULL,
                            NULL,
                            1,
                            &blobPlainText
                        ))
        {
            //something
            break;
        }

        //
        // Construct the 128 Char long Entropy value
        //

        memcpy(
            blobCrypt.pbData,
            blobEntropy.pbData, blobEntropy.cbData
            );

        memcpy(
            blobCrypt.pbData + blobEntropy.cbData,
            blobPlainText.pbData,
            blobPlainText.cbData
            );

        blobEntropy.cbData += blobPlainText.cbData;
        blobEntropy.pbData = blobCrypt.pbData;


        //Free memory & Zero-off Blob structure
        LocalFree(blobPlainText.pbData);
        ZeroMemory(&blobPlainText, sizeof(blobPlainText));


        //
        // Enumerate all the stored credentials in the registry
        //

        dwRet = RegOpenKeyEx(
                    HKEY_CURRENT_USER,
                    _T("SOFTWARE\\MICROSOFT\\IdentityCRL\\Creds"),
                    0,
                    RegSAM,
                    &hKeyCreds
                    );

        if(ERROR_SUCCESS != dwRet)
        {
            _tprintf(_T("ERROR: Cannot opening credential key!"));
            break;
        }

        while( true )
        {
            dwRet = RegEnumKey(
                        hKeyCreds,
                        dwCount,
                        (LPTSTR)&szMsgrUserName,
                        MAX_PATH
                        );

            if( ERROR_SUCCESS != dwRet )
            {
                break;
            }

            dwRet = RegOpenKeyEx(
                        hKeyCreds,
                        szMsgrUserName,
                        0,
                        RegSAM,
                        &hKeyUserCred
                        );

            if(ERROR_SUCCESS == dwRet)
            {
                dwTemp = MAX_PATH;


                //
                // Read encrypted passsword
                //

                dwRet = RegQueryValueEx(
                            hKeyUserCred,
                            _T("ps:password"),
                            NULL,
                            &dwType,
                            (LPBYTE)pEncPassword,
                            &dwTemp);

                if( ERROR_SUCCESS == dwRet &&
                    REG_BINARY == dwType )
                {
                    blobCrypt.pbData = (LPBYTE)pEncPassword;
                    blobCrypt.cbData = dwTemp;

                    //
                    // Decrypt & Display Credential Info!
                    //
                    if(TRUE == CryptUnprotectData(
                                        &blobCrypt,
                                        NULL,
                                        &blobEntropy,
                                        NULL,
                                        NULL,
                                        1,
                                        &blobPlainText
                                    ))
                    {
                        _tprintf(
                            _T("Username : %s\nPassword : %ws\n\n"),
                            szMsgrUserName,
                            blobPlainText.pbData
                            );

                        LocalFree(blobPlainText.pbData);
                    }
                }

                //Close User Cred Key
                RegCloseKey(hKeyUserCred);
                hKeyUserCred = NULL;
            }

            dwCount++;
        }

    }while(false);


    if(NULL != pDynamicSalt)
    {
        free(pDynamicSalt);
    }

    if(NULL != pEncPassword)
    {
        free(pEncPassword);
    }

    if(NULL != hKeyCreds)
    {
        RegCloseKey(hKeyCreds);
    }

    if(NULL != hKeyDynSalt)
    {
        RegCloseKey(hKeyDynSalt);
    }
}