I ask for help in decrypting KMS.

[korBeginnerDev]

Hi. First of all, I apologize for my inexperienced English skills.
I am a novice developer who wants to develop KMS 1.2.41 based on Eric`s shared OrionAlpha.
I analyzed the localhost through IDA. However, packets keep coming in strangely and erros occur.

The data below is the source analyzed and coded as I understood.
Is there something I misunderstood, coded, or fixed less?

(We are sorry that the indentation has disappeared and it is inconvenient to see the copy.)

In fact, I saw the 1.2.41 pack that was already shared, but even if I lack a lot,
I want to implement it with my own strength.
However, because I am lacking a lot, I ask questions like this. I`m sorry.

IGCipher.java

public static byte[] keys = { (byte) 0xEC, (byte) 0x30, (byte) 0x76, (byte) 0x01, (byte) 0x45, (byte) 0xD0, (byte) 0x72, (byte) 0xBF, (byte) 0xB7, (byte) 0x98, (byte) 0x20, (byte) 0xFC, (byte) 0x4B, (byte) 0xE9, (byte) 0xB3, (byte) 0xAD, (byte) 0x5C, (byte) 0x22, (byte) 0xF7, (byte) 0x0C, (byte) 0x42, (byte) 0x13, (byte) 0x81, (byte) 0xBD, (byte) 0x63, (byte) 0x8D, (byte) 0xD4, (byte) 0xC3, (byte) 0xF2, (byte) 0x10, (byte) 0x19, (byte) 0xE0, (byte) 0xFB, (byte) 0xA1, (byte) 0x6E, (byte) 0x66, (byte) 0xEA, (byte) 0xAE, (byte) 0xD6, (byte) 0xCE, (byte) 0x06, (byte) 0x18, (byte) 0x4E, (byte) 0xEB, (byte) 0x78, (byte) 0x95, (byte) 0xDB, (byte) 0xBA, (byte) 0xB6, (byte) 0x42, (byte) 0x7A, (byte) 0x2A, (byte) 0x83, (byte) 0x0B, (byte) 0x54, (byte) 0x67, (byte) 0x6D, (byte) 0xE8, (byte) 0x65, (byte) 0xE7, (byte) 0x2F, (byte) 0x07, (byte) 0xF3, (byte) 0xAA, (byte) 0x27, (byte) 0x7B, (byte) 0x85, (byte) 0xB0, (byte) 0x26, (byte) 0xFD, (byte) 0xBB, (byte) 0xA9, (byte) 0xFA, (byte) 0xBE, (byte) 0xA8, (byte) 0xD7, (byte) 0xCB, (byte) 0xCC, (byte) 0x92, (byte) 0xDA, (byte) 0xF9, (byte) 0x93, (byte) 0x60, (byte) 0x2D, (byte) 0xDD, (byte) 0xD2, (byte) 0xA2, (byte) 0x9B, (byte) 0x39, (byte) 0x5F, (byte) 0x82, (byte) 0x21, (byte) 0x4C, (byte) 0x69, (byte) 0xF8, (byte) 0x31, (byte) 0x87, (byte) 0xEE, (byte) 0x8E, (byte) 0xAD, (byte) 0x8C, (byte) 0x6A, (byte) 0xBC, (byte) 0xB5, (byte) 0x6B, (byte) 0x59, (byte) 0x13, (byte) 0xF1, (byte) 0x04, (byte) 0x00, (byte) 0xF6, (byte) 0x5A, (byte) 0x35, (byte) 0x79, (byte) 0x48, (byte) 0x8F, (byte) 0x15, (byte) 0xCD, (byte) 0x97, (byte) 0x57, (byte) 0x12, (byte) 0x3E, (byte) 0x37, (byte) 0xFF, (byte) 0x9D, (byte) 0x4F, (byte) 0x51, (byte) 0xF5, (byte) 0xA3, (byte) 0x70, (byte) 0xBB, (byte) 0x14, (byte) 0x75, (byte) 0xC2, (byte) 0xB8, (byte) 0x72, (byte) 0xC0, (byte) 0xED, (byte) 0x7D, (byte) 0x68, (byte) 0xC9, (byte) 0x2E, (byte) 0x0D, (byte) 0x62, (byte) 0x46, (byte) 0x17, (byte) 0x11, (byte) 0x4D, (byte) 0x6C, (byte) 0xC4, (byte) 0x7E, (byte) 0x53, (byte) 0xC1, (byte) 0x25, (byte) 0xC7, (byte) 0x9A, (byte) 0x1C, (byte) 0x88, (byte) 0x58, (byte) 0x2C, (byte) 0x89, (byte) 0xDC, (byte) 0x02, (byte) 0x64, (byte) 0x40, (byte) 0x01, (byte) 0x5D, (byte) 0x38, (byte) 0xA5, (byte) 0xE2, (byte) 0xAF, (byte) 0x55, (byte) 0xD5, (byte) 0xEF, (byte) 0x1A, (byte) 0x7C, (byte) 0xA7, (byte) 0x5B, (byte) 0xA6, (byte) 0x6F, (byte) 0x86, (byte) 0x9F, (byte) 0x73, (byte) 0xE6, (byte) 0x0A, (byte) 0xDE, (byte) 0x2B, (byte) 0x99, (byte) 0x4A, (byte) 0x47, (byte) 0x9C, (byte) 0xDF, (byte) 0x09, (byte) 0x76, (byte) 0x9E, (byte) 0x30, (byte) 0x0E, (byte) 0xE4, (byte) 0xB2, (byte) 0x94, (byte) 0xA0, (byte) 0x3B, (byte) 0x34, (byte) 0x1D, (byte) 0x28, (byte) 0x0F, (byte) 0x36, (byte) 0xE3, (byte) 0x23, (byte) 0xB4, (byte) 0x03, (byte) 0xD8, (byte) 0x90, (byte) 0xC8, (byte) 0x3C, (byte) 0xFE, (byte) 0x5E, (byte) 0x32, (byte) 0x24, (byte) 0x50, (byte) 0x1F, (byte) 0x3A, (byte) 0x43, (byte) 0x8A, (byte) 0x96, (byte) 0x41, (byte) 0x74, (byte) 0xAC, (byte) 0x52, (byte) 0x33, (byte) 0xF0, (byte) 0xD9, (byte) 0x29, (byte) 0x80, (byte) 0xB1, (byte) 0x16, (byte) 0xD3, (byte) 0xAB, (byte) 0x91, (byte) 0xB9, (byte) 0x84, (byte) 0x7F, (byte) 0x61, (byte) 0x1E, (byte) 0xCF, (byte) 0xC5, (byte) 0xD1, (byte) 0x56, (byte) 0x3D, (byte) 0xCA, (byte) 0xF4, (byte) 0x05, (byte) 0xC6, (byte) 0xE5, (byte) 0x08, (byte) 0x49 };

public static byte[] getDefaultKeys() {
ByteBuffer buffer = ByteBuffer.allocate(4);
buffer.putInt(-967814158); //Default Key.
buffer.order(ByteOrder.BIG_ENDIAN);
return buffer.array();
}

public static byte[] innoDecrypt(XORCrypter cipher, int dataLen, byte[] innoHash) {
byte[] v4 = innoHash;
byte[] v9 = getDefaultKeys();
if (innoHash.length <= 0)
v4 = v9;

byte[] result = new byte[dataLen];

if (dataLen > 0) {
for (int i = 0; i < dataLen; i++) {
int v7 = (v4 ^ keys[innoHash[0]]) & 0xFF;
int v8 = ((v7 >> 1) & 0xFF & 0x55 | 2 * (v7 & 0xD5)) & 0xFF;
innoHash = (byte) (0x10 * v8 | (v8 >> 4));
result = MorphKey(v4, (0x10 * v8 | (v8 >> 4)));
}
}
return result;
}

public static byte[] innoHash(byte[] buffer, int dataLen, byte[] keys) {
byte[] v3 = keys;
int v4 = 0;
if (keys == null) { //if (!a3)
v3 = getDefaultKeys(); //v3 = &-967814158;
}

if (dataLen > 0) {//if (a2 > 0)
do {
MorphKey(v3, buffer[v4++]);
} while (v4 < dataLen);
}
return v3;
}

public static byte[] MorphKey(byte[] buffer, int key) {
key = key & 0xFF; //key = buffer[v4++] & 0xFF, byte to int.
int v3 = buffer[1] & 0xFF; //byte to int.
buffer[0] += keys[v3] - key;
buffer[1] = (byte) (v3 - (keys[key] ^ buffer[2]));
int v4 = buffer[3] & 0xFF;
int v5 = v4;
int v6 = (v4 - buffer[0]) & 0xFF;
buffer[2] ^= key + keys[v5];
buffer[3] = (byte) (keys[key] + v6);
buffer[0] = (byte) (8 * buffer[0] | (buffer[0] >> 29));
return buffer;
}

Existing InPacket.java, dataLen part of appendBuffer function.

dataLen = decodeShort () → dataLen = rawSeq ^ decodeShort ();

 

[korBeginnerDev]

I coded as I analyzed and tried. I`m still new to assembly and pointer arithmetic in C, but I`m trying.
Below is the code I wrote. But it doesn`t work. Please let me know if there is anything I am missing. Please.

InPacket.java

src = cipher.decrypt(src); -> src = IGCipher.innoDecrypt(this, src, IGCipher.innoHash(src, 4, null));

IGCipher.java (The newly created class.)

@getDefaultKey

public static byte[] getDefaultKey(int defaultKey) {
ByteBuffer buffer = ByteBuffer.allocate(Integer.BYTES);
buffer.putInt(defaultKey);
return buffer.array();
}

MorphKey

public static byte[] MorphKey(byte[] a1, byte a2) {
int key = a2 & 0xFF;
byte[] result = a1;
int v3 = a1[1] & 0xFF;
result[0] += keys[v3] - key;
result[1] = (byte) (v3 - (keys[key] ^ result[2]));
int v4 = a1[3] & 0xFF;
int v5 = v4;
int v6 = (v4 - a1[0]) & 0xFF;
result[2] ^= key + keys[v5];
a1[3] = (byte) (keys[key] + v6);
a1[0] = (byte) (8 * a1[0] | (a1[0] >> 29));
return result;
}

@innoHash

public static byte[] innoHash(byte[] a1, int a2, byte[] a3) {
byte[] v3 = a3;
int v4 = 0;
int v6 = -967814158;
if (a3 == null || a3.length <= 0) {
v3 = getDefaultKey(v6);
}
if (a2 > 0) {
do {
MorphKey(v3, a1[v4++]);
} while (v4 < a2);
}
return v3;
}

@innoDecrypt

public static byte[] innoDecrypt(InPacket p, byte[] buffer, byte[] innoHash) {
byte[] v4 = innoHash;
int v9 = -967814158;
if (innoHash == null || innoHash.length <= 0) {
v4 = getDefaultKey(v9);
}
byte[] result = new byte[p.getDataLen()];
if (p.getDataLen() > 0) {
int i = 0;
byte[] v6 = buffer;
int v10 = p.getDataLen();
do {
int v7 = (v6 ^ keys[v4[0] & 0xFF]) & 0xFF;
int v8 = ((v7 >> 1) & 0x55 | 2 * (v7 & 0xD5)) & 0xFF;
v6 = (byte) (16 * v8 | (v8 >> 4));
result = MorphKey(v4, (byte) (16 * v8 | (v8 >> 4)));
++i;
--v10;
} while (v10 > 0);
}
return result;
}

@ivKeys

public static final byte[] keys = { (byte) 0xEC, (byte) 0x30, (byte) 0x76, (byte) 0x01, (byte) 0x45, (byte) 0xD0, (byte) 0x72, (byte) 0xBF, (byte) 0xB7, (byte) 0x98, (byte) 0x20, (byte) 0xFC, (byte) 0x4B, (byte) 0xE9, (byte) 0xB3, (byte) 0xAD, (byte) 0x5C, (byte) 0x22, (byte) 0xF7, (byte) 0x0C, (byte) 0x42, (byte) 0x13, (byte) 0x81, (byte) 0xBD, (byte) 0x63, (byte) 0x8D, (byte) 0xD4, (byte) 0xC3, (byte) 0xF2, (byte) 0x10, (byte) 0x19, (byte) 0xE0, (byte) 0xFB, (byte) 0xA1, (byte) 0x6E, (byte) 0x66, (byte) 0xEA, (byte) 0xAE, (byte) 0xD6, (byte) 0xCE, (byte) 0x06, (byte) 0x18, (byte) 0x4E, (byte) 0xEB, (byte) 0x78, (byte) 0x95, (byte) 0xDB, (byte) 0xBA, (byte) 0xB6, (byte) 0x42, (byte) 0x7A, (byte) 0x2A, (byte) 0x83, (byte) 0x0B, (byte) 0x54, (byte) 0x67, (byte) 0x6D, (byte) 0xE8, (byte) 0x65, (byte) 0xE7, (byte) 0x2F, (byte) 0x07, (byte) 0xF3, (byte) 0xAA, (byte) 0x27, (byte) 0x7B, (byte) 0x85, (byte) 0xB0, (byte) 0x26, (byte) 0xFD, (byte) 0xBB, (byte) 0xA9, (byte) 0xFA, (byte) 0xBE, (byte) 0xA8, (byte) 0xD7, (byte) 0xCB, (byte) 0xCC, (byte) 0x92, (byte) 0xDA, (byte) 0xF9, (byte) 0x93, (byte) 0x60, (byte) 0x2D, (byte) 0xDD, (byte) 0xD2, (byte) 0xA2, (byte) 0x9B, (byte) 0x39, (byte) 0x5F, (byte) 0x82, (byte) 0x21, (byte) 0x4C, (byte) 0x69, (byte) 0xF8, (byte) 0x31, (byte) 0x87, (byte) 0xEE, (byte) 0x8E, (byte) 0xAD, (byte) 0x8C, (byte) 0x6A, (byte) 0xBC, (byte) 0xB5, (byte) 0x6B, (byte) 0x59, (byte) 0x13, (byte) 0xF1, (byte) 0x04, (byte) 0x00, (byte) 0xF6, (byte) 0x5A, (byte) 0x35, (byte) 0x79, (byte) 0x48, (byte) 0x8F, (byte) 0x15, (byte) 0xCD, (byte) 0x97, (byte) 0x57, (byte) 0x12, (byte) 0x3E, (byte) 0x37, (byte) 0xFF, (byte) 0x9D, (byte) 0x4F, (byte) 0x51, (byte) 0xF5, (byte) 0xA3, (byte) 0x70, (byte) 0xBB, (byte) 0x14, (byte) 0x75, (byte) 0xC2, (byte) 0xB8, (byte) 0x72, (byte) 0xC0, (byte) 0xED, (byte) 0x7D, (byte) 0x68, (byte) 0xC9, (byte) 0x2E, (byte) 0x0D, (byte) 0x62, (byte) 0x46, (byte) 0x17, (byte) 0x11, (byte) 0x4D, (byte) 0x6C, (byte) 0xC4, (byte) 0x7E, (byte) 0x53, (byte) 0xC1, (byte) 0x25, (byte) 0xC7, (byte) 0x9A, (byte) 0x1C, (byte) 0x88, (byte) 0x58, (byte) 0x2C, (byte) 0x89, (byte) 0xDC, (byte) 0x02, (byte) 0x64, (byte) 0x40, (byte) 0x01, (byte) 0x5D, (byte) 0x38, (byte) 0xA5, (byte) 0xE2, (byte) 0xAF, (byte) 0x55, (byte) 0xD5, (byte) 0xEF, (byte) 0x1A, (byte) 0x7C, (byte) 0xA7, (byte) 0x5B, (byte) 0xA6, (byte) 0x6F, (byte) 0x86, (byte) 0x9F, (byte) 0x73, (byte) 0xE6, (byte) 0x0A, (byte) 0xDE, (byte) 0x2B, (byte) 0x99, (byte) 0x4A, (byte) 0x47, (byte) 0x9C, (byte) 0xDF, (byte) 0x09, (byte) 0x76, (byte) 0x9E, (byte) 0x30, (byte) 0x0E, (byte) 0xE4, (byte) 0xB2, (byte) 0x94, (byte) 0xA0, (byte) 0x3B, (byte) 0x34, (byte) 0x1D, (byte) 0x28, (byte) 0x0F, (byte) 0x36, (byte) 0xE3, (byte) 0x23, (byte) 0xB4, (byte) 0x03, (byte) 0xD8, (byte) 0x90, (byte) 0xC8, (byte) 0x3C, (byte) 0xFE, (byte) 0x5E, (byte) 0x32, (byte) 0x24, (byte) 0x50, (byte) 0x1F, (byte) 0x3A, (byte) 0x43, (byte) 0x8A, (byte) 0x96, (byte) 0x41, (byte) 0x74, (byte) 0xAC, (byte) 0x52, (byte) 0x33, (byte) 0xF0, (byte) 0xD9, (byte) 0x29, (byte) 0x80, (byte) 0xB1, (byte) 0x16, (byte) 0xD3, (byte) 0xAB, (byte) 0x91, (byte) 0xB9, (byte) 0x84, (byte) 0x7F, (byte) 0x61, (byte) 0x1E, (byte) 0xCF, (byte) 0xC5, (byte) 0xD1, (byte) 0x56, (byte) 0x3D, (byte) 0xCA, (byte) 0xF4, (byte) 0x05, (byte) 0xC6, (byte) 0xE5, (byte) 0x08, (byte) 0x49 };

Maybe the cause this problem is that I use SeqRcv, SeqSnd written by Eric as it is?

 

[korBeginnerDev]

Eventually I solved this problem myself. Thanks to Ragezone for always giving a lot of knowledge.In particular, I am grateful for Eric`s outstanding knowledge that always reminds me of new knowledge.