Please could you help me locate the encrypted password

counterstrikewi · **Joined:** 19 Apr 2009 23:01 **Posts:** 13

hi aluigi,

i have located "Phrase" in my clientregistry.blob file and include the hex section

Code:

00019540  00 00 50 68 72 61 73 65 01 50 7E 00 00 00 00 00    ..Phrase.P~.....
00019550  00 00 04 00 04 00 00 00 01 00 00 00 02 00 00 00    ................
00019560  04 00 5C 00 00 00 02 00 00 00 43 37 35 36 41 33    ..\.......C756A3
00019570  31 41 30 38 32 46 42 33 45 30 31 34 46 41 34 37    1A082FB3E014FA47
00019580  42 41 37 32 41 41 42 43 38 41 35 46 38 31 32 37    BA72AABC8A5F8127
00019590  44 39 35 43 34 32 43 45 46 45 37 30 39 42 43 45    D95C42CEFE709BCE
000195A0  31 46 35 37 34 30 37 32 35 39 44 36 34 31 35 33    1F57407259D64153
000195B0  46 44 34 46 30 41 32 35 43 43 31 42 33 34 39 38    FD4F0A25CC1B3498
000195C0  30 38 45 31 30 33 12 00 2A 00 00 00 43 6C 6F 63    08E103..*...Cloc

as i understand it,

Code:

C756A31A082FB3E014FA47BA72AABC8A5F8127D95C42CEFE709BCE1F57407259D64153FD4F0A25CC1B349808E103

is my encrypted password?

Thank you

counterstrikewi · **Joined:** 19 Apr 2009 23:01 **Posts:** 13

I am getting the registry values using this delphi procedure i found:

procedure GetRegistryValues;
var
Reg: TRegistry;
strProductID: String;
strMachineGuid: String;
strHalfLifeIO: String;
begin
Reg:= TRegistry.Create;
try
Reg.Rootkey:= HKEY_LOCAL_MACHINE; //should this be HKEY_CURRENT_USER?
Reg.Openkey('SOFTWARE\Microsoft\Windows\CurrentVersion', FALSE);
strProductID := Reg.ReadString('ProductId');
Reg.CloseKey;
Reg.Openkey('SOFTWARE\Microsoft\Cryptography', FALSE);
strMachineGuid := Reg.ReadString('MachineGuid');
Reg.CloseKey;
Reg.Rootkey := HKEY_CURRENT_USER;
Reg.Openkey('\Software\Valve\Half-Life\Settings', FALSE);
strHalfLifeIO := Reg.ReadString('io');
Reg.CloseKey;
finally
Reg.Free;
// complete := PChar(strProductID+strMachineGuid+strHalfLifeIO);
showmessage(PChar(strProductID+strMachineGuid+strHalfLifeIO));
end;
end;

as i understand, the string shown at the end of that procedure should be my decryption key?

Now that i have my encrypted password and my decryption key, how would i go about getting the actual password

Thank you

aluigi · **Posted:** 20 May 2009 23:40

for the first post, yes that one is your encrypted password.

and for the second post, yes the concatenation of those 3 values is your decryption key.
the whole process for decrypting the steam password is available in the source code of my steampwd tool so the answer is there (then in any case I know only C so any of my explanation is exactly the same of my source code)

counterstrikewi · **Joined:** 19 Apr 2009 23:01 **Posts:** 13

thanks luigi, have finished my steam decrypter in delphi now

source here:
steam-decrypter-in-delphi-by-counterstrikewi-t883.html

it turns out that i didnt need the decryption key in the end just the encrypted password and then to call the funtion DecryptDatafor this Machine which is located in the Steam.dll file

thanks again

counterstrikewi

Luigi Auriemma

Please could you help me locate the encrypted password