C++ GAMEGUARD SOURCE

Here the full source to bypass GG all you need to do is change a addresses put all if you want too.. Open CE view memory address of gameMOD64.des and put all important address to terminate GG....

Code:

#include <windows.h> #include <time.h> #include "blowfish.h" ///////////////////////////////////////////////////////////////////////// // GameGuard Namespace // Description: // The namespace for GameGuard. namespace GameGuard { ///////////////////////////////////////////////////////////////////////// // Blowfish inclusions // Description: // For proper linking to blowfish functions extern"C" { void Blowfish_Init(BLOWFISH_CTX *bf_CTX, unsignedchar *gg_pKey, int keyLen); void Blowfish_Encrypt(BLOWFISH_CTX *bf_CTX, unsignedlong *xl, unsignedlong *xr); void Blowfish_Decrypt(BLOWFISH_CTX *bf_CTX, unsignedlong *xl, unsignedlong *xr); }; ///////////////////////////////////////////////////////////////////////// // INCA Salt // Description: // The salt used by INCA with blowfish. #define INCA_SALT "@SAU^T2*KY" ///////////////////////////////////////////////////////////////////////// // GameGuard Key Struct // Description: // The structure of the GameGuard packet. typedefstruct GG_AUTH { unsignedlong dwIndex; unsignedlong dwValue1; unsignedlong dwValue2; unsignedlong dwValue3; }GG_AUTH,*PGG_AUTH; ///////////////////////////////////////////////////////////////////////// // GameGuard Key Table // Description: // Used in portions of the key generation. staticlongint GG_KEY_TABLE[] = { 0x00478CAB, 0x0047D130, 0x00478E3C, 0x0047DC1F, 0x00475D40, 0x0047FA7B, 0x004764A5, 0x0047E7F4, 0x00477A8E, 0x0047FC4F, 0x00476D0B, 0x0047ED9A, 0x00477803, 0x00481662, 0x00476CDC, 0x00481361, 0x00476019, 0x00483348, 0x00477D9B, 0x004802BF, 0x004795AB, 0x0047AC70, 0x00477C74, 0x0047D072, 0x00477D63, 0x0047f0c7, 0x00474f2d, 0x0047c3d5, 0x004781b3, 0x0047eae1, 0x0047842a, 0x0047ff17, 0x00476afa, 0x0047f9e0, 0x00474d99, 0x004823d0, 0x004775c5, 0x004827f5, 0x00478d6e, 0x00482f9e, 0x00475d2d, 0x0047b02f, 0x00475fc1, 0x0047c98b, 0x004750b4, 0x0047ce4b, 0x00475b01, 0x0047d7a0 }; ///////////////////////////////////////////////////////////////////////// // GameGuard Class // Description: // Used to generate keys to send to the server. class CGameGuard { protected: BLOWFISH_CTX blowfish_CTX; ///////////////////////////////////////////////////////////////////////// // blowfish_Encrypt() // Description: // Recreation of the encryption which uses the generic blowfish by INCA. void blowfish_Encrypt(unsignedlong *pInKey); ///////////////////////////////////////////////////////////////////////// // blowfish_Decrypt() // Description: // Recreation of the decryption which uses the generic blowfish by INCA. void blowfish_Decrypt(unsignedlong *pInKey); ///////////////////////////////////////////////////////////////////////// // inca_FunctionDemangle() // Description: // A recursive function called within the keygen used for demangling the index. unsignedint inca_FunctionDemangle(unsignedint iIndex, unsignedint iLevel); ///////////////////////////////////////////////////////////////////////// // inca_Rand() // Description: // INCA's own version of rand(). longint inca_Rand(); public: ///////////////////////////////////////////////////////////////////////// // gameguard_KeyGen() // Description: // The keygenerations for the server auth key from INCA. GG_AUTH gameguard_KeyGen(unsignedlong *pInKey); ///////////////////////////////////////////////////////////////////////// // CGameGuard() // Description: // The initialization to this class. CGameGuard(); ///////////////////////////////////////////////////////////////////////// // ~CGameGuard() // Description: // The deconstructor to this class. virtual ~CGameGuard(){} };
};

Code:

#include "GameGuard.h" GameGuard::CGameGuard::CGameGuard() { srand(time(NULL)); memset(&blowfish_CTX, 0, sizeof(blowfish_CTX)); Blowfish_Init(&blowfish_CTX, (unsignedchar*)INCA_SALT ,10); } void GameGuard::CGameGuard::blowfish_Decrypt(unsignedlong *pInKey) { Blowfish_Decrypt(&blowfish_CTX, &pInKey[1],&pInKey[3]); pInKey[2] ^= 0x64D84A; pInKey[3] ^= 0xF0F4C802; Blowfish_Decrypt(&blowfish_CTX, &pInKey[0],&pInKey[2]); pInKey[0] ^= 0xFD3A9D; pInKey[1] ^= 0x9D2DB902; } void GameGuard::CGameGuard::blowfish_Encrypt(unsignedlong *pInKey) { pInKey[0] ^= 0xAFD349D; pInKey[1] ^= 0x9D28B918; Blowfish_Encrypt(&blowfish_CTX, &pInKey[0],&pInKey[2]); pInKey[2] ^= 0xB64D24A; pInKey[3] ^= 0xF674C8B9; Blowfish_Encrypt(&blowfish_CTX, &pInKey[1],&pInKey[3]); } unsignedint GameGuard::CGameGuard::inca_FunctionDemangle(unsignedint iIndex,unsignedint iLevel) { int iPtr14 = 0x61; int iPtr18 = 0x62; int iPtr1c = 0x63; int iPtr20 = 0x64; int iPtr24 = 0x45; int iPtr4 = 0x46; int iPtr8 = 0x47; int iPtrc = 0x5A; int itemporaryValue; int edx = iLevel % 0xA; int iFinal = 0; if(edx == 1) { itemporaryValue = iPtr14; do { iIndex -= itemporaryValue; iIndex++; itemporaryValue--; }while(itemporaryValue > 0); } elseif(edx == 2) { iIndex -= iPtr18; iIndex += iPtrc - iPtr14; if( !(iLevel % 2)) iIndex--; } elseif(edx == 3) { iIndex++; iIndex -= iPtr20 * iPtrc; iIndex += 100; } elseif(edx == 4) { itemporaryValue = iPtr18; do { iIndex += itemporaryValue; iIndex--; itemporaryValue--; }while(itemporaryValue > 0); } elseif(edx == 5) iIndex -= (iPtr20 & iPtr8); elseif(edx == 6) iIndex += (iPtr24 & iPtrc); elseif(edx == 7) { iIndex -= iPtr14 + iPtrc; iIndex += iPtr20; } elseif(edx == 8) { itemporaryValue = iPtr1c; do { iIndex -= itemporaryValue; iIndex--; itemporaryValue--; }while(itemporaryValue > 0); } elseif(edx == 9) { if( iLevel % 3) { if( iLevel %3 == 1) iIndex++; else iIndex -= 2; } else iIndex--; } else { if(iLevel % 2) iIndex -= iPtr4 | iPtr1c; else iIndex -= iPtr8 | iPtr24; } if(iLevel >= 2) iFinal = inca_FunctionDemangle(iIndex,iLevel-2); else iFinal = iIndex; return iFinal; } longint GameGuard::CGameGuard::inca_Rand() { longint iResult = 0; for(int i = 0; i<8; i++) { longint m_temporaryValue = rand(); m_temporaryValue = m_temporaryValue%0x10; iResult |= m_temporaryValue<<(i<<2); } return result; } GameGuard::GG_AUTH GameGuard::CGameGuard::gameguard_KeyGen(unsignedlong *pInKey) { GameGuard::GG_AUTH gg_finalKey; unsignedint itemporaryValue; unsignedint iIndex; unsignedshort itempVar1 = 8; unsignedshort itempVar2 = 1; unsignedchar *keyPtr1; unsignedchar *keyPtr2; unsignedchar keyPTR; blowfish_Decrypt(pInKey); while(itempVar1) { keyPtr1 = (unsignedchar *)pInKey; keyPtr2 = (unsignedchar *)pInKey + itempVar2; for(unsignedshort i = 0; i < itempVar1; i++) { for(unsignedshort j = 0; j < itempVar2; j++) { keyPTR = (keyPtr1[0] ^ keyPtr2[0]); if(keyPTR & 0x80) { keyPTR *= 2; keyPTR ^= 0xA9; } else keyPTR *= 2; keyPtr1[0] ^= keyPTR; keyPtr1++; keyPtr2[0] ^= keyPTR; keyPtr2++; } keyPtr1 += itempVar2; keyPtr2 += itempVar2; } itempVar1 >>= 1; itempVar2 <<= 1; } itemporaryValue = pInKey[2]; pInKey[2] = pInKey[3]; pInKey[3] = itemporaryValue; itemporaryValue = pInKey[1]; pInKey[1] = pInKey[0]; pInKey[0] = itemporaryValue; pInKey[0] = pInKey[3] ^ itemporaryValue; unsignedlong pOutKey[4]; pOutKey[0] = 0x10056; pOutKey[1] = inca_Rand(); pOutKey[2] = inca_Rand(); pOutKey[3] = inca_Rand(); if(pInKey[0]) { iIndex = pInKey[0]; iIndex = GameGuard::GG_KEY_TABLE[(iIndex-1)%0x30]; } iIndex = inca_FunctionDemangle(iIndex, (pInKey[0]-1)%0x14+10); for(unsignedint iPtr2C = 0; (iPtr2C <= pInKey[0]) && (pInKey[0] <= 0x3E8); iPtr2C++) { iIndex = iIndex - 2 + (pInKey[2] ^ pInKey[3]) % 3; } /* Credits To Gene In This Portion - Polymorphic a bit of it needs to be changed */ itemporaryValue = pInKey[2]-0x35f3a386; itemporaryValue ^= 0xad5656c6; itemporaryValue += 0xd97e3d52; itemporaryValue -= 0xdfe08b35; itemporaryValue += 0x1c9f236d; itemporaryValue ^= 0x03f74ad0; pOutKey[1] = itemporaryValue; pOutKey[2] = itemporaryValue ^ 0xf8805824; /* End Credits to Gene */ itemporaryValue = pOutKey[0] ^ pOutKey[3]; pOutKey[3] = pOutKey[2] ^ pOutKey[1]; pOutKey[2] = itemporaryValue; itemporaryValue = pOutKey[0] ^ pOutKey[1]; pOutKey[0] = pOutKey[1]; pOutKey[1] = itemporaryValue; blowfish_Encrypt(pOutKey); gg_finalKey.dwIndex = pOutKey[0]; gg_finalKey.dwValue1 = pOutKey[1]; gg_finalKey.dwValue2 = pOutKey[2]; gg_finalKey.dwValue3 = pOutKey[3]; return gg_finalKey;
}

Code:

 *

#include "blowfish.h"

extern "C"
{
    void Blowfish_Init(BLOWFISH_CTX *ctx, unsigned char *key, int keyLen);
    void Blowfish_Encrypt(BLOWFISH_CTX *ctx, unsigned long *xl, unsigned long *xr);
    void Blowfish_Decrypt(BLOWFISH_CTX *ctx, unsigned long *xl, unsigned long *xr);
};

#define INCA_SALT "@SAU^T2*KY"
#define LOG_FILE "GGDestroyer.txt"

BLOWFISH_CTX blowfish_CTX;
void Log(const char* lpcFmt, ...){
    char szBuf[0x4000];
    va_list vaArgs;
    va_start(vaArgs, lpcFmt);
    _vsnprintf(szBuf, sizeof(szBuf), lpcFmt, vaArgs);
    va_end(vaArgs);
    szBuf[0x4000-1] = 0;
    
    FILE* f = fopen(LOG_FILE,"a");
    fprintf(f,szBuf);
    fclose(f);
}

static long int keytable_a[] = 
{ 
    0xBB81C25F, 0x7B59CD33, 0x2CEEA53C, 0xA6F6D818, 0xB3CC25D6, 0x939EA3AA, 0xA80E9B0C, 0x89F289A9, 0x33754F81, 0xD4F3D2E7, 
    0xDFE08B35, 0xDB52D835, 0xC332A8E9, 0xD7EFE273, 0x591BEF5D, 0x129D4B53, 0xEB6DB874, 0xE40B4BD5, 0xA0084DFE, 0xB62B4B9B, 
    0x02AD07BD, 0xB3CE8586, 0x3A2E2E70, 0x31A46056, 0xA26B0C29, 0xABA0270D, 0x9115FA79, 0x3981123B, 0x512E4042, 0x35299AD2, 
    0x4B464853, 0x1859E8A2, 0x985E3B9F, 0xF9C2567D, 0xA03882B6, 0x54754C14, 0xDE946598, 0x6F12F367, 0x6A634E08, 0x867CC428, 
    0xAD5656C6, 0xFF72F827, 0xE05FF5C3, 0x15D6D946, 0x7B1F75B0, 0x3178CF46, 0xB9852F7E, 0x9B4B03F7, 0xD1545CCF, 0x9C9EFE2A, 
    0x4E7C4492, 0x8EC4DAB1, 0x47AF6199, 0xA96CFE6D, 0x27ADEBA6, 0x5748B50F, 0x35673D88, 0xE0495767, 0xCC9F8E22, 0x9E3F3D66, 
    0x23243733, 0xC9DD91CE, 0xB4DA939E, 0xBBF2CA50, 0xB87FF903, 0xCC8023FC, 0x68C6A373, 0x4528F454, 0x3EBFE99F, 0x70CA9668, 
    0x710C2548, 0xB63933FA, 0x5B7C905F, 0x5F3453BB, 0x35F3A386, 0x94AE1E9B, 0x784F86CC, 0xDF46EF5C, 0x4C3393C3, 0x68ED1FCE, 
    0x1C9F236D, 0x8976E5C3, 0x20258E69, 0x9A91AC1B, 0xC1D40FBA, 0xE44EBC89, 0x476FFC00, 0xB12F5EEB, 0x0DA7913B, 0x6A35DB14, 
    0x3B6C550E, 0x37119DD5, 0x497F6269, 0x81C4DBFE, 0x62A1210D, 0xA2EEF041, 0x0DC4FACB, 0xD27134AF, 0x64A80774, 0x7B2FE0D8, 
    0xE11FB1DA, 0xD5C76EAE, 0xBBD840CC, 0x3A3AF6F1, 0x3CD62F1C, 0xF23BF183, 0xCEDA959C, 0x67A99824, 0xA8B4DB1B, 0xC14754A6, 
    0x24255B5C, 0x79F45FEA, 0x9B0E4E3F, 0xB9821090, 0x46210D85, 0xE9B1B2BA, 0x8E5EE01F, 0x5354ADE8, 0xBC6632AD, 0x4F4A2B1C, 
    0x092B4913, 0x17569306, 0xEE6D613F, 0x13473088, 0x93FDD1D3, 0x8DEF5A63, 0x63AD03B0, 0xCD1E5A87, 0xA65D20B7, 0x2DA779A6, 
    0xA5BEA0AA, 0xE5591190, 0xC8A2BD58, 0x6E077A37, 0x3AF9B094, 0xF270FD3B, 0x6287F12E, 0xD976C38F, 0x9B05CAE6, 0x6DF955F1, 
    0x1C5C64AF, 0xE69CFD34, 0x3F4A4829, 0xBE4EE239, 0x5EB1AE55, 0x2DD17FB1, 0xA051C0E4, 0x7D060C8C, 0x9F0B06B7, 0x06BED38B, 
    0x54A1CB8F, 0x22AA4B70, 0x59E3364E, 0x19BA9F2C, 0xD5A2B1A3, 0x34A1177F, 0x22C09480, 0xDD5E2C1B, 0x99FD19B7, 0x3C8908F0, 
    0x832AA9F8, 0xBB1102D0, 0x29097D23, 0x92C8859C, 0xE38AFD1B, 0x3B7BC9F4, 0x0C5E5390, 0xEEF927CA, 0xDC66F863, 0xF504E9DE, 
    0xAC643475, 0xA87D6602, 0xC4494177, 0x4025D907, 0x9FB4784A, 0x47DCBACD, 0x44A831AF, 0xD6652215, 0x4EC5C687, 0x45AF9BA2, 
    0xD48D7094, 0x0D5C5C62, 0x412088B5, 0x484D9019, 0xECEF56AD, 0x5E53DF96, 0x003B445B, 0x995E329A, 0xF4C68B72, 0x51012307, 
    0x128073E2, 0xEF3BEABE, 0xA33B677C, 0x8DCEDF5F, 0xE1A79DE1, 0x848B3DDC, 0x43957112, 0x5C336DF6, 0x03F74AD0, 0x2EB6A68D, 
    0x8A8C42FC, 0x54C74362, 0xF108E247, 0x2635AC47, 0xC1695282, 0xFEF20A1D, 0x2262FC9F, 0x04AFB6A4, 0x8FD3194D, 0xC23C19AE, 
    0x208D015F, 0x607C6D0C, 0x5E421EB5, 0x382E0A8E, 0x61D2891F, 0x92253905, 0xB42FCB50, 0xD7304333, 0x7FF90C38, 0x31309209, 
    0x1A11B6A8, 0x19E86D48, 0xC0580251, 0xC6271FA0, 0xF8805824, 0x94C0E012, 0xED79F2E2, 0xCA722A50, 0xF6F4395C, 0xA13F343B, 
    0x5DD36564, 0x92B85983, 0x6BE6D0C9, 0xE7CDE12A, 0x8AFFC34E, 0xE94125D0, 0xF9DDA7D2, 0xD0F36E77, 0x0A54A428, 0x16B506B0, 
    0x0E42341F, 0xE258448B, 0x467A807A, 0xB09D73AA, 0x1BBCF019, 0xA744FCFD, 0xD6D9DEBD, 0x30400626, 0xB0A37337, 0x95600B25, 
    0x22FA1868, 0x2E6635BC, 0x64AF2511, 0x2413FCBC, 0xC164E404, 0xF25879D5, 0x91199D20, 0xDEF53609, 0x2D8F9B27, 0x33BD5A18, 
    0xDD8835DB, 0x4A6F40B4, 0xDCF4D42C, 0x5AFD50DE, 0x9184A3CA, 0xCF08C336, 0x571AF998, 0xE081E2AD, 0x65763066, 0x06480706, 
    0x1589A0F5, 0x6B0F8A1F, 0xB1F58436, 0x57A8B4AC, 0xA0AA43DA, 0x43A2CE8C, 0x1C7916B2, 0x6AAF2190, 0x7E14589F, 0x02AF279A, 
    0x006B5062, 0x96C5075B, 0x194F67DD, 0x4EC01CA3, 0xF362D8CF, 0x6482BF64, 0xF7B4FA0B, 0x51C6275F, 0x7EE61750, 0x6D6FBF44, 
    0xA1EA7791, 0xE12CCE14, 0xF86F859E, 0x16E3AF71, 0xAE497827, 0x57768B5C, 0x0B66A91F, 0xEA87D985, 0x68796326, 0x2A14E4BE, 
    0x1D620D3D, 0x60D1F3D8, 0x75F3D116, 0xE49E51A3, 0xB8EC2780, 0x0F3B57F1, 0x4E2E497D, 0x1B8B5CA2, 0x626B709E, 0x504DAB78, 
    0x6B9325C5, 0x28438B33, 0x937780C1, 0xDB6D48B5, 0x44C8FB85, 0xA37E38DE, 0xC598CFB1, 0xF835B550, 0x70374436, 0x0475190C, 
    0x9EF7C4D4, 0x3F1D8CC2, 0x6978985E, 0xD2EE7744, 0x588B0994, 0x27AB3373, 0xA5E15F67, 0x8724092F, 0xB98CF499, 0x4A593309, 
    0xBD2C10F9, 0xA9DC2903, 0x1A931E49, 0x0E9E14EE, 0x0891556A, 0xB1605D7A, 0xF2170F2E, 0xFC034E99, 0x20D68445, 0x27572E0C, 
    0xEBA01EBF, 0x8B1F5893, 0x8B55262F, 0x822A141F, 0x6BB7F475, 0x454ACC63, 0xB386C371, 0x4C50974D, 0xEBB30AE6, 0xB01C0081, 
    0x2E0FE2A4, 0xFB613F0E, 0xE34CC68D, 0x450E9D75, 0x654AFD50, 0x08D563C8, 0x0BDAC1DF, 0x8CA70BC8, 0xFFCE8AFB, 0x0B25BC25, 
    0x9AE68266, 0xED50D1D1, 0x460402FF, 0x6CE8A29C, 0x4AF77399, 0xF0AF7938, 0xE0820DF3, 0xB277AD96, 0x71861AF0, 0x2C2E7976, 
    0x46C30360, 0x766835AA, 0xA81A0014, 0x0A354AF2, 0xF05C7BCD, 0x1045F140, 0x673B9D5C, 0x026B7454, 0x6697DE92, 0x28763AF0, 
    0x35417950, 0xBC478EF5, 0x2F1BB557, 0x1691A833, 0x8CD50B89, 0x9044E27C, 0xA5609595, 0x7210A380, 0xE27ECC5E, 0x15D72641, 
    0x7EEFE9B3, 0xC36AB360, 0xC0844567, 0xC49AB3DD, 0x132F384A, 0x72286069, 0xBEA10C2C, 0x15F511C7, 0xFBB8F9D0, 0x07C121E5, 
    0x24397916, 0x907EE887, 0xA003B5CF, 0x0ACD9F8C, 0xA9D726BC, 0xBD9F8F95, 0x9887F4AF, 0xF3A502A4, 0xB7F38987, 0x04DF707A, 
    0x5DDC2E06, 0x49EF12E7, 0xC4142C0E, 0x0CB741AD, 0x556BDB5E, 0x850646AD, 0x69A275B9, 0x2EBD7BB7, 0x29BA720F, 0x2F8F188C, 
    0x0D450C10, 0xE25B760F, 0x40449CBF, 0xBFE4EEFE, 0x3A665BBC, 0xE019D92D, 0x249EA1D8, 0xBDBC617A, 0x668CD9F4, 0x7F8E0E99, 
    0x5B2239E1, 0x905FF989, 0x2B201D60, 0x49029BEC, 0x4E77BC63, 0xD2562DA2, 0xFFD98099, 0xB42DF97D, 0x8505B2D5, 0x0948675D, 
    0x4AFFBAE6, 0x4978B0E4, 0x8855B2BF, 0xAE8D3D12, 0x961A13FF, 0x805A47AA, 0xDEFE3589, 0x28BE386A, 0x89B3323D, 0xF06B3826, 
    0xE14993CC, 0x1142C0CC, 0x6D619017, 0x03140900, 0x47EC74FF, 0xFFA16DB1, 0xE88CA635, 0x3FDB23B0, 0x79315FAA, 0x3B74A6C1, 
    0x53BDE900, 0x2D4B2EBF, 0xEED0AE36, 0x5D220451, 0x656BE40F, 0x35D97284, 0x202FF74A, 0xED33F0FC, 0x780E2EBA, 0xEF0FA8A8, 
    0xA5C8C33E, 0x632FF03A, 0x023F1E99, 0xC2543492, 0xF7228AAB, 0x467FAC82, 0xBC654D25, 0x484192DA, 0x8CC6C3F8, 0x1FAA5E5C, 
    0xDE1833E5, 0xF75D49E8, 0xED2BF8CD, 0x4739BC40, 0x10B05852, 0x5800D146, 0x91B9AF83, 0x63A22FC7, 0xC9E62402, 0xD3E2C178, 
    0x021941A1, 0xFE802F49, 0x93213E5F, 0x0F5C830A, 0xC6C166CF, 0x6F38446C, 0xE4DA00D1, 0x55E5AD51, 0x462B7556, 0x4D44069B
};

void init()
{
    srand((unsigned int)time(NULL));
    memset(&blowfish_CTX, 0, sizeof(blowfish_CTX));
    Blowfish_Init(&blowfish_CTX, (unsigned char*)INCA_SALT ,10);    
}

long int inca__rand()
{
    long int res = 0;
    for(int i = 0; i<8; i++)
    {
          long int temp = rand();
          temp = temp%0x10;
          res |= temp<<(i<<2);
    }
    return res;
}

void blowfish__decrypt(unsigned long *key)
{
    Blowfish_Decrypt(&blowfish_CTX, &key[1],&key[3]);
    key[2] ^= 0x64D84A;
    key[3] ^= 0xF0F4C802;
    Blowfish_Decrypt(&blowfish_CTX, &key[0],&key[2]);
    key[0] ^= 0xFD3A9D;
    key[1] ^= 0x9D2DB902;
}


void blowfish__encrypt(unsigned long *key)
{
    key[0] ^= 0xAFD349D;
    key[1] ^= 0x9D28B918;
    Blowfish_Encrypt(&blowfish_CTX, &key[0],&key[2]);
    key[2] ^= 0xB64D24A;
    key[3] ^= 0xF674C8B9;
    Blowfish_Encrypt(&blowfish_CTX, &key[1],&key[3]);
}

unsigned long get_index(char* key)
{
    unsigned long keyone = 0;
    unsigned long keytwo = 0;
    unsigned long keythree = 0;
    unsigned long keyfour = 0;

    sscanf(key,"%X %X %X %X",&keyone,&keytwo,&keythree,&keyfour);

    unsigned long keys[4] = { keyone, keytwo, keythree, keyfour };
    blowfish__decrypt(keys);
    return keys[0];
}

unsigned long* inca__keygen(unsigned long* inkey)
{
    unsigned short first = 8;
    unsigned short second = 1;
    unsigned int temp;
    unsigned int index;
    unsigned char* ptr1;
    unsigned char* ptr2;
    unsigned char ptr;
    unsigned long* outkey = (unsigned long*)malloc(4*4);

    blowfish__decrypt(inkey);
    
    if(inkey[0] == 0x000)
    {
        // static key
        outkey[0] = 0xd5091f33;
        outkey[1] = 0x7ea484fa;
        outkey[2] = 0xbb6d43d1;
        outkey[3] = 0xbee38f18;
        return outkey;
    }
    else
    {
        while(first)
        {
            ptr1 = (unsigned char*)inkey;
            ptr2 = (unsigned char*)inkey+second;
            
            for (unsigned short i = 0; i < first; i++)
            {
                for (unsigned short j = 0; j < second; j++)
                {
                    ptr = (ptr1[0] ^ ptr2[0]);

                    if (ptr & 0x80)
                    {
                        ptr *= 2;
                        ptr ^= 0xA9;
                    }
                    else
                        ptr *= 2;

                    ptr1[0] ^= ptr;
                    ptr1++;
                    ptr2[0] ^= ptr;
                    ptr2++;
                }
            
                ptr1 += second;
                ptr2 += second;
            }
        
            first >>= 1;
            second *= 2;
        }

        temp = inkey[2];
        inkey[2] = inkey[3];
        inkey[3] = temp;
        temp = inkey[1];
        inkey[1] = inkey[0];
        inkey[0] = inkey[3] ^ temp;
        
        outkey[0] = 0x10056;
        outkey[1] = inca__rand();
        outkey[2] = inca__rand();
        outkey[3] = inca__rand();

        Log("INDEX: %x\n",inkey[0]);

        // fuck u Themida Virtual Machine.
        switch(inkey[0])
        {
        case 0x001:
        {
            DWORD GlobalVal1 = 0xA2EEF041;
            DWORD GlobalVal2 = 0x35673D88;
            DWORD GlobalVal3 = 0xA65D20B7;
            DWORD GlobalVal4 = 0xF7228AAB;
            DWORD GlobalVal5 = 0xFFD98099;
            DWORD GlobalVal6 = 0x1F000059;
            DWORD GlobalVal7 = 0xF1CFBE7F;

            DWORD TempVal1 = 0x00;
            DWORD TempVal2 = 0x00;

            TempVal1 = inkey[3] - GlobalVal1;
            TempVal1 = TempVal1       - GlobalVal2;
            TempVal2 = TempVal1       + 0x4270D0F0;
            TempVal1 = TempVal1       + GlobalVal3;

            TempVal2 = GlobalVal4     - TempVal2;
            TempVal1 = TempVal2       - GlobalVal5;
            TempVal2 = TempVal2       + GlobalVal6;
            TempVal1 = TempVal1       + GlobalVal7;
            
            outkey[1] = TempVal2;
            outkey[2] = TempVal1;
            break;
        }
        case 0x00C:
        {
            DWORD TempVal1 = 0x00;
            DWORD TempVal2 = 0x00;
            DWORD TempVal3 = 0x00;

            TempVal1 = inkey[2] ^ 0xA0084DFE;
            TempVal2 = TempVal1 - 0x9C9EFE2A;
            TempVal1 = 0xDFE08B35 - TempVal1;
            TempVal1 = TempVal1 + 0xC921EEB5;
            TempVal3 = 0x70CA9668 - 0x12CC72A5;

            TempVal1 += 2;

            TempVal2 = TempVal1 - 0x6DF955F1;
            TempVal2 = TempVal1 ^ TempVal3;

            outkey[1] = TempVal1;
            outkey[3] = TempVal2;

            break;
        }
        case 0x012:
        {
            DWORD TempVal1 = 0x00;
            DWORD TempVal2 = 0x00;

            TempVal1 = inkey[3] + 0x49167F43;
            TempVal1 = TempVal1 + 0xF9C2567D;
            TempVal1 = TempVal1 - 0xDF46EF5C;
            TempVal1 = TempVal1 + 0xF7AC72B1;
            TempVal2 = TempVal1 & 0x476FFC00;
            TempVal2 = TempVal2 ^ 0x30400626;
            TempVal2 = TempVal2 - 0x3EBFE99F;
            TempVal2 = TempVal2 + 0x6A01E805;
            
            outkey[3] = TempVal1;
            outkey[1] = TempVal2;

            break;
        }
        case 0x021:
        {
            DWORD TempVal1 = inkey[2] ^ 0xA0084DFE;
            DWORD TempVal2 = TempVal1 - 0x9C9EFE2A;

            TempVal1 += 0xDFE08B35;
            TempVal1 += 0xA6ED8601;

            DWORD TempVal3 = 0x70CA9668 + 0x2284AE0D;
            TempVal1 += 2;

            TempVal2 = TempVal1 - 0x6DDF955F1;
            TempVal2 = TempVal1 ^ TempVal3;

            outkey[3] = TempVal1;
            outkey[1] = TempVal2;

            break;
        }
        case 0x013:
        {
            DWORD GlobalVal1 = 0xA0084DFE;
            DWORD GlobalVal2 = 0x9C9EFE2A;
            DWORD GlobalVal3 = 0xDFE08B35;
            DWORD GlobalVal4 = 0x6330DC47;
            DWORD GlobalVal5 = 0x70CA9668;
    
            DWORD TempVal1 = 0x00;
            DWORD TempVal2 = 0x00;
            DWORD TempVal3 = 0x00;

            TempVal1 = inkey[2] - GlobalVal1;
            TempVal2 = TempVal1       + GlobalVal2;
            TempVal1 = TempVal1       ^ GlobalVal3;
            TempVal1 = TempVal1       + GlobalVal4;
            TempVal3 = GlobalVal5     - 0x6D399CCC;
 
            TempVal1 += 2;

            TempVal2 = TempVal1 - TempVal3;
            
            outkey[1] = TempVal1;
            outkey[3] = TempVal2;
            break;
        }
        case 0x014:
        {
            DWORD TempVal1 = inkey[2] ^ 0xA0084DFE;
            DWORD TempVal2 = TempVal1 + 0x9C9EFE2A;

            TempVal1 += 0xDFE08B35;
            TempVal1 += 0x021180ED;

            DWORD TempVal3 = 0x70CA9668 - 0x0A549B92;

            TempVal1 += 2;

            TempVal2 = TempVal1 + 0x6DF955F1;
            TempVal2 = TempVal1 ^ TempVal3;

            inkey[1] = TempVal1;
            inkey[3] = TempVal2;

            break;
        }

        case 0x017:
        {
            DWORD GlobalVal1 = 0xA0084DFE; 
            DWORD GlobalVal2 = 0x9C9EFE2A; 
            DWORD GlobalVal3 = 0xDFE08B35; 
            DWORD GlobalVal4 = 0x3097ABA4; 
            DWORD GlobalVal5 = 0x70CA9668; 
            DWORD GlobalVal6 = 0x6DF955F1; 
            
            DWORD TempVal1 = 0x00; 
            DWORD TempVal2 = 0x00; 
            DWORD TempVal3 = 0x00; 
            
            TempVal1 = inkey[2] - GlobalVal1;     
            TempVal2 = TempVal1 ^ GlobalVal2; 
            TempVal1 = TempVal1 ^ GlobalVal3; 
            TempVal1 = TempVal1 + GlobalVal4; 
            TempVal3 = GlobalVal5 ^ 0xD149E53C; 
            TempVal1 = TempVal1 + 2; 
            TempVal2 = TempVal1 - TempVal3; 
            
            outkey[1] = TempVal1; 
            outkey[3] = TempVal2; 
            break;
        }
        case 0x011:
        {
            DWORD TempVal1 = 0x0A;
            DWORD TempVal2 = 0x14;
            DWORD TempVal3 = 0x1E;

            TempVal1 = inkey[2] + 0xA65D20B7;
            TempVal1 += 0x20258E69;
            TempVal1 |= 0x1011;

            TempVal3 = 0x7B2FE0D8 ^ 0x750D34FF;
            DWORD TempVal4 = TempVal1 ^ TempVal3;
            
            TempVal1 |= 0x7FF90C38;
            TempVal1 += 0x556A4AD7;

            TempVal2 = keytable_a[TempVal4 % 0x1F4] ^ TempVal1;
            TempVal2 += 1;

            outkey[3] = TempVal2;
            outkey[1] = TempVal1;
            break;
        }
        case 0x02A:
        {
            DWORD GlobalVal1 = 0xA65D20B7;
            DWORD GlobalVal2 = 0x20258E69;
            DWORD GlobalVal3 = 0x7B2FE0D8;
            DWORD GlobalVal4 = 0x7FF90C38;
            DWORD GlobalVal5 = 0x96E21B47;
            DWORD GlobalVal6 = 0x5850FF75; 

            DWORD TempVal1 = 0x0A;
            DWORD TempVal2 = 0x14;
            DWORD TempVal3 = 0x1E;

            TempVal1 = inkey[2] + GlobalVal1;
            TempVal1 += GlobalVal2;
            TempVal1 |= 0x1011;

            TempVal3 = GlobalVal3 - 0x0FC2B42;

            DWORD GlobalVal = TempVal1 ^ TempVal3;

            TempVal1 |= GlobalVal4;
            TempVal1 += GlobalVal5;

            TempVal2 = keytable_a[GlobalVal % 0x1F4] + TempVal1;
            TempVal2 += GlobalVal6;

            outkey[1] = TempVal1;
            outkey[3] = TempVal2;
            break;
        }
        case 0x028:
        {
            DWORD GlobalVal1 = 0xA65D20B7;
            DWORD GlobalVal2 = 0x20258E69;
            DWORD GlobalVal3 = 0x7B2FE0D8;
            DWORD GlobalVal4 = 0x7FF90C38;
            DWORD GlobalVal5 = 0x85D3D618;
            DWORD GlobalVal6 = 0x5850FF75;

            DWORD TempVal1 = 0x0A;
            DWORD TempVal2 = 0x14;
            DWORD TempVal3 = 0x1E;

            TempVal1 = inkey[2] + GlobalVal1;
            TempVal1 = TempVal1 - GlobalVal2;
            TempVal1 |= 0x1011;

            TempVal3 = 0x6A68EC6A - GlobalVal3;
            DWORD TempAddress = TempVal1 - TempVal3;

            TempVal1 |= GlobalVal4;
            TempVal1 = TempVal1 + GlobalVal5;

            TempVal2 = keytable_a[TempAddress % 0x1F4];
            TempVal2 = TempVal2 - TempVal1;

            TempVal2 += GlobalVal6;

            outkey[3] = TempVal2;
            outkey[1] = TempVal1;        
            break;
        }
        case 0x006:
        {
            DWORD TempVal1 = inkey[2] - 0xA0084DFE;
            DWORD TempVal2 = TempVal1 ^ 0x9C9EFE2A;
            TempVal1 ^= 0xDFE08B35;
            TempVal1 += 0x30B6CC64;

            DWORD TempVal3 = 0x70CA9668 ^ 0xD149E53C;
            TempVal1 += 2;
            TempVal2 = TempVal1 ^ 0x6DF955F1;
            TempVal2 = TempVal1 - TempVal3;

            outkey[1] = TempVal1;
            outkey[3] = TempVal2;
            break;
        }
        case 0x008:
        {
            DWORD TempVal1 = inkey[2] ^ 0xA0084DFE;
            DWORD TempVal2 = TempVal1 - 0x9C9EFE2A;
            
            TempVal1 += 0xDFE08B35;
            TempVal1 += 0xD677BA21;

            DWORD TempVal3 = 0x70CA9668 - 0x54F31548;
            TempVal1 += 2;

            TempVal2 = TempVal1 - 0x6DF955F1;
            TempVal2 = TempVal1 ^ TempVal3;

            outkey[1] = TempVal1;
            outkey[3] = TempVal2;
            break;
        }
        case 0x015:
        {
            DWORD TempVal1 = inkey[2] ^ 0xA0084DFE;
            DWORD TempVal2 = TempVal1 - 0x9C9EFE2A;
            TempVal1 += 0xDFE08B35;
            TempVal1 += 0xA6ED8601;
            DWORD TempVal3 = 0x70CA9668 + 0x2284AE0D;

            TempVal1 += 2;
            TempVal2 = TempVal1 - 0x6DF955F1;
            TempVal2 = TempVal1 ^ TempVal3;

            //346BAC9D
            //27587C40
        
            outkey[1] = TempVal1;
            outkey[3] = TempVal2;

            break;
        }
        case 0x01F:
        {
            DWORD GlobalVal1 = 0x35F3A386;
            DWORD GlobalVal2 = 0xAD5656C6;
            DWORD GlobalVal3 = 0x51300592;
            DWORD GlobalVal4 = 0xDFE08B35;
            DWORD GlobalVal5 = 0x1C9F236D;
            DWORD GlobalVal6 = 0x03F74AD0;
            DWORD GlobalVal7 = 0xF8805824;

            DWORD TempVal1 = inkey[2] - GlobalVal1;
            
            TempVal1 -= GlobalVal2;
            TempVal1 += GlobalVal3;
            TempVal1 ^= GlobalVal4;
            TempVal1 ^= GlobalVal5;
            TempVal1 ^= GlobalVal6;

            DWORD TempVal2 = TempVal1 - GlobalVal7;
            outkey[1] = TempVal1;
            outkey[2] = TempVal2;
            break;
        }
        }
        

        temp = outkey[0] ^ outkey[3];
        outkey[3] = outkey[2] ^ outkey[1];
        outkey[2] = temp;
        temp = outkey[0] ^ outkey[1];
        outkey[0] = outkey[1];
        outkey[1] = temp;

    }

    blowfish__encrypt(outkey);

    return outkey;
}

unsigned long* inca__keygen(char* key)
{
    unsigned long keyone = 0;
    unsigned long keytwo = 0;
    unsigned long keythree = 0;
    unsigned long keyfour = 0;

    sscanf(key,"%X %X %X %X",&keyone,&keytwo,&keythree,&keyfour);

    unsigned long inkey[4] = { keyone, keytwo, keythree, keyfour };

    return inca__keygen(inkey); 
}

HERE THE FULL SOURCE CODE TO BYPASS GG CHANGE THE OLD HOOD ADDRESS

Hacking Requirements

A Brain
Hands
A little tiny bit knowledge on hacking.

Credit by: mauka

READ MY WIKI

C++ GAMEGUARD SOURCE

Post a Reply

Similar Threads

Tags for this Thread