When a cell is in Hidden(Locked, Algorithm) Mode, its value cannot be read, and it can only be used to send a query to it and receive the response. Same queries return same responses, but you cannot guess the response having just the query, unless you have the dongle. For more information refer to SentinelPro Documentation.

Rainbow shell uses this kind of cells to encrypt the application. It stores the query values in the executable, and uses the response values to decode it.

Now enough theory, let's see a real protected application. You will need these programs to go further in this article:

1. PE Explorer(we need a program to seperate an executable sections, many executable editors do the job.)
2. Micro$oft Visual C++(a win32 C++ compiler would suffice)
3. NamehNegar (Build : 3.1.3006.0)(a delphi program, it's in Farsi(Iranians language, Persian...), I just selected this because it could be downloaded easily from the internet.)
4. Your favourite debugger, I will use M$ Visual Studio(yeah I like it).

Now the hard job, traceing the victim... I first located the places that the program tried to talk to the dongle, then set breakpoints on them... you need to make the program think the dongle is present... tracing the program took me to the decoding place , decryption procedure here:

//prototype : Decode(DWORD *where,DWORD size,DWORD key) 

00417F74 57                   push        edi
00417F75 8B 74 24 14          mov         esi,dword ptr [esp+14h] ;size
00417F79 C1 EE 02             shr         esi,2
00417F7C 8B CE                mov         ecx,esi
00417F7E 4E                   dec         esi
00417F7F 85 C9                test        ecx,ecx
00417F81 74 31                je          00417FB4
00417F83 8B 54 24 10          mov         edx,dword ptr [esp+10h] ;where
00417F87 8B 7C 24 18          mov         edi,dword ptr [esp+18h] ;key
00417F8B 8B CF                mov         ecx,edi
00417F8D 8B DF                mov         ebx,edi
00417F8F C1 E1 04             shl         ecx,4
00417F92 83 C2 04             add         edx,4
00417F95 C1 E3 05             shl         ebx,5
00417F98 03 CF                add         ecx,edi
00417F9A C1 E9 09             shr         ecx,9
00417F9D 33 CB                xor         ecx,ebx
00417F9F 03 F9                add         edi,ecx
00417FA1 8B 4A FC             mov         ecx,dword ptr [edx-4]
00417FA4 33 CF                xor         ecx,edi
00417FA6 03 C1                add         eax,ecx
00417FA8 89 4A FC             mov         dword ptr [edx-4],ecx
00417FAB 33 F8                xor         edi,eax
00417FAD 8B CE                mov         ecx,esi
00417FAF 4E                   dec         esi
00417FB0 85 C9                test        ecx,ecx
00417FB2 75 D7                jne         00417F8B
00417FB4 5F                   pop         edi
00417FB5 5E                   pop         esi
00417FB6 5B                   pop         ebx
00417FB7 C2 0C 00             ret         0Ch
//////////////////////////

//////////////////////////
void decode(DWORD *where, DWORD size, DWORD key)
{
	DWORD sum=0;
	
	while(size--) {
		key += (key * 5 / 512) ^ (key * 32);
		*where ^= key;
		sum += *where;
		key ^= sum;
		where ++;
	}
}
//////////////////////////