              MS SQL PasswordsPro module
              ++++++++++++++++++++++++++

    Software required
           * PasswordsPro

    MS SQL use both upper/mixed case password hashes, MS SQL 2005 omits
    the upper case version for increased protection against brute force attacks.

    Please ensure that 'Convert passwords to unicode before hashing' option is enabled
    before using this module for either of the upper/mixed case hashes.

    A little theory on hash creation
    +++++++++++++++++++++++++++++++++

    The algorithm is fairly simple.
    Convert the password to UNICODE format (if not unicode already)
    Append a random 4-byte salt, then process with SHA-1

    Below is basic code which will compute both mixed/uppercase hash values.
    where len is length of ANSI string.
    password1 and password2 hold lower/upper case variants respectively.
    argv[1] is pointer to ANSI password string.
    This isn't proper unicode conversion, i know - just to demonstrate.

    The salt is 4 byte random challenge, use rand() for example.

    -------------------------------------------------- start

        for(i = 0; i < len; i++)
        {
          ((unsigned short *)password1)[i] = argv[1][i];
          ((unsigned short *)password2)[i] = toupper(argv[1][i]);
        }

        memcpy(&password1[len*2],&salt,4);
        memcpy(&password2[len*2],&salt,4);

        SHA1Init(&sha1_ctx1);
        SHA1Init(&sha1_ctx2);

        SHA1Update(&sha1_ctx1,(uchar*)password1,len*2 + 4);
        SHA1Update(&sha1_ctx2,(uchar*)password2,len*2 + 4);

        SHA1Final(&sha1_ctx1,(uchar*)&msql_hash1);
        SHA1Final(&sha1_ctx2,(uchar*)&msql_hash2);

    -------------------------------------------------- end

    Information on the algorithm was found in article by David Litchfield.
    google for "Cracking SQL passwords" for more information.

    ++++++++++++++++++++++++++++++++++++++

    Feb 5th - v1.1b
       * updated to reflect API changes

    Dec 30th - Version 1.0
       * fixed silly bugs

    Oct 24th - Version 1.0b
       * pre-release

    send all bugs/comments to Kevin Devine