/*
GS enctypeX servers list decoder/encoder 0.1.3b
by Luigi Auriemma
e-mail: aluigi@autistici.org
web: aluigi.org
This is the algorithm used by ANY new and old game which contacts the Gamespy master server.
It has been written for being used in gslist so there are no explanations or comments here,
if you want to understand something take a look to gslist.c
Copyright 2008-2012 Luigi Auriemma
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
http://www.gnu.org/licenses/gpl-2.0.txt
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <time.h>
#include <ctype.h>
typedef struct {
unsigned char encxkey[261]; // static key
int offset; // everything decrypted till now (total)
int start; // where starts the buffer (so how much big is the header), this is the only one you need to zero
} enctypex_data_t;
int enctypex_func5(unsigned char *encxkey, int cnt, unsigned char *id, int idlen, int *n1, int *n2) {
int i,
tmp,
mask = 1;
if(!cnt) return(0);
if(cnt > 1) {
do {
mask = (mask << 1) + 1;
} while(mask < cnt);
}
i = 0;
do {
*n1 = encxkey[*n1 & 0xff] + id[*n2];
(*n2)++;
if(*n2 >= idlen) {
*n2 = 0;
*n1 += idlen;
}
tmp = *n1 & mask;
if(++i > 11) tmp %= cnt;
} while(tmp > cnt);
return(tmp);
}
void enctypex_func4(unsigned char *encxkey, unsigned char *id, int idlen) {
int i,
n1 = 0,
n2 = 0;
unsigned char t1,
t2;
if(idlen < 1) return;
for(i = 0; i < 256; i++) encxkey[i] = i;
for(i = 255; i >= 0; i--) {
t1 = enctypex_func5(encxkey, i, id, idlen, &n1, &n2);
t2 = encxkey[i];
encxkey[i] = encxkey[t1];
encxkey[t1] = t2;
}
encxkey[256] = encxkey[1];
encxkey[257] = encxkey[3];
encxkey[258] = encxkey[5];
encxkey[259] = encxkey[7];
encxkey[260] = encxkey[n1 & 0xff];
}
int enctypex_func7(unsigned char *encxkey, unsigned char d) {
unsigned char a,
b,
c;
a = encxkey[256];
b = encxkey[257];
c = encxkey[a];
encxkey[256] = a + 1;
encxkey[257] = b + c;
a = encxkey[260];
b = encxkey[257];
b = encxkey[b];
c = encxkey[a];
encxkey[a] = b;
a = encxkey[259];
b = encxkey[257];
a = encxkey[a];
encxkey[b] = a;
a = encxkey[256];
b = encxkey[259];
a = encxkey[a];
encxkey[b] = a;
a = encxkey[256];
encxkey[a] = c;
b = encxkey[258];
a = encxkey[c];
c = encxkey[259];
b += a;
encxkey[258] = b;
a = b;
c = encxkey[c];
b = encxkey[257];
b = encxkey[b];
a = encxkey[a];
c += b;
b = encxkey[260];
b = encxkey[b];
c += b;
b = encxkey[c];
c = encxkey[256];
c = encxkey[c];
a += c;
c = encxkey[b];
b = encxkey[a];
encxkey[260] = d;
c ^= b ^ d;
encxkey[259] = c;
return(c);
}
int enctypex_func7e(unsigned char *encxkey, unsigned char d) {
unsigned char a,
b,
c;
a = encxkey[256];
b = encxkey[257];
c = encxkey[a];
encxkey[256] = a + 1;
encxkey[257] = b + c;
a = encxkey[260];
b = encxkey[257];
b = encxkey[b];
c = encxkey[a];
encxkey[a] = b;
a = encxkey[259];
b = encxkey[257];
a = encxkey[a];
encxkey[b] = a;
a = encxkey[256];
b = encxkey[259];
a = encxkey[a];
encxkey[b] = a;
a = encxkey[256];
encxkey[a] = c;
b = encxkey[258];
a = encxkey[c];
c = encxkey[259];
b += a;
encxkey[258] = b;
a = b;
c = encxkey[c];
b = encxkey[257];
b = encxkey[b];
a = encxkey[a];
c += b;
b = encxkey[260];
b = encxkey[b];
c += b;
b = encxkey[c];
c = encxkey[256];
c = encxkey[c];
a += c;
c = encxkey[b];
b = encxkey[a];
c ^= b ^ d;
encxkey[260] = c; // encrypt
encxkey[259] = d; // encrypt
return(c);
}
int enctypex_func6(unsigned char *encxkey, unsigned char *data, int len) {
int i;
for(i = 0; i < len; i++) {
data[i] = enctypex_func7(encxkey, data[i]);
}
return(len);
}
int enctypex_func6e(unsigned char *encxkey, unsigned char *data, int len) {
int i;
for(i = 0; i < len; i++) {
data[i] = enctypex_func7e(encxkey, data[i]);
}
return(len);
}
void enctypex_funcx(unsigned char *encxkey, unsigned char *key, unsigned char *encxvalidate, unsigned char *data, int datalen) {
int i,
keylen;
keylen = strlen(key);
for(i = 0; i < datalen; i++) {
encxvalidate[(key[i % keylen] * i) & 7] ^= encxvalidate[i & 7] ^ data[i];
}
enctypex_func4(encxkey, encxvalidate, 8);
}
static int enctypex_data_cleaner_level = 2; // 0 = do nothing
// 1 = colors
// 2 = colors + strange chars
// 3 = colors + strange chars + sql
int enctypex_data_cleaner(unsigned char *dst, unsigned char *src, int max) {
static const unsigned char strange_chars[] = {
' ','E',' ',',','f',',','.','t',' ','^','%','S','<','E',' ','Z',
' ',' ','`','`','"','"','.','-','-','~','`','S','>','e',' ','Z',
'Y','Y','i','c','e','o','Y','I','S','`','c','a','<','-','-','E',
'-','`','+','2','3','`','u','P','-',',','1','`','>','%','%','%',
'?','A','A','A','A','A','A','A','C','E','E','E','E','I','I','I',
'I','D','N','O','O','O','O','O','x','0','U','U','U','U','Y','D',
'B','a','a','a','a','a','a','e','c','e','e','e','e','i','i','i',
'i','o','n','o','o','o','o','o','+','o','u','u','u','u','y','b',
'y' };
unsigned char c,
*p;
if(!dst) return(0);
if(dst != src) dst[0] = 0; // the only change in 0.1.3a
if(!src) return(0);
if(max < 0) max = strlen(src);
for(p = dst; (c = *src) && (max > 0); src++, max--) {
if(c == '\\') { // avoids the backslash delimiter
*p++ = '/';
continue;
}
if(enctypex_data_cleaner_level >= 1) {
if(c == '^') { // Quake 3 colors
//if(src[1] == 'x') { // ^x112233 (I don't remember the game which used this format)
//src += 7;
//max -= 7;
//} else
if(isdigit(src[1]) || islower(src[1])) { // ^0-^9, ^a-^z... a good compromise
src++;
max--;
} else {
*p++ = c;
}
continue;
}
if(c == 0x1b) { // Unreal colors
src += 3;
max -= 3;
continue;
}
if(c < ' ') { // other colors
continue;
}
}
if(enctypex_data_cleaner_level >= 2) {
if(c >= 0x7f) c = strange_chars[c - 0x7f];
}
if(enctypex_data_cleaner_level >= 3) {
switch(c) { // html/SQL injection (paranoid mode)
case '\'':
case '\"':
case '&':
case '^':
case '?':
case '{':
case '}':
case '(':
case ')':
case '[':
case ']':
case '-':
case ';':
case '~':
case '|':
case '$':
case '!':
case '<':
case '>':
case '*':
case '%':
case ',': c = '.'; break;
default: break;
}
}
if((c == '\r') || (c == '\n')) { // no new line
continue;
}
*p++ = c;
}
*p = 0;
return(p - dst);
}
// function not related to the algorithm, I have created it only for a quick handling of the received data
// very quick explanation:
// - if you use out it will be considered as an output buffer where placing all the IP and ports of the servers in the classical format: 4 bytes for IP and 2 for the port
// - if you don't use out the function will return a non-zero value if you have received all the data from the master server
// - if you use infobuff it will be considered as an output buffer where placing all the informations of one server at time in the format "IP:port \parameter1\value1\...\parameterN\valueN"
// - infobuff_size is used to avoid to write more data than how much supported by infobuff
// - infobuff_offset instead is used for quickly handling the next servers for infobuff because, as just said, the function handles only one server at time
// infobuff_offset is just the offset of the server to handle in our enctypex buffer, the function returns the offset to the next one or a value zero or -1 if there are no other hosts
// data and out can't be the same buffer because in some games like AA the gamespy master server returns
// 5 bytes for each IP/port and so there is the risk of overwriting the data to handle, that's why I use
// an output buffer which is at least "(datalen / 5) * 6" bytes long
int enctypex_decoder_convert_to_ipport(unsigned char *data, int datalen, unsigned char *out, unsigned char *infobuff, int infobuff_size, int infobuff_offset) {
#define enctypex_infobuff_check(X) \
if(infobuff) { \
if((int)(infobuff_size - infobuff_len) <= (int)(X)) { \
infobuff_size = 0; \
} else
typedef struct {
unsigned char type;
unsigned char *name;
} par_t;
int i,
len,
pars = 0, // pars and vals are used for making the function
vals = 0, // thread-safe when infobuff is not used
infobuff_len = 0;
unsigned char tmpip[6],
port[2],
t,
*p,
*o,
*l;
static const int use_parval = 1; // par and val are required, so this bool is useless
static unsigned char // this function is not thread-safe if you use it for retrieving the extra data (infobuff)
parz = 0,
valz = 0,
**val = NULL;
static par_t *par = NULL; // par[255] and *val[255] was good too
if(!data) return(0);
if(datalen < 6) return(0); // covers the 6 bytes of IP:port
o = out;
p = data;
l = data + datalen;
p += 4; // your IP
port[0] = *p++; // the most used port
port[1] = *p++;
if((port[0] == 0xff) && (port[1] == 0xff)) {
return(-1); // error message from the server
}
if(infobuff && infobuff_offset) { // restore the data
p = data + infobuff_offset;
} else {
if(p < l) {
pars = *p++;
if(use_parval) { // save the static data
parz = pars;
par = realloc(par, sizeof(par_t) * parz);
}
for(i = 0; (i < pars) && (p < l); i++) {
t = *p++;
if(use_parval) {
par[i].type = t;
par[i].name = p;
}
p += strlen(p) + 1;
}
}
if(p < l) {
vals = *p++;
if(use_parval) { // save the static data
valz = vals;
val = realloc(val, sizeof(unsigned char *) * valz);
}
for(i = 0; (i < vals) && (p < l); i++) {
if(use_parval) val[i] = p;
p += strlen(p) + 1;
}
}
}
if(use_parval) {
pars = parz;
vals = valz;
}
if(infobuff && (infobuff_size > 0)) {
infobuff[0] = 0;
}
while(p < l) {
t = *p++;
if(!t && !memcmp(p, "\xff\xff\xff\xff", 4)) {
if(!out) o = out - 1; // so the return is not 0 and means that we have reached the end
break;
}
len = 5;
if(t & 0x02) len = 9;
if(t & 0x08) len += 4;
if(t & 0x10) len += 2;
if(t & 0x20) len += 2;
tmpip[0] = p[0];
tmpip[1] = p[1];
tmpip[2] = p[2];
tmpip[3] = p[3];
if((len < 6) || !(t & 0x10)) {
tmpip[4] = port[0];
tmpip[5] = port[1];
} else {
tmpip[4] = p[4];
tmpip[5] = p[5];
}
if(out) {
memcpy(o, tmpip, 6);
o += 6;
}
enctypex_infobuff_check(22) {
infobuff_len = sprintf(infobuff,
"%u.%u.%u.%u:%hu ",
tmpip[0], tmpip[1], tmpip[2], tmpip[3],
(unsigned short)((tmpip[4] << 8) | tmpip[5]));
}}
p += len - 1; // the value in len is no longer used from this point
if(t & 0x40) {
for(i = 0; (i < pars) && (p < l); i++) {
enctypex_infobuff_check(1 + strlen(par[i].name) + 1) {
infobuff[infobuff_len++] = '\\';
infobuff_len += enctypex_data_cleaner(infobuff + infobuff_len, par[i].name, -1);
infobuff[infobuff_len++] = '\\';
infobuff[infobuff_len] = 0;
}}
t = *p++;
if(use_parval) {
if(!par[i].type) { // string
if(t == 0xff) { // inline string
enctypex_infobuff_check(strlen(p)) {
infobuff_len += enctypex_data_cleaner(infobuff + infobuff_len, p, -1);
}}
p += strlen(p) + 1;
} else { // fixed string
if(t < vals) {
enctypex_infobuff_check(strlen(val[t])) {
infobuff_len += enctypex_data_cleaner(infobuff + infobuff_len, val[t], -1);
}}
}
}
} else { // number (-128 to 127)
enctypex_infobuff_check(5) {
infobuff_len += sprintf(infobuff + infobuff_len, "%d", (signed char)t);
}}
}
}
}
}
if(infobuff) { // do NOT touch par/val, I use realloc
return(p - data);
}
}
if((out == data) && ((o - out) > (p - data))) { // I need to remember this
fprintf(stderr, "\nError: input and output buffer are the same and there is not enough space\n");
exit(1);
}
if(infobuff) { // do NOT touch par/val, I use realloc
parz = 0;
valz = 0;
return(-1);
}
return(o - out);
}
int enctypex_decoder_rand_validate(unsigned char *validate) {
int i,
rnd;
rnd = ~time(NULL);
for(i = 0; i < 8; i++) {
do {
rnd = ((rnd * 0x343FD) + 0x269EC3) & 0x7f;
} while((rnd < 0x21) || (rnd >= 0x7f));
validate[i] = rnd;
}
validate[i] = 0;
return(i);
}
unsigned char *enctypex_init(unsigned char *encxkey, unsigned char *key, unsigned char *validate, unsigned char *data, int *datalen, enctypex_data_t *enctypex_data) {
int a,
b;
unsigned char encxvalidate[8];
if(*datalen < 1) return(NULL);
a = (data[0] ^ 0xec) + 2;
if(*datalen < a) return(NULL);
b = data[a - 1] ^ 0xea;
if(*datalen < (a + b)) return(NULL);
memcpy(encxvalidate, validate, 8);
enctypex_funcx(encxkey, key, encxvalidate, data + a, b);
a += b;
if(!enctypex_data) {
data += a;
*datalen -= a; // datalen is untouched in stream mode!!!
} else {
enctypex_data->offset = a;
enctypex_data->start = a;
}
return(data);
}
unsigned char *enctypex_decoder(unsigned char *key, unsigned char *validate, unsigned char *data, int *datalen, enctypex_data_t *enctypex_data) {
unsigned char encxkeyb[261],
*encxkey;
encxkey = enctypex_data ? enctypex_data->encxkey : encxkeyb;
if(!enctypex_data || (enctypex_data && !enctypex_data->start)) {
data = enctypex_init(encxkey, key, validate, data, datalen, enctypex_data);
if(!data) return(NULL);
}
if(!enctypex_data) {
enctypex_func6(encxkey, data, *datalen);
return(data);
} else if(enctypex_data && enctypex_data->start) {
enctypex_data->offset += enctypex_func6(encxkey, data + enctypex_data->offset, *datalen - enctypex_data->offset);
return(data + enctypex_data->start);
}
return(NULL);
}
// exactly as above but with enctypex_func6e instead of enctypex_func6
unsigned char *enctypex_encoder(unsigned char *key, unsigned char *validate, unsigned char *data, int *datalen, enctypex_data_t *enctypex_data) {
unsigned char encxkeyb[261],
*encxkey;
encxkey = enctypex_data ? enctypex_data->encxkey : encxkeyb;
if(!enctypex_data || (enctypex_data && !enctypex_data->start)) {
data = enctypex_init(encxkey, key, validate, data, datalen, enctypex_data);
if(!data) return(NULL);
}
if(!enctypex_data) {
enctypex_func6e(encxkey, data, *datalen);
return(data);
} else if(enctypex_data && enctypex_data->start) {
enctypex_data->offset += enctypex_func6e(encxkey, data + enctypex_data->offset, *datalen - enctypex_data->offset);
return(data + enctypex_data->start);
}
return(NULL);
}
unsigned char *enctypex_msname(unsigned char *gamename, unsigned char *retname) {
static unsigned char msname[256];
unsigned i,
c,
server_num;
if(!gamename) return(NULL);
server_num = 0;
for(i = 0; gamename[i]; i++) {
c = tolower(gamename[i]);
server_num = c - (server_num * 0x63306ce7);
}
server_num %= 20;
if(retname) {
snprintf(retname, 256, "%s.ms%d.gamespy.com", gamename, server_num);
return(retname);
}
snprintf(msname, sizeof(msname), "%s.ms%d.gamespy.com", gamename, server_num);
return(msname);
}
int enctypex_wrapper(unsigned char *key, unsigned char *validate, unsigned char *data, int size) {
int i;
unsigned char *p;
if(!key || !validate || !data || (size < 0)) return(0);
p = enctypex_decoder(key, validate, data, &size, NULL);
if(!p) return(-1);
for(i = 0; i < size; i++) {
data[i] = p[i];
}
return(size);
}
// data must be enough big to include the 23 bytes header, remember it: data = realloc(data, size + 23);
int enctypex_quick_encrypt(unsigned char *key, unsigned char *validate, unsigned char *data, int size) {
int i,
rnd,
tmpsize,
keylen,
vallen;
unsigned char tmp[23];
if(!key || !validate || !data || (size < 0)) return(0);
keylen = strlen(key); // only for giving a certain randomness, so useless
vallen = strlen(validate);
rnd = ~time(NULL);
for(i = 0; i < sizeof(tmp); i++) {
rnd = (rnd * 0x343FD) + 0x269EC3;
tmp[i] = rnd ^ key[i % keylen] ^ validate[i % vallen];
}
tmp[0] = 0xeb; // 7
tmp[1] = 0x00;
tmp[2] = 0x00;
tmp[8] = 0xe4; // 14
for(i = size - 1; i >= 0; i--) {
data[sizeof(tmp) + i] = data[i];
}
memcpy(data, tmp, sizeof(tmp));
size += sizeof(tmp);
tmpsize = size;
enctypex_encoder(key, validate, data, &tmpsize, NULL);
return(size);
}