看freetds的源码：
unsigned char *
tds7_crypt_pass(const unsigned char *clear_pass, int len, unsigned char *crypt_pass)
{
int i;
for (i = 0; i < len; i++)
crypt_pass[i] = ((clear_pass[i] << 4) | (clear_pass[i] >> 4)) ^ 0xA5;
return crypt_pass;
}
调用：tds7_crypt_pass((unsigned char *) unicode_string, password_len, (unsigned char *) unicode_string);
这一点，wireshark早已经解析出来了。只是，当时不知道用哪种算法实现。
附调试代码：
#include <stdio.h>
#include "stdlib.h"
#include <string.h>
unsigned char *tds7_crypt_pass(const unsigned char *clear_pass, int len, unsigned char *crypt_pass)
{
int i;
for (i = 0;i < len; i++)
crypt_pass[i] = ((clear_pass[i] << 4) | (clear_pass[i] >> 4)) ^ 0xA5;
return crypt_pass;
}
int main()
{
const unsigned char password[]="abc123";
unsigned char buf[30];
unsigned char *encrpted_pass=buf;
int i;
memset(encrpted_pass,0,sizeof(buf));
tds7_crypt_pass(password,sizeof(password)-1,encrpted_pass);
for(i=0;i<sizeof(password)-1;i++)
{
printf("%c ",password[i]);
printf("%x/n",encrpted_pass[i]);
}
return 0;
}