[Warden Module] - Decompression

[Fr3DBr]

Hello,

Im working on my warden module and i'm up to the point i downloaded the module from the 0x01 stream packets
and then dumped this to a file, MD5HASH.MOD

Like This :

Code Select Expand


[Log 21/01/2010 21:58:04]-> ---------------------------------------------------------------------------
[Log 21/01/2010 21:58:04]-> WARDEN MODULE CHECK
[Log 21/01/2010 21:58:04]-> MODULE NAME (MD5) : 1078705980E0FFDB3B677F673D46E329
[Log 21/01/2010 21:58:04]-> MODULE KEY  (RC4) : 01A801187E809E6F6834B445E1B4ED64
[Log 21/01/2010 21:58:04]-> MODULE SIZE       : 18818 Bytes
[Log 21/01/2010 21:58:04]-> ---------------------------------------------------------------------------
[Log 21/01/2010 21:58:04]-> DOWNLOADING MODULE...
[Log 21/01/2010 21:58:05]-> DOWNLOAD COMPLETE...
[Log 21/01/2010 21:58:05]-> MODULE MD5 : OK
[Log 21/01/2010 21:58:05]-> DECRYPTING MODULE...
[Log 21/01/2010 21:58:05]-> DECRYPTION : OK
[Log 21/01/2010 21:58:05]-> SAVING MODULE : 1078705980E0FFDB3B677F673D46E329.MOD TO DISK...
[Log 21/01/2010 21:58:05]-> MODULE SAVING : OK
[Log 21/01/2010 21:58:05]-> ---------------------------------------------------------------------------


the question is, after we decrypt that MOD file w/ the RC4 Key we got in the 0x00 packet, what should we do next ? i got a little confused by the documentation

[Fr3DBr]

Ah i found i must use ZLIB to decompress it, now i have it decompressed, but i still didnt managed to fix the file...