void CT_cbTeaDecrypt()
{
unsigned int esp=GetContextData(UE_ESP);
unsigned int values[2]= {0};
if(!ReadProcessMemory(fdProcessInfo->hProcess, (void*)(esp+4), &values, 8, 0))
{
CT_FatalError(rpmerror());
return;
}
unsigned char first_5_bytes[5]="";
memcpy(first_5_bytes, &values[1], 4);
first_5_bytes[4]=magic_byte_cert;
unsigned char* new_data=(unsigned char*)malloc2(values[1]);
if(!ReadProcessMemory(fdProcessInfo->hProcess, (void*)values[0], new_data, values[1], 0))
{
CT_FatalError(rpmerror());
return;
}
unsigned char* temp=(unsigned char*)malloc2(encrypted_cert_real_size+values[1]+5);
if(encrypted_cert_real)
{
memcpy(temp, encrypted_cert_real, encrypted_cert_real_size);
free2(encrypted_cert_real);
}
encrypted_cert_real=temp;
memcpy(encrypted_cert_real+encrypted_cert_real_size, first_5_bytes, 5);
memcpy(encrypted_cert_real+encrypted_cert_real_size+5, new_data, values[1]);
free2(new_data);
encrypted_cert_real_size+=values[1]+5;
}
void RemoveListDuplicates(HWND hwndDlg, UINT id)
{
int total_unique=0;
char** unique_list;
HWND lst=GetDlgItem(hwndDlg, id);
int total_list=SendMessageA(lst, LB_GETCOUNT, 0, 0);
unique_list=(char**)malloc2(total_list*4);
memset(unique_list, 0, total_list*4);
//Filter duplicates
for(int i=0; i<total_list; i++)
{
if(!total_unique) //First entry
{
int textlen=SendMessageA(lst, LB_GETTEXTLEN, 0, 0);
unique_list[total_unique]=(char*)malloc2(textlen+1);
memset(unique_list[total_unique], 0, textlen+1);
SendMessageA(lst, LB_GETTEXT, i, (LPARAM)unique_list[total_unique]);
total_unique++;
}
else //Other entries
{
char list_text[256]="";
SendMessageA(lst, LB_GETTEXT, i, (LPARAM)list_text);
bool isnotinlist=true;
for(int i=0; i<total_unique; i++) //Search for a string in the unique list
{
if(!strcmp(unique_list[i], list_text))
isnotinlist=false;
}
if(isnotinlist) //Add a new item to the unique list
{
int textlen=strlen(list_text);
unique_list[total_unique]=(char*)malloc2(textlen+1);
memset(unique_list[total_unique], 0, textlen+1);
strcpy(unique_list[total_unique], list_text);
total_unique++;
}
}
}
//Add all unique items to list
SendMessageA(lst, LB_RESETCONTENT, 0, 0);
for(int i=0; i<total_unique; i++)
{
SendMessageA(lst, LB_ADDSTRING, 0, (LPARAM)unique_list[i]);
free2(unique_list[i]);
}
free2(unique_list);
}
void EV_cbVirtualProtect()
{
unsigned int sec_addr=0;
unsigned int sec_size=0;
unsigned int esp_addr=0;
BYTE* sec_data=0;
esp_addr=(long)GetContextData(UE_ESP);
ReadProcessMemory(EV_fdProcessInfo->hProcess, (const void*)((esp_addr)+4), &sec_addr, 4, 0);
ReadProcessMemory(EV_fdProcessInfo->hProcess, (const void*)((esp_addr)+8), &sec_size, 4, 0);
BYTE* header_code=(BYTE*)malloc2(0x1000);
ReadProcessMemory(EV_fdProcessInfo->hProcess, (void*)(sec_addr-0x1000), header_code, 0x1000, 0);
if(*(unsigned short*)header_code != 0x5A4D) //not a PE file
{
free2(header_code);
return;
}
free2(header_code);
DeleteAPIBreakPoint((char*)"kernel32.dll", (char*)"VirtualProtect", UE_APISTART);
sec_data=(BYTE*)malloc2(sec_size);
ReadProcessMemory(EV_fdProcessInfo->hProcess, (const void*)sec_addr, sec_data, sec_size, 0);
unsigned int SetEnvA=0,SetEnvW=0;
SetEnvW=EV_FindSetEnvPattern(sec_data, sec_size, false)+sec_addr;
if(!(SetEnvW-sec_addr))
{
SetEnvW=EV_FindSetEnvPatternOld(sec_data, sec_size, false)+sec_addr;
if(!(SetEnvW-sec_addr))
{
SetEnvW=EV_FindSetEnvPatternOldOld(sec_data, sec_size, false)+sec_addr;
if(!(SetEnvW-sec_addr))
EV_FatalError("Could not locate the SetEnvW function, please contact Mr. eXoDia...");
}
}
//SetHardwareBreakPoint(SetEnvW, UE_DR1, UE_HARDWARE_EXECUTE, UE_HARDWARE_SIZE_1, (void*)EV_cbSetEnvW);
SetBPX(SetEnvW, UE_BREAKPOINT, (void*)EV_cbSetEnvW);
SetEnvA=EV_FindSetEnvPattern(sec_data, sec_size, true)+sec_addr;
if(!(SetEnvA-sec_addr))
{
SetEnvA=EV_FindSetEnvPatternOld(sec_data, sec_size, true)+sec_addr;
if(!(SetEnvA-sec_addr))
{
SetEnvA=EV_FindSetEnvPatternOldOld(sec_data, sec_size, true)+sec_addr;
if(!(SetEnvA-sec_addr))
EV_FatalError("Could not locate the SetEnvA function, please contact Mr. eXoDia...");
}
}
//SetHardwareBreakPoint(SetEnvA, UE_DR0, UE_HARDWARE_EXECUTE, UE_HARDWARE_SIZE_1, (void*)EV_cbSetEnvA);
SetBPX(SetEnvW, UE_BREAKPOINT, (void*)EV_cbSetEnvA);
}
void CT_cbReturnSeed1()
{
DeleteBPX(GetContextData(UE_EIP));
unsigned int esp=GetContextData(UE_ESP);
unsigned int _stack=0;
if(!ReadProcessMemory(fdProcessInfo->hProcess, (void*)esp, &_stack, 4, 0))
{
CT_FatalError(rpmerror());
return;
}
return_counter++;
if(return_counter!=2)
{
unsigned char* return_bytes=(unsigned char*)malloc2(0x1000);
if(!ReadProcessMemory(fdProcessInfo->hProcess, (void*)_stack, return_bytes, 0x1000, 0))
{
CT_FatalError(rpmerror());
return;
}
unsigned int retn=CT_FindReturnPattern(return_bytes, 0x1000);
free2(return_bytes);
if(!retn)
{
CT_FatalError("Could not find return");
return;
}
SetBPX(retn+_stack, UE_BREAKPOINT, (void*)CT_cbReturnSeed1);
}
else
{
SetContextData(UE_ESP, GetContextData(UE_ESP)+4);
SetContextData(UE_EIP, _stack);
CT_cbOtherSeeds();
}
}
void CT_cbOtherSeeds()
{
puts("cbOtherSeeds");
unsigned int eip=GetContextData(UE_EIP);
unsigned char* eip_data=(unsigned char*)malloc2(0x10000);
if(!ReadProcessMemory(fdProcessInfo->hProcess, (void*)eip, eip_data, 0x10000, 0))
{
CT_FatalError(rpmerror());
return;
}
unsigned int stdcall=CT_FindStdcallPattern(eip_data, 0x10000);
if(!stdcall)
{
stdcall=CT_FindCall2Pattern(eip_data, 0x10000);
if(!stdcall)
{
CT_FatalError("Could not find call pattern...");
return;
}
}
eip_data+=stdcall;
unsigned int size=0x10000-stdcall;
unsigned int retn=size=CT_FindReturnPattern(eip_data, size);
if(!retn)
{
CT_FatalError("Could not find RET");
return;
}
unsigned int and_addrs[4]= {0};
for(int i=0; i<4; i++)
{
and_addrs[i]=CT_FindAndPattern2(eip_data, size);
if(!and_addrs[i])
and_addrs[i]=CT_FindAndPattern1(eip_data, size);
if(!and_addrs[i])
{
CT_FatalError("Could not find AND [REG],[VAL]");
return;
}
size-=and_addrs[i];
eip_data+=and_addrs[i];
if(i)
and_addrs[i]+=and_addrs[i-1];
}
CT_SortArray(and_addrs, 4);
other_seed_counter=0;
for(int i=0; i<4; i++)
SetBPX(and_addrs[i]+eip+stdcall, UE_BREAKPOINT, (void*)CT_cbGetOtherSeed);
free2(eip_data);
}
static void cbDw()
{
unsigned int eip=GetContextData(UE_EIP);
DeleteBPX(eip);
BYTE* eip_data=(BYTE*)malloc2(0x1000);
if(!ReadProcessMemory(g_fdProcessInfo->hProcess, (void*)eip, eip_data, 0x1000, 0))
{
VF_FatalError(rpmerror(), g_ErrorMessageCallback);
return;
}
unsigned int and20=VF_FindAnd20Pattern(eip_data, 0x1000);
unsigned int minusreg=0;
if(!and20)
{
and20=VF_FindShrPattern(eip_data, 0x1000);
if(!and20)
{
VF_FatalError("Could not find 'and [reg],20", g_ErrorMessageCallback);
return;
}
minusreg=8;
}
unsigned int andreg=eip_data[and20+1]&0x0F;
andreg-=minusreg;
g_extra_options_reg=0xFFFFFFFF;
switch(andreg)
{
case 0:
g_extra_options_reg=UE_EAX;
break;
case 1:
g_extra_options_reg=UE_ECX;
break;
case 2:
g_extra_options_reg=UE_EDX;
break;
case 3:
g_extra_options_reg=UE_EBX;
break;
case 5:
g_extra_options_reg=UE_EBP;
break;
case 6:
g_extra_options_reg=UE_ESI;
break;
case 7:
g_extra_options_reg=UE_EDI;
break;
}
if(g_extra_options_reg==0xFFFFFFFF)
VF_FatalError("Could not determine the register (extradw)", g_ErrorMessageCallback);
free2(eip_data);
SetBPX(and20+eip, UE_BREAKPOINT, (void*)cbDwordRetrieve);
}
void FormatHex(char* string)
{
int len=strlen(string);
_strupr(string);
char* new_string=(char*)malloc2(len+1);
memset(new_string, 0, len+1);
for(int i=0,j=0; i<len; i++)
if(IsHexChar(string[i]))
j+=sprintf(new_string+j, "%c", string[i]);
strcpy(string, new_string);
free2(new_string);
}
void CT_cbEndBigLoop()
{
DeleteBPX(end_big_loop);
DeleteBPX(tea_decrypt);
DeleteBPX(magic_byte);
encrypted_cert_real_size+=4;
unsigned char* final_data=(unsigned char*)malloc2(encrypted_cert_real_size);
memset(final_data, 0, encrypted_cert_real_size);
memcpy(final_data, encrypted_cert_real, encrypted_cert_real_size-4);
free2(encrypted_cert_real);
CT_cert_data->encrypted_data=final_data;
CT_cert_data->encrypted_size=encrypted_cert_real_size;
encrypted_cert_real_size=0;
CT_RetrieveSaltValue();
}
int getPossible(int x,int y)
{
int n=15;
int attack;
int defence;
int attackFree1;
int defenceFree1;
int attackFree2;
int defenceFree2;
int possible=-100;
//左右扩展
int al,ar;
int dl,dr;
//横向攻击
for (al=y-1; al>=0; al--)
{
if (gameMap[x][al]!='*') break;
}
for (ar=y+1; ar<n; ar++)
{
if (gameMap[x][ar]!='*') break;
}
//横向防守
for (dl=y-1; dl>=0; dl--)
{
if (gameMap[x][dl]!='o') break;
}
for (dr=y+1; dr<n; dr++)
{
if (gameMap[x][dr]!='o') break;
}
attack=ar-al-1;
defence=dr-dl-1;
free1(x,al,ar,&attackFree1,&attackFree2);
free1(x,dl,dr,&defenceFree1,&defenceFree2);
possible=max(possible,getPossibleByAD(attack,defence,attackFree1,attackFree2,defenceFree1,defenceFree2));
//竖向进攻
for (al=x-1; al>=0; al--)
{
if (gameMap[al][y]!='*') break;
}
for (ar=x+1; ar<n; ar++)
{
if (gameMap[ar][y]!='*') break;
}
//竖向防守
for (dl=x-1; dl>=0; dl--)
{
if (gameMap[dl][y]!='o') break;
}
for (dr=x+1; dr<n; dr++)
{
if (gameMap[dr][y]!='o') break;
}
attack=ar-al-1;
defence=dr-dl-1;
free2(al,ar,y,&attackFree1,&attackFree2);
free2(dl,dr,y,&defenceFree1,&defenceFree2);
possible=max(possible,getPossibleByAD(attack,defence,attackFree1,attackFree2,defenceFree1,defenceFree2));
//正对角线进攻
int al1,al2,ar1,ar2;
int dl1,dl2,dr1,dr2;
for (al1=x-1,al2=y-1; al1>=0 && al2>=0; al1--,al2--)
{
if (gameMap[al1][al2]!='*') break;
}
for (ar1=x+1,ar2=y+1; ar1<n && ar2<n; ar1++,ar2++)
{
if (gameMap[ar1][ar2]!='*') break;
}
//正对角线防守
for (dl1=x-1,dl2=y-1; dl1>=0 && dl2>=0; dl1--,dl2--)
{
if (gameMap[dl1][dl2]!='o') break;
}
for (dr1=x+1,dr2=y+1; dr1<n && dr2<n; dr1++,dr2++)
{
if (gameMap[dr1][dr2]!='o') break;
}
attack=ar1-al1-1;
defence=dr1-dl1-1;
free3(al1,al2,ar1,ar2,&attackFree1,&attackFree2);
free3(dl1,dl2,dr1,dr2,&defenceFree1,&defenceFree2);
possible=max(possible,getPossibleByAD(attack,defence,attackFree1,attackFree1,defenceFree1,defenceFree2));
//负对角线进攻
for (al1=x-1,al2=y+1; al1>=0 && al2<n; al1--,al2++)
{
if (gameMap[al1][al2]!='*') break;
}
for (ar1=x+1,ar2=y-1; ar1<n && ar2>=0; ar1++,ar2--)
{
if (gameMap[ar1][ar2]!='*') break;
}
//负对角线防守
for (dl1=x-1,dl2=y+1; dl1>=0 && dl2<n; dl1--,dl2++)
{
if (gameMap[dl1][dl2]!='o') break;
}
for (dr1=x+1,dr2=y-1; dr1<n && dr2>=0; dr1++,dr2--)
{
if (gameMap[dr1][dr2]!='o') break;
}
attack=ar1-al1-1;
defence=dr1-dl1-1;
free4(al1,al2,ar1,ar2,&attackFree1,&attackFree2);
free4(dl1,dl2,dr1,dr2,&defenceFree1,&defenceFree2);
possible=max(possible,getPossibleByAD(attack,defence,attackFree1,attackFree2,defenceFree1,defenceFree2));
return possible;
}
static void cbVirtualProtect()
{
MEMORY_BASIC_INFORMATION mbi= {0};
unsigned int sec_addr=0;
unsigned int sec_size=0;
unsigned int esp_addr=0;
BYTE* sec_data=0;
esp_addr=(long)GetContextData(UE_ESP);
if(!ReadProcessMemory(g_fdProcessInfo->hProcess, (const void*)((esp_addr)+4), &sec_addr, 4, 0))
{
VF_FatalError(rpmerror(), g_ErrorMessageCallback);
return;
}
sec_addr-=0x1000;
VirtualQueryEx(g_fdProcessInfo->hProcess, (void*)sec_addr, &mbi, sizeof(MEMORY_BASIC_INFORMATION));
sec_size=mbi.RegionSize;
sec_data=(BYTE*)malloc2(sec_size);
if(!ReadProcessMemory(g_fdProcessInfo->hProcess, (const void*)sec_addr, sec_data, sec_size, 0))
{
free2(sec_data);
VF_FatalError(rpmerror(), g_ErrorMessageCallback);
return;
}
if(*(unsigned short*)sec_data != 0x5A4D) //not a PE file
{
free2(sec_data);
return;
}
DeleteAPIBreakPoint((char*)"kernel32.dll", (char*)"VirtualProtect", UE_APISTART);
unsigned int armversion_addr=VF_FindarmVersion(sec_data, sec_size);
if(!armversion_addr)
{
free2(sec_data);
VF_FatalError("Could not find '<armVersion'", g_ErrorMessageCallback);
return;
}
armversion_addr+=sec_addr;
unsigned int push_addr=VF_FindPushAddr(sec_data, sec_size, armversion_addr);
if(!push_addr)
{
free2(sec_data);
VF_FatalError("Could not find reference to '<armVersion'", g_ErrorMessageCallback);
return;
}
int call_decrypt=push_addr;
while(sec_data[call_decrypt]!=0xE8) //TODO: fix this!!
call_decrypt--;
unsigned int call_dw=0;
memcpy(&call_dw, (sec_data+call_decrypt+1), 4);
unsigned int call_dest=(call_decrypt+sec_addr)+call_dw+5;
unsigned int push100=0;
for(int i=call_decrypt; i>0; i--)
{
if(sec_data[i]==0x68 and sec_data[i+1]==0x00 and sec_data[i+2]==0x01 and sec_data[i+3]==0x00 and sec_data[i+4]==0x00)
{
push100=i;
break;
}
}
if(!push100)
{
VF_FatalError("Could not find 'push 100'", g_ErrorMessageCallback);
return;
}
//push_addr+=sec_addr; //TODO: remove this
call_decrypt+=sec_addr;
push100+=sec_addr;
g_version_decrypt_call=call_decrypt;
g_version_decrypt_call_dest=call_dest;
g_version_decrypt_neweip=push100;
SetBPX(g_version_decrypt_call_dest, UE_BREAKPOINT, (void*)cbDecryptCall);
free2(sec_data);
}
/**********************************************************************
* Functions
*********************************************************************/
DWORD WINAPI VF_DebugThread(void* lpVoid)
{
ResetContent(true);
g_raw_options=0;
g_extra_options=0;
g_version[0]=0;
HWND hwndDlg=g_shared_hwnd;
char temp[10]="";
char* log_text=(char*)malloc2(4096);
char log_location[256]="";
char filename_nopath[256]="";
memset(log_text, 0, 4096);
if(!VF_RawOptions(g_szFileName, &g_raw_options, &g_minimal, VF_ErrorMessageCallback))
{
free2(log_text);
return 0;
}
sprintf(temp, "%.8X", g_raw_options);
SetDlgItemTextA(hwndDlg, IDC_EDT_RAWOPTIONS, temp);
VF_Version(g_szFileName, g_version, VF_ErrorMessageCallback);
SetDlgItemTextA(hwndDlg, IDC_EDT_VERSIONNUM, g_version);
VF_ExtraOptions(g_szFileName, &g_extra_options, VF_ErrorMessageCallback);
sprintf(temp, "%.8X", g_extra_options);
SetDlgItemTextA(hwndDlg, IDC_EDT_EXTRAOPTIONS, temp);
ARMA_OPTIONS op= {0};
EXTRA_OPTIONS eo= {0};
if(g_extra_options)
{
FillArmaExtraOptionsStruct(g_extra_options, &eo);
FillArmaOptionsStruct(g_raw_options, g_version, &op, &eo, g_minimal);
}
else
FillArmaOptionsStruct(g_raw_options, g_version, &op, 0, g_minimal);
if(g_extra_options or g_raw_options or g_version[0])
{
if(log_version)
{
strcpy(log_location, g_szFileName);
int len=strlen(log_location);
while(len and log_location[len]!='.')
len--;
if(len)
{
log_location[len]=0;
sprintf(log_location, "%s_version.log", log_location);
}
else
sprintf(log_location, "%s_version.log", g_szFileName);
len=strlen(g_szFileName);
while(g_szFileName[len]!='\\')
len--;
strcpy(filename_nopath, g_szFileName+len+1);
sprintf(log_text, "File:\r\n>%s\r\n", filename_nopath);
}
PrintArmaOptionsStruct(&op, log_text, g_raw_options, g_extra_options);
if(log_version)
{
DeleteFileA(log_location);
HANDLE hFile=CreateFileA(log_location, GENERIC_ALL, 0, 0, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);
if(hFile==INVALID_HANDLE_VALUE)
{
if(MessageBoxA(g_shared_hwnd, "Could not write log file, wanna copy the log to clipboard?", "Error", MB_ICONERROR|MB_YESNO)==IDYES)
CopyToClipboard(log_text);
}
else
{
DWORD written=0;
WriteFile(hFile, log_text, strlen(log_text), &written, 0);
CloseHandle(hFile);
}
}
}
free2(log_text);
return 0;
}
// out_map was initialized to 0 already
int segment1(image *in_image, image *out_map, int min_dist_th)
{
int n_bands = in_image->num_of_bands;
int n_lines = in_image->num_of_lines;
int n_cols = in_image->num_of_samples;
int n_seg = 0; // number of segments, first segment is named 1, second 2, and so on
float pel_dist, min_dist; // measurement of the distance between two pixels
imgpel **map = (imgpel **) dim2 (n_lines, n_cols, sizeof(imgpel));
for(int y=0; y<n_lines; y++)
{
for(int x=0; x<n_cols; x++)
{
if(map[y][x] == 0) // non-segmented pixel, check its eight neighbors for a potential merge; if no merge, start a new segment
{
min_dist = (float) LARGE_FLOAT;
for(int j=y-1; j<=y+1; j++)
{
for(int i=x-1; i<=x+1; i++)
{
if(j>=0 && j<n_lines && i>=0 && i<n_cols && (j!=y || i!=x) && (map[j][i]>0))
{
pel_dist = 0;
for(int k=0; k<n_bands; k++)
pel_dist += ((in_image->IMG[k][y][x] - in_image->IMG[k][j][i]) * (in_image->IMG[k][y][x] - in_image->IMG[k][j][i]));
if(pel_dist < min_dist)
{
min_dist = pel_dist;
map[y][x] = map[j][i];
}
}
}
}
if (min_dist > min_dist_th * n_bands)
{
n_seg += 1;
map[y][x] = (imgpel) n_seg;
}
}
}
}
for(int y=0; y<n_lines; y++)
{
for(int x=0; x<n_cols; x++)
{
int boundary_flag = 0;
for(int j=y-1; j<=y+1; j++)
{
for(int i=x-1; i<=x+1; i++)
{
int jj = clip(0, n_lines-1, j);
int ii = clip(0, n_cols-1, i);
if(map[jj][ii] != map[y][x]) boundary_flag = 1;
}
}
for(int k=0; k<n_bands; k++)
out_map->IMG[k][y][x] = ((boundary_flag==1) ? 0xFFFF : in_image->IMG[k][y][x]);
}
}
free2((char **)map);
return n_seg;
}
/* free a 2-d array of complexs */
void free2dcomplex(dcomplex **p)
{
free2((void**)p);
}
/* free a 2-d array of complexs */
void free2complex(complex **p)
{
free2((void**)p);
}
/* free a 2-d array of doubles */
void free2double(double **p)
{
free2((void**)p);
}
/* free a 2-d array of floats */
void free2float(float **p)
{
free2((void**)p);
}
/* free a 2-d array of ints */
void free2int(int **p)
{
free2((void**)p);
}
int main( int argc, char *argv[] )
{
int ntr=0; /* number of traces */
int ntrv=0; /* number of traces */
int ns=0;
int nsv=0;
float dt;
float dtv;
cwp_String fs;
cwp_String fv;
FILE *fps;
FILE *fpv;
FILE *headerfp;
float *data; /* data matrix of the migration volume */
float *vel; /* velocity matrix */
float *velfi; /* velocity function interpolated to ns values*/
float *velf; /* velocity function */
float *vdt;
float *ddt;
float *ap; /* array of apperture values in m */
float apr; /* array of apperture values in m */
int *apt=NULL; /* array of apperture time limits in mig. gath*/
float r; /* maximum radius with a given apperture */
float ir2; /* r/d2 */
float ir3; /* r/d3 */
float d2; /* spatial sampling int. in dir 2. */
float d3; /* spatial sampling int. in dir 3. */
float **mgd=NULL; /* migration gather data */
float *migt; /* migrated data trace */
int **mgdnz=NULL; /* migration gather data non zero samples*/
float dm; /* migration gather spatial sample int. */
int im; /* number of traces in migration gather */
int *mtnz; /* migrated trace data non zero smaples */
char **dummyi; /* index array that the trace contains zeros only */
float fac; /* velocity scale factor */
int sphr; /* spherical divergence flag */
int imt; /* mute time sample of trace */
float tmp;
int imoff;
int **igtr=NULL;
int nigtr;
int n2;
int n3;
int verbose;
/* phase shift filter stuff */
float power; /* power of i omega applied to data */
float amp; /* amplitude associated with the power */
float arg; /* argument of power */
float phasefac; /* phase factor */
float phase; /* phase shift = phasefac*PI */
complex exparg; /* cexp(I arg) */
register float *rt; /* real trace */
register complex *ct; /* complex transformed trace */
complex *filt; /* complex power */
float omega; /* circular frequency */
float domega; /* circular frequency spacing (from dt) */
float sign; /* sign in front of i*omega default -1 */
int nfft; /* number of points in nfft */
int nf; /* number of frequencies (incl Nyq) */
float onfft; /* 1 / nfft */
size_t nzeros; /* number of padded zeroes in bytes */
initargs(argc, argv);
requestdoc(1);
MUSTGETPARSTRING("fs",&fs);
MUSTGETPARSTRING("fv",&fv);
MUSTGETPARINT("n2",&n2);
MUSTGETPARINT("n3",&n3);
MUSTGETPARFLOAT("d2",&d2);
MUSTGETPARFLOAT("d3",&d3);
if (!getparfloat("dm", &dm)) dm=(d2+d3)/2.0;
/* open datafile */
fps = efopen(fs,"r");
fpv = efopen(fv,"r");
/* Open tmpfile for headers */
headerfp = etmpfile();
/* get information from the first data trace */
ntr = fgettra(fps,&tr,0);
if(n2*n3!=ntr) err(" Number of traces in file %d not equal to n2*n3 %d \n",
ntr,n2*n3);
ns=tr.ns;
if (!getparfloat("dt", &dt)) dt = ((float) tr.dt)/1000000.0;
if (!dt) {
dt = .002;
warn("dt not set, assumed to be .002");
}
/* get information from the first velocity trace */
ntrv = fgettra(fpv,&trv,0);
if(ntrv!=ntr) err(" Number of traces in velocity file %d differ from %d \n",
ntrv,ntr);
nsv=trv.ns;
if (!getparfloat("dtv", &dtv)) dtv = ((float) trv.dt)/1000000.0;
if (!dtv) {
dtv = .002;
warn("dtv not set, assumed to be .002 for velocity");
}
if (!getparfloat("fac", &fac)) fac=2.0;
if (!getparint("verbose", &verbose)) verbose=0;
if (!getparint("sphr", &sphr)) sphr=0;
if (!getparfloat("apr", &apr)) apr=75;
apr*=3.141592653/180;
/* allocate arrays */
data = bmalloc(sizeof(float),ns,ntr);
vel = bmalloc(sizeof(float),nsv,ntr);
velf = ealloc1float(nsv);
velfi = ealloc1float(ns);
migt = ealloc1float(ns);
vdt = ealloc1float(nsv);
ddt = ealloc1float(ns);
ap = ealloc1float(ns);
mtnz = ealloc1int(ns);
dummyi = (char **) ealloc2(n2,n3,sizeof(char));
/* Times to do interpolation of velocity from sparse sampling */
/* to fine sampling of the data */
{ register int it;
for(it=0;it<nsv;it++) vdt[it]=it*dtv;
for(it=0;it<ns;it++) ddt[it]=it*dt;
}
/* Read traces into data */
/* Store headers in tmpfile */
ntr=0;
erewind(fps);
erewind(fpv);
{ register int i2,i3;
for(i3=0;i3<n3;i3++)
for(i2=0;i2<n2;i2++) {
fgettr(fps,&tr);
fgettr(fpv,&trv);
if(tr.trid > 2) dummyi[i3][i2]=1;
else dummyi[i3][i2]=0;
efwrite(&tr, 1, HDRBYTES, headerfp);
bmwrite(data,1,0,i3*n2+i2,ns,tr.data);
bmwrite(vel,1,0,i3*n2+i2,nsv,trv.data);
}
erewind(headerfp);
/* set up the phase filter */
power = 1.0;sign = 1.0;phasefac = 0.5;
phase = phasefac * PI;
/* Set up for fft */
nfft = npfaro(ns, LOOKFAC * ns);
if (nfft >= SU_NFLTS || nfft >= PFA_MAX)
err("Padded nt=%d -- too big", nfft);
nf = nfft/2 + 1;
onfft = 1.0 / nfft;
nzeros = (nfft - ns) * FSIZE;
domega = TWOPI * onfft / dt;
/* Allocate fft arrays */
rt = ealloc1float(nfft);
ct = ealloc1complex(nf);
filt = ealloc1complex(nf);
/* Set up args for complex power evaluation */
arg = sign * PIBY2 * power + phase;
exparg = cexp(crmul(I, arg));
{
register int i;
for (i = 0 ; i < nf; ++i) {
omega = i * domega;
/* kludge to handle omega=0 case for power < 0 */
if (power < 0 && i == 0) omega = FLT_MAX;
/* calculate filter */
amp = pow(omega, power) * onfft;
filt[i] = crmul(exparg, amp);
}
}
/* set up constants for migration */
if(verbose) fprintf(stderr," Setting up constants....\n");
r=0;
for(i3=0;i3<n3;i3++)
for(i2=0;i2<n2;i2++) {
if(dummyi[i3][i2] < 1) {
/* get the velocity function */
bmread(vel,1,0,i3*n2+i2,nsv,velf);
/* linear interpolation from nsv to ns values */
intlin(nsv,vdt,velf,velf[0],velf[nsv-1],ns,ddt,velfi);
/* Apply scale factor to velocity */
{ register int it;
for(it=0;it<ns;it++) velfi[it] *=fac;
}
/* compute maximum radius from apperture and velocity */
{ register int it;
for(it=0;it<ns;it++)
ap[it] = ddt[it]*velfi[it]*tan(apr)/2.0;
}
tmp = ap[isamax(ns,ap,1)];
if(tmp>r) r=tmp;
}
}
r=MIN(r,sqrt(SQR((n2-1)*d2)+SQR((n3-1)*d3)));
ir2 = (int)(2*r/d2)+1;
ir3 = (int)(2*r/d3)+1;
im = (int)(r/dm)+1;
/* allocate migration gather */
mgd = ealloc2float(ns,im);
mgdnz = ealloc2int(ns,im);
apt = ealloc1int(im);
/* set up the stencil for selecting traces */
igtr = ealloc2int(ir2*ir3,2);
stncl(r, d2, d3,igtr,&nigtr);
if(verbose) {
fprintf(stderr," Maximum radius %f\n",r);
fprintf(stderr," Maximum offset %f\n",
sqrt(SQR((n2-1)*d2)+SQR((n3-1)*d3)));
}
/* main processing loop */
for(i3=0;i3<n3;i3++)
for(i2=0;i2<n2;i2++) {
memset( (void *) tr.data, (int) '\0',ns*FSIZE);
if(dummyi[i3][i2] < 1) {
memset( (void *) mgd[0], (int) '\0',ns*im*FSIZE);
memset( (void *) mgdnz[0], (int) '\0',ns*im*ISIZE);
/* get the velocity function */
bmread(vel,1,0,i3*n2+i2,nsv,velf);
/* linear interpolation from nsv to ns values */
intlin(nsv,vdt,velf,velf[0],velf[nsv-1],ns,ddt,velfi);
/* Apply scale factor to velocity */
{ register int it;
for(it=0;it<ns;it++) velfi[it] *=fac;
}
/* create the migration gather */
{ register int itr,ist2,ist3;
for(itr=0;itr<nigtr;itr++) {
ist2=i2+igtr[0][itr];
ist3=i3+igtr[1][itr];
if(ist2 >= 0 && ist2 <n2)
if(ist3 >= 0 && ist3 <n3) {
if(dummyi[ist3][ist2] <1) {
imoff = (int) (
sqrt(SQR(igtr[0][itr]*d2)
+SQR(igtr[1][itr]*d3))/dm+0.5);
bmread(data,1,0,ist3*n2+ist2,ns,tr.data);
imoff=MIN(imoff,im-1);
{ register int it;
/* get the mute time for this
offset, apperture and velocity */
xindex(ns,ap,imoff*dm,&imt);
for(it=imt;it<ns;it++)
if(tr.data[it]!=0) {
mgd[imoff][it]+=tr.data[it];
mgdnz[imoff][it]+=1;
}
}
}
}
}
}
/* normalize the gather */
{ register int ix,it;
for(ix=0;ix<im;ix++)
for(it=0;it<ns;it++)
if(mgdnz[ix][it] > 1) mgd[ix][it] /=(float) mgdnz[ix][it];
}
memset( (void *) tr.data, (int) '\0',ns*FSIZE);
memset( (void *) mtnz, (int) '\0',ns*ISIZE);
/* do a knmo */
{ register int ix,it;
for(ix=0;ix<im;ix++) {
/* get the mute time for this
offset, apperture and velocity */
xindex(ns,ap,ix*dm,&imt);
knmo(mgd[ix],migt,ns,velfi,0,ix*dm,dt,imt,sphr);
/* stack the gather */
for(it=0;it<ns;it++) {
if(migt[it]!=0.0) {
tr.data[it] += migt[it];
mtnz[it]++;
}
/* tr.data[it] += mgd[ix][it]; */
}
}
}
{ register int it;
for(it=0;it<ns;it++)
if(mtnz[it]>1) tr.data[it] /=(float)mtnz[it];
}
/*Do the phase filtering before the trace is released*/
/* Load trace into rt (zero-padded) */
memcpy( (void *) rt, (const void *) tr.data, ns*FSIZE);
memset((void *) (rt + ns), (int) '\0', nzeros);
pfarc(1, nfft, rt, ct);
{ register int i;
for (i = 0; i < nf; ++i) ct[i] = cmul(ct[i], filt[i]);
}
pfacr(-1, nfft, ct, rt);
memcpy( (void *) tr.data, (const void *) rt, ns*FSIZE);
} /* end of dummy if */
/* spit out the gather */
efread(&tr, 1, HDRBYTES, headerfp);
puttr(&tr);
if(verbose) fprintf(stderr," %d %d\n",i2,i3);
} /* end of i2 loop */
} /* end of i3 loop */
/* This should be the last thing */
efclose(headerfp);
/* Free memory */
free2int(igtr);
free2float(mgd);
free2int(mgdnz);
free1int(apt);
bmfree(data);
bmfree(vel);
free1float(velfi);
free1float(velf);
free1float(ddt);
free1float(vdt);
free1float(ap);
free1int(mtnz);
free1float(migt);
free1float(rt);
free1complex(ct);
free1complex(filt);
free2((void **) dummyi);
return EXIT_SUCCESS;
}
DWORD WINAPI CT_FindCertificates(void* lpvoid)
{
CT_created_log=false;
CT_isdebugging=true;
patched_magic_jump=false;
fdProcessInfo=0;
magic_value_addr=0;
encrypted_cert_real=0;
encrypted_cert_real_size=0;
cert_func_count=0;
if(CT_cert_data)
{
if(CT_cert_data->projectid)
free2(CT_cert_data->projectid);
if(CT_cert_data->customer_service)
free2(CT_cert_data->customer_service);
if(CT_cert_data->website)
free2(CT_cert_data->website);
if(CT_cert_data->unknown_string)
free2(CT_cert_data->unknown_string);
if(CT_cert_data->stolen_keys)
free2(CT_cert_data->stolen_keys);
if(CT_cert_data->intercepted_libs)
free2(CT_cert_data->intercepted_libs);
if(CT_cert_data->raw_data)
free2(CT_cert_data->raw_data);
if(CT_cert_data->encrypted_data)
free2(CT_cert_data->encrypted_data);
free2(CT_cert_data);
}
CT_cert_data=(CERT_DATA*)malloc2(sizeof(CERT_DATA));
memset(CT_cert_data, 0, sizeof(CERT_DATA));
InitVariables(program_dir, (CT_DATA*)CT_cert_data, StopDebug, 1, GetParent(CT_shared));
FILE_STATUS_INFO inFileStatus= {0};
CT_time1=GetTickCount();
IsPE32FileValidEx(CT_szFileName, UE_DEPTH_SURFACE, &inFileStatus);
if(inFileStatus.FileIs64Bit)
{
MessageBoxA(CT_shared, "64-bit files are not (yet) supported!", "Error!", MB_ICONERROR);
return 0;
}
HANDLE hFile, fileMap;
ULONG_PTR va;
DWORD bytes_read=0;
StaticFileLoad(CT_szFileName, UE_ACCESS_READ, false, &hFile, &bytes_read, &fileMap, &va);
if(!IsArmadilloProtected(va))
{
InitVariables(program_dir, 0, StopDebug, 0, 0);
CT_isdebugging=false;
MessageBoxA(CT_shared, "Not armadillo protected...", "Error!", MB_ICONERROR);
return 0;
}
StaticFileClose(hFile);
fdFileIsDll=inFileStatus.FileIsDLL;
if(!fdFileIsDll)
fdProcessInfo=(LPPROCESS_INFORMATION)InitDebugEx(CT_szFileName, 0, 0, (void*)CT_cbEntry);
else
fdProcessInfo=(LPPROCESS_INFORMATION)InitDLLDebug(CT_szFileName, false, 0, 0, (void*)CT_cbEntry);
if(fdProcessInfo)
{
EnableWindow(GetDlgItem(CT_shared, IDC_BTN_START), 0);
DebugLoop();
InitVariables(program_dir, 0, StopDebug, 0, 0);
CT_ParseCerts();
}
else
MessageBoxA(CT_shared, "Something went wrong during initialization...", "Error!", MB_ICONERROR);
InitVariables(program_dir, 0, StopDebug, 0, 0);
CT_isdebugging=false;
return 0;
}
void CT_cbVirtualProtect()
{
DeleteAPIBreakPoint((char*)"kernel32.dll", (char*)"VirtualProtect", UE_APISTART);
long esp_addr=GetContextData(UE_ESP);
unsigned int security_code_base=0,security_code_size=0;
if(!ReadProcessMemory(fdProcessInfo->hProcess, (void*)(esp_addr+4), &security_code_base, 4, 0))
{
CT_FatalError(rpmerror());
return;
}
if(!ReadProcessMemory(fdProcessInfo->hProcess, (void*)(esp_addr+8), &security_code_size, 4, 0))
{
CT_FatalError(rpmerror());
return;
}
BYTE* security_code=(BYTE*)malloc2(security_code_size);
BYTE* header_code=(BYTE*)malloc2(0x1000);
if(!ReadProcessMemory(fdProcessInfo->hProcess, (void*)security_code_base, security_code, security_code_size, 0))
{
CT_FatalError(rpmerror());
return;
}
if(!ReadProcessMemory(fdProcessInfo->hProcess, (void*)(security_code_base-0x1000), header_code, 0x1000, 0))
{
CT_FatalError(rpmerror());
return;
}
IMAGE_DOS_HEADER *pdh=(IMAGE_DOS_HEADER*)((DWORD)header_code);
IMAGE_NT_HEADERS *pnth=(IMAGE_NT_HEADERS*)((DWORD)header_code+pdh->e_lfanew);
CT_cert_data->timestamp=pnth->FileHeader.TimeDateStamp;
free2(header_code);
//Certificate data
unsigned int breakpoint_addr=CT_FindCertificateFunctionNew(security_code, security_code_size);
if(!breakpoint_addr)
breakpoint_addr=CT_FindCertificateFunctionOld(security_code, security_code_size);
if(!breakpoint_addr)
{
CT_FatalError("Could not find NextDword...");
return;
}
SetHardwareBreakPoint((security_code_base+breakpoint_addr), UE_DR0, UE_HARDWARE_EXECUTE, UE_HARDWARE_SIZE_1, (void*)CT_cbCertificateFunction);
//Magic
magic_value_addr=CT_FindMagicPattern(security_code, security_code_size, &magic_ebp_sub);
if(magic_value_addr)
SetHardwareBreakPoint((security_code_base+magic_value_addr), UE_DR1, UE_HARDWARE_EXECUTE, UE_HARDWARE_SIZE_1, (void*)CT_cbMagicValue);
//Magic MD5=0
if(magic_value_addr)
{
unsigned int end_search=CT_FindEndInitSymVerifyPattern(security_code+magic_value_addr, security_code_size-magic_value_addr);
unsigned int md5_move=CT_FindPubMd5MovePattern(security_code+magic_value_addr, security_code_size-magic_value_addr);
if(end_search and md5_move and md5_move>end_search) //Arma with MD5=0 in SymVerify
CT_cert_data->zero_md5_symverify=true;
}
else if(CT_cert_data->timestamp<0x49000000) //~v6 (before sometimes it failed)
CT_cert_data->zero_md5_symverify=true;
//Encrypted cert data
unsigned int push400=CT_FindDecryptKey1Pattern(security_code, security_code_size);
if(push400)
{
magic_byte=CT_FindMagicJumpPattern(security_code+push400, security_code_size-push400, &cmp_data);
if(magic_byte)
{
magic_byte+=push400;
unsigned int pushff=CT_FindPushFFPattern(security_code+magic_byte, security_code_size-magic_byte);
if(pushff)
{
pushff+=magic_byte;
tea_decrypt=CT_FindTeaDecryptPattern(security_code+pushff, security_code_size-magic_byte);
if(tea_decrypt)
{
tea_decrypt+=pushff;
noteax=CT_FindVerifySymPattern(security_code+tea_decrypt, security_code_size-tea_decrypt);
if(noteax)
{
noteax+=tea_decrypt;
end_big_loop=CT_FindReturnPattern(security_code+noteax, security_code_size-noteax);
//end_big_loop=CT_FindEndLoopPattern(security_code+noteax, security_code_size-noteax);
if(end_big_loop)
{
end_big_loop+=noteax+security_code_base;
noteax+=security_code_base;
tea_decrypt+=security_code_base;
magic_byte+=security_code_base;
}
}
}
}
}
}
if(CT_FindECDSAVerify(security_code, security_code_size))
CT_cert_data->checksumv8=true;
if(CT_cert_data->timestamp>0x4C100000) //v7.40 (just before)
{
//Salt
salt_func_addr=FindSalt1Pattern(security_code, security_code_size); //v9.60
if(!salt_func_addr)
salt_func_addr=FindSalt2Pattern(security_code, security_code_size);
if(salt_func_addr)
{
memcpy(salt_code, (void*)(salt_func_addr+security_code), 60);
salt_func_addr+=(unsigned int)security_code_base;
}
}
free2(security_code);
}
void CT_cbCertificateFunction()
{
if(!cert_func_count)
cert_func_count++;
else if(cert_func_count==1)
{
DeleteHardwareBreakPoint(UE_DR0);
long retn_eax=GetContextData(UE_EAX);
MEMORY_BASIC_INFORMATION mbi= {0};
unsigned int mem_size=0x10000;
if(VirtualQueryEx(fdProcessInfo->hProcess, (void*)retn_eax, &mbi, sizeof(MEMORY_BASIC_INFORMATION)))
mem_size=mbi.RegionSize-(retn_eax-(unsigned int)mbi.BaseAddress);
BYTE* certificate_code=(BYTE*)malloc2(mem_size);
if(!ReadProcessMemory(fdProcessInfo->hProcess, (void*)retn_eax, certificate_code, mem_size, 0))
{
free2(certificate_code);
CT_FatalError("Failed to read process memory...");
}
//Arma 9.60 support
puts("errorfuck");
unsigned int esp=GetContextData(UE_ESP);
unsigned int _stack=0;
if(!ReadProcessMemory(fdProcessInfo->hProcess, (void*)esp, &_stack, 4, 0))
{
CT_FatalError(rpmerror());
return;
}
unsigned char* return_bytes=(unsigned char*)malloc2(0x1000);
if(!ReadProcessMemory(fdProcessInfo->hProcess, (void*)_stack, return_bytes, 0x1000, 0))
{
CT_FatalError(rpmerror());
return;
}
unsigned int push100=CT_FindPush100Pattern(return_bytes, 0x1000);
unsigned int retn=CT_FindReturnPattern(return_bytes, 0x1000);
if(!retn)
CT_FindReturnPattern2(return_bytes, 0x1000);
if(push100 and push100<retn)
{
unsigned int call=CT_FindCall1Pattern(return_bytes+push100, 0x1000-push100);
if(!call)
call=CT_FindCall2Pattern(return_bytes+push100, 0x1000-push100);
if(!call)
{
if(MessageBoxA(CT_shared, "Could not find call, continue?", "Continue?", MB_ICONERROR|MB_YESNO)==IDYES)
if(!magic_value_addr)
CT_RetrieveSaltValue();
}
else
{
SetBPX(_stack+call+push100, UE_BREAKPOINT, (void*)CT_cbSeed1);
return_counter=0;
SetBPX(_stack+retn, UE_BREAKPOINT, (void*)CT_cbReturnSeed1);
}
CT_cert_data->raw_size=mem_size;
CT_cert_data->raw_data=(unsigned char*)malloc2(mem_size);
memcpy(CT_cert_data->raw_data, certificate_code, mem_size);
}
else
{
free2(return_bytes);
//Get raw certificate data
unsigned int cert_start=CT_FindCertificateMarkers(certificate_code, mem_size);
if(!cert_start)
cert_start=CT_FindCertificateMarkers2(certificate_code, mem_size);
if(!cert_start)
{
free2(certificate_code);
if(MessageBoxA(CT_shared, "Could not find start markers, continue?", "Continue?", MB_ICONERROR|MB_YESNO)==IDYES)
{
if(!magic_value_addr)
CT_RetrieveSaltValue();
}
else
StopDebug();
return;
}
CT_cert_data->raw_size=mem_size;
CT_cert_data->raw_data=(unsigned char*)malloc2(mem_size);
memcpy(CT_cert_data->raw_data, certificate_code, mem_size);
if(!magic_value_addr)
CT_RetrieveSaltValue();
}
}
else
DeleteHardwareBreakPoint(UE_DR0);
}
/* termination */
void AHEAP_end (AHEAP *H){
free2 (H->v);
*H = INIT_AHEAP;
}
