help to get _protected.compilationDate about mqllock

[sergpsu]

Hi.
You can't get compilationDate, it's compiled into each dll separately like other _protected fields.

[Ell3Tre]

so there is no way to decrypt the request?

[Ell3Tre]

however if you would like to help me crack the plugin, please add me to discord Ell3Tre#5699 @sergpsu

[sergpsu]

compilationDate is only used to generate xor key for hiding _protected struct in memory. To decrypt license you need _protected.licenseKey. Hint: compilationDate is unix timestamp, so can be bruteforced

[Ell3Tre]

what I would like to do is decrypt the response of the site mqllock.com//lic.php?lic=&rev=1&rslt=&acc_no=&cid2= to do this I need both the compilationDate and the license key, if I want I can guess the compilationDate but how I can get the license key

[sergpsu]

License key is precompiled into DLL and DLL is protected with VMProtect. You can try scanning memory for _protected structure after DLL is loaded <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail> Вірусів немає. www.avast.com <https://www.avast.com/sig-email?utm_medium=email&utm_source=link&utm_campaign=sig-email&utm_content=webmail> <#DAB4FAD8-2DD7-40BB-A1B8-4E2AA1F9FDF2>

…

On Mon, Feb 7, 2022 at 5:25 PM Ell3Tre ***@***.***> wrote: what I would like to do is decrypt the response of the site mqllock.com//lic.php?lic=&rev=1&rslt=&acc_no=&cid2= to do this I need both the compilationDate and the license key, if I want I can guess the compilationDate but how I can get the license key — Reply to this email directly, view it on GitHub <#1 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACTOXTAW5OPYUGUPYVPKGGLUZ7QAJANCNFSM5NVN2AEQ> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you were mentioned.Message ID: ***@***.***>