コード例 #1
0
ファイル: EDAT.cs プロジェクト: Hector-Ab/PeXploit
 private int checkHeader(byte[] rifKey, EDATData data, NPD npd, FileStream i)
 {
     int num8;
     i.Seek(0L, SeekOrigin.Begin);
     byte[] buffer = new byte[160];
     byte[] o = new byte[160];
     byte[] buffer3 = new byte[0x10];
     Console.WriteLine("Checking NPD Version:" + npd.getVersion());
     if ((npd.getVersion() == 0L) || (npd.getVersion() == 1L))
     {
         if ((data.getFlags() & 0x7ffffffeL) != 0L)
         {
             Console.WriteLine("ERROR: Incorrect Header Flags");
             return STATUS_ERROR_INCORRECT_FLAGS;
         }
     }
     else if (npd.getVersion() == 2L)
     {
         if ((data.getFlags() & 0x7effffe0L) != 0L)
         {
             Console.WriteLine("ERROR: Incorrect Header Flags");
             return STATUS_ERROR_INCORRECT_FLAGS;
         }
     }
     else if ((npd.getVersion() == 3L) || (npd.getVersion() == 4L))
     {
         if ((data.getFlags() & 0x7effffc0L) != 0L)
         {
             Console.WriteLine("ERROR: Incorrect Header Flags");
             return STATUS_ERROR_INCORRECT_FLAGS;
         }
     }
     else
     {
         Console.WriteLine("ERROR: Unsupported EDAT version (need keys)");
         return STATUS_ERROR_INCORRECT_VERSION;
     }
     if (npd.getVersion() == 4L)
     {
     }
     i.Read(buffer, 0, buffer.Length);
     i.Read(buffer3, 0, buffer3.Length);
     Console.WriteLine("Checking header hash:");
     AppLoader loader = new AppLoader();
     int hashFlag = ((data.getFlags() & FLAG_KEYENCRYPTED) == 0L) ? 2 : 0x10000002;
     if ((data.getFlags() & FLAG_DEBUG) != 0L)
     {
         hashFlag |= 0x1000000;
     }
     if (!loader.doAll(hashFlag, 1, buffer, 0, o, 0, buffer.Length, new byte[0x10], new byte[0x10], rifKey, buffer3, 0))
     {
         Console.WriteLine("Error verifying header. Is rifKey valid?.");
         return STATUS_ERROR_HEADERCHECK;
     }
     Console.WriteLine("Checking metadata hash:");
     loader = new AppLoader();
     loader.doInit(hashFlag, 1, new byte[0x10], new byte[0x10], rifKey);
     int num3 = ((data.getFlags() & FLAG_COMPRESSED) != 0L) ? 0x20 : 0x10;
     int num4 = (int) (((data.getFileLen() + data.getBlockSize()) - 11) / data.getBlockSize());
     int num5 = 0;
     int num6 = 0x100;
     for (long j = num3 * num4; j > 0L; j -= num8)
     {
         num8 = (HEADER_MAX_BLOCKSIZE > j) ? ((int) j) : HEADER_MAX_BLOCKSIZE;
         i.Seek((long) (num6 + num5), SeekOrigin.Begin);
         byte[] buffer4 = new byte[num8];
         o = new byte[num8];
         i.Read(buffer4, 0, buffer4.Length);
         loader.doUpdate(buffer4, 0, o, 0, num8);
         num5 += num8;
     }
     if (!loader.doFinal(buffer, 0x90))
     {
         Console.WriteLine("Error verifying metadatasection. Data tampered");
         return STATUS_ERROR_HEADERCHECK;
     }
     return STATUS_OK;
 }
コード例 #2
0
        private int checkHeader(byte[] rifKey, EDATData data, NPD npd, FileStream i)
        {
            i.Seek(0, SeekOrigin.Begin);
            byte[] header       = new byte[0xA0];
            byte[] o            = new byte[0xA0];
            byte[] expectedHash = new byte[0x10];
            //Version check
            Console.WriteLine("Checking NPD Version:" + npd.getVersion());
            if ((npd.getVersion() == 0) || (npd.getVersion() == 1))
            {
                if ((data.getFlags() & 0x7FFFFFFE) != 0)
                {
                    Console.WriteLine("ERROR: Incorrect Header Flags"); return(STATUS_ERROR_INCORRECT_FLAGS);
                }
            }
            else if (npd.getVersion() == 2)
            {
                if ((data.getFlags() & 0x7EFFFFE0) != 0)
                {
                    Console.WriteLine("ERROR: Incorrect Header Flags"); return(STATUS_ERROR_INCORRECT_FLAGS);
                }
            }
            else if (npd.getVersion() == 3 || (npd.getVersion() == 4))
            {
                if ((data.getFlags() & 0x7EFFFFC0) != 0)
                {
                    Console.WriteLine("ERROR: Incorrect Header Flags"); return(STATUS_ERROR_INCORRECT_FLAGS);
                }
            }
            else
            {
                Console.WriteLine("ERROR: Unsupported EDAT version (need keys)"); return(STATUS_ERROR_INCORRECT_VERSION);
            }

            {
                int keyIndex = 0;
                if (npd.getVersion() == 4)
                {
                    keyIndex = 1;
                }


                i.Read(header, 0, header.Length);
                i.Read(expectedHash, 0, expectedHash.Length);
                Console.WriteLine("Checking header hash:");
                AppLoader a        = new AppLoader();
                int       hashFlag = ((data.getFlags() & FLAG_KEYENCRYPTED) == 0) ? 0x00000002 : 0x10000002;
                if ((data.getFlags() & FLAG_DEBUG) != 0)
                {
                    hashFlag |= 0x01000000;
                }



                //Veryfing header
                bool result = a.doAll(hashFlag, 0x00000001, header, 0, o, 0, header.Length, new byte[0x10], new byte[0x10], rifKey, expectedHash, 0);
                if (!result)
                {
                    Console.WriteLine("Error verifying header. Is rifKey valid?.");
                    return(STATUS_ERROR_HEADERCHECK);
                }
                Console.WriteLine("Checking metadata hash:");
                a = new AppLoader();
                a.doInit(hashFlag, 0x00000001, new byte[0x10], new byte[0x10], rifKey);

                int sectionSize = ((data.getFlags() & FLAG_COMPRESSED) != 0) ? 0x20 : 0x010; //BUG??? What about FLAG0x20??
                //Determine the metadatasection total len
                int numBlocks = (int)((data.getFileLen() + data.getBlockSize() - 11) / data.getBlockSize());

                int readed     = 0;
                int baseOffset = 0x100;
                //baseOffset +=  modifier; //There is an unknown offset to add to the metadatasection... value seen 0
                long remaining = sectionSize * numBlocks;
                while (remaining > 0)
                {
                    int lenToRead = (HEADER_MAX_BLOCKSIZE > remaining) ? (int)remaining : HEADER_MAX_BLOCKSIZE;
                    i.Seek(baseOffset + readed, SeekOrigin.Begin);
                    byte[] content = new byte[lenToRead];
                    o = new byte[lenToRead];
                    i.Read(content, 0, content.Length);
                    a.doUpdate(content, 0, o, 0, lenToRead);
                    readed    += lenToRead;
                    remaining -= lenToRead;
                }
                result = a.doFinal(header, 0x90);


                if (!result)
                {
                    Console.WriteLine("Error verifying metadatasection. Data tampered");
                    return(STATUS_ERROR_HEADERCHECK);
                }
                return(STATUS_OK);
            }
        }
コード例 #3
0
        private int checkHeader(byte[] rifKey, EDATData data, NPD npd, FileStream i)
        {
            int num8;

            i.Seek(0L, SeekOrigin.Begin);
            byte[] buffer  = new byte[160];
            byte[] o       = new byte[160];
            byte[] buffer3 = new byte[0x10];
            Console.WriteLine("Checking NPD Version:" + npd.getVersion());
            if ((npd.getVersion() == 0L) || (npd.getVersion() == 1L))
            {
                if ((data.getFlags() & 0x7ffffffeL) != 0L)
                {
                    Console.WriteLine("ERROR: Incorrect Header Flags");
                    return(STATUS_ERROR_INCORRECT_FLAGS);
                }
            }
            else if (npd.getVersion() == 2L)
            {
                if ((data.getFlags() & 0x7effffe0L) != 0L)
                {
                    Console.WriteLine("ERROR: Incorrect Header Flags");
                    return(STATUS_ERROR_INCORRECT_FLAGS);
                }
            }
            else if ((npd.getVersion() == 3L) || (npd.getVersion() == 4L))
            {
                if ((data.getFlags() & 0x7effffc0L) != 0L)
                {
                    Console.WriteLine("ERROR: Incorrect Header Flags");
                    return(STATUS_ERROR_INCORRECT_FLAGS);
                }
            }
            else
            {
                Console.WriteLine("ERROR: Unsupported EDAT version (need keys)");
                return(STATUS_ERROR_INCORRECT_VERSION);
            }
            if (npd.getVersion() == 4L)
            {
            }
            i.Read(buffer, 0, buffer.Length);
            i.Read(buffer3, 0, buffer3.Length);
            Console.WriteLine("Checking header hash:");
            AppLoader loader   = new AppLoader();
            int       hashFlag = ((data.getFlags() & FLAG_KEYENCRYPTED) == 0L) ? 2 : 0x10000002;

            if ((data.getFlags() & FLAG_DEBUG) != 0L)
            {
                hashFlag |= 0x1000000;
            }
            if (!loader.doAll(hashFlag, 1, buffer, 0, o, 0, buffer.Length, new byte[0x10], new byte[0x10], rifKey, buffer3, 0))
            {
                Console.WriteLine("Error verifying header. Is rifKey valid?.");
                return(STATUS_ERROR_HEADERCHECK);
            }
            Console.WriteLine("Checking metadata hash:");
            loader = new AppLoader();
            loader.doInit(hashFlag, 1, new byte[0x10], new byte[0x10], rifKey);
            int num3 = ((data.getFlags() & FLAG_COMPRESSED) != 0L) ? 0x20 : 0x10;
            int num4 = (int)(((data.getFileLen() + data.getBlockSize()) - 11) / data.getBlockSize());
            int num5 = 0;
            int num6 = 0x100;

            for (long j = num3 * num4; j > 0L; j -= num8)
            {
                num8 = (HEADER_MAX_BLOCKSIZE > j) ? ((int)j) : HEADER_MAX_BLOCKSIZE;
                i.Seek((long)(num6 + num5), SeekOrigin.Begin);
                byte[] buffer4 = new byte[num8];
                o = new byte[num8];
                i.Read(buffer4, 0, buffer4.Length);
                loader.doUpdate(buffer4, 0, o, 0, num8);
                num5 += num8;
            }
            if (!loader.doFinal(buffer, 0x90))
            {
                Console.WriteLine("Error verifying metadatasection. Data tampered");
                return(STATUS_ERROR_HEADERCHECK);
            }
            return(STATUS_OK);
        }