RGH Retail Profile Fix

//Loaded a DLL to apply the hook to the call in XAM
//    *Could probably edit dashboard.xbx(?) to launch DLL then return to xshell*
//Branched to my custom function.
//Loads Dev/Retail profiles just fine
typedef struct {
    BYTE                S[256];
    BYTE                i,j;
} XECRYPT_RC4_STATE;
typedef DWORD (*XEKEYSUNOBFUSCATE)(DWORD r3, BYTE* r4, DWORD r5, BYTE* r6, DWORD* r7);
typedef void (*XECRYPTHMACSHA)(const BYTE * pbKey, DWORD cbKey, const BYTE * pbInp1, DWORD cbInp1, const BYTE * pbInp2, DWORD cbInp2, const BYTE * pbInp3, DWORD cbInp3, BYTE * pbOut, DWORD cbOut);
typedef void  (*XECRYPTRC4KEY)(XECRYPT_RC4_STATE * pRc4State, const BYTE * pbKey, DWORD cbKey);
typedef void  (*XECRYPTRC4ECB)(XECRYPT_RC4_STATE * pRc4State, BYTE * pbInpOut, DWORD cbInpOut);
#define PATCH_LOC_XEKEYSUNOBFUSCATE (0x81CBD5CC) // XAM call to XeKeysUnObfuscate Dev 14699
DWORD XeKeysUnObfuscateHook(DWORD r3, BYTE* r4, DWORD r5, BYTE* r6, DWORD* r7)
{
    /*
        r3 - ?
        r4 - account info start(buffer)
        r5 - data size
        r6 - decrypt buffer
        r7 - ?
    */
    XEKEYSUNOBFUSCATE XeKeysUnObfuscate = (XEKEYSUNOBFUSCATE)resolveFunct("xboxkrnl.exe", 597);
    if (r3 == 1) // From tests I did, profiles only called when set to 1
    {
        // Try with original key
        DWORD ret = XeKeysUnObfuscate(r3, r4, r5, r6, r7);
        if (ret == 1) // If pass: continue
            return ret;
        else // fail: swap key and try again
        {
            XECRYPTHMACSHA XeCryptHmacSha = (XECRYPTHMACSHA)resolveFunct("xboxkrnl.exe", 386);
            XECRYPTRC4KEY XeCryptRc4Key = (XECRYPTRC4KEY)resolveFunct("xboxkrnl.exe", 395);
            XECRYPTRC4ECB XeCryptRc4Ecb = (XECRYPTRC4ECB)resolveFunct("xboxkrnl.exe", 396);
            XECRYPT_RC4_STATE rc4State;
            BYTE HmacShaKey[0x10] = {0xE1, 0xBC, 0x15, 0x9C, 0x73, 0xB1, 0xEA, 0xE9, 0xAB, 0x31, 0x70, 0xF3, 0xAD, 0x47, 0xEB, 0xF3}; //retail key
            //BYTE HmacShaKey[0x10] = {0xDA, 0xB6, 0x9A, 0xD9, 0x8E, 0x28, 0x76, 0x4F, 0x97, 0x7E, 0xE2, 0x48, 0x7E, 0x4F, 0x3F, 0x68}; //devkit key
            BYTE hash[0x18];
            BYTE newHash[0x10];
            BYTE rc4Key[0x10];
            memcpy(hash, r4, 0x18);
            *r7 = r5 - 0x18;
            memcpy(r6, r4 + 0x18, r5 - 0x18);
            XeCryptHmacSha((const BYTE *)HmacShaKey, 0x10, hash, 0x10, 0, 0, 0, 0, rc4Key, 0x10);
            XeCryptRc4Key(&rc4State, rc4Key, 0x10);
            XeCryptRc4Ecb(&rc4State, hash + 0x10, 0x8);
            XeCryptRc4Ecb(&rc4State, (BYTE *)r6, *r7 - 0x18);
            XeCryptHmacSha((const BYTE *)HmacShaKey, 0x10, hash+0x10, 8, (const BYTE *)r6, *r7, 0, 0, newHash, 0x10);
            int result = memcmp(hash, newHash, 0x10);
            if (result == 0)
                return (1);
            else
                return result;
        }

    }
    else
    {
        return XeKeysUnObfuscate(r3, r4, r5, r6, r7);
    }
}
// Un-tested
typedef DWORD (*XEKEYSOBFUSCATE)(DWORD r3, BYTE* r4, DWORD r5, BYTE* r6, DWORD* r7);
typedef void (*XECRYPTRANDOM)(BYTE * pb, DWORD cb);
typedef void (*XECRYPTRC4)(const BYTE * pbKey, DWORD cbKey, BYTE * pbInpOut, DWORD cbInpOut);
#define PATCH_LOC_XEKEYSOBFUSCATE (0x81CBD5BC) // XAM call to XeKeysObfuscate Dev 14699

DWORD XeKeysObfuscateHook(DWORD r3, BYTE* r4, DWORD r5, BYTE* r6, DWORD* r7)
{
    XEKEYSOBFUSCATE XeKeysObfuscate = (XEKEYSOBFUSCATE)resolveFunct("xboxkrnl.exe", 596);
    if (r3 == 1)
    {
        //Encrypt with retail Key
        BYTE retailKey[0x10] = {0xE1, 0xBC, 0x15, 0x9C, 0x73, 0xB1, 0xEA, 0xE9, 0xAB, 0x31, 0x70, 0xF3, 0xAD, 0x47, 0xEB, 0xF3}; //retail key
        //copy decrypted data to 0x18+ of buffer
        memcpy(r6 + 0x18, r4, r5);
        *r7 = r5 + 0x18;
        // Create random data then copy to 0x10
        XECRYPTRANDOM XeCryptRandom = (XECRYPTRANDOM)resolveFunct("xboxkrnl.exe", 394);
        XeCryptRandom(r6 + 0x10, 8);
        // create a Hmac-Sha hash of the random data & decrypted data
        XECRYPTHMACSHA XeCryptHmacSha = (XECRYPTHMACSHA)resolveFunct("xboxkrnl.exe", 386);
        XeCryptHmacSha((BYTE*)retailKey, 0x10, r6 + 0x10, *r7 - 0x10, 0, 0, 0, 0, r6, 0x10);
        BYTE rc4Key[0x10];
        // Hash previously created hash to make the RC4 key
        XeCryptHmacSha((BYTE*)retailKey, 0x10, r6, 0x10, 0, 0, 0, 0, (BYTE*)rc4Key, 0x10);
        // Encrypt the data
        XECRYPTRC4 XeCryptRc4 = (XECRYPTRC4)resolveFunct("xboxkrnl.exe", 397);
        XeCryptRc4((const BYTE*)rc4Key, 0x10, r6 + 0x10, *r7 - 0x10);
        return (0);
    }
    else
    {
        return XeKeysObfuscate(r3, r4, r5, r6, r7);
    }
}
// Better solution ... should never need to be updated?
// hookImpStub found in DashLaunch source
hookImpStub("xam.xex", "xboxkrnl.exe", 597, (DWORD)XeKeysUnObfuscateHook);
hookImpStub("xam.xex", "xboxkrnl.exe", 596, (DWORD)XeKeysObfuscateHook);

// Other method
// patchInJump also found in DashLaunch source
patchInJump((PDWORD)PATCH_LOC_XEKEYSUNOBFUSCATE, (DWORD)XeKeysUnObfuscateHook, false);
patchInJump((PDWORD)PATCH_LOC_XEKEYSOBFUSCATE, (DWORD)XeKeysObfuscateHook, false);

// credit [c0z] for hook code