Advertisement
Guest User

Untitled

a guest
Aug 7th, 2020
505
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 2.78 KB | None | 0 0
  1. __forceinline __int64 decrypt_uworld(const uint32_t key, const uint64_t* state)
  2. {
  3.     unsigned __int64 v19; // rcx
  4.     unsigned __int64 v20; // rdi
  5.     __int64 v21; // r8
  6.     unsigned __int64 v22; // r10
  7.     unsigned __int64 v23; // r11
  8.     unsigned __int64 v24; // r8
  9.     unsigned __int64 v25; // r10
  10.     unsigned __int64 v26; // rcx
  11.     unsigned __int64 v27; // rdx
  12.     v19 = 2685821657736338717i64
  13.         * ((unsigned int)key ^ (unsigned int)(key << 25) ^ (((unsigned int)key ^ ((unsigned __int64)(unsigned int)key >> 15)) >> 12))
  14.         % 7;
  15.     v20 = state[v19];
  16.     v21 = (2685821657736338717i64
  17.         * ((unsigned int)key ^ (unsigned int)(key << 25) ^ (((unsigned int)key ^ ((unsigned __int64)(unsigned int)key >> 15)) >> 12))) >> 32;
  18.     switch ((unsigned int)v19 % 7)
  19.     {
  20.     case 0u:
  21.         v22 = v20 - (unsigned int)(v21 - 1);
  22.         goto LABEL_25;
  23.     case 1u:
  24.         v20 = __ROL8__(v20 - (unsigned int)(v21 + 2 * v19), (unsigned __int8)(((int)v21 + (int)v19) % 0x3Fu) + 1);
  25.         break;
  26.     case 2u:
  27.         v20 = ~(v20 - (unsigned int)(v21 + 2 * v19));
  28.         break;
  29.     case 3u:
  30.         v26 = 2 * ((2 * v20) ^ ((2 * v20) ^ (v20 >> 1)) & 0x5555555555555555i64);
  31.         v20 = v26 ^ (v26 ^ (((2 * v20) ^ ((2 * v20) ^ (v20 >> 1)) & 0x5555555555555555i64) >> 1)) & 0x5555555555555555i64;
  32.         break;
  33.     case 4u:
  34.         v27 = __ROR8__(v20, (unsigned __int8)(((int)v21 + 2 * (int)v19) % 0x3Fu) + 1);
  35.         v20 = (2 * v27) ^ ((2 * v27) ^ (v27 >> 1)) & 0x5555555555555555i64;
  36.         break;
  37.     case 5u:
  38.         v22 = __ROR8__(v20, (unsigned __int8)(((int)v21 + 2 * (int)v19) % 0x3Fu) + 1);
  39.     LABEL_25:
  40.         v23 = (2 * v22) ^ ((2 * v22) ^ (v22 >> 1)) & 0x5555555555555555i64;
  41.         v24 = (4 * v23) ^ ((4 * v23) ^ (v23 >> 2)) & 0x3333333333333333i64;
  42.         v25 = (16 * v24) ^ ((16 * v24) ^ (v24 >> 4)) & 0xF0F0F0F0F0F0F0Fi64;
  43.         v20 = __ROL8__((v25 << 8) ^ ((v25 << 8) ^ (v25 >> 8)) & 0xFF00FF00FF00FFi64, 32);
  44.         break;
  45.     case 6u:
  46.         v20 = ~v20 - (unsigned int)(v21 + v19);
  47.         break;
  48.     default:
  49.         break;
  50.     }
  51.     return v20 ^ (unsigned int)key;
  52. }
  53.  
  54. __forceinline uint64_t read_uworld()
  55. {
  56.     uint64_t key = 0;/* = Read<uint64_t>(g_ProcessBase + 0x6B86EF8);*/
  57.     if (!ReadProcessMemory(h_process, (void*)(main_base + 0x6C36DB8), &key, sizeof(uint64_t), NULL)) {
  58.         cout << "   [-] RPM1 failed!" << endl;
  59.         return 0;
  60.     }
  61.  
  62. #pragma pack(push, 1)
  63.     struct State
  64.     {
  65.         uint64_t Keys[7];
  66.     };
  67. #pragma pack(pop)
  68.     State state = { 0 }; /*Read<State>(g_ProcessBase + 0x6B86EC0);*/
  69.     if (!ReadProcessMemory(h_process, (void*)(main_base + 0x6C36D80), &state, sizeof(State), NULL)) {
  70.         cout << "   [-] RPM2 failed!" << endl;
  71.         return 0;
  72.     }
  73.  
  74.     uint64_t decrypted = 0;
  75.     if (!ReadProcessMemory(h_process, (void*)(decrypt_uworld(key, (const uint64_t*)& state)), &decrypted, sizeof(uint64_t), NULL)) {
  76.         cout << "   [-] RPM3 failed!" << endl;
  77.         return 0;
  78.     }
  79.  
  80.     return decrypted;
  81.  
  82.     /*return Read<uint64_t>(DecryptUWorld(key, (const uint64_t*)& state));*/
  83. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement