/** * Steamless - Copyright (c) 2015 - 2024 atom0s [atom0s@live.com] * * This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License. * To view a copy of this license, visit http://creativecommons.org/licenses/by-nc-nd/4.0/ or send a letter to * Creative Commons, PO Box 1866, Mountain View, CA 94042, USA. * * By using Steamless, you agree to the above license and its terms. * * Attribution - You must give appropriate credit, provide a link to the license and indicate if changes were * made. You must do so in any reasonable manner, but not in any way that suggests the licensor * endorses you or your use. * * Non-Commercial - You may not use the material (Steamless) for commercial purposes. * * No-Derivatives - If you remix, transform, or build upon the material (Steamless), you may not distribute the * modified material. You are, however, allowed to submit the modified works back to the original * Steamless project in attempt to have it added to the original project. * * You may not apply legal terms or technological measures that legally restrict others * from doing anything the license permits. * * No warranties are given. */ namespace Steamless.Unpacker.Variant10.x86 { using API; using API.Events; using API.Extensions; using API.Model; using API.PE32; using API.Services; using Classes; using System; using System.IO; using System.Linq; using System.Reflection; [SteamlessApiVersion(1, 0)] public class Main : SteamlessPlugin { /// /// Internal logging service instance. /// private LoggingService m_LoggingService; /// /// Gets the author of this plugin. /// public override string Author => "atom0s"; /// /// Gets the name of this plugin. /// public override string Name => "SteamStub Variant 1.0 Unpacker (x86)"; /// /// Gets the description of this plugin. /// public override string Description => "Unpacker for the 32bit SteamStub variant 1.0."; /// /// Gets the version of this plugin. /// public override Version Version => Assembly.GetExecutingAssembly().GetName().Version; /// /// Internal wrapper to log a message. /// /// /// private void Log(string msg, LogMessageType type) { this.m_LoggingService.OnAddLogMessage(this, new LogMessageEventArgs(msg, type)); } /// /// Initialize function called when this plugin is first loaded. /// /// /// public override bool Initialize(LoggingService logService) { this.m_LoggingService = logService; return true; } /// /// Processing function called when a file is being unpacked. Allows plugins to check the file /// and see if it can handle the file for its intended purpose. /// /// /// public override bool CanProcessFile(string file) { try { // Load the file.. var f = new Pe32File(file); if (!f.Parse() || f.IsFile64Bit() || !f.HasSection(".bind")) return false; // Obtain the bind section data.. var bind = f.GetSectionData(".bind"); // Attempt to locate the known v1.x signature.. var variant = Pe32Helpers.FindPattern(bind, "60 81 EC 00 10 00 00 BE ?? ?? ?? ?? B9 6A"); if (variant == -1) return false; return true; } catch { return false; } } /// /// Processing function called to allow the plugin to process the file. /// /// /// /// public override bool ProcessFile(string file, SteamlessOptions options) { // Initialize the class members.. this.Options = options; this.OriginalEntryPoint = 0; // Parse the file.. this.File = new Pe32File(file); if (!this.File.Parse()) return false; // Announce we are being unpacked with this packer.. this.Log("File is packed with SteamStub Variant 1.0!", LogMessageType.Information); this.Log("Step 1 - Read, decode and validate the SteamStub DRM header.", LogMessageType.Information); if (!this.Step1()) return false; this.Log("Step 2 - Handle .bind section.", LogMessageType.Information); if (!this.Step2()) return false; this.Log("Step 3 - Rebuild and save the unpacked file.", LogMessageType.Information); if (!this.Step3()) return false; if (this.Options.RecalculateFileChecksum) { this.Log("Step 4 - Rebuild unpacked file checksum.", LogMessageType.Information); if (!this.Step4()) return false; } return true; } /// /// Step #1 /// /// Read, decode and validate the SteamStub DRM header. /// /// private bool Step1() { // Obtain the bind section.. var section = this.File.GetSection(".bind"); if (!section.IsValid) return false; // Find the header information from the unpacker call.. var bind = this.File.GetSectionData(".bind"); var offset = Pe32Helpers.FindPattern(bind, "60 81 EC 00 10 00 00 BE ?? ?? ?? ?? B9 6A"); if (offset == -1) return false; // Read the needed header information.. var headerPointer = BitConverter.ToUInt32(bind, (int)offset + 8); var headerSize = BitConverter.ToUInt32(bind, (int)offset + 13) * 4; // Calculate the file offset from the pointer.. var fileOffset = this.File.GetFileOffsetFromRva(headerPointer - this.File.NtHeaders.OptionalHeader.ImageBase); // Read the header data.. var headerData = new byte[headerSize]; Array.Copy(this.File.FileData, fileOffset, headerData, 0, headerSize); // Decrypt the header data.. for (var x = 0; x < headerSize; x++) headerData[x] ^= (byte)(x * x); // Store the header and validate it.. this.StubHeader = Pe32Helpers.GetStructure(headerData); // Validate the header via the unpacker function matching the file entry point.. if (this.StubHeader.BindFunction - this.File.NtHeaders.OptionalHeader.ImageBase != this.File.NtHeaders.OptionalHeader.AddressOfEntryPoint) return false; // Find the OEP from the unpacker function.. offset = Pe32Helpers.FindPattern(bind, "61 B8 ?? ?? ?? ?? FF E0"); if (offset == -1) return false; // Read and store the real OEP.. this.OriginalEntryPoint = BitConverter.ToUInt32(bind, (int)offset + 2) - this.File.NtHeaders.OptionalHeader.ImageBase; return true; } /// /// Step #2 /// /// Remove the bind section if requested. /// Find the code section. /// /// private bool Step2() { // Remove the bind section if its not requested to be saved.. if (!this.Options.KeepBindSection) { // Obtain the .bind section.. var bindSection = this.File.GetSection(".bind"); if (!bindSection.IsValid) return false; // Remove the section.. this.File.RemoveSection(bindSection); // Decrease the header section count.. var ntHeaders = this.File.NtHeaders; ntHeaders.FileHeader.NumberOfSections--; this.File.NtHeaders = ntHeaders; this.Log(" --> .bind section was removed from the file.", LogMessageType.Debug); } else this.Log(" --> .bind section was kept in the file.", LogMessageType.Debug); return true; } /// /// Step #3 /// /// Rebuild and save the unpacked file. /// /// private bool Step3() { FileStream fStream = null; try { // Zero the DosStubData if desired.. if (this.Options.ZeroDosStubData && this.File.DosStubSize > 0) this.File.DosStubData = Enumerable.Repeat((byte)0, (int)this.File.DosStubSize).ToArray(); // Rebuild the file sections.. this.File.RebuildSections(this.Options.DontRealignSections == false); // Open the unpacked file for writing.. var unpackedPath = this.File.FilePath + ".unpacked.exe"; fStream = new FileStream(unpackedPath, FileMode.Create, FileAccess.ReadWrite); // Write the DOS header to the file.. fStream.WriteBytes(Pe32Helpers.GetStructureBytes(this.File.DosHeader)); // Write the DOS stub to the file.. if (this.File.DosStubSize > 0) fStream.WriteBytes(this.File.DosStubData); // Update the NT headers.. var ntHeaders = this.File.NtHeaders; ntHeaders.OptionalHeader.AddressOfEntryPoint = this.OriginalEntryPoint; ntHeaders.OptionalHeader.CheckSum = 0; this.File.NtHeaders = ntHeaders; // Write the NT headers to the file.. fStream.WriteBytes(Pe32Helpers.GetStructureBytes(ntHeaders)); // Write the sections to the file.. for (var x = 0; x < this.File.Sections.Count; x++) { var section = this.File.Sections[x]; var sectionData = this.File.SectionData[x]; // Write the section header to the file.. fStream.WriteBytes(Pe32Helpers.GetStructureBytes(section)); // Set the file pointer to the sections raw data.. var sectionOffset = fStream.Position; fStream.Position = section.PointerToRawData; // Write the sections raw data.. fStream.WriteBytes(sectionData); // Reset the file offset.. fStream.Position = sectionOffset; } // Set the stream to the end of the file.. fStream.Position = fStream.Length; // Write the overlay data if it exists.. if (this.File.OverlayData != null) fStream.WriteBytes(this.File.OverlayData); this.Log(" --> Unpacked file saved to disk!", LogMessageType.Success); this.Log($" --> File Saved As: {unpackedPath}", LogMessageType.Success); return true; } catch { this.Log(" --> Error trying to save unpacked file!", LogMessageType.Error); return false; } finally { fStream?.Dispose(); } } /// /// Step #4 /// /// Recalculate the file checksum. /// /// private bool Step4() { var unpackedPath = this.File.FilePath + ".unpacked.exe"; if (!Pe32Helpers.UpdateFileChecksum(unpackedPath)) { this.Log(" --> Error trying to recalculate unpacked file checksum!", LogMessageType.Error); return false; } this.Log(" --> Unpacked file updated with new checksum!", LogMessageType.Success); return true; } /// /// Gets or sets the Steamless options this file was requested to process with. /// private SteamlessOptions Options { get; set; } /// /// Gets or sets the file being processed. /// private Pe32File File { get; set; } /// /// Gets or sets the DRM stub header. /// private SteamStub32Var10Header StubHeader { get; set; } /// /// Gets or sets the true entry point take from the bind unpacker function. /// private uint OriginalEntryPoint { get; set; } } }