51 lines
2.3 KiB
Python
51 lines
2.3 KiB
Python
import logging
|
|
|
|
from .. import glob
|
|
|
|
# Found @ addr 0x004C88E0
|
|
LOOKUP_TABLE = b"\xb4b\x07\xe5\x9d\xafc\xdd\xe3\xd0\xcc\xfe\xdc\xdbk.j@\xabG\xc9\xd1S\xd5 \x91\xa5\x0eJ\xdf\x18\x89\xfdo%\x12\xb7\x13w\x00e6mI\xecW*\xa9\x11_\xfax\x95\xa4\xbd\x1e\xd9yD\xcd\xde\x81\xeb\t>\xf6\xee\xda\x7f\xa3\x1a\xa7-\xa6\xad\xc1F\x93\xd2\x1b\x9c\xaa\xd7NKML\xf3\xb84\xc0\xca\x88\xf4\x94\xcb\x0490\x82\xd6s\xb0\xbf\"\x01AnH,\xa8u\xb1\n\xae\x9f\'\x80\x10\xce\xf0)(\x85\r\x05\xf75\xbb\xbc\x15\x06\xf5`q\x03\x1f\xeaZ3\x92\x8d\xe7\x90[\xe9\xcf\x9e\xd3]\xed1\x1c\x0bR\x16Q\x0f\x86\xc5h\x9b!\x0c\x8bB\x87\xffO\xbe\xc8\xe8\xc7\xd4z\xe0U/\x8a\x8e\xba\x987\xe4\xb28\xa1\xb62\x83:{\x84<a\xfb\x8c\x14=C;\x1d\xc3\xa2\x96\xb3\xf8\xc4\xf2&+\xd8|\xfc#$f\xefidPTY\xf1\xa0t\xac\xc6}\xb5\xe6\xe2\xc2~g\x17^\xe1\xb9?lp\x08\x99EVv\xf9\x9a\x97\x19r\\\x02\x8fX"
|
|
|
|
logger = logging.getLogger(__name__)
|
|
|
|
def uncompress(byteStream: bytes) -> bytearray:
|
|
"""Uncompress client packet.
|
|
This is actually a deobfuscation as there is no compression involved anymore
|
|
as zlib was removed and just swapped with this implementation after the leak.
|
|
|
|
Arguments:
|
|
byteStream {bytes} -- Bytes sent by client
|
|
"""
|
|
checksum, data = byteStream[0], bytearray(byteStream[1:])
|
|
|
|
data = xor_every_other_byte(get_port_xor_key(), data)
|
|
data = run_though_lookup_table(data)
|
|
|
|
if checksum != calc_checksum(data):
|
|
logger.error("Checksum failed!\n\tExpected: %d\n\tGot: %d" % (checksum, calc_checksum(data)))
|
|
raise Exception("Checksum failed!")
|
|
|
|
return data
|
|
|
|
def xor_every_other_byte(xor, byteStream: bytearray):
|
|
# xor: (server_port ^ 0xCCCC) & 0xFF
|
|
for i in range(1, len(byteStream), 2):
|
|
byteStream[i] = byteStream[i] ^ xor
|
|
return byteStream
|
|
|
|
def run_though_lookup_table(byteStream: bytes):
|
|
return bytearray([LOOKUP_TABLE[b] for b in byteStream])
|
|
|
|
def calc_checksum(byteStream: bytes):
|
|
checksum = 0
|
|
for i in range(len(byteStream)):
|
|
checksum = checksum ^ byteStream[i] & 0xAA
|
|
return checksum
|
|
|
|
# It should be faster to call a function and do an if, then to read the property of a dict and do bit operations after
|
|
_port_xor_key = None
|
|
def get_port_xor_key():
|
|
global _port_xor_key
|
|
if _port_xor_key is None:
|
|
_port_xor_key = (glob.config["port"] ^ 0xCCCC) & 0xFF
|
|
return _port_xor_key
|