Foro de elhacker.net

; Esto lo meti en una DLL, ya que usando WinASM me resulta mas fácil hacer una DLL, cargarla con Olly y campiar EIP a la funcion que hice.
; El bruteforcing es mas lento por Olly, pero puedo poner BP's rapido.
.386
 
.MODEL flat,stdcall
 
OPTION CASEMAP:NONE
 
Include windows.inc
Include user32.inc
Include kernel32.inc
include masm32.inc
 
 
IncludeLib user32.lib
IncludeLib kernel32.lib
includelib masm32.lib
 
 
.DATA
Serial db 01Fh              ; Buffer donde vamos a generar el string a probar
pad     db 10h dup(00h)     ; Espacio que sigue al buffer (16 bytes) que nos permite ir creando un string mas largo cada vez, sin tener que allocar nada
sep     db 00Dh, 00Ah, 000h ; Usado para ir separando los seriales encontrados
seriales db 400h dup(00h)   ; Buffer donde guardaremos los seriales hallados.
 
TestHello proc uses esi edi
; Prueba hasta 5 chars (desde 20h hasta 7Eh)
seguir:
    mov eax, offset Serial
    add byte ptr [eax], 1
    cmp byte ptr [eax], 7Eh
    jbe calc
 
    mov byte ptr [eax], 20h
    .if byte ptr [eax+1] == 0           ; Sintaxis MASM para no tener que hacer los cmp a mano.
       mov byte ptr [eax+1], 1Fh
    .endif    
    add byte ptr [eax+1], 1
    cmp byte ptr [eax+1], 7Eh
    jbe calc
 
    mov byte ptr [eax+1], 20h
    .if byte ptr [eax+2] == 0
       mov byte ptr [eax+2], 1Fh
    .endif    
    add byte ptr [eax+2], 1
    cmp byte ptr [eax+2], 7Eh
    jbe calc
 
    mov byte ptr [eax+2], 20h
    .if byte ptr [eax+3] == 0
       mov byte ptr [eax+3], 1Fh
    .endif    
    add byte ptr [eax+3], 1
    cmp byte ptr [eax+3], 7Eh
    jbe calc
 
    mov byte ptr [eax+3], 20h
    .if byte ptr [eax+4] == 0
       mov byte ptr [eax+4], 1Fh
    .endif    
    add byte ptr [eax+4], 1
    cmp byte ptr [eax+4], 7Eh
    jbe calc
 
    jmp salida
 
calc:
    xor edi,edi
    xor eax, eax
    mov esi, offset Serial
bucle:
    lodsb
    test al,al
    jz compara
    ror edi,0Dh
    add edi, eax
    jmp bucle 
compara:
    cmp edi, 0F6C53333h
    jnz seguir
    invoke szCatStr, offset seriales, offset sep        ; MASM macro szCatStr. Une 2 szStrings y guarda el resultado en la 1era.
    invoke szCatStr, offset seriales, offset Serial
    jmp seguir
 
salida:
    ret    
TestHello endp
 

.386
.model flat, stdcall
option casemap: none
 
include windows.inc
include kernel32.inc
includelib kernel32.lib
 
.data?
password db 5 dup(?)
 
.code
keymaker:
 
mov   eax, 0F6C53333h    ; Constante a reversear
lea   edi, password + 4  
 
inicio:
mov   [edi], al  ; Guardando el serial
dec   edi        ;   generado
 
movzx ebx, al
sub   eax, ebx
rol   eax, 0Dh
cmp   eax, 0
jne   inicio
 
invoke ExitProcess, 0
 
end keymaker

Private Declare Function fROR Lib "FBin.dll" (ByVal Num As Long, ByVal pos As Long) As Long
Function EncriptAlgorithm(s As String, Optional ByVal target As Long = &HF6C53333) As Boolean
    Dim barr() As Byte
    Dim edi As Long
    Dim i As Long
    barr = StrConv(s, vbFromUnicode)
    For i = 0 To UBound(barr)
        edi = fROR(edi, &HD)
        edi = edi + barr(i)
    Next
    EncriptAlgorithm = (edi = target)
End Function

TVqAAAEAAAAEABAA//8AAEABAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQokAAAAAAAAAABQRQAATAEEAEjMOFwAAAAAAAAAAOAADiELAQFIAAIAAAAGAAAAAAAAABAAAAAQAAAAIAAAAABAAAAQAAAAAgAAAQAAAAAAAAAEAAAAAAAAAABQAAAABAAAmD8AAAIAQAAAEAAAABAAAAAAAQAAAAAAAAAAABAAAAAAIAAAbQAAAAAwAAAUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAAWAAAAAAQAAAAAgAAAAQAAAAAAAAAAAAAAAAAACAAAGAuZWRhdGEAAG0AAAAAIAAAAAIAAAAGAAAAAAAAAAAAAAAAAABAAABALmlkYXRhAAAUAAAAADAAAAACAAAACAAAAAAAAAAAAAAAAAAAQAAAwC5yZWxvYwAACAAAAABAAAAAAgAAAAoAAAAAAAAAAAAAAAAAAEAAAEIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADHASMNVieVWV1GLRQiLTQzTyFlfXsnCCABVieVWV1GLRQiLTQzTwFlfXsnCCABVieVWV1GLRQiLTQzT4FlfXsnCCABVieVWV1GLRQiLTQzT6FlfXsnCCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUCAAAAEAAAAEAAAABAAAACggAAA4IAAASCAAAAQQAAAZEAAALhAAAEMQAABeIAAAWSAAAGMgAABoIAAAAQAAAAIAAwBGQmluLmRsbABmUk9SAGZST0wAZlNITABmU0hSAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

.386
.model flat, stdcall
option casemap: none
 
include windows.inc
include kernel32.inc
includelib kernel32.lib
 
.data?
password db 5 dup(?)
 
.code
keymaker:
 
mov   eax, 0F6C53333h    ; Constante a reversear
lea   edi, password + 4  
 
inicio:
movzx ebx, al
shl   bl, 1      ; Descarta el primer bit
shr   bl, 1      ;   para trabajar en ASCII de 7 bits
 
mov   [edi], bl  ; Guardando el serial
dec   edi        ;   generado
 
sub   eax, ebx
rol   eax, 0Dh
cmp   eax, 0
jne   inicio
 
invoke ExitProcess, 0
 
end keymaker

EDI = 0    ; EDI = 00000000h
ADD EDI, 76; EDI = 00000076h
ROR EDI, D ; EDI = 03B00000h
ADD EDI, 52; EDI = 03B00052h
ROR EDI, D ; EDI = 02901D80h
ADD EDI, 7A; EDI = 02901DFAh
ROR EDI, D ; EDI = EFD01480h
ADD EDI, 4A; EDI = EFD014CAh
ROR EDI, D ; EDI = A6577E80h
ADD EDI, 58; EDI = A6577ED8h
ROR EDI, D ; EDI = F6C532BBh

EDI = 0    ; EDI = 00000000h
ADD EDI, 76; EDI = 00000076h
ROR EDI, D ; EDI = 03B00000h
ADD EDI, 52; EDI = 03B00052h
ROR EDI, D ; EDI = 02901D80h
ADD EDI, 7A; EDI = 02901DFAh
ROR EDI, D ; EDI = EFD01480h
ADD EDI, 4A; EDI = EFD014CBh
ROR EDI, D ; EDI = A65F7E80h
ADD EDI, 58; EDI = A65F7ED8h
ROR EDI, D ; EDI = F6C532FBh

format PE GUI 4.0
entry start
 
include 'win32w.inc'
 
section '.text' code readable executable
start:
    invoke  GetModuleHandle,0
    mov     [wc.hInstance],eax
    invoke  LoadIcon,0,IDI_APPLICATION
    mov     [wc.hIcon],eax
    invoke  LoadCursor,0,IDC_ARROW
    mov     [wc.hCursor],eax
    invoke  RegisterClass,wc
    test    eax,eax
    jz      error
 
    invoke IsDebuggerPresent,0    ; ACTIVAR despues de depurar
    cmp eax,0
    jne end_loop
 
    invoke  CreateWindowEx,0,_class,_title,WS_VISIBLE+WS_DLGFRAME+WS_SYSMENU,128,128,256,100,NULL,NULL,[wc.hInstance],NULL
    test    eax,eax
    jz      error
 
    msg_loop:
        invoke  GetMessage,msg,NULL,0,0
        cmp     eax,1
        jb      end_loop
        jne     msg_loop
        invoke  TranslateMessage,msg
        invoke  DispatchMessage,msg
        jmp     msg_loop
 
  error:
        invoke  MessageBox,NULL,_error,NULL,MB_ICONERROR+MB_OK
 
  end_loop:
        invoke  ExitProcess,[msg.wParam]
 
proc WindowProc uses ebx esi edi, hwnd,wmsg,wparam,lparam
        cmp     [wmsg],WM_DESTROY
        je      .wmdestroy
        cmp     [wmsg],WM_CREATE
        je      .wmcreate
        cmp     [wmsg],WM_COMMAND
        je      .wmcommand
 
        jmp .defwndproc
 
  .wmcommand:
        xor eax, eax
        xor edx, edx
 
        mov eax, [_buttonregistry]
        mov edx, [lparam]
 
        cmp eax,edx
        jne .finish
 
        invoke GetWindowTextA,[_editregistry],password,10
 
        stdcall checkpass,password ; Comprobamos la contraseña.
 
        jmp .finish
  .defwndproc:
        invoke  DefWindowProc,[hwnd],[wmsg],[wparam],[lparam]
        jmp     .finish
  .wmcreate:
        invoke CreateWindowExA,WS_EX_APPWINDOW,_labelclass,_labeltext,WS_CHILD+WS_VISIBLE,10,10,150,20,[hwnd],NULL,[wc.hInstance],NULL
        mov edx,dword[fs:0x18]
        push edx
        invoke CreateWindowExA,WS_EX_APPWINDOW,_editclass,0,WS_CHILD+WS_VISIBLE+WS_BORDER,115,10,125,20,[hwnd],NULL,[wc.hInstance],NULL
        mov [_editregistry],eax
        pop edx
        mov edx,dword[edx+0x30]
        push edx
        invoke CreateWindowExA,WS_EX_APPWINDOW,_buttonclass,_buttonname,WS_CHILD+WS_VISIBLE,10,40,230,20,[hwnd],NULL,[wc.hInstance],NULL
        mov [_buttonregistry],eax
        pop edx
        movsx edx,byte[edx+2]
        mov [dbg],edx    ; Si esta debugger presente
 
        jmp .finish
  .wmdestroy:
        invoke  PostQuitMessage,0
        xor     eax,eax
  .finish:
        ret
endp
 
proc checkpass,pass
    mov esi, [pass]
 
    compute_hash:
        xor     edi, edi     ;EDI = 0
        xor     eax, eax   ;EAX = 0
        cld
    compute_hash_again:
        lodsb                ;AL = BYTE[ESI] , ESI = ESI + 1
        test    al, al
       jz       compute_hash_finished
        ror     edi, 0xD
        add     edi, eax
       jmp      compute_hash_again
    compute_hash_finished:
 
    ;EDI = El Hash de la cadena
    cmp edi,0xF6C53333
    jne salircheck
    mov eax, [dbg]
    cmp eax,1
    je salircheck
 
    invoke MessageBoxA,0,_goodpass,_goodtitle,MB_OK+MB_ICONINFORMATION
 
    salircheck:
    ret
endp
 
section '.data' data readable writeable
 
  _class        TCHAR 'KeyGenMe Fary',0
  _title        TCHAR 'Fary KeyGenME - 1.0',0
  _error        TCHAR 'Startup failed.',0
  _goodpass     db    'Enhorabuena, superaste el reto!ahora el keygen ;)',0
  _goodtitle    db    'Good Boy',0
 
  _buttonregistry       dd ?
  _buttonclass          db 'BUTTON',0
  _buttonname           db 'Registrar',0
 
  _editregistry         dd ?
  _editclass            db 'EDIT',0
 
  _labelclass           db 'STATIC',0
  _labeltext            db 'Fary Password: ',0
 
   password             rb 11
   dbg                  dd 0
 
  wc WNDCLASS 0,WindowProc,0,0,NULL,NULL,NULL,COLOR_BTNFACE+1,NULL,_class
 
  msg MSG
 
section '.idata' import data readable writeable
 
  library kernel32,'KERNEL32.DLL',\
          user32,'USER32.DLL'
 
  include 'api\kernel32.inc'
  include 'api\user32.inc'
 

function HexToBin(Hex: String): String;
var
   Bin: String;
   k: Byte;
Begin
   Bin:='';
   For k:=1 to Length(Hex) do
      if      Hex[k]='0' then Bin:=Bin+'0000'
      else if Hex[k]='1' then Bin:=Bin+'0001'
      else if Hex[k]='2' then Bin:=Bin+'0010'
      else if Hex[k]='3' then Bin:=Bin+'0011'
      else if Hex[k]='4' then Bin:=Bin+'0100'
      else if Hex[k]='5' then Bin:=Bin+'0101'
      else if Hex[k]='6' then Bin:=Bin+'0110'
      else if Hex[k]='7' then Bin:=Bin+'0111'
      else if Hex[k]='8' then Bin:=Bin+'1000'
      else if Hex[k]='9' then Bin:=Bin+'1001'
      else if Hex[k]='A' then Bin:=Bin+'1010'
      else if Hex[k]='B' then Bin:=Bin+'1011'
      else if Hex[k]='C' then Bin:=Bin+'1100'
      else if Hex[k]='D' then Bin:=Bin+'1101'
      else if Hex[k]='E' then Bin:=Bin+'1110'
      else if Hex[k]='F' then Bin:=Bin+'1111';
   HexToBin:=Bin;
End;
 
function BinToHex(Bin: String): String;
 
var
   k: Byte;
   s: String;
   Hex: String;
Begin
   Hex:='';
   While Length(Bin) mod 4<>0 do Bin:='0'+Bin;
   For k:=0 to Length(Bin) div 4 -1 do
   Begin
      s:=Copy(Bin,k*4+1,4);
      if      s='0000' then s:='0'
      else if s='0001' then s:='1'
      else if s='0010' then s:='2'
      else if s='0011' then s:='3'
      else if s='0100' then s:='4'
      else if s='0101' then s:='5'
      else if s='0110' then s:='6'
      else if s='0111' then s:='7'
      else if s='1000' then s:='8'
      else if s='1001' then s:='9'
      else if s='1010' then s:='A'
      else if s='1011' then s:='B'
      else if s='1100' then s:='C'
      else if s='1101' then s:='D'
      else if s='1110' then s:='E'
      else if s='1111' then s:='F';
      Hex:=Hex+s;
   End;
   BinToHex:=Hex;
End;
 
function StrToHex(Str: String): Integer;
var
   Hex:Integer;
Begin
 
   if (str.Length=7) Then
   Begin
        str:='0' + str;
   end;
 
   if (str.Length=6) Then
   Begin
        str:='00' + str;
   end;
 
   Hex:=       (strToInt(copy(Str,1,1))*128);
   Hex:= Hex + (strToInt(copy(Str,2,1))*64);
   Hex:= Hex + (strToInt(copy(Str,3,1))*32);
   Hex:= Hex + (strToInt(copy(Str,4,1))*16);
   Hex:= Hex + (strToInt(copy(Str,5,1))*8);
   Hex:= Hex + (strToInt(copy(Str,6,1))*4);
   Hex:= Hex + (strToInt(copy(Str,7,1))*2);
   Hex:= Hex + (strToInt(copy(Str,8,1))*1);
   StrToHex:=Hex;
end;
 
function shLeft(Str:String;N:integer): String;
var
   s:String;
Begin
         s:=copy(Str,N+1,32-N)+copy(Str,1,N);
         shLeft:=s;
   end;
 
procedure TForm1.Button1Click(Sender: TObject);
      var
         A,B:String;
         C:Integer;
Label
rotacionar,ciclo;
                      //F6C53333    Caractere >=32 <=126  $20 $7E
begin
      A:= 'F6C53333';
      B:= HexToBin(A);
 
      ciclo:
      // 8 bits
      C:= strToHex(copy(B,25,8));
      IF (C>31) and (C<127) Then
      Begin
        Edit1.text:= (intTohex(C,2)) + Edit1.text ;
        B:= (Copy(B,1,24)) + '00000000';
        GOTO rotacionar;
      end;  // fin 8 bits
 
 
      //7 bits
      C:= strToHex(copy(B,26,7));
      IF (C>31) and (C<127) Then
      Begin
        Edit1.text:= (intTohex(C,2)) + Edit1.text;
        B:= (Copy(B,1,25)) + '0000000';
        GOTO rotacionar;
      end;   //fin 7 bits
 
 
      //6 bits  (Con 6 bits positivos no passa valor $7E  No precisa testar con 5)
      C:= strToHex(copy(B,27,6));
      IF (C>31) and (C<127) Then
      Begin
        Edit1.text:=  (intTohex(C,2)) + Edit1.text;
        B:= (Copy(B,1,26)) + '000000';
        GOTO rotacionar;
      end;    //fin 6 bits
 
 
      rotacionar:
      IF ((Copy(B,1,32)) <> '00000000000000000000000000000000') Then
      begin
        B:=shLeft(B,13);
        goto ciclo;
       //Showmessage(B);
      end;
end;                         

Function HexToStr(s: String): String;
Var i: Integer;
Begin
  Result:=''; i:=1;
  While i<Length(s) Do Begin
    Result:=Result+Chr(StrToIntDef('$'+Copy(s,i,2),0));
    Inc(i,2);
  End;
End; 

Showmessage(hexTostr(Edit1.text));

     Showmessage('¡Hummmm, valor incorrecto !!!!!');
     rotacionar:
      IF ((Copy(B,1,32)) <> '00000000000000000000000000000000') Then
      begin
        B:=shLeft(B,13);
        goto ciclo;
       //Showmessage(B);
      end;

F6C53333 - 38   = F6C532FB; //38hex es el carácter 8
ROL F6C532FB, D = A65F7ED8
 
Y ahora voy restanto 7/8 bits como tu mencionas:
A65F7ED8 - 58   = A65F7E80; //58hex es el caracter X
ROL A65F7E80, D = EFD014CB
EFD014CB - 4B   = EFD01480; //4Bhex es el caracter K
ROL EFD01480, D = 02901DFA
02901DFA - 7A   = 02901D80; //7Ahex es el caracter z
ROL 02901D80, D = 03B00052
03B00052 - 52   = 03B00000; // 52hex es el caracter R
ROL 00000076, D = 00000076
00000076 - 76   = 00000000; //76hex es el caracter v