1,088,879 Community Members

Reversing a Algorithm

Ad: Meru Networks Wi-Fi Solutions
Reply Start New Discussion
Member Avatar
Light Poster
48 posts since Dec 2007
Reputation Points: 10
Solved Threads: 1
Skill Endorsements: 0
 
0
 
4 Years Ago

hey,

I have a program that uses a certain algorithm to decrypt dll files from the game, half-life. but once i have decrypted them, the game crashed whenever i try to start it with the un-encrypted files. How would I reverse the algorithm, making the program encrypt them instead of decrypting them. I have the code and it is posted below:

hldlldec.c:

  1. /*
  2.     Copyright 2007 Luigi Auriemma
  4.     This program is free software; you can redistribute it and/or modify
  5.     it under the terms of the GNU General Public License as published by
  6.     the Free Software Foundation; either version 2 of the License, or
  7.     (at your option) any later version.
  9.     This program is distributed in the hope that it will be useful,
  10.     but WITHOUT ANY WARRANTY; without even the implied warranty of
  11.     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12.     GNU General Public License for more details.
  14.     You should have received a copy of the GNU General Public License
  15.     along with this program; if not, write to the Free Software
  16.     Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
  18.     http://www.gnu.org/licenses/gpl.txt
  19. */
  21. #include <stdio.h>
  22. #include <stdlib.h>
  23. #include <stdint.h>
  24. #include <string.h>
  25. #include <sys/stat.h>
  26. #include <ctype.h>
  27. #include "pe.h"
  31. #define VER         "0.1"
  32. #define round(n)    (((n + (PE_align - 1)) / PE_align) * PE_align)
  36. void halflife_dll_decrypt(uint8_t *data, uint32_t datasz);
  37. void find_impexp_tables(uint8_t *base, uint32_t baseoff, uint32_t *impoff, uint32_t *impsz, uint32_t *expoff, uint32_t *expsz);
  38. void dump_section(FILE *fd, uint32_t num, uint8_t *data, uint32_t datasz);
  39. uint8_t *fd_read(uint8_t *name, int *fdlen);
  40. void fd_write(uint8_t *name, uint8_t *data, int datasz);
  41. void std_err(void);
  45. int         dump    = 0;
  46. uint8_t     *in_file,
  47.             *out_file;
  51. int main(int argc, char *argv[]) {
  52.     uint32_t    filelen;
  53.     int         i;
  54.     uint8_t     *filebuff;
  56.     fputs("\n"
  57.         "Half-life DLL decrypter and rebuilder "VER"\n"
  58.         "by Luigi Auriemma\n"
  59.         "e-mail: aluigi@autistici.org\n"
  60.         "web:    aluigi.org\n"
  61.         "\n", stdout);
  63.     if(argc < 3) {
  64.         printf("\n"
  65.             "Usage: %s [options] <input.DLL> <output.DLL>\n"
  66.             "\n"
  67.             "Options:\n"
  68.             "-d    dump all the sections of the DLL instead of building the PE file,\n"
  69.             "      use <output.DLL> as base for the sequential output filename\n"
  70.             "\n", argv[0]);
  71.         exit(1);
  72.     }
  74.     argc -= 2;
  75.     for(i = 1; i < argc; i++) {
  76.         if(((argv[i][0] != '-') && (argv[i][0] != '/')) || (strlen(argv[i]) != 2)) {
  77.             printf("\nError: recheck your options (%s is not valid)\n", argv[i]);
  78.             exit(1);
  79.         }
  80.         switch(argv[i][1]) {
  81.             case 'd': dump = 1;     break;
  82.             default: {
  83.                 printf("\nError: wrong command-line argument (%s)\n\n", argv[i]);
  84.                 exit(1);
  85.                 } break;
  86.         }
  87.     }
  89.     in_file  = argv[argc];
  90.     out_file = argv[argc + 1];
  92.     filebuff = fd_read(in_file, &filelen);
  94.     halflife_dll_decrypt(filebuff, filelen);
  96.     printf("\n- the DLL has been decrypted and %s\n", dump
  97.         ? "dumped in the various section files"
  98.         : "rebuilt");
  99.     free(filebuff);
  100.     return(0);
  101. }
  105. void halflife_dll_decrypt(uint8_t *data, uint32_t datasz) {
  107.     typedef struct {
  108.         uint32_t    Characteristics;
  109.         uint32_t    Sections;
  110.         uint32_t    copywhat;
  111.         uint32_t    ImageBase;
  112.         uint32_t    EntryPoint;
  113.         uint32_t    ImportTable;
  114.     } hlhdr_t;
  116.     typedef struct {
  117.         uint32_t    rva;
  118.         uint32_t    raw_size;
  119.         uint32_t    virtual_size;
  120.         uint32_t    file_offset;
  121.         uint32_t    zero;
  122.     } hlsec_t;
  124.     const static char   *sec_names[4] = { ".text", ".rdata", ".data", ".rsrc" };
  126.     hlhdr_t     *hlhdr;
  127.     hlsec_t     *hlsec;
  128.     FILE        *fd;
  129.     uint32_t    i,
  130.                 fdoff,
  131.                 peoff;
  132.     uint8_t     chr,
  133.                 *base;
  135.     if(*(uint32_t *)(data + 64) != 0x12345678) {
  136.         printf("\nAlert: this DLL doesn't seem encrypted with the Valve algorithm\n");
  137.     }
  139.     base    = data;
  140.     data   += 68;
  141.     datasz -= 68;
  143.     chr = 'W';
  144.     for(i = 0; i < datasz; i++) {
  145.         data[i] ^= chr;
  146.         chr += data[i] + 'W';
  147.     }
  149.     hlhdr = (void *)data;
  150.     hlsec = (void *)(data + sizeof(hlhdr_t));
  152.     hlhdr->copywhat     ^= 0x7a32bc85;
  153.     hlhdr->ImageBase    ^= 0x49c042d1;
  154.     hlhdr->ImportTable  ^= 0x872c3d47;
  155.     hlhdr->EntryPoint   -= 12;
  157.     printf("\n"
  158.         "  Characteristics  %08x\n"
  159.         "  Sections         %08x\n"
  160.         "  copywhat         %08x\n"
  161.         "  ImageBase        %08x\n"
  162.         "  EntryPoint       %08x\n"
  163.         "  ImportTable      %08x\n",
  164.         hlhdr->Characteristics,
  165.         hlhdr->Sections,
  166.         hlhdr->copywhat,
  167.         hlhdr->ImageBase,
  168.         hlhdr->EntryPoint,
  169.         hlhdr->ImportTable);
  171.     for(i = 0; i <= hlhdr->Sections; i++) {
  172.         printf("\n"
  173.             "- section %u\n"
  174.             "  raw_size         %08x\n"
  175.             "  virtual_size     %08x\n"
  176.             "  file_offset      %08x\n"
  177.             "  rva              %08x\n"
  178.             "  zero             %08x\n",
  179.             i,
  180.             hlsec[i].raw_size,
  181.             hlsec[i].virtual_size,
  182.             hlsec[i].file_offset,
  183.             hlsec[i].rva,
  184.             hlsec[i].zero);
  186.         if(dump) {
  187.             dump_section(NULL, i, base + hlsec[i].file_offset, hlsec[i].virtual_size);
  188.         }
  189.     }
  191.     if(dump) return;
  192.     printf("\n");
  194.     /* when all the section have been placed in memory         */
  195.     /* HL.EXE calls hlhdr->EntryPoint and then hlhdr->copywhat */
  196.     /* copying a zone of the DLL in the HL.EXE process         */
  198.     /*                  IMPORTANT NOTE                      */
  199.     /* all the PE stuff here and in pe.h seems to work fine */
  200.     /* but for the moment I consider it only a work-around  */
  201.     /* so don't take it too seriously                       */
  203.     for(i = 0; i <= hlhdr->Sections; i++) {
  204.         PE_size_image += round(hlsec[i].raw_size);
  205.     }
  207.     PE_sections         = hlhdr->Sections + 1;
  208.     PE_size_code        = hlsec[0].raw_size;
  209.     PE_entry_point      = hlhdr->EntryPoint - hlhdr->ImageBase;
  210.     PE_base_code        = hlsec[0].rva      - hlhdr->ImageBase;
  211.     PE_image_base       = hlhdr->ImageBase;
  212.     PE_Characteristics  = hlhdr->Characteristics;
  214.     printf("- search offsets and sizes of the import and export tables\n");
  216.     PE_import_rva = hlhdr->ImportTable;
  217.     find_impexp_tables(
  218.         base + hlsec[1].file_offset,
  219.         hlsec[1].rva,
  220.         &PE_import_rva, &PE_import_size,
  221.         &PE_export_rva, &PE_export_size);
  223.     PE_import_rva      -= PE_image_base;
  224.     PE_export_rva      -= PE_image_base;
  225.     if(hlhdr->Sections >= 3) {
  226.         PE_resource_rva     = hlsec[3].rva - PE_image_base;
  227.         PE_resource_size    = hlsec[3].virtual_size;
  228.     }
  230.     printf("- now I try to build the PE DLL (experimental)\n\n");
  232.     fd = fopen(out_file, "wb");
  233.     if(!fd) std_err();
  235.     PE_dos_fwrite(fd);
  236.     PE_sign_fwrite(fd);
  237.     PE_file_fwrite(fd);
  238.     PE_optional_fwrite(fd);
  240.     peoff = ftell(fd);
  241.     fseek(fd, PE_base_code, SEEK_SET);
  243.     for(i = 0; i <= hlhdr->Sections; i++) {
  244.         fdoff = ftell(fd);
  245.         printf("  section %u -> %08x -> %08x\n",
  246.             i,
  247.             (uint32_t)ftell(fd),
  248.             hlsec[i].rva);
  249.         dump_section(fd, i, base + hlsec[i].file_offset, hlsec[i].virtual_size);
  250.         hlsec[i].file_offset = fdoff;       // here file_offset becomes our new offset
  251.     }
  253.     fseek(fd, peoff, SEEK_SET);
  255.     for(i = 0; i <= hlhdr->Sections; i++) {
  256.         PE_Characteristics  = IMAGE_SCN_CNT_CODE | IMAGE_SCN_MEM_EXECUTE          |
  257.                               IMAGE_SCN_MEM_READ | IMAGE_SCN_CNT_INITIALIZED_DATA |
  258.                               IMAGE_SCN_MEM_WRITE;
  259.         PE_virtual_size     = hlsec[i].virtual_size;
  260.         PE_rva              = hlsec[i].rva;
  261.         PE_raw_size         = hlsec[i].raw_size;
  262.         PE_file_offset      = hlsec[i].file_offset;
  264.         if(i < 4) {
  265.             strcpy(PE_section_name, sec_names[i]);
  266.         } else {
  267.             sprintf(PE_section_name, "sec%u", i);
  268.         }
  270.         PE_section_fwrite(fd);
  271.     }
  273.     fclose(fd);
  274. }
  278.     /* the following stupid function takes the data where starts the import table */
  279.     /* and finds its size and the offset and size of the export table too         */
  281. void find_impexp_tables(uint8_t *base, uint32_t baseoff, uint32_t *impoff, uint32_t *impsz, uint32_t *expoff, uint32_t *expsz) {
  282.     uint32_t    off,
  283.                 maxoff;
  284.     uint16_t    hint;
  285.     uint8_t     *data,
  286.                 *p;
  288.     data = base + (*impoff - baseoff);
  289.     p = data;
  291.     maxoff = 0;
  292.     while((off = *(uint32_t *)(p + 12))) {
  293.         if(off > maxoff) maxoff = off;
  294.         p += 20;
  295.     }
  297.     maxoff -= (baseoff - PE_image_base);
  298.     p = base + maxoff;
  300.     while(*p++);
  301.     if((p - base) & 1) p++;
  303.     while((hint = *(uint16_t *)p)) {
  304.         p += 2;
  305.         while(*p++);
  306.         if((p - base) & 1) p++;
  307.     }
  309.     while(!*p) p++;         // blah I think it's lame
  310.     p -= ((p - base) & 3);
  311.     p -= 4;
  313.     *impsz  = p - data;
  314.     *expoff = (p - base) + baseoff;
  316.     data = p;
  318.     off = *(uint32_t *)(p + 12);
  319.     off -= (baseoff - PE_image_base);
  320.     p = base + off;
  322.     while(*p) {
  323.         while(*p++);
  324.     }
  325.     if((p - base) & 1) p++;
  327.     *expsz = p - data;
  329.     printf("- import table found: %08x -> %u\n", *impoff - baseoff, *impsz);
  330.     printf("- export table found: %08x -> %u\n", *expoff - baseoff, *expsz);
  331. }
  335. void dump_section(FILE *fd, uint32_t num, uint8_t *data, uint32_t datasz) {
  336.     uint32_t    i,
  337.                 zero;
  338.     uint8_t     *fname  = NULL,
  339.                 *p;
  341.     if(dump) {
  342.         fname = malloc(strlen(out_file) + 12);
  343.         p = strrchr(out_file, '.');
  344.         if(p) {
  345.             sprintf(fname, "%.*s_%u.%s", p - out_file, out_file, num, p + 1);
  346.         } else {
  347.             sprintf(fname, "%s_%u.dll", out_file, num);
  348.         }
  350.         printf("- write %s\n", fname);
  351.         fd = fopen(fname, "wb");
  352.         if(!fd) std_err();
  353.     }
  355.     fwrite(data, datasz, 1, fd);
  357.     if(dump) {
  358.         fclose(fd);
  359.         free(fname);
  360.     } else {
  361.         zero = round(datasz);
  362.         for(i = datasz; i < zero; i++) {
  363.             fputc(0, fd);
  364.         }
  365.     }
  366. }
  370. uint8_t *fd_read(uint8_t *name, int *fdlen) {
  371.     struct stat xstat;
  372.     FILE        *fd;
  373.     uint8_t     *buff;
  375.     printf("- open file %s\n", name);
  376.     fd = fopen(name, "rb");
  377.     if(!fd) std_err();
  378.     fstat(fileno(fd), &xstat);
  379.     buff = malloc(xstat.st_size);
  380.     fread(buff, xstat.st_size, 1, fd);
  381.     fclose(fd);
  382.     *fdlen = xstat.st_size;
  383.     return(buff);
  384. }
  388. void fd_write(uint8_t *name, uint8_t *data, int datasz) {
  389.     FILE    *fd;
  391.     printf("- create file %s\n", name);
  392.     fd = fopen(name, "rb");
  393.     if(fd) {
  394.         fclose(fd);
  395.         printf("- file already exists, do you want to overwrite it (y/N)?\n  ");
  396.         fflush(stdin);
  397.         if(tolower(fgetc(stdin)) != 'y') exit(1);
  398.     }
  399.     fd = fopen(name, "wb");
  400.     if(!fd) std_err();
  401.     fwrite(data, datasz, 1, fd);
  402.     fclose(fd);
  403. }
  407. void std_err(void) {
  408.     perror("\nError");
  409.     exit(1);
  410. }

pe.h:

  1. /*
  2.     Copyright 2007 Luigi Auriemma
  4.     This program is free software; you can redistribute it and/or modify
  5.     it under the terms of the GNU General Public License as published by
  6.     the Free Software Foundation; either version 2 of the License, or
  7.     (at your option) any later version.
  9.     This program is distributed in the hope that it will be useful,
  10.     but WITHOUT ANY WARRANTY; without even the implied warranty of
  11.     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12.     GNU General Public License for more details.
  14.     You should have received a copy of the GNU General Public License
  15.     along with this program; if not, write to the Free Software
  16.     Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
  18.     http://www.gnu.org/licenses/gpl.txt
  19. */
  21. #include <stdio.h>
  22. #include <stdlib.h>
  23. #include <cstdint.h>
  24. #include <string.h>
  28.     /* DEFINES */
  32. #define IMAGE_DOS_SIGNATURE                 0x5A4D
  33. #define IMAGE_OS2_SIGNATURE                 0x454E
  34. #define IMAGE_OS2_SIGNATURE_LE              0x454C
  35. #define IMAGE_VXD_SIGNATURE                 0x454C
  36. #define IMAGE_NT_SIGNATURE                  0x00004550
  37. #define IMAGE_NT_OPTIONAL_HDR32_MAGIC       0x10b
  38. #define IMAGE_NT_OPTIONAL_HDR64_MAGIC       0x20b
  39. #define IMAGE_NT_OPTIONAL_HDR_MAGIC         IMAGE_NT_OPTIONAL_HDR32_MAGIC
  40. #define IMAGE_ROM_OPTIONAL_HDR_MAGIC        0x107
  41. #define IMAGE_SEPARATE_DEBUG_SIGNATURE      0x4944
  42. #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES    16
  43. #define IMAGE_SIZEOF_ROM_OPTIONAL_HEADER    56
  44. #define IMAGE_SIZEOF_STD_OPTIONAL_HEADER    28
  45. #define IMAGE_SIZEOF_NT_OPTIONAL_HEADER     224
  46. #define IMAGE_SIZEOF_SHORT_NAME             8
  47. #define IMAGE_SIZEOF_SECTION_HEADER         40
  48. #define IMAGE_SIZEOF_SYMBOL                 18
  49. #define IMAGE_SIZEOF_AUX_SYMBOL             18
  50. #define IMAGE_SIZEOF_RELOCATION             10
  51. #define IMAGE_SIZEOF_BASE_RELOCATION        8
  52. #define IMAGE_SIZEOF_LINENUMBER             6
  53. #define IMAGE_SIZEOF_ARCHIVE_MEMBER_HDR     60
  55. #define IMAGE_FILE_MACHINE_I386             0x014c
  57. #define IMAGE_FILE_RELOCS_STRIPPED          1
  58. #define IMAGE_FILE_EXECUTABLE_IMAGE         2
  59. #define IMAGE_FILE_LINE_NUMS_STRIPPED       4
  60. #define IMAGE_FILE_LOCAL_SYMS_STRIPPED      8
  61. #define IMAGE_FILE_AGGRESIVE_WS_TRIM        16
  62. #define IMAGE_FILE_LARGE_ADDRESS_AWARE      32
  63. #define IMAGE_FILE_BYTES_REVERSED_LO        128
  64. #define IMAGE_FILE_32BIT_MACHINE            256
  65. #define IMAGE_FILE_DEBUG_STRIPPED           512
  66. #define IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP  1024
  67. #define IMAGE_FILE_NET_RUN_FROM_SWAP        2048
  68. #define IMAGE_FILE_SYSTEM                   4096
  69. #define IMAGE_FILE_DLL                      8192
  70. #define IMAGE_FILE_UP_SYSTEM_ONLY           16384
  71. #define IMAGE_FILE_BYTES_REVERSED_HI        32768
  73. #define IMAGE_SUBSYSTEM_UNKNOWN             0
  74. #define IMAGE_SUBSYSTEM_NATIVE              1
  75. #define IMAGE_SUBSYSTEM_WINDOWS_GUI         2
  76. #define IMAGE_SUBSYSTEM_WINDOWS_CUI         3
  77. #define IMAGE_SUBSYSTEM_OS2_CUI             5
  78. #define IMAGE_SUBSYSTEM_POSIX_CUI           7
  79. #define IMAGE_SUBSYSTEM_NATIVE_WINDOWS      8
  80. #define IMAGE_SUBSYSTEM_WINDOWS_CE_GUI      9
  81. #define IMAGE_SUBSYSTEM_XBOX                14
  83. #define IMAGE_SCN_CNT_CODE                  32
  84. #define IMAGE_SCN_CNT_INITIALIZED_DATA      64
  85. #define IMAGE_SCN_CNT_UNINITIALIZED_DATA    128
  86. #define IMAGE_SCN_LNK_OTHER                 256
  87. #define IMAGE_SCN_LNK_INFO                  512
  88. #define IMAGE_SCN_TYPE_OVER                 1024
  89. #define IMAGE_SCN_LNK_REMOVE                2048
  90. #define IMAGE_SCN_LNK_COMDAT                4096
  91. #define IMAGE_SCN_MEM_DISCARDABLE           0x2000000
  92. #define IMAGE_SCN_MEM_NOT_CACHED            0x4000000
  93. #define IMAGE_SCN_MEM_NOT_PAGED             0x8000000
  94. #define IMAGE_SCN_MEM_SHARED                0x10000000
  95. #define IMAGE_SCN_MEM_EXECUTE               0x20000000
  96. #define IMAGE_SCN_MEM_READ                  0x40000000
  97. #define IMAGE_SCN_MEM_WRITE                 0x80000000
  101.     /* STRUCTURES */
  105. typedef struct {
  106.     uint16_t    e_magic;
  107.     uint16_t    e_cblp;
  108.     uint16_t    e_cp;
  109.     uint16_t    e_crlc;
  110.     uint16_t    e_cparhdr;
  111.     uint16_t    e_minalloc;
  112.     uint16_t    e_maxalloc;
  113.     uint16_t    e_ss;
  114.     uint16_t    e_sp;
  115.     uint16_t    e_csum;
  116.     uint16_t    e_ip;
  117.     uint16_t    e_cs;
  118.     uint16_t    e_lfarlc;
  119.     uint16_t    e_ovno;
  120.     uint16_t    e_res[4];
  121.     uint16_t    e_oemid;
  122.     uint16_t    e_oeminfo;
  123.     uint16_t    e_res2[10];
  124.     int32_t     e_lfanew;
  125. } IMAGE_DOS;
  127. typedef struct {
  128.     uint16_t    Machine;
  129.     uint16_t    NumberOfSections;
  130.     uint32_t    TimeDateStamp;
  131.     uint32_t    PointerToSymbolTable;
  132.     uint32_t    NumberOfSymbols;
  133.     uint16_t    SizeOfOptionalHeader;
  134.     uint16_t    Characteristics;
  135. } IMAGE_FILE;
  137. typedef struct {
  138.     uint32_t    VirtualAddress;
  139.     uint32_t    Size;
  140. } IMAGE_DATA_DIRECTORY;
  142. typedef struct {
  143.     uint16_t    Magic;
  144.     uint8_t     MajorLinkerVersion;
  145.     uint8_t     MinorLinkerVersion;
  146.     uint32_t    SizeOfCode;
  147.     uint32_t    SizeOfInitializedData;
  148.     uint32_t    SizeOfUninitializedData;
  149.     uint32_t    AddressOfEntryPoint;
  150.     uint32_t    BaseOfCode;
  151.     uint32_t    BaseOfData;
  152.     uint32_t    ImageBase;
  153.     uint32_t    SectionAlignment;
  154.     uint32_t    FileAlignment;
  155.     uint16_t    MajorOperatingSystemVersion;
  156.     uint16_t    MinorOperatingSystemVersion;
  157.     uint16_t    MajorImageVersion;
  158.     uint16_t    MinorImageVersion;
  159.     uint16_t    MajorSubsystemVersion;
  160.     uint16_t    MinorSubsystemVersion;
  161.     uint32_t    Win32VersionValue;
  162.     uint32_t    SizeOfImage;
  163.     uint32_t    SizeOfHeaders;
  164.     uint32_t    CheckSum;
  165.     uint16_t    Subsystem;
  166.     uint16_t    DllCharacteristics;
  167.     uint32_t    SizeOfStackReserve;
  168.     uint32_t    SizeOfStackCommit;
  169.     uint32_t    SizeOfHeapReserve;
  170.     uint32_t    SizeOfHeapCommit;
  171.     uint32_t    LoaderFlags;
  172.     uint32_t    NumberOfRvaAndSizes;
  173.     IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
  174. } IMAGE_OPTIONAL32;
  176. #define PE_DIR_ExportTable  DataDirectory[0]
  177. #define PE_DIR_ImportTable  DataDirectory[1]
  178. #define PE_DIR_Resource     DataDirectory[2]
  179. #define PE_DIR_Exception    DataDirectory[3]
  180. #define PE_DIR_Security     DataDirectory[4]
  181. #define PE_DIR_Relocation   DataDirectory[5]
  182. #define PE_DIR_Debug        DataDirectory[6]
  183. #define PE_DIR_Copyright    DataDirectory[7]
  184. #define PE_DIR_GlobalPtr    DataDirectory[8]
  185. #define PE_DIR_TLSTable     DataDirectory[9]
  186. #define PE_DIR_LoadConfig   DataDirectory[10]
  187. #define PE_DIR_BoundImport  DataDirectory[11]
  188. #define PE_DIR_IAT          DataDirectory[12]
  189. #define PE_DIR_DelayImport  DataDirectory[13]
  190. #define PE_DIR_COM          DataDirectory[14]
  191. #define PE_DIR_Reserved     DataDirectory[15]
  193. typedef struct {
  194.     uint8_t     Name[IMAGE_SIZEOF_SHORT_NAME];
  195.     union {
  196.         uint32_t    PhysicalAddress;
  197.         uint32_t    VirtualSize;
  198.     } Misc;
  199.     uint32_t    VirtualAddress;
  200.     uint32_t    SizeOfRawData;
  201.     uint32_t    PointerToRawData;
  202.     uint32_t    PointerToRelocations;
  203.     uint32_t    PointerToLinenumbers;
  204.     uint16_t    NumberOfRelocations;
  205.     uint16_t    NumberOfLinenumbers;
  206.     uint32_t    Characteristics;
  207. } IMAGE_SECTION_HEADER;
  211.     /* GLOBAL VARIABLES */
  215. uint32_t    PE_align            = 0x1000,
  216.             PE_sections         = 0,
  217.             PE_size_code    = 0,
  218.             PE_entry_point      = 0,
  219.             PE_base_code        = 0x00001000,
  220.             PE_image_base       = 0,
  221.             PE_size_image       = 0,
  222.             PE_Characteristics  = 0,
  223.             PE_virtual_size     = 0,
  224.             PE_file_offset      = 0,
  225.             PE_raw_size         = 0,
  226.             PE_rva              = 0,
  227.             PE_export_rva       = 0,
  228.             PE_export_size      = 0,
  229.             PE_import_rva       = 0,
  230.             PE_import_size      = 0,
  231.             PE_iat_rva          = 0,
  232.             PE_iat_size         = 0,
  233.             PE_resource_rva     = 0,
  234.             PE_resource_size    = 0;
  235. uint8_t     PE_section_name[IMAGE_SIZEOF_SHORT_NAME];
  239.     /* FUNCTIONS */
  243. void PE_dos_fwrite(FILE *fd) {
  244.     IMAGE_DOS               hdr;
  245.     const static uint8_t dosdata[64] =
  246.         "\x0E\x1F\xBA\x0E\x00\xB4\x09\xCD\x21\xB8\x01\x4C\xCD\x21\x54\x68"
  247.         "\x69\x73\x20\x70\x72\x6F\x67\x72\x61\x6D\x20\x63\x61\x6E\x6E\x6F"
  248.         "\x74\x20\x62\x65\x20\x72\x75\x6E\x20\x69\x6E\x20\x44\x4F\x53\x20"
  249.         "\x6D\x6F\x64\x65\x2E\x0D\x0D\x0A\x24\x00\x00\x00\x00\x00\x00\x00";
  251.     memset(&hdr, 0, sizeof(hdr));
  253.     hdr.e_magic                     = IMAGE_DOS_SIGNATURE;
  254.     hdr.e_cblp                      = 0x0090;
  255.     hdr.e_cp                        = 0x0003;
  256.     hdr.e_cparhdr                   = 0x0004;
  257.     hdr.e_maxalloc                  = 0xffff;
  258.     hdr.e_sp                        = 0x00b8;
  259.     hdr.e_lfarlc                    = 0x0040;
  260.     hdr.e_lfanew                    = sizeof(hdr) + sizeof(dosdata);
  262.     fwrite(&hdr,     sizeof(hdr),     1, fd);
  263.     fwrite(&dosdata, sizeof(dosdata), 1, fd);
  264. }
  268. void PE_sign_fwrite(FILE *fd) {
  269.     uint32_t                hdr;
  271.     hdr = IMAGE_NT_SIGNATURE;
  273.     fwrite(&hdr,     sizeof(hdr),     1, fd);
  274. }
  278. void PE_file_fwrite(FILE *fd) {
  279.     IMAGE_FILE              hdr;
  281.     memset(&hdr, 0, sizeof(hdr));
  283.     hdr.Machine                     = IMAGE_FILE_MACHINE_I386;
  284.     hdr.NumberOfSections            = PE_sections;
  285.     hdr.SizeOfOptionalHeader        = sizeof(IMAGE_OPTIONAL32);
  286.     hdr.Characteristics             = PE_Characteristics;
  288.     fwrite(&hdr,     sizeof(hdr),     1, fd);
  289. }
  293. void PE_optional_fwrite(FILE *fd) {
  294.     IMAGE_OPTIONAL32        hdr;
  296.     memset(&hdr, 0, sizeof(hdr));
  298.     hdr.Magic                       = IMAGE_NT_OPTIONAL_HDR32_MAGIC;
  299.     hdr.SizeOfCode                  = PE_size_code;
  300.     hdr.SizeOfInitializedData       = PE_size_image - PE_size_code;
  301.     hdr.AddressOfEntryPoint         = PE_entry_point;
  302.     hdr.BaseOfCode                  = PE_base_code;
  303.     hdr.ImageBase                   = PE_image_base;
  304.     hdr.SectionAlignment            = PE_align;
  305.     hdr.FileAlignment               = PE_align;
  306.     hdr.MajorOperatingSystemVersion = 4;
  307.     hdr.MajorSubsystemVersion       = 4;
  308.     hdr.SizeOfImage                 = PE_size_image;
  309.     hdr.SizeOfHeaders               = PE_base_code;
  310.     hdr.Subsystem                   = IMAGE_SUBSYSTEM_WINDOWS_GUI;
  311.     hdr.SizeOfStackReserve          = 0x00100000;
  312.     hdr.SizeOfStackCommit           = 0x00001000;
  313.     hdr.SizeOfHeapReserve           = 0x00100000;
  314.     hdr.SizeOfHeapCommit            = 0x00001000;
  315.     hdr.NumberOfRvaAndSizes         = IMAGE_NUMBEROF_DIRECTORY_ENTRIES;
  317.     hdr.PE_DIR_ExportTable.VirtualAddress   = PE_export_rva;
  318.     hdr.PE_DIR_ExportTable.Size             = PE_export_size;
  319.     hdr.PE_DIR_ImportTable.VirtualAddress   = PE_import_rva;
  320.     hdr.PE_DIR_ImportTable.Size             = PE_import_size;
  321.     hdr.PE_DIR_Resource.VirtualAddress      = PE_resource_rva;
  322.     hdr.PE_DIR_Resource.Size                = PE_resource_size;
  324.     fwrite(&hdr,     sizeof(hdr),     1, fd);
  325. }
  329. void PE_section_fwrite(FILE *fd) {
  330.     IMAGE_SECTION_HEADER    hdr;
  332.     memset(&hdr, 0, sizeof(hdr));
  334.     strncpy(hdr.Name, PE_section_name, sizeof(hdr.Name));
  335.     hdr.Misc.VirtualSize            = PE_virtual_size;
  336.     hdr.VirtualAddress              = PE_rva - PE_image_base;
  337.     hdr.SizeOfRawData               = PE_raw_size;
  338.     hdr.PointerToRawData            = PE_file_offset;
  339.     hdr.Characteristics             = PE_Characteristics;
  341.     fwrite(&hdr,     sizeof(hdr),     1, fd);
  342. }

thanks in advance,

vs49688

Member Avatar
Light Poster
48 posts since Dec 2007
Reputation Points: 10
Solved Threads: 1
Skill Endorsements: 0
 
0
 
4 Years Ago

is nobody going to help. I really need to do this.

Member Avatar
Most Valuable Poster
10,263 posts since Oct 2006
Reputation Points: 4,155
Solved Threads: 416
Skill Endorsements: 22
•Moderator
• Featured
 
0
 
4 Years Ago

is nobody going to help. I really need to do this.

My best advice is to contact the original author ( Luigi Auriemma) about this. I'm not going to waste hours of work on this, when the OP (you) isn't showing any effort whatsoever.
Besides: this smells a bit to illegal for my taste

Member Avatar
Newbie Poster
2 posts since Aug 2009
Reputation Points: 10
Solved Threads: 0
Skill Endorsements: 0
 
0
 
4 Years Ago

Hello,

I've researched the cryptographic algorithm (needed it to fix a bug in hw.dll).

Here goes:

  1. Decryption algorithm:
  3. key = 'W'
  4. for all bytes:
  5.     new_byte = byte^key
  6.     key += new_byte+'W'
  8. Encryption algorithm:
  10. key = 'W'
  11. for all bytes:
  12.     new_byte = byte^key
  13.     key += byte^'W'

For people interested in (fixing) the hw.dll bug; it's the bug where, on systems with more than 2147483647 (2^31-1) bytes of RAM, Half-Life exits with the error message "Available memory less than 15MB!!!".

To fix this bug, I decrypted hw.dll, then patched the opcode at offset 0xB5464:

  1. From:
  2. 3D 00 00 F0 00: cmp eax, 0xF00000
  3. A3 B4 14 80 02: mov [0x28014B4], eax
  4. 7D 12:          jge 0xB5478          ; Bug. We should ignore the OF (overflow flag).
  6. To:
  7. 3D 00 00 F0 00: cmp eax, 0xF00000
  8. A3 B4 14 80 02: mov [0x28014B4], eax
  9. 73 12:          jnb 0xB5478          ; Patched. Ignores the OF (overflow flag).

...and then encrypted the DLL again using the aforementioned algorithm.

I've hosted the encryption/decryption source code for the algorithm over here:
http://my-svn.assembla.com/svn/slipstream/valve_crypt/
(I figure source code is just a description of the inner workings, so as long as I distribute only information instead of binaries, there should be no legal issues.)

Jelle Geerts

You
This article has been dead for over three months: Start a new discussion instead
Post: Markdown Formatting Help
Software Development > C
Start New Discussion
High-performance Wi-Fi Solutions For Education. Download A Free Infopack Now.
Tags Related to this Article