From a278875e1c3004702598a3fed7c193d8010d4970 Mon Sep 17 00:00:00 2001 From: atom0s Date: Fri, 29 Mar 2024 22:04:56 -0700 Subject: [PATCH] Unpacker: (variant31.x86) Fixed AES decryption not properly handling the code section, leading to junk data being copied into unpacked file. Unpacker: (variant31.x86) Fixed AES decryption not properly preserving non-encrypted data. --- Steamless.Unpacker.Variant31.x86/Main.cs | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/Steamless.Unpacker.Variant31.x86/Main.cs b/Steamless.Unpacker.Variant31.x86/Main.cs index 92fe6c1..923b105 100644 --- a/Steamless.Unpacker.Variant31.x86/Main.cs +++ b/Steamless.Unpacker.Variant31.x86/Main.cs @@ -404,9 +404,9 @@ namespace Steamless.Unpacker.Variant31.x86 this.Log($" --> {codeSection.SectionName} section is encrypted.", LogMessageType.Debug); // Obtain the code section data.. - var codeSectionData = new byte[codeSection.SizeOfRawData + this.StubHeader.CodeSectionStolenData.Length]; + var codeSectionData = new byte[(long)this.StubHeader.CodeSectionRawSize + this.StubHeader.CodeSectionStolenData.Length]; Array.Copy(this.StubHeader.CodeSectionStolenData, 0, codeSectionData, 0, this.StubHeader.CodeSectionStolenData.Length); - Array.Copy(this.File.FileData, this.File.GetFileOffsetFromRva(codeSection.VirtualAddress), codeSectionData, this.StubHeader.CodeSectionStolenData.Length, codeSection.SizeOfRawData); + Array.Copy(this.File.FileData, this.File.GetFileOffsetFromRva(codeSection.VirtualAddress), codeSectionData, this.StubHeader.CodeSectionStolenData.Length, (long)this.StubHeader.CodeSectionRawSize); // Create the AES decryption helper.. var aes = new AesHelper(this.StubHeader.AES_Key, this.StubHeader.AES_IV); @@ -417,8 +417,11 @@ namespace Steamless.Unpacker.Variant31.x86 if (data == null) return false; - // Set the code section override data.. - this.CodeSectionData = data; + // Merge the code section data into the original.. + var sectionData = this.File.SectionData[this.CodeSectionIndex]; + Array.Copy(data, sectionData, (long)this.StubHeader.CodeSectionRawSize); + + this.CodeSectionData = sectionData; return true; }