static EncryptionVersion getHeaderOffsetAndVersion(MyPEImage peImage, out uint headerOffset) { headerOffset = 0; var version = getVersion(peImage, headerOffset); if (version != EncryptionVersion.Unknown) { return(version); } var section = peImage.findSection(".rsrc"); if (section == null) { return(EncryptionVersion.Unknown); } headerOffset = section.PointerToRawData; uint end = section.PointerToRawData + section.SizeOfRawData - 0x1000 + 1; while (headerOffset < end) { version = getVersion(peImage, headerOffset); if (version != EncryptionVersion.Unknown) { return(version); } headerOffset++; } return(EncryptionVersion.Unknown); }
static EncryptionVersion GetHeaderOffsetAndVersion(MyPEImage peImage, out uint headerOffset) { headerOffset = 0; var version = GetVersion(peImage, headerOffset); if (version != EncryptionVersion.Unknown) { return(version); } var section = peImage.FindSection(".rsrc"); if (section != null) { version = GetHeaderOffsetAndVersion(section, peImage, out headerOffset); if (version != EncryptionVersion.Unknown) { return(version); } } foreach (var section2 in peImage.Sections) { version = GetHeaderOffsetAndVersion(section2, peImage, out headerOffset); if (version != EncryptionVersion.Unknown) { return(version); } } return(EncryptionVersion.Unknown); }
public PeHeader(MainType mainType, PeImage peImage) { uint headerOffset; version = getHeaderOffsetAndVersion(peImage, out headerOffset); headerData = peImage.offsetReadBytes(headerOffset, 0x1000); }
public PeHeader(MainType mainType, MyPEImage peImage) { version = GetHeaderOffsetAndVersion(peImage, out uint headerOffset); headerData = peImage.OffsetReadBytes(headerOffset, 0x1000); // MC uses 4-byte xorKey, 2 Hex for 1 Byte GuessXorKey(false, peImage, 4); switch (version) { case EncryptionVersion.V1: case EncryptionVersion.V2: case EncryptionVersion.V3: case EncryptionVersion.V4: case EncryptionVersion.V5: default: xorKey = 0x7ABF931; break; case EncryptionVersion.V6: xorKey = 0x7ABA931; break; case EncryptionVersion.V7: xorKey = 0x8ABA931; break; case EncryptionVersion.V8: if (CheckMcKeyRva(peImage, 0x99BA9A13)) break; if (CheckMcKeyRva(peImage, 0x18ABA931)) break; if (CheckMcKeyRva(peImage, 0x18ABA933)) break; break; } }
public PeHeader(MainType mainType, MyPEImage peImage) { uint headerOffset; version = GetHeaderOffsetAndVersion(peImage, out headerOffset); headerData = peImage.OffsetReadBytes(headerOffset, 0x1000); switch (version) { case EncryptionVersion.V1: case EncryptionVersion.V2: case EncryptionVersion.V3: case EncryptionVersion.V4: case EncryptionVersion.V5: default: xorKey = 0x7ABF931; break; case EncryptionVersion.V6: xorKey = 0x7ABA931; break; case EncryptionVersion.V7: xorKey = 0x8ABA931; break; case EncryptionVersion.V8: if (CheckMcKeyRva(peImage, 0x99BA9A13)) break; if (CheckMcKeyRva(peImage, 0x18ABA931)) break; if (CheckMcKeyRva(peImage, 0x18ABA933)) break; break; } }
public DepotEncryptedManifest(AppId appId, DepotId depotId, string branchName, string encryptedManifestId, EncryptionVersion version) { BranchName = branchName; EncryptedManifestId = encryptedManifestId; Version = version; AppId = appId; DepotId = depotId; }
public PeHeader(MainType mainType, MyPEImage peImage) { uint headerOffset; version = GetHeaderOffsetAndVersion(peImage, out headerOffset); headerData = peImage.OffsetReadBytes(headerOffset, 0x1000); switch (version) { case EncryptionVersion.V1: case EncryptionVersion.V2: case EncryptionVersion.V3: case EncryptionVersion.V4: case EncryptionVersion.V5: default: xorKey = 0x7ABF931; break; case EncryptionVersion.V6: xorKey = 0x7ABA931; break; case EncryptionVersion.V7: xorKey = 0x8ABA931; break; case EncryptionVersion.V8: if (CheckMcKeyRva(peImage, 0x99BA9A13)) { break; } if (CheckMcKeyRva(peImage, 0x18ABA931)) { break; } if (CheckMcKeyRva(peImage, 0x18ABA933)) { break; } break; } }
public MemoryStream Encrypt(EncryptionVersion version) { MemoryStream stream = new MemoryStream(); using (AesCryptoServiceProvider aes = new AesCryptoServiceProvider()) { aes.Mode = CipherMode.CBC; aes.Key = keys[version].GetKey(); aes.IV = keys[version].GetIV(); byte[] buffer = new byte[512]; using (CryptoStream cryptoStream = new CryptoStream(Stream(), aes.CreateEncryptor(), CryptoStreamMode.Read)) { int count; do { count = cryptoStream.Read(buffer, 0, 512); stream.Write(buffer, 0, count); }while (count > 0); } } return(stream); }
public PeHeader(MainType mainType, MyPEImage peImage) { uint headerOffset; version = getHeaderOffsetAndVersion(peImage, out headerOffset); switch (version) { case EncryptionVersion.V1: case EncryptionVersion.V2: case EncryptionVersion.V3: case EncryptionVersion.V4: case EncryptionVersion.V5: default: xorKey = 0x7ABF931; break; case EncryptionVersion.V6: xorKey = 0x7ABA931; break; } headerData = peImage.offsetReadBytes(headerOffset, 0x1000); }
static EncryptionVersion GetHeaderOffsetAndVersion(MyPEImage peImage, out uint headerOffset) { headerOffset = 0; var version = GetVersion(peImage, headerOffset); if (version != EncryptionVersion.Unknown) return version; var section = peImage.FindSection(".rsrc"); if (section != null) { version = GetHeaderOffsetAndVersion(section, peImage, out headerOffset); if (version != EncryptionVersion.Unknown) return version; } foreach (var section2 in peImage.Sections) { version = GetHeaderOffsetAndVersion(section2, peImage, out headerOffset); if (version != EncryptionVersion.Unknown) return version; } return EncryptionVersion.Unknown; }
static EncryptionVersion getHeaderOffsetAndVersion(PeImage peImage, out uint headerOffset) { headerOffset = 0; var version = getVersion(peImage, headerOffset); if (version != EncryptionVersion.Unknown) return version; var section = peImage.findSection(".rsrc"); if (section == null) return EncryptionVersion.Unknown; headerOffset = section.pointerToRawData; uint end = section.pointerToRawData + section.sizeOfRawData - 0x1000 + 1; while (headerOffset < end) { version = getVersion(peImage, headerOffset); if (version != EncryptionVersion.Unknown) return version; headerOffset++; } return EncryptionVersion.Unknown; }