double lolz

/*
** VAC decryption key brute-forcer
*/

#include <stdio.h>
#include <windows.h>
#include <conio.h>
#include <Tlhelp32.h>
#include "Detours.h"

HMODULE vacModule = NULL;

UINT32 decryptCall = 0x27EE;


//
// Decrypt function
// key = packet
BOOL (__cdecl *VacDecryptCode)(UINT8* dwDestAddress, UINT8* key, UINT8* somePointer, UINT32 something);

UINT8 block[0x10000];

UINT8 more_buffer[0x10000];

UINT32 test_dump[10];
UINT32 last_crc = 0;
UINT8 running = 0;

void PrintCurrentTime() {
	SYSTEMTIME sysTime;

		GetLocalTime( &sysTime );

		printf("[%d/%d/%d %d:%d:%d] ", sysTime.wYear, sysTime.wMonth,
			sysTime.wDay, sysTime.wHour, sysTime.wMinute, sysTime.wSecond);

}


void StatusThread() {


		while ( running ) {

				// Update status every minute
				Sleep(60000);
				printf("Currently on key %p %p, last CRC32 was %p...\n",test_dump[1],test_dump[0],last_crc);


		}
}


// A jump inserted at the end of the CRC32 routine lands us here
// We monitor CRC32's coming off of CRC32_ProcessBuffer
void __declspec(naked) Crc32Hook() {
		__asm {
			pop esi
			mov last_crc, eax
			mov [edi], eax
			pop ebx
			retn
		}
}


int main( int argc, char** argv ) {

		HMODULE hVac = LoadLibraryA("SourceInit.dat");


		if (!hVac) {
				printf("Can't load VAC client\n");
				return 1;
		}

		test_dump[0] = 0;

		UINT8* callPtr = (UINT8*)hVac + 0x27ee;
		UINT8* decode_addr = (UINT8*)hVac + 0x29CE;

		printf("hVac %p, Callptr %p\n", hVac, callPtr);
		printf("decoding at %p\n", decode_addr);

		VacDecryptCode = (BOOL (__cdecl *)(UINT8 *,UINT8 *,UINT8 *,UINT32))callPtr;

		UINT8* patchPtr = (UINT8*)hVac + 0x10e67;
		void (*origCrc32)() = (void(*)())patchPtr;

		// hookens

		DetourTransactionBegin();
		DetourUpdateThread( GetCurrentThread() );

		DetourAttach( (PVOID*)&origCrc32, Crc32Hook);
		DetourTransactionCommit();
		//return 0;

		printf("Brute-forcing key... this will take a while.\n");

		// Try it

		running = 1;
		CreateThread( 0, 100000, (LPTHREAD_START_ROUTINE)StatusThread, NULL, NULL, NULL );



		BOOL result = VacDecryptCode( decode_addr, (UINT8*)test_dump, (UINT8*)more_buffer, 0x2000);
		while (!result) {
					//printf("Tried key 0x%p\n", test_dump[2]);
					result = VacDecryptCode( decode_addr, (UINT8*)test_dump, (UINT8*)more_buffer, 0x2000);

					if (test_dump[0] == 0xffffffff) test_dump[1]++;
					test_dump[0]++;

		}

		running = 0;

		printf("Decrypt successful! key %p %p\n", test_dump[1], test_dump[0]);

		return 0;
}