/*
dcanalyzer.c
--
Analyzer for DarkComet Servers, make sure the server is fully unpacked before 
using this tool. It will decrypt all known data, if it doesn't work you may be 
working with a very old version of darkcomet and you should have a look at 
the PE resources for the unencrypted data. 

This tool is public domain. Tested under GCC and VS2010 with many darkcomet 
versions. 
*/
#define _BSD_SOURCE /* make gcc happy with snprintf as ansi */

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <string.h>

#ifdef WIN32
#include <Windows.h>
#endif

#if _MSC_VER
#define snprintf _snprintf /* work around for microsoft's "C" compiler */
#endif

/* We search the entire file for this string to find the RC4 key */
#define KEY_PREFIX "#KCMDDC" 


int process(char * file);
void ShowOutput(char * str);
void process_resource_table(int pos, char found, char * goal); 

FILE * fh;
int32_t rsrc_pos;
int32_t rsrc_virtual;
char * dcstr = NULL;

/* RC4 borrowed from FreeBSD */
struct rc4_state {
	uint8_t	perm[256];
	uint8_t	index1;
	uint8_t	index2;
};

static __inline void swap_bytes(uint8_t *a, uint8_t *b)
{
	uint8_t temp;
	temp = *a;
	*a = *b;
	*b = temp;
}

void rc4_init(struct rc4_state * state, uint8_t *key, int keylen)
{
	uint8_t j;
	int i;

	/* Initialize state with identity permutation */
	for (i = 0; i < 256; i++)
		state->perm[i] = (uint8_t)i; 
	state->index1 = 0;
	state->index2 = 0;
  
	/* Randomize the permutation using key data */
	for (j = i = 0; i < 256; i++) {
		j += state->perm[i] + key[i % keylen]; 
		swap_bytes(&state->perm[i], &state->perm[j]);
	}
}

void rc4_crypt(struct rc4_state * state, uint8_t *inbuf, uint8_t *outbuf, 
	int buflen)
{
	int i;
	uint8_t j;

	for (i = 0; i < buflen; i++) {

		/* Update modification indicies */
		state->index1++;
		state->index2 += state->perm[state->index1];

		/* Modify permutation */
		swap_bytes(&state->perm[state->index1],
		    &state->perm[state->index2]);

		/* Encrypt/decrypt next byte */
		j = state->perm[state->index1] + state->perm[state->index2];
		outbuf[i] = inbuf[i] ^ state->perm[j];
	}
}
/* end FreeBSD RC4 code */

/* my PE header structs */
struct DATA_DIR 
{
	uint32_t addr;
	uint32_t size;
};

struct RES_DIR_TABLE 
{
	uint32_t characteristics;
	uint32_t timestamp;
	uint16_t major;
	uint16_t minor;
	uint16_t num_name_elems;
	uint16_t num_id_elems;
};

struct RES_DIR_ENTRY 
{
	union 
	{
		uint32_t name_rva;
		uint32_t id;
	} identifier; 
	union 
	{
		uint32_t data_entry_rva;
		uint32_t subdir_rva;
	} child;
};

struct RES_DATA 
{
	uint32_t data_rva;
	uint32_t size;
	uint32_t codepage;
	uint32_t reserved;
};



void process_resource_entry(struct RES_DIR_ENTRY entry, char found, 
	char * goal)
{
	struct RES_DATA data;
	
	if (entry.child.data_entry_rva & 0x80000000) {
		/* process subdir entry */
		process_resource_table(entry.child.subdir_rva & 0x7FFFFFFF, 
			found, goal);
	} else {
		if (found) {
			fseek(fh, rsrc_pos + entry.child.data_entry_rva, 
				SEEK_SET);
			fread(&data, sizeof(data), 1, fh);
			dcstr = (char*) malloc(data.size+1);
			dcstr[data.size] = '\0';
			fseek(fh, data.data_rva - rsrc_virtual + rsrc_pos, 
				SEEK_SET);
			fread(dcstr, 1, data.size, fh);
		}
		/* process data entry */
	}
}

void process_resource_entry_id(struct RES_DIR_ENTRY entry, char found, 
	char * goal) 
{
	process_resource_entry(entry, found, goal);
}

char check_unicode_str(char * goal, char * input, unsigned int len) 
{
	unsigned int i;
	char next;
	if (strlen(goal) == len) {
		for (i = 0; i < len*2; i++) {
			next = (i % 2) == 0 ? goal[i/2] : 0;
			if (input[i] != next)
				return 0;
		}
	} else {
		return 0;
	}
	return 1;
}

void process_resource_entry_name(struct RES_DIR_ENTRY entry, char found, 
	char * goal) 
{
	uint16_t name_len;
	char * name;

	fseek(fh, rsrc_pos + (entry.identifier.name_rva & 0x7FFFFFFF), SEEK_SET);
	fread(&name_len, sizeof(name_len), 1, fh);

	name = (char*) malloc(name_len*2 + 1); 
	fread(name, 1, name_len*2, fh);

	if (check_unicode_str(goal, name, name_len)) {
		process_resource_entry(entry, 1, goal);
	} else {
		process_resource_entry(entry, found, goal);
	}	
}

void process_resource_table(int pos, char found, char * goal) 
{
	struct RES_DIR_TABLE table;
	int i;
	int length;
	struct RES_DIR_ENTRY * entries;

	fseek(fh, rsrc_pos + pos, SEEK_SET);
	fread(&table, sizeof(table), 1, fh);
	length = sizeof(struct RES_DIR_ENTRY) * 
		(table.num_id_elems + table.num_name_elems);
	entries = (struct RES_DIR_ENTRY*) malloc(length);
	fread(entries, length, 1, fh);

	for (i = 0; i < table.num_name_elems; i++) {
		process_resource_entry_name(entries[i], found, goal);
	}

	for (i = 0; i < table.num_id_elems; i++) {
		process_resource_entry_id(entries[i], found, goal);
	}
}

char * decrypt_dcdata(char * instr, char * key) 
{
	struct rc4_state rc4state;
	int i;
	int len = strlen(instr)/2;
	char * data;
	unsigned int tempdata;
	data = (char *)malloc(len);
	
	for (i = 0; i < len; i++) {
		sscanf(instr+(i*2), "%2X", &tempdata);
		data[i] = (char) tempdata;
	}
	rc4_init(&rc4state, (uint8_t*)key, strlen(key));
	rc4_crypt(&rc4state, (uint8_t*)data, (uint8_t*)data, len);
	data[len] = '\0';
	return data;
}

int main(int argc, char** argv) {

	if (argc < 2) {
		ShowOutput("Please specify a file!");
		return EXIT_FAILURE;
	}

	return process(argv[1]);
}

#ifdef WIN32
int APIENTRY WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, 
	LPSTR lpCmdLine, int nCmdShow) 
{
	char buffer[8192];
	OPENFILENAME ofn;
	if (__argc > 1) {
		return main(__argc, __argv);
	} else {
		ZeroMemory( &ofn , sizeof( ofn));
		ofn.lStructSize = sizeof(ofn);
		ofn.lpstrFile = buffer;
		ofn.lpstrFile[0] = '\0';
		ofn.nMaxFile = sizeof(buffer);
		ofn.lpstrFilter = "DarkComet Server Executables\0*.exe";
		ofn.nFilterIndex = 1;
		ofn.lpstrFileTitle = NULL;
		ofn.nMaxFileTitle = 0;
		ofn.lpstrInitialDir = NULL;
		ofn.Flags = OFN_PATHMUSTEXIST | OFN_FILEMUSTEXIST;
		GetOpenFileName(&ofn);

		return process(ofn.lpstrFile);
	}
}
#endif

void ShowOutput(char * str) 
{
#ifdef WIN32
		MessageBoxExA(NULL, str, "DCAnalyzer", 0, 0);
#else
		printf("%s\n", str);
#endif
}

/* simple scanner to parse key out of executable */
char * find_key_by_force() 
{
	int pos = 0;
	char * prefix = KEY_PREFIX;
	int max = strlen(prefix);
	char * keybuf = (char*) malloc(4096);
	char cur;
	fseek(fh, 0, SEEK_SET); /* go to start of file */
	
	do {
		fread(&cur, 1, 1, fh);
		
		if (pos >= max) {
			keybuf[pos] = cur;
			if (cur == '\0')
				break;
			pos++;
		} else if (cur == prefix[pos]) {
			keybuf[pos] = cur;
			pos++;
		} else {
			pos = 0;
		}

		if (pos == 4096) /* no heap overflow for you! */
			break;
	} while (!feof(fh));

	strncat(keybuf, "890", 4096); /* comes from a separate function */

	return keybuf;
}

int process(char * file) 
{
	uint16_t mz_hdr;
	uint32_t pe_hdr_loc; 
	uint32_t pe_hdr; 
	uint16_t opt_hdr; 
	uint32_t num_rva_sizes;
	uint32_t image_base;
	unsigned int opt_hdr_pos;
	unsigned int i;
	char * output;
	char buffer[1024];
	char final_buffer[8192];
	char section_name[9];
	char found;
	int successful;
	char * key;
    /* We search for these when we can't find the new DCDATA resource.
       Used for old versions of DarkComet */
	char * fallbacks[] = {"FWB", "GENCODE", "MUTEX", "NETDATA", "OFFLINEK", 
		"SID", "FTPUPLOADK", "FTPHOST", "FTPUSER", "FTPPASS", "FTPPORT", 
		"FTPSIZE", "FTPROOT", "PWD"};

	fh = fopen(file, "rb");
	if (fh == NULL) {
		ShowOutput("File open failed");
		return EXIT_FAILURE;
	}

	key = find_key_by_force();

	fseek(fh, 0, SEEK_SET); /* go to start of file */

	section_name[8] = '\0';

	fread(&mz_hdr, sizeof(int16_t), 1, fh); /* read first 2 bytes of file */
	if (mz_hdr != *(uint16_t*)"MZ") { 
		ShowOutput("Not an MZ Executable!");
		return EXIT_FAILURE;
	}

	fseek(fh, 0x3C, SEEK_SET);
	fread(&pe_hdr_loc, sizeof(pe_hdr_loc), 1, fh); /* offset of PE header */
	
	fseek(fh, pe_hdr_loc, SEEK_SET);
	fread(&pe_hdr, sizeof(pe_hdr), 1, fh); 

	if (pe_hdr != *(uint32_t*)"PE\0\0") {
		ShowOutput("Not a PE Executable!");
		return EXIT_FAILURE;
	}

	opt_hdr_pos = pe_hdr_loc + 0x18;
	fseek(fh, opt_hdr_pos, SEEK_SET);
	fread(&opt_hdr, sizeof(opt_hdr), 1, fh);

	if (opt_hdr != 0x010B) {
		ShowOutput("Invalid optional header!");
		return EXIT_FAILURE;
	}

	fseek(fh, opt_hdr_pos + 28, SEEK_SET); /* ImageBase so we can subtract it later */
	fread(&image_base, sizeof(image_base), 1, fh);

	fseek(fh, opt_hdr_pos + 92, SEEK_SET); /*  NumberOfRvaAndSizes */
	fread(&num_rva_sizes, sizeof(num_rva_sizes), 1, fh);

	if (num_rva_sizes > 0x10)
		num_rva_sizes = 0x10; /* enforce this so dumb tricks cannot work */
	
	fseek(fh, num_rva_sizes*8, SEEK_CUR);
	
	/* we should now be at the section headers */
	found = 0;
	do {
		fread(section_name, 1, 8, fh);
		if (strncmp(".rsrc", section_name, 8) == 0) {
			fseek(fh, 4, SEEK_CUR);
			fread(&rsrc_virtual, 4, 1, fh);
			fseek(fh, 4, SEEK_CUR);
			fread(&rsrc_pos, 4, 1, fh);
			found++;
			fseek(fh, 16, SEEK_CUR);   /* skip rest of this section header. */
		} else  {
			fseek(fh, 40-8, SEEK_CUR); /* skip rest of this section header. */
		}
	} while (found != 1);

	process_resource_table(0,0, "DCDATA");

	if (dcstr != NULL) {
		ShowOutput(decrypt_dcdata(dcstr, key));
	} else {
		final_buffer[0] = '\0';
		successful = 0;
		for (i = 0; i < (sizeof(fallbacks)/sizeof(*fallbacks)); i++) {
			process_resource_table(0,0, fallbacks[i]);
			if (dcstr != NULL) {
				output = decrypt_dcdata(dcstr, key);
				if (final_buffer[0] == '\0')
					snprintf(buffer, 1024, "%s: %s", fallbacks[i], output);
				else 
					snprintf(buffer, 1024, "\n%s: %s", fallbacks[i], output);
				strncat(final_buffer, buffer, 8192);
				successful++;
				dcstr = NULL; /* null it every round */
			}
		}
		if (successful) 

			ShowOutput(final_buffer);
		else 
			ShowOutput("Could not find any DarkComet resource!\n");

	}
	
	return EXIT_SUCCESS;
}