| 551 | } |
| 552 | |
| 553 | DWORD DetectFileKeyByContent(void * pvEncryptedData, DWORD dwSectorSize, DWORD dwFileSize) |
| 554 | { |
| 555 | DWORD dwFileKey; |
| 556 | |
| 557 | // Try to break the file encryption key as if it was a WAVE file |
| 558 | if(dwSectorSize >= 0x0C) |
| 559 | { |
| 560 | dwFileKey = DetectFileKeyByKnownContent(pvEncryptedData, 0x46464952, dwFileSize - 8); |
| 561 | if(dwFileKey != 0) |
| 562 | return dwFileKey; |
| 563 | } |
| 564 | |
| 565 | // Try to break the encryption key as if it was an EXE file |
| 566 | if(dwSectorSize > 0x40) |
| 567 | { |
| 568 | dwFileKey = DetectFileKeyByKnownContent(pvEncryptedData, 0x00905A4D, 0x00000003); |
| 569 | if(dwFileKey != 0) |
| 570 | return dwFileKey; |
| 571 | } |
| 572 | |
| 573 | // Try to break the encryption key as if it was a XML file |
| 574 | if(dwSectorSize > 0x04) |
| 575 | { |
| 576 | dwFileKey = DetectFileKeyByKnownContent(pvEncryptedData, 0x6D783F3C, 0x6576206C); |
| 577 | if(dwFileKey != 0) |
| 578 | return dwFileKey; |
| 579 | } |
| 580 | |
| 581 | // Not detected, sorry |
| 582 | return 0; |
| 583 | } |
| 584 | |
| 585 | DWORD DecryptFileKey( |
| 586 | const char * szFileName, |
no test coverage detected