From 0b67eab1d1030b4f1e30b56c699bc4e642995d72 Mon Sep 17 00:00:00 2001 From: atom0s Date: Fri, 15 Apr 2022 19:28:59 -0700 Subject: [PATCH] Unpacker v2.1 (x86) - Updated the header information based on new sample info. --- .../Classes/SteamStubHeader.cs | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/Steamless.Unpacker.Variant21.x86/Classes/SteamStubHeader.cs b/Steamless.Unpacker.Variant21.x86/Classes/SteamStubHeader.cs index 70c7dee..9199612 100644 --- a/Steamless.Unpacker.Variant21.x86/Classes/SteamStubHeader.cs +++ b/Steamless.Unpacker.Variant21.x86/Classes/SteamStubHeader.cs @@ -34,11 +34,11 @@ namespace Steamless.Unpacker.Variant21.x86.Classes public struct SteamStub32Var21Header { public uint XorKey; // The base XOR key, if defined, to unpack the file with. - public uint GetModuleHandleA_idata; // The address of GetModuleHandleA inside of the .idata section. - public uint GetModuleHandleW_idata; // The address of GetModuleHandleW inside of the .idata section. - public uint GetProcAddress_idata; // The address of GetProcAddress inside of the .idata section. - public uint LoadLibraryA_idata; // The address of LoadLibraryA inside of the .idata section. - public uint Unknown0000; // Unknown (Was 0 when testing. Possibly LoadLibraryW.) + public uint GetModuleHandleA; // The address of GetModuleHandleA. (If set.) + public uint GetModuleHandleW; // The address of GetModuleHandleW. (If set.) + public uint GetProcAddress; // The address of GetProcAddress. (If set.) + public uint LoadLibraryA; // The address of LoadLibraryA. (If set.) + public uint LoadLibraryW; // The address of LoadLibraryW. (If set.) public uint BindSectionVirtualAddress; // The virtual address to the .bind section. public uint BindStartFunctionSize; // The size of the start function from the .bind section. public uint PayloadKeyMatch; // The key inside of the SteamDRMP.dll file that is matched to this structures data. (This matches the first 4 bytes of the payload data.) @@ -54,7 +54,7 @@ namespace Steamless.Unpacker.Variant21.x86.Classes public uint SteamDRMPDllSize; // The offset inside of the payload data holding the size of the SteamDRMP.dll file data. public uint XTeaKeys; // The offset inside of the payload data holding the address to the Xtea keys to decrypt the SteamDRMP.dll file. - [MarshalAs(UnmanagedType.ByValArray, SizeConst = 0x31C)] + [MarshalAs(UnmanagedType.ByValArray, SizeConst = 0x2B8)] public byte[] StubData; // Misc stub data, such as strings, error messages, etc. } @@ -65,10 +65,10 @@ namespace Steamless.Unpacker.Variant21.x86.Classes public struct SteamStub32Var21Header_D0Variant { public uint XorKey; // The base XOR key, if defined, to unpack the file with. - public uint GetModuleHandleA_idata; // The address of GetModuleHandleA inside of the .idata section. - public uint GetModuleHandleW_idata; // The address of GetModuleHandleW inside of the .idata section. - public uint GetProcAddress_idata; // The address of GetProcAddress inside of the .idata section. - public uint LoadLibraryA_idata; // The address of LoadLibraryA inside of the .idata section. + public uint GetModuleHandleA; // The address of GetModuleHandleA. (If set.) + public uint GetModuleHandleW; // The address of GetModuleHandleW. (If set.) + public uint GetProcAddress; // The address of GetProcAddress. (If set.) + public uint LoadLibraryA; // The address of LoadLibraryA. (If set.) public uint BindSectionVirtualAddress; // The virtual address to the .bind section. public uint BindStartFunctionSize; // The size of the start function from the .bind section. public uint PayloadKeyMatch; // The key inside of the SteamDRMP.dll file that is matched to this structures data. (This matches the first 4 bytes of the payload data.)