static EncryptionVersion getHeaderOffsetAndVersion(MyPEImage peImage, out uint headerOffset)
{
headerOffset = 0;
var version = getVersion(peImage, headerOffset);
if (version != EncryptionVersion.Unknown)
{
return(version);
}
var section = peImage.findSection(".rsrc");
if (section == null)
{
return(EncryptionVersion.Unknown);
}
headerOffset = section.PointerToRawData;
uint end = section.PointerToRawData + section.SizeOfRawData - 0x1000 + 1;
while (headerOffset < end)
{
version = getVersion(peImage, headerOffset);
if (version != EncryptionVersion.Unknown)
{
return(version);
}
headerOffset++;
}
return(EncryptionVersion.Unknown);
}
static EncryptionVersion GetHeaderOffsetAndVersion(MyPEImage peImage, out uint headerOffset)
{
headerOffset = 0;
var version = GetVersion(peImage, headerOffset);
if (version != EncryptionVersion.Unknown)
{
return(version);
}
var section = peImage.FindSection(".rsrc");
if (section != null)
{
version = GetHeaderOffsetAndVersion(section, peImage, out headerOffset);
if (version != EncryptionVersion.Unknown)
{
return(version);
}
}
foreach (var section2 in peImage.Sections)
{
version = GetHeaderOffsetAndVersion(section2, peImage, out headerOffset);
if (version != EncryptionVersion.Unknown)
{
return(version);
}
}
return(EncryptionVersion.Unknown);
}
public PeHeader(MainType mainType, PeImage peImage)
{
uint headerOffset;
version = getHeaderOffsetAndVersion(peImage, out headerOffset);
headerData = peImage.offsetReadBytes(headerOffset, 0x1000);
}
public PeHeader(MainType mainType, MyPEImage peImage) {
version = GetHeaderOffsetAndVersion(peImage, out uint headerOffset);
headerData = peImage.OffsetReadBytes(headerOffset, 0x1000);
// MC uses 4-byte xorKey, 2 Hex for 1 Byte
GuessXorKey(false, peImage, 4);
switch (version) {
case EncryptionVersion.V1:
case EncryptionVersion.V2:
case EncryptionVersion.V3:
case EncryptionVersion.V4:
case EncryptionVersion.V5:
default:
xorKey = 0x7ABF931;
break;
case EncryptionVersion.V6:
xorKey = 0x7ABA931;
break;
case EncryptionVersion.V7:
xorKey = 0x8ABA931;
break;
case EncryptionVersion.V8:
if (CheckMcKeyRva(peImage, 0x99BA9A13))
break;
if (CheckMcKeyRva(peImage, 0x18ABA931))
break;
if (CheckMcKeyRva(peImage, 0x18ABA933))
break;
break;
}
}
public PeHeader(MainType mainType, MyPEImage peImage) {
uint headerOffset;
version = GetHeaderOffsetAndVersion(peImage, out headerOffset);
headerData = peImage.OffsetReadBytes(headerOffset, 0x1000);
switch (version) {
case EncryptionVersion.V1:
case EncryptionVersion.V2:
case EncryptionVersion.V3:
case EncryptionVersion.V4:
case EncryptionVersion.V5:
default:
xorKey = 0x7ABF931;
break;
case EncryptionVersion.V6:
xorKey = 0x7ABA931;
break;
case EncryptionVersion.V7:
xorKey = 0x8ABA931;
break;
case EncryptionVersion.V8:
if (CheckMcKeyRva(peImage, 0x99BA9A13))
break;
if (CheckMcKeyRva(peImage, 0x18ABA931))
break;
if (CheckMcKeyRva(peImage, 0x18ABA933))
break;
break;
}
}
public DepotEncryptedManifest(AppId appId, DepotId depotId, string branchName, string encryptedManifestId, EncryptionVersion version)
{
BranchName = branchName;
EncryptedManifestId = encryptedManifestId;
Version = version;
AppId = appId;
DepotId = depotId;
}
public PeHeader(MainType mainType, MyPEImage peImage)
{
uint headerOffset;
version = GetHeaderOffsetAndVersion(peImage, out headerOffset);
headerData = peImage.OffsetReadBytes(headerOffset, 0x1000);
switch (version)
{
case EncryptionVersion.V1:
case EncryptionVersion.V2:
case EncryptionVersion.V3:
case EncryptionVersion.V4:
case EncryptionVersion.V5:
default:
xorKey = 0x7ABF931;
break;
case EncryptionVersion.V6:
xorKey = 0x7ABA931;
break;
case EncryptionVersion.V7:
xorKey = 0x8ABA931;
break;
case EncryptionVersion.V8:
if (CheckMcKeyRva(peImage, 0x99BA9A13))
{
break;
}
if (CheckMcKeyRva(peImage, 0x18ABA931))
{
break;
}
if (CheckMcKeyRva(peImage, 0x18ABA933))
{
break;
}
break;
}
}
public MemoryStream Encrypt(EncryptionVersion version)
{
MemoryStream stream = new MemoryStream();
using (AesCryptoServiceProvider aes = new AesCryptoServiceProvider())
{
aes.Mode = CipherMode.CBC;
aes.Key = keys[version].GetKey();
aes.IV = keys[version].GetIV();
byte[] buffer = new byte[512];
using (CryptoStream cryptoStream = new CryptoStream(Stream(), aes.CreateEncryptor(), CryptoStreamMode.Read))
{
int count;
do
{
count = cryptoStream.Read(buffer, 0, 512);
stream.Write(buffer, 0, count);
}while (count > 0);
}
}
return(stream);
}
public PeHeader(MainType mainType, MyPEImage peImage)
{
uint headerOffset;
version = getHeaderOffsetAndVersion(peImage, out headerOffset);
switch (version)
{
case EncryptionVersion.V1:
case EncryptionVersion.V2:
case EncryptionVersion.V3:
case EncryptionVersion.V4:
case EncryptionVersion.V5:
default:
xorKey = 0x7ABF931;
break;
case EncryptionVersion.V6:
xorKey = 0x7ABA931;
break;
}
headerData = peImage.offsetReadBytes(headerOffset, 0x1000);
}
static EncryptionVersion GetHeaderOffsetAndVersion(MyPEImage peImage, out uint headerOffset) {
headerOffset = 0;
var version = GetVersion(peImage, headerOffset);
if (version != EncryptionVersion.Unknown)
return version;
var section = peImage.FindSection(".rsrc");
if (section != null) {
version = GetHeaderOffsetAndVersion(section, peImage, out headerOffset);
if (version != EncryptionVersion.Unknown)
return version;
}
foreach (var section2 in peImage.Sections) {
version = GetHeaderOffsetAndVersion(section2, peImage, out headerOffset);
if (version != EncryptionVersion.Unknown)
return version;
}
return EncryptionVersion.Unknown;
}
static EncryptionVersion getHeaderOffsetAndVersion(PeImage peImage, out uint headerOffset)
{
headerOffset = 0;
var version = getVersion(peImage, headerOffset);
if (version != EncryptionVersion.Unknown)
return version;
var section = peImage.findSection(".rsrc");
if (section == null)
return EncryptionVersion.Unknown;
headerOffset = section.pointerToRawData;
uint end = section.pointerToRawData + section.sizeOfRawData - 0x1000 + 1;
while (headerOffset < end) {
version = getVersion(peImage, headerOffset);
if (version != EncryptionVersion.Unknown)
return version;
headerOffset++;
}
return EncryptionVersion.Unknown;
}
public PeHeader(MainType mainType, PeImage peImage)
{
uint headerOffset;
version = getHeaderOffsetAndVersion(peImage, out headerOffset);
headerData = peImage.offsetReadBytes(headerOffset, 0x1000);
}
