String Logfile.log MOSS[ESL] WarRock

08/16/2014 12:32 Alliance�#1

This is a string generated by LogFile.log Moss(ESL):
C:\Nexon\Warrock EU\System\..\data\items.bin is 03516462 md5: 8c9697e9192afe370827e5314765b2f9
Some one say what is 03516462 and how to calculate it?

08/16/2014 21:00 Maurice#2

It is the CRC32...

Funny thing is, you have a source to parse the fcld, but u don't know what this is?

Code:

using System;
using System.Security.Cryptography;

namespace fcldParser
{
    public class Crc32 : HashAlgorithm
    {
        public const uint DefaultPolynomial = 0xedb88320;
        public const uint DefaultSeed = uint.MaxValue;
        private static uint[] defaultTable;
        private uint hash;
        private uint seed;
        private uint[] table;

        public Crc32()
        {
            this.table = InitializeTable(0xedb88320);
            this.seed = uint.MaxValue;
            this.Initialize();
        }

        public Crc32(uint polynomial, uint seed)
        {
            this.table = InitializeTable(polynomial);
            this.seed = seed;
            this.Initialize();
        }

        private static uint CalculateHash(uint[] table, uint seed, byte[] buffer, int start, int size)
        {
            uint num = seed;
            for (int i = start; i < size; i++)
            {
                num = (num >> 8) ^ table[(int) ((IntPtr) (buffer[i] ^ (num & 0xff)))];
            }
            return num;
        }

        public static uint Compute(byte[] buffer)
        {
            return ~CalculateHash(InitializeTable(0xedb88320), uint.MaxValue, buffer, 0, buffer.Length);
        }

        public static uint Compute(uint seed, byte[] buffer)
        {
            return ~CalculateHash(InitializeTable(0xedb88320), seed, buffer, 0, buffer.Length);
        }

        public static uint Compute(uint polynomial, uint seed, byte[] buffer)
        {
            return ~CalculateHash(InitializeTable(polynomial), seed, buffer, 0, buffer.Length);
        }

        protected override void HashCore(byte[] buffer, int start, int length)
        {
            this.hash = CalculateHash(this.table, this.hash, buffer, start, length);
        }

        protected override byte[] HashFinal()
        {
            byte[] buffer = this.UInt32ToBigEndianBytes(~this.hash);
            base.HashValue = buffer;
            return buffer;
        }

        public override void Initialize()
        {
            this.hash = this.seed;
        }

        private static uint[] InitializeTable(uint polynomial)
        {
            if ((polynomial == 0xedb88320) && (defaultTable != null))
            {
                return defaultTable;
            }
            uint[] numArray = new uint[0x100];
            for (int i = 0; i < 0x100; i++)
            {
                uint num2 = (uint) i;
                for (int j = 0; j < 8; j++)
                {
                    if ((num2 & 1) == 1)
                    {
                        num2 = (num2 >> 1) ^ polynomial;
                    }
                    else
                    {
                        num2 = num2 >> 1;
                    }
                }
                numArray[i] = num2;
            }
            if (polynomial == 0xedb88320)
            {
                defaultTable = numArray;
            }
            return numArray;
        }

        private byte[] UInt32ToBigEndianBytes(uint x)
        {
            return new byte[] { ((byte) ((x >> 0x18) & 0xff)), ((byte) ((x >> 0x10) & 0xff)), ((byte) ((x >> 8) & 0xff)), ((byte) (x & 0xff)) };
        }

        public override int HashSize
        {
            get
            {
                return 0x20;
            }
        }
    }
}

If u wanna fake it on ESL, u just can extract the logfile from the zip, replace the original CRC32 with the scripted items.bin's CRC32 and save it, drag it to the zip, upload the zip @ esl.eu and you can enjoy your win's on you wished ladder.. I am suprised this isn't been known before o.O

08/16/2014 23:14 Alliance�#3

I request what is because i calculate crc32 but not is equal with the original items.bin and Global.FCL for this motive i ask.But your methos is wrong because if you change the CRC32 with scripted version when i download you compressed file from esl and compare my CRC with your CRC it is not equal.
Thre is another method.
And if you use this method the modified document date change...i think you don't see how to bypass it hahahahahhahahahaha

08/16/2014 23:23 xBl4ckRaz0R.#4

Pack your items.bin with Winrar and you'll see the CRC32 Checksum as last entry.
And for your problem i think you're using somekind of wrong CRC32 class.
Add me in skype maybe i am able to help you.

08/17/2014 00:17 Alliance�#5

Quote:

Originally Posted by ~Nazar*

It is the CRC32...

Funny thing is, you have a source to parse the fcld, but u don't know what this is?

Code:

using System;
using System.Security.Cryptography;

namespace fcldParser
{
    public class Crc32 : HashAlgorithm
    {
        public const uint DefaultPolynomial = 0xedb88320;
        public const uint DefaultSeed = uint.MaxValue;
        private static uint[] defaultTable;
        private uint hash;
        private uint seed;
        private uint[] table;

        public Crc32()
        {
            this.table = InitializeTable(0xedb88320);
            this.seed = uint.MaxValue;
            this.Initialize();
        }

        public Crc32(uint polynomial, uint seed)
        {
            this.table = InitializeTable(polynomial);
            this.seed = seed;
            this.Initialize();
        }

        private static uint CalculateHash(uint[] table, uint seed, byte[] buffer, int start, int size)
        {
            uint num = seed;
            for (int i = start; i < size; i++)
            {
                num = (num >> 8) ^ table[(int) ((IntPtr) (buffer[i] ^ (num & 0xff)))];
            }
            return num;
        }

        public static uint Compute(byte[] buffer)
        {
            return ~CalculateHash(InitializeTable(0xedb88320), uint.MaxValue, buffer, 0, buffer.Length);
        }

        public static uint Compute(uint seed, byte[] buffer)
        {
            return ~CalculateHash(InitializeTable(0xedb88320), seed, buffer, 0, buffer.Length);
        }

        public static uint Compute(uint polynomial, uint seed, byte[] buffer)
        {
            return ~CalculateHash(InitializeTable(polynomial), seed, buffer, 0, buffer.Length);
        }

        protected override void HashCore(byte[] buffer, int start, int length)
        {
            this.hash = CalculateHash(this.table, this.hash, buffer, start, length);
        }

        protected override byte[] HashFinal()
        {
            byte[] buffer = this.UInt32ToBigEndianBytes(~this.hash);
            base.HashValue = buffer;
            return buffer;
        }

        public override void Initialize()
        {
            this.hash = this.seed;
        }

        private static uint[] InitializeTable(uint polynomial)
        {
            if ((polynomial == 0xedb88320) && (defaultTable != null))
            {
                return defaultTable;
            }
            uint[] numArray = new uint[0x100];
            for (int i = 0; i < 0x100; i++)
            {
                uint num2 = (uint) i;
                for (int j = 0; j < 8; j++)
                {
                    if ((num2 & 1) == 1)
                    {
                        num2 = (num2 >> 1) ^ polynomial;
                    }
                    else
                    {
                        num2 = num2 >> 1;
                    }
                }
                numArray[i] = num2;
            }
            if (polynomial == 0xedb88320)
            {
                defaultTable = numArray;
            }
            return numArray;
        }

        private byte[] UInt32ToBigEndianBytes(uint x)
        {
            return new byte[] { ((byte) ((x >> 0x18) & 0xff)), ((byte) ((x >> 0x10) & 0xff)), ((byte) ((x >> 8) & 0xff)), ((byte) (x & 0xff)) };
        }

        public override int HashSize
        {
            get
            {
                return 0x20;
            }
        }
    }
}

I think you is so much noob , try this class and check if the number which i request help is equal.The number present in the string isn't the CRC32 Checksum

08/17/2014 01:29 xBl4ckRaz0R.#6

Quote:

Originally Posted by Alliance�

I think you is so much noob , try this class and check if the number which i request help is equal.The number present in the string isn't the CRC32 Checksum

Yes. It doesn't seem to be in CRC32 format, maybe it's a ESL homemade cryption?
How about looking into MOSS via. OllyDBG or smth. similar?

08/17/2014 16:58 Alliance�#7

Close Thread i debugg Moss.exe and i found what is this code.

08/17/2014 19:29 .Sin0ne#8

#closed