[Delphi - Source] Generate ResourceGuard file checksum

[mauka]

unit uCRS;

interface

const
  CSR_KEY: array [0 .. 1023] of Byte =
   ($00, $00, $00, $00, $96, $30, $07, $77, $2C, $61, $0E, $EE,
    $BA, $51, $09, $99, $19, $C4, $6D, $07, $8F, $F4, $6A, $70, $35, $A5, $63,
    $E9, $A3, $95, $64, $9E, $32, $88, $DB, $0E, $A4, $B8, $DC, $79, $1E, $E9,
    $D5, $E0, $88, $D9, $D2, $97, $2B, $4C, $B6, $09, $BD, $7C, $B1, $7E, $07,
    $2D, $B8, $E7, $91, $1D, $BF, $90, $64, $10, $B7, $1D, $F2, $20, $B0, $6A,
    $48, $71, $B9, $F3, $DE, $41, $BE, $84, $7D, $D4, $DA, $1A, $EB, $E4, $DD,
    $6D, $51, $B5, $D4, $F4, $C7, $85, $D3, $83, $56, $98, $6C, $13, $C0, $A8,
    $6B, $64, $7A, $F9, $62, $FD, $EC, $C9, $65, $8A, $4F, $5C, $01, $14, $D9,
    $6C, $06, $63, $63, $3D, $0F, $FA, $F5, $0D, $08, $8D, $C8, $20, $6E, $3B,
    $5E, $10, $69, $4C, $E4, $41, $60, $D5, $72, $71, $67, $A2, $D1, $E4, $03,
    $3C, $47, $D4, $04, $4B, $FD, $85, $0D, $D2, $6B, $B5, $0A, $A5, $FA, $A8,
    $B5, $35, $6C, $98, $B2, $42, $D6, $C9, $BB, $DB, $40, $F9, $BC, $AC, $E3,
    $6C, $D8, $32, $75, $5C, $DF, $45, $CF, $0D, $D6, $DC, $59, $3D, $D1, $AB,
    $AC, $30, $D9, $26, $3A, $00, $DE, $51, $80, $51, $D7, $C8, $16, $61, $D0,
    $BF, $B5, $F4, $B4, $21, $23, $C4, $B3, $56, $99, $95, $BA, $CF, $0F, $A5,
    $BD, $B8, $9E, $B8, $02, $28, $08, $88, $05, $5F, $B2, $D9, $0C, $C6, $24,
    $E9, $0B, $B1, $87, $7C, $6F, $2F, $11, $4C, $68, $58, $AB, $1D, $61, $C1,
    $3D, $2D, $66, $B6, $90, $41, $DC, $76, $06, $71, $DB, $01, $BC, $20, $D2,
    $98, $2A, $10, $D5, $EF, $89, $85, $B1, $71, $1F, $B5, $B6, $06, $A5, $E4,
    $BF, $9F, $33, $D4, $B8, $E8, $A2, $C9, $07, $78, $34, $F9, $00, $0F, $8E,
    $A8, $09, $96, $18, $98, $0E, $E1, $BB, $0D, $6A, $7F, $2D, $3D, $6D, $08,
    $97, $6C, $64, $91, $01, $5C, $63, $E6, $F4, $51, $6B, $6B, $62, $61, $6C,
    $1C, $D8, $30, $65, $85, $4E, $00, $62, $F2, $ED, $95, $06, $6C, $7B, $A5,
    $01, $1B, $C1, $F4, $08, $82, $57, $C4, $0F, $F5, $C6, $D9, $B0, $65, $50,
    $E9, $B7, $12, $EA, $B8, $BE, $8B, $7C, $88, $B9, $FC, $DF, $1D, $DD, $62,
    $49, $2D, $DA, $15, $F3, $7C, $D3, $8C, $65, $4C, $D4, $FB, $58, $61, $B2,
    $4D, $CE, $51, $B5, $3A, $74, $00, $BC, $A3, $E2, $30, $BB, $D4, $41, $A5,
    $DF, $4A, $D7, $95, $D8, $3D, $6D, $C4, $D1, $A4, $FB, $F4, $D6, $D3, $6A,
    $E9, $69, $43, $FC, $D9, $6E, $34, $46, $88, $67, $AD, $D0, $B8, $60, $DA,
    $73, $2D, $04, $44, $E5, $1D, $03, $33, $5F, $4C, $0A, $AA, $C9, $7C, $0D,
    $DD, $3C, $71, $05, $50, $AA, $41, $02, $27, $10, $10, $0B, $BE, $86, $20,
    $0C, $C9, $25, $B5, $68, $57, $B3, $85, $6F, $20, $09, $D4, $66, $B9, $9F,
    $E4, $61, $CE, $0E, $F9, $DE, $5E, $98, $C9, $D9, $29, $22, $98, $D0, $B0,
    $B4, $A8, $D7, $C7, $17, $3D, $B3, $59, $81, $0D, $B4, $2E, $3B, $5C, $BD,
    $B7, $AD, $6C, $BA, $C0, $20, $83, $B8, $ED, $B6, $B3, $BF, $9A, $0C, $E2,
    $B6, $03, $9A, $D2, $B1, $74, $39, $47, $D5, $EA, $AF, $77, $D2, $9D, $15,
    $26, $DB, $04, $83, $16, $DC, $73, $12, $0B, $63, $E3, $84, $3B, $64, $94,
    $3E, $6A, $6D, $0D, $A8, $5A, $6A, $7A, $0B, $CF, $0E, $E4, $9D, $FF, $09,
    $93, $27, $AE, $00, $0A, $B1, $9E, $07, $7D, $44, $93, $0F, $F0, $D2, $A3,
    $08, $87, $68, $F2, $01, $1E, $FE, $C2, $06, $69, $5D, $57, $62, $F7, $CB,
    $67, $65, $80, $71, $36, $6C, $19, $E7, $06, $6B, $6E, $76, $1B, $D4, $FE,
    $E0, $2B, $D3, $89, $5A, $7A, $DA, $10, $CC, $4A, $DD, $67, $6F, $DF, $B9,
    $F9, $F9, $EF, $BE, $8E, $43, $BE, $B7, $17, $D5, $8E, $B0, $60, $E8, $A3,
    $D6, $D6, $7E, $93, $D1, $A1, $C4, $C2, $D8, $38, $52, $F2, $DF, $4F, $F1,
    $67, $BB, $D1, $67, $57, $BC, $A6, $DD, $06, $B5, $3F, $4B, $36, $B2, $48,
    $DA, $2B, $0D, $D8, $4C, $1B, $0A, $AF, $F6, $4A, $03, $36, $60, $7A, $04,
    $41, $C3, $EF, $60, $DF, $55, $DF, $67, $A8, $EF, $8E, $6E, $31, $79, $BE,
    $69, $46, $8C, $B3, $61, $CB, $1A, $83, $66, $BC, $A0, $D2, $6F, $25, $36,
    $E2, $68, $52, $95, $77, $0C, $CC, $03, $47, $0B, $BB, $B9, $16, $02, $22,
    $2F, $26, $05, $55, $BE, $3B, $BA, $C5, $28, $0B, $BD, $B2, $92, $5A, $B4,
    $2B, $04, $6A, $B3, $5C, $A7, $FF, $D7, $C2, $31, $CF, $D0, $B5, $8B, $9E,
    $D9, $2C, $1D, $AE, $DE, $5B, $B0, $C2, $64, $9B, $26, $F2, $63, $EC, $9C,
    $A3, $6A, $75, $0A, $93, $6D, $02, $A9, $06, $09, $9C, $3F, $36, $0E, $EB,
    $85, $67, $07, $72, $13, $57, $00, $05, $82, $4A, $BF, $95, $14, $7A, $B8,
    $E2, $AE, $2B, $B1, $7B, $38, $1B, $B6, $0C, $9B, $8E, $D2, $92, $0D, $BE,
    $D5, $E5, $B7, $EF, $DC, $7C, $21, $DF, $DB, $0B, $D4, $D2, $D3, $86, $42,
    $E2, $D4, $F1, $F8, $B3, $DD, $68, $6E, $83, $DA, $1F, $CD, $16, $BE, $81,
    $5B, $26, $B9, $F6, $E1, $77, $B0, $6F, $77, $47, $B7, $18, $E6, $5A, $08,
    $88, $70, $6A, $0F, $FF, $CA, $3B, $06, $66, $5C, $0B, $01, $11, $FF, $9E,
    $65, $8F, $69, $AE, $62, $F8, $D3, $FF, $6B, $61, $45, $CF, $6C, $16, $78,
    $E2, $0A, $A0, $EE, $D2, $0D, $D7, $54, $83, $04, $4E, $C2, $B3, $03, $39,
    $61, $26, $67, $A7, $F7, $16, $60, $D0, $4D, $47, $69, $49, $DB, $77, $6E,
    $3E, $4A, $6A, $D1, $AE, $DC, $5A, $D6, $D9, $66, $0B, $DF, $40, $F0, $3B,
    $D8, $37, $53, $AE, $BC, $A9, $C5, $9E, $BB, $DE, $7F, $CF, $B2, $47, $E9,
    $FF, $B5, $30, $1C, $F2, $BD, $BD, $8A, $C2, $BA, $CA, $30, $93, $B3, $53,
    $A6, $A3, $B4, $24, $05, $36, $D0, $BA, $93, $06, $D7, $CD, $29, $57, $DE,
    $54, $BF, $67, $D9, $23, $2E, $7A, $66, $B3, $B8, $4A, $61, $C4, $02, $1B,
    $68, $5D, $94, $2B, $6F, $2A, $37, $BE, $0B, $B4, $A1, $8E, $0C, $C3, $1B,
    $DF, $05, $5A, $8D, $EF, $02, $2D);

implementation

end.

function GenCsrCheckSum (const Buffer: TBytes): DWORD;
var
 EBX_, ECX_: DWORD;
 AL, BL: Byte;
begin
 ECX_ := $FFFFFFFF;
 for BL in Buffer do
  begin
   AL := PByte(LongWord(Pointer(@ECX_)))^;
   AL := AL xor BL;

   ECX_ := ECX_ shr 8;
   EBX_ := PDWord(@CSR_KEY[(AL * 4)])^;
   ECX_ := ECX_ xor EBX_;
  end;
 Result := - (ECX_ -1);
end;

[MentaL]

[z5796644]

show me the offset plz

[mauka]

Edited out!

99% of all done ;)

function GenCsrCheckSum (const Buffer: TBytes): DWORD;
var
 EBX_, ECX_: DWORD;
 AL, BL: Byte;
begin
 ECX_ := $FFFFFFFF;
 for BL in Buffer do
  begin
   AL := PByte(LongWord(Pointer(@ECX_)))^;
   AL := AL xor BL;

   ECX_ := ECX_ shr 8;
   EBX_ := PDWord(@CSR_KEY[(AL * 4)])^;
   ECX_ := ECX_ xor EBX_;
  end;
 Result := - (ECX_ -1);
end;

no more fucking asm shit.. xD

[z5796644]

i can't read the fucking delphi code X_X

[mauka]

Well.. DWORD even in C++ are still DWORD

function GenCsrCheckSum (const Buffer: TBytes): DWORD

C++

 int GenCsrCheckSum (LPByte *src, int size)

AL := PByte(LongWord(Pointer(@ECX_)))^;

C++

AL = ((LPByte)ECX_)[0]

the rest is same..
Ps. i try write myself small shit in C++, but i not know good syntax

int GenCsrCheckSum (LPByte *Src, int Size)
{
 DWORD ECX_ = 0xFFFFFFFF;
 DWORD ECX_;
 BYTE AL;

 for ( int i = 0; i < Size; i++ )
 {
  AL = ((LPByte)ECX_)[0];
  AL = AL ^ Src[i]
 
  ECX_ = ECX_ >> 8;
  EBX_ = ((DWORD*)Src)[AL * 4];
  ECX_ = ECX_ ^ EBX_;
 }
 Return = - ECX_ 
}

i think in C++ its must be like this.. :)

  AL ^= Src[i]
 
  ECX_ = ECX_ >> 8;
  EBX_ = ((DWORD*)Src)[AL * 4];
  ECX_ ^=  EBX_;

PSSSS. this C++ crap is written in forum ;) the base idea is right, but as i dunno c++ syntax its may need some correction :))


OnTopic:
The keys in main.exe (CSR_KEY) note that keys are DWORD`s not byte ;)

Offset      0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

00927B10                            00 00 00 00 96 30 07 77               –0 w
00927B20   2C 61 0E EE BA 51 09 99  19 C4 6D 07 8F F4 6A 70   ,a īŗQ ™ Äm  ōjp
00927B30   35 A5 63 E9 A3 95 64 9E  32 88 DB 0E A4 B8 DC 79   5c飕d˛2ˆŪ ¤øÜy
00927B40   1E E9 D5 E0 88 D9 D2 97  2B 4C B6 09 BD 7C B1 7E    éÕąˆŁŅ—+L¶ ½|±~
00927B50   07 2D B8 E7 91 1D BF 90  64 10 B7 1D F2 20 B0 6A    -øē‘ æ d · ņ °j
00927B60   48 71 B9 F3 DE 41 BE 84  7D D4 DA 1A EB E4 DD 6D   Hq¹óŽA¾„}ŌŚ ėäŻm
00927B70   51 B5 D4 F4 C7 85 D3 83  56 98 6C 13 C0 A8 6B 64   QµŌōĒ…ӃV˜l ĄØkd
00927B80   7A F9 62 FD EC C9 65 8A  4F 5C 01 14 D9 6C 06 63   złbżģÉeŠO\  Łl c
00927B90   63 3D 0F FA F5 0D 08 8D  C8 20 6E 3B 5E 10 69 4C   c= śõ   Č n;^ iL
00927BA0   E4 41 60 D5 72 71 67 A2  D1 E4 03 3C 47 D4 04 4B   äA`Õrqg¢Ńä <GŌ K
00927BB0   FD 85 0D D2 6B B5 0A A5  FA A8 B5 35 6C 98 B2 42   ż… Ņkµ śØµ5l˜²B
00927BC0   D6 C9 BB DB 40 F9 BC AC  E3 6C D8 32 75 5C DF 45   ÖÉ»Ū@ł¼¬ćlŲ2u\ßE
00927BD0   CF 0D D6 DC 59 3D D1 AB  AC 30 D9 26 3A 00 DE 51   Ļ ÖÜY=Ń«¬0Ł&: ŽQ
00927BE0   80 51 D7 C8 16 61 D0 BF  B5 F4 B4 21 23 C4 B3 56   €Q×Č aŠæµō´!#ijV
00927BF0   99 95 BA CF 0F A5 BD B8  9E B8 02 28 08 88 05 5F   ™•ŗĻ ½ø˛ø ( ˆ _
00927C00   B2 D9 0C C6 24 E9 0B B1  87 7C 6F 2F 11 4C 68 58   ²Ł Ę$é ±‡|o/ LhX
00927C10   AB 1D 61 C1 3D 2D 66 B6  90 41 DC 76 06 71 DB 01   « aĮ=-f¶ AÜv qŪ 
00927C20   BC 20 D2 98 2A 10 D5 EF  89 85 B1 71 1F B5 B6 06   ¼ Ņ˜* Õļ‰…±q µ¶ 
00927C30   A5 E4 BF 9F 33 D4 B8 E8  A2 C9 07 78 34 F9 00 0F   äæŸ3Ōøč¢É x4ł  
00927C40   8E A8 09 96 18 98 0E E1  BB 0D 6A 7F 2D 3D 6D 08   ˇØ – ˜ į» j -=m 
00927C50   97 6C 64 91 01 5C 63 E6  F4 51 6B 6B 62 61 6C 1C   —ld‘ \cęōQkkbal 
00927C60   D8 30 65 85 4E 00 62 F2  ED 95 06 6C 7B A5 01 1B   Ų0e…N bņķ• l{  
00927C70   C1 F4 08 82 57 C4 0F F5  C6 D9 B0 65 50 E9 B7 12   Įō ‚WÄ õĘŁ°ePé· 
00927C80   EA B8 BE 8B 7C 88 B9 FC  DF 1D DD 62 49 2D DA 15   źø¾‹|ˆ¹üß ŻbI-Ś 
00927C90   F3 7C D3 8C 65 4C D4 FB  58 61 B2 4D CE 51 B5 3A   ó|ӌeLŌūXa²MĪQµ:
00927CA0   74 00 BC A3 E2 30 BB D4  41 A5 DF 4A D7 95 D8 3D   t ¼£ā0»ŌAßJוŲ=
00927CB0   6D C4 D1 A4 FB F4 D6 D3  6A E9 69 43 FC D9 6E 34   mÄѤūōÖÓjéiCüŁn4
00927CC0   46 88 67 AD D0 B8 60 DA  73 2D 04 44 E5 1D 03 33   Fˆg­Šø`Śs- Då  3
00927CD0   5F 4C 0A AA C9 7C 0D DD  3C 71 05 50 AA 41 02 27   _L ŖÉ| Ż<q PŖA '
00927CE0   10 10 0B BE 86 20 0C C9  25 B5 68 57 B3 85 6F 20      ¾†  É%µhW³…o 
00927CF0   09 D4 66 B9 9F E4 61 CE  0E F9 DE 5E 98 C9 D9 29    Ōf¹ŸäaĪ łŽ^˜ÉŁ)
00927D00   22 98 D0 B0 B4 A8 D7 C7  17 3D B3 59 81 0D B4 2E   "˜Š°´Ø×Ē =³Y  ´.
00927D10   3B 5C BD B7 AD 6C BA C0  20 83 B8 ED B6 B3 BF 9A   ;\½·­lŗĄ ƒøķ¶³æš
00927D20   0C E2 B6 03 9A D2 B1 74  39 47 D5 EA AF 77 D2 9D    ā¶ šŅ±t9GÕźÆwŅ 
00927D30   15 26 DB 04 83 16 DC 73  12 0B 63 E3 84 3B 64 94    &Ū ƒ Üs  cć„;d”
00927D40   3E 6A 6D 0D A8 5A 6A 7A  0B CF 0E E4 9D FF 09 93   >jm ØZjz Ļ ä ˙ “
00927D50   27 AE 00 0A B1 9E 07 7D  44 93 0F F0 D2 A3 08 87   '®  ±˛ }D“ šŅ£ ‡
00927D60   68 F2 01 1E FE C2 06 69  5D 57 62 F7 CB 67 65 80   hņ  žĀ i]Wb÷Ėge€
00927D70   71 36 6C 19 E7 06 6B 6E  76 1B D4 FE E0 2B D3 89   q6l ē knv Ōžą+Ó‰
00927D80   5A 7A DA 10 CC 4A DD 67  6F DF B9 F9 F9 EF BE 8E   ZzŚ ĢJŻgoß¹łłļ¾ˇ
00927D90   43 BE B7 17 D5 8E B0 60  E8 A3 D6 D6 7E 93 D1 A1   C¾· Õˇ°`č£ÖÖ~“Ń
00927DA0   C4 C2 D8 38 52 F2 DF 4F  F1 67 BB D1 67 57 BC A6   ÄĀŲ8RņßOńg»ŃgW¼¦
00927DB0   DD 06 B5 3F 4B 36 B2 48  DA 2B 0D D8 4C 1B 0A AF   Ż µ?K6²HŚ+ ŲL  Æ
00927DC0   F6 4A 03 36 60 7A 04 41  C3 EF 60 DF 55 DF 67 A8   öJ 6`z AĆļ`ßUßgØ
00927DD0   EF 8E 6E 31 79 BE 69 46  8C B3 61 CB 1A 83 66 BC   ļˇn1y¾iFŒ³aĖ ƒf¼
00927DE0   A0 D2 6F 25 36 E2 68 52  95 77 0C CC 03 47 0B BB    Ņo%6āhR•w Ģ G »
00927DF0   B9 16 02 22 2F 26 05 55  BE 3B BA C5 28 0B BD B2   ¹  "/& U¾;ŗÅ( ½²
00927E00   92 5A B4 2B 04 6A B3 5C  A7 FF D7 C2 31 CF D0 B5   ’Z´+ j³\§˙×Ā1ĻŠµ
00927E10   8B 9E D9 2C 1D AE DE 5B  B0 C2 64 9B 26 F2 63 EC   ‹˛Ł, ®Ž[°Ād›&ņcģ
00927E20   9C A3 6A 75 0A 93 6D 02  A9 06 09 9C 3F 36 0E EB   œ£ju “m ©  œ?6 ė
00927E30   85 67 07 72 13 57 00 05  82 4A BF 95 14 7A B8 E2   …g r W  ‚Jæ• zøā
00927E40   AE 2B B1 7B 38 1B B6 0C  9B 8E D2 92 0D BE D5 E5   ®+±{8 ¶ ›ˇŅ’ ¾Õå
00927E50   B7 EF DC 7C 21 DF DB 0B  D4 D2 D3 86 42 E2 D4 F1   ·ļÜ|!ßŪ ŌŅÓ†BāŌń
00927E60   F8 B3 DD 68 6E 83 DA 1F  CD 16 BE 81 5B 26 B9 F6   ų³ŻhnƒŚ Ķ ¾ [&¹ö
00927E70   E1 77 B0 6F 77 47 B7 18  E6 5A 08 88 70 6A 0F FF   įw°owG· ęZ ˆpj ˙
00927E80   CA 3B 06 66 5C 0B 01 11  FF 9E 65 8F 69 AE 62 F8   Ź; f\   ˙˛e i®bų
00927E90   D3 FF 6B 61 45 CF 6C 16  78 E2 0A A0 EE D2 0D D7   Ó˙kaEĻl xā  īŅ ×
00927EA0   54 83 04 4E C2 B3 03 39  61 26 67 A7 F7 16 60 D0   Tƒ NĀ³ 9a&g§÷ `Š
00927EB0   4D 47 69 49 DB 77 6E 3E  4A 6A D1 AE DC 5A D6 D9   MGiIŪwn>JjŃ®ÜZÖŁ
00927EC0   66 0B DF 40 F0 3B D8 37  53 AE BC A9 C5 9E BB DE   f ß@š;Ų7S®¼©Å˛»Ž
00927ED0   7F CF B2 47 E9 FF B5 30  1C F2 BD BD 8A C2 BA CA    Ļ²Gé˙µ0 ņ½½ŠĀŗŹ
00927EE0   30 93 B3 53 A6 A3 B4 24  05 36 D0 BA 93 06 D7 CD   0“³S¦£´$ 6Šŗ“ ×Ķ
00927EF0   29 57 DE 54 BF 67 D9 23  2E 7A 66 B3 B8 4A 61 C4   )WŽTægŁ#.zf³øJaÄ
00927F00   02 1B 68 5D 94 2B 6F 2A  37 BE 0B B4 A1 8E 0C C3     h]”+o*7¾ ´ˇ Ć
00927F10   1B DF 05 5A 8D EF 02 2D                             ß Z ļ -

[z5796644]

hmm,could you show me the asm ?

[mauka]

@00974610; GenCsrCheckSum

  PUSH EBP
  MOV EBP,ESP
  SUB ESP,0x8
  PUSH EBX
  PUSH ESI
  PUSH EDI
  MOV DWORD PTR SS:[EBP-0x8],ECX
  MOV EAX,DWORD PTR SS:[EBP+0xC]
  MOV DWORD PTR SS:[EBP-0x4],EAX
  PUSH ESI
  PUSH EDI
  MOV EAX,DWORD PTR SS:[EBP+0x10]
  MOV ECX,DWORD PTR DS:[EAX]
  MOV EBX,DWORD PTR SS:[EBP-0x8]
  MOV EDI,DWORD PTR DS:[EBX]
  MOV ESI,DWORD PTR SS:[EBP+0x8]
  MOV EBX,DWORD PTR SS:[EBP-0x4]
  LEA EDX,DWORD PTR DS:[ESI+EBX]
L018:
  XOR EAX,EAX
  MOV BL,BYTE PTR DS:[ESI]
  MOV AL,CL
  INC ESI
  XOR AL,BL
  SHR ECX,0x8
  MOV EBX,DWORD PTR DS:[EDI+EAX*0x4]
  XOR ECX,EBX
  CMP EDX,ESI
  JNZ L018
  POP EDI
  POP ESI
  MOV EAX,DWORD PTR SS:[EBP+0x10]
  MOV DWORD PTR DS:[EAX],ECX
  POP EDI
  POP ESI
  POP EBX
  MOV ESP,EBP
  POP EBP
  RETN 0xC

I think ppl dont understand this..
Well as u know there is 2 types of file checks
1 - self checksum of file
2 - additional check by resource guard

1 - i allready released, its BMDFixer

...
Edite out!
...

So after u edit BMD or any other file u update its checksum with BMD checksumGen func, but its will crash be cause of resource guard ;) coz miss mach of secondary file check checksum and this func gen a resourceguarded files checksum todo fully legal files ;) without cracking main.exe

[z5796644]

does it works?

[mauka]

It is ;) i`we checked checksum of GS and its read 1/2 of GameGuard.crs file
so last 1024 (in theory it could be checksum) but its not.

so its must be a crypted CSR_Keys, but they are constant to T_T
My OS is fucked and i cant load target in olly and debug it, only if atach then it works T_T_T_T_T

[z5796644]

00973CE0  /$  55                     push    ebp
00973CE1  |.  8BEC                   mov     ebp, esp
00973CE3  |.  83EC 20                sub     esp, 20
00973CE6  |.  8B45 0C                mov     eax, [arg.2]
00973CE9  |.  50                     push    eax                                       ; /DataSize
00973CEA  |.  8B4D 08                mov     ecx, [arg.1]                              ; |
00973CED  |.  51                     push    ecx                                       ; |DataAddress
00973CEE  |.  FF15 B401D200          call    dword ptr [<&KERNEL32.IsBadReadPtr>]      ; \IsBadReadPtr
00973CF4  |.  85C0                   test    eax, eax
00973CF6  |.  75 0F                  jnz     short 00973D07
00973CF8  |.  837D 0C 00             cmp     [arg.2], 0
00973CFC  |.  74 09                  je      short 00973D07
00973CFE  |.  817D 0C FFFFFFEF       cmp     [arg.2], EFFFFFFF
00973D05  |.  72 07                  jb      short 00973D0E
00973D07  |>  32C0                   xor     al, al
00973D09  |.  E9 DA000000            jmp     00973DE8
00973D0E  |>  8B55 08                mov     edx, [arg.1]
00973D11  |.  8955 F4                mov     [local.3], edx
00973D14  |.  8B45 0C                mov     eax, [arg.2]
00973D17  |.  C1E8 08                shr     eax, 8
00973D1A  |.  8945 F0                mov     [local.4], eax
00973D1D  |.  837D F0 00             cmp     [local.4], 0
00973D21  |.  7F 07                  jg      short 00973D2A
00973D23  |.  C745 F0 01000000       mov     [local.4], 1
00973D2A  |>  8B4D 0C                mov     ecx, [arg.2]
00973D2D  |.  81E1 FFFF0000          and     ecx, 0FFFF
00973D33  |.  8D9409 1000B71D        lea     edx, dword ptr [ecx+ecx+1DB70010]
00973D3A  |.  8955 FC                mov     [local.1], edx
00973D3D  |.  C745 F8 00000000       mov     [local.2], 0
00973D44  |.  C745 EC 00000000       mov     [local.5], 0
00973D4B  |.  EB 09                  jmp     short 00973D56
00973D4D  |>  8B45 EC                /mov     eax, [local.5]
00973D50  |.  83C0 01                |add     eax, 1
00973D53  |.  8945 EC                |mov     [local.5], eax
00973D56  |>  817D EC 00010000        cmp     [local.5], 100
00973D5D  |.  0F8D 83000000          |jge     00973DE6
00973D63  |.  C745 E8 00000000       |mov     [local.6], 0
00973D6A  |.  C745 E0 00000000       |mov     [local.8], 0
00973D71  |.  EB 12                  |jmp     short 00973D85
00973D73  |>  8B4D E0                |/mov     ecx, [local.8]
00973D76  |.  83C1 01                ||add     ecx, 1
00973D79  |.  894D E0                ||mov     [local.8], ecx
00973D7C  |.  8B55 F8                ||mov     edx, [local.2]
00973D7F  |.  83C2 01                ||add     edx, 1
00973D82  |.  8955 F8                ||mov     [local.2], edx
00973D85  |>  8B45 F8                | mov     eax, [local.2]
00973D88  |.  3B45 0C                ||cmp     eax, [arg.2]
00973D8B  |.  73 19                  ||jnb     short 00973DA6
00973D8D  |.  8B4D E0                ||mov     ecx, [local.8]
00973D90  |.  3B4D F0                ||cmp     ecx, [local.4]
00973D93  |.  7D 11                  ||jge     short 00973DA6
00973D95  |.  8B55 F4                ||mov     edx, [local.3]
00973D98  |.  0355 F8                ||add     edx, [local.2]
00973D9B  |.  0FB602                 ||movzx   eax, byte ptr [edx]
00973D9E  |.  0345 E8                ||add     eax, [local.6]
00973DA1  |.  8945 E8                ||mov     [local.6], eax
00973DA4  |.^ EB CD                  |\jmp     short 00973D73
00973DA6  |>  8B4D E8                |mov     ecx, [local.6]
00973DA9  |.  334D FC                |xor     ecx, [local.1]
00973DAC  |.  894D E4                |mov     [local.7], ecx
00973DAF  |.  8B45 E4                |mov     eax, [local.7]
00973DB2  |.  0345 EC                |add     eax, [local.5]
00973DB5  |.  33D2                   |xor     edx, edx
00973DB7  |.  B9 00010000            |mov     ecx, 100
00973DBC  |.  F7F1                   |div     ecx
00973DBE  |.  8B45 E4                |mov     eax, [local.7]
00973DC1  |.  330495 1063E600        |xor     eax, dword ptr [edx*4+E66310]
00973DC8  |.  8B4D EC                |mov     ecx, [local.5]
00973DCB  |.  8B55 10                |mov     edx, [arg.3]
00973DCE  |.  89448A 04              |mov     dword ptr [edx+ecx*4+4], eax
00973DD2  |.  8B45 EC                |mov     eax, [local.5]
00973DD5  |.  8B4D 10                |mov     ecx, [arg.3]
00973DD8  |.  8B5481 04              |mov     edx, dword ptr [ecx+eax*4+4]
00973DDC  |.  D1EA                   |shr     edx, 1
00973DDE  |.  8955 FC                |mov     [local.1], edx
00973DE1  |.^ E9 67FFFFFF            \jmp     00973D4D
00973DE6  |>  B0 01                  mov     al, 1
00973DE8  |>  8BE5                   mov     esp, ebp
00973DEA  |.  5D                     pop     ebp
00973DEB  \.  C3                     retn

this shit is right
check 0x00E66310
DWORD CSR_KEY[256] = 0x00E66310

[mauka]

Edited:
In this func its simply generate Array[0x100] of unsingned chars (last 1024 bytes from GG.csr)

Table GenRGChecksum (LPByte *key);

if its dont fail generate table of it, later its will recheck if its not <> GG.CSR Table ;)

mismatched from the RG checksum.

Last 0x100 Dwords are checksum of GuardedFiles[File_Count] ;)

 THdr = packed record
  Signature : DWORD;
  File_Count: DWORD;
  Table_Size: DWORD;
  Unk0, Unk1: DWORD;
 end;
 PHdr = ^THdr;

now left understand only header [20 bytes] of GG.crs file, i dont know last 2 dwords

[Didi2013]

THdr=packed record
Signature:DWord;//$4752
Count:DWord;
Size:DWord;//-16 -1024(last)
Checksum:DWord;
end;

Sizeof=16 bytes

[mauka]

No reason continue it reverse nor research.. There is released source of RG file generator (GameGuard.crs), far i remember its written in Phyton

[Didi2013]

No reason continue it reverse nor research.. There is released source of RG file generator (GameGuard.crs), far i remember its written in Phyton

thanks

- - - Updated - - -

No reason continue it reverse nor research.. There is released source of RG file generator (GameGuard.crs), far i remember its written in Phyton

File has expired and does not exist anymore on this server

- - - Updated - - -

File has expired and does not exist anymore on this server
File has expired and does not exist anymore on this server!!!

- - - Updated - - -

File has expired and does not exist anymore on this server

[mauka]

http://files.inbox.lv/ticket/b9c8ae403d342ef63351e96b87321b8d51e94873/musrcs.rar