Since the last forum crashed and burned from arguing. I figured lets start a new thread about developing a crack and please lets just use this thread only for cracking purposes.
I think the last thread concluded that it's impossible without the 256 bits key.
end of the story.
Lesson: blizzard owned us....... for the time being...
Quote from: TehHawk on July 19, 2010, 06:14:18 PM
I think the last thread concluded that it's impossible without the 256 bits key.
end of the story.
Lesson: blizzard owned us....... for the time being...
you are probably right. :'( It just sucks having the full version of the game but can't do anything with it. Maybe we can a continue working on a crack and once the key comes out on the 27th, we can finish the crack.
In the meantime i'm going to brush up on my skills with some Brood War and continue working on a crack.
Okay, hold up. Has someone looked at the beta SWF yet and see if it has something of a key that can be used for Authenticating?
The auth key is the decrypt key right? Or is it something else entirely?
Everything that I've seen points them out to be one of the same.
Hmm.. There must be something in the beta files that are encrypted which gets decrypted the same way.
Quote from: Kernel64 on July 19, 2010, 08:31:02 PM
Hmm.. There must be something in the beta files that are encrypted which gets decrypted the same way.
Nothing in the beta is encrypted with the same thing as this is the problem, there is not a single encryption in the beta. However with the Digital Download the important stuff is encrypted with the key that is going to be available on the blizzard servers on the 27th. Once the 27th rolls around there will be no need for a crack since you could install freely and without a battle.net account.
It's amazing how many people just copied what i said about the key.
Anyways, since you guys are so into makin a crack, i'll post what i have found.
Salsa20 R(389) encryption for both mpqe files.
They corrupted the file header and run a crc32 check on file edit.
Memory dumps of the installer are NOT protected but still use a header corruption technique (I wasn't able to circumvent a hc on a memory dump, so this is all i got).
Modifying the authorization code isn't too difficult with the right tools, however, it still requires the 256 bit key for the tome decryption.
Useful tools:
Ollydbg
Phant0m
Peid with crc32 plugin
IDA PRO
IGNORE PEOPLE THAT SAY YOU NEED AN EMULATED SERVER - EVERYTHING EXCEPT THE 256-BIT KEY CAN BE FOUND LOCALLY.
Edit: You might wanna get Kerneldetective for dumping the sc2 installer.
The 256 bit key I believe is retrieved somehow by the Authentication code for sure than. The Authentication Code and the Decryption code are the one and the same. As proof I present that there is no storage space for authentication code, however when you change a jump address from jz to jnz it opens a screen where you manually enter the authentication code, this than goes directly down to a section of code containing hasValidDecryptionKey.
This means that the authentication key is also checked. Then there are 3 characters that are restricted. So that narrows down the decryption key further.
Quote from: darkrei9n on July 19, 2010, 08:57:09 PM
The 256 bit key I believe is retrieved somehow by the Authentication code for sure than. The Authentication Code and the Decryption code are the one and the same. As proof I present that there is no storage space for authentication code, however when you change a jump address from jz to jnz it opens a screen where you manually enter the authentication code, this than goes directly down to a section of code containing hasValidDecryptionKey.
This means that the authentication key is also checked. Then there are 3 characters that are restricted. So that narrows down the decryption key further.
Yeah, it's the auth code. Now all you gotta do is guess a 10 - 20 digit & alphanumerical number.
Quote from: obliviron on July 19, 2010, 09:21:54 PM
Quote from: darkrei9n on July 19, 2010, 08:57:09 PM
The 256 bit key I believe is retrieved somehow by the Authentication code for sure than. The Authentication Code and the Decryption code are the one and the same. As proof I present that there is no storage space for authentication code, however when you change a jump address from jz to jnz it opens a screen where you manually enter the authentication code, this than goes directly down to a section of code containing hasValidDecryptionKey.
This means that the authentication key is also checked. Then there are 3 characters that are restricted. So that narrows down the decryption key further.
Yeah, it's the auth code. Now all you gotta do is guess a 10 - 20 digit & alphanumerical number.
30 digits. Its a 30 digit number. Also, the code is validated. So we can make a keygen based off of what is found acceptable and try all those.
To darkrei9n, obliviron and other cracking pros:
The chinese cracking group made some progress on this and I'm going to translate what they currently get:
1. They also find authentication key and decription key is the same and get to the screen for manaully entering the authentication code. So everything still boils down to getting the salsa20 decription key.
2. What they found is that the mpqe file heads are NOT corrupted, and you can get plain text from them. With the plain text known, one can do a XOR with cipher text to get the Hash table. With a second round of sorting on Hash table you can get decription key. They compare the mpqe file with the beta non-encrypted) ones. For example, the first row in beta mpq is 01 00 03 00. And in retail mpqe it's 01 00 05 00. If you do a XOR of 03 and 05 and use the result to XOR the other mpqe and you get the same result. This shows the key is valid. So we actually know the plain text. However, the second row of mpqe file is messed up so there's 8 bits out of 64 bits plain text missing.
3. Now the project is: Attack sala20 cryptography with complete knowledge of ciphertext and about 90% plain text. Is there any algorithm optimized for computing that?
We hope the pros here can help us and share the knowledge and skills. I don't know much about the terminology in cryptography so the translation may be a little hard to understand. But you pros should be able to get it!
gzxaaa. The installer validates the authentication key, which means that there's something in the installer that checks the authentication key, if you find this you can narrow down the possible authentication keys than that makes brute forcing it easier as you remove a bunch of invalid keys.
Quote from: darkrei9n link=topic=2034.msg19226#msg19226 date=1279591029
...however when you change a jump address from jz to jnz it opens a screen where you manually enter the authentication code...
Quote from: gzxaaa on July 20, 2010, 01:20:22 AM
...
1. They also find authentication key and decription key is the same and get to the screen for manaully entering the authentication code. So everything still boils down to getting the salsa20 decription key.
...
To get to that screen(where you manually enter the auth key) you just need to restrict the SC2 installer from accessing the net(or simply unplug your network cable/turn off your modem). Then when you try to install the game you will get an error explaining that you need the authkey from internet. On that error screen when you click on the yellow triangle(with the exclamation mark on it) in the bottom right corner and it opens the following screen:
(http://i28.tinypic.com/nvx2e.png)
No need to modify the exe in any way to get to that screen...
P.S.
Sry for the lame Paint editing just didn't wanted everyone to see the p0rn that I was downloading :)
The other thread also crashed and burned because some members have no concept of respect and manners. I can see the same happening here.
If we all work together we might come up with something. I remember when Mass Effect 1 came out and everyone was trying to crack the game to pass the "galaxy map" section, eventually the solution came from a random user.
When a lot of people are working together towards cracking something, sooner or later that thing will break.
/OFFTOPICQuote from: steve30x on July 20, 2010, 02:17:19 AM
The other thread also crashed and burned because some members have no concept of respect and manners. I can see the same happening here.
Actually all the posts that were made above yours were contributing with some info or at least were on topic. But I guess you are right - it all comes to respect and
manners like not spamming the topic with useless replies!
Quote from: 2g4u on July 20, 2010, 03:04:11 AM
/OFFTOPIC
Quote from: steve30x on July 20, 2010, 02:17:19 AM
The other thread also crashed and burned because some members have no concept of respect and manners. I can see the same happening here.
Actually all the posts that were made above yours were contributing with some info or at least were on topic. But I guess you are right - it all comes to respect and manners like not spamming the topic with useless replies!
I wa'nt attacking anybody that posted on this thread before me. I was just stating a fact. I'm hoping the rude non respectful people start dont on here also.
http://baiy.cn/utils/crypto/ (http://baiy.cn/utils/crypto/) its chinese but the app is eng can decypt salsa20 but needs password :'(
Somebody already tried this crack?
http://letitbit.net/download/34330.34ccf4074ada77a5ebeeea49b612172b5/Installer.rar.html (http://letitbit.net/download/34330.34ccf4074ada77a5ebeeea49b612172b5/Installer.rar.html)
Pay attention maybe it can have a virus.
Just click free in the toolbar wait 60second and download it i just downloaded it but not sure if im going to try this.
Too lazy to restart the computer (i have bootcamp, im a mac user)
Il test, downloading now...
Until i conferm its real nobudy shold down it
And im going to confifm that it is real or not. Its the least I can do :thumbsup:
I can confirm 2 things already, Its NO virus, and the installer is russian...
Not sure if it works yet though
Fake and russian
http://www.playground.ru/cheats/nocd/ (http://www.playground.ru/cheats/nocd/)
NoCD для StarCraft 2: Wings of Liberty (http://www.playground.ru/cheats/starcraft_2/)not tested
EDIT sorry did not lock at the date i hate russians dont know that an BETA needs to have BETA in the filename
yep, its fake. Il test the untested one now...
I think that whole site is one big fake...
QuoteI think that whole site is one big fake...
http://www.playground.ru/ (http://www.playground.ru/cheats/nocd/)
no its an kinda god crack site
Wait a minute, did the old installer ask you for a cd???
The crack one does...
http://img834.imageshack.us/f/sc2.png/ (http://img834.imageshack.us/f/sc2.png/)
BTW; It's a random code, and nvm the background...
Quote from: Doomer3001 on July 20, 2010, 08:50:09 AM
Wait a minute, did the old installer ask you for a cd???
The crack one does...
http://img834.imageshack.us/f/sc2.png/ (http://img834.imageshack.us/f/sc2.png/)
WOW no the old installer doesnt asked for a cd i think.(not sure)
ya it does rename ui 2 and see
So... when you remove ui2, it needs a disk? What if ui2 IS the disk?! Just make an image of it perhaps? And add the other mpqe's? Make it one big iso or something? If it wants a disk, we'll give it a disk!
Just a random idea...
Il report back when I created the iso, mounted it, and use the installer to load it
stupid that text is an placeholder for the cd version
EDIT the key is in one of the exe's couse any mpq works in palace of Installer UI 2.MPQE
OMG... youre right... How is it going to check if it has the right key, if it doesnt already have it... ???
And I remember someone say that the installer doesn't know how to use the mpqe's...
why is it using the ui2 mpqe then...?
Ok... the only thing we need to do... is get the key from the mpqe...
Doomer the conclusions that you are coming to atm are either wrong or already known. The installer reqs the cd because the only thing in the Installer.rar archive downloaded from that Russian site is the Installer.exe application and Installer UI 1.MPQ, it still needs Installer UI 2.MPQE and Installer Tome 1.MPQE.
Tnx for the constructive critisism and inpiration :thumbsup:
Just trying to help :P
where is the Chinese site that's also cracking decryption? cant find it
Is it going to be much easier to crack the game after blizzard lets you install it?
Because im not going to wait longer than a day after the game release.
@tomsons;
http://translate.google.com/translate?hl=en&sl=zh-CN&u=http://3dmgame.chnren.com/bbs/showtopic.aspx%3Ftopicid%3D1364288%26page%3Dend&ei=MqJCTOX0M4WF4Qa437yjDg&sa=X&oi=translate&ct=result&resnum=7&ved=0CD4Q7gEwBg&prev=/search%3Fq%3Dmpqe%26hl%3Den%26sa%3DX%26tbo%3D1%26tbs%3Dqdr:d (http://translate.google.com/translate?hl=en&sl=zh-CN&u=http://3dmgame.chnren.com/bbs/showtopic.aspx%3Ftopicid%3D1364288%26page%3Dend&ei=MqJCTOX0M4WF4Qa437yjDg&sa=X&oi=translate&ct=result&resnum=7&ved=0CD4Q7gEwBg&prev=/search%3Fq%3Dmpqe%26hl%3Den%26sa%3DX%26tbo%3D1%26tbs%3Dqdr:d)
here you go. I think you ment this one
Quote from: Doomer3001 on July 20, 2010, 09:13:09 AM
OMG... youre right... How is it going to check if it has the right key, if it doesnt already have it... ???
like all programs do.... tries to decryp ....
decrypt fail = Error
decrypt ok = Proced with decryption
if u try to trick it to decrypt with the wrong key you will get 7 GB of unusefull data... simple
As a reminder please read the Rules of this section:
Quote from: From Rules Topic
This section is for the discussion of Starcraft II Development (Hacking/Reversal/Research).
Anything not related to the above mentioned will be either moved or deleted.
Make sure you visit the Wiki also.
For actual good examples of what research related topics mean, check out the Starcraft section in research area for posts on research.
This topic is just turning out into where to get a crack. If you have nothing useful to post or discuss, please don't post in here, but rather another section to discuss where to find a crack.
Unless you have info or want to discuss how to bypass the security measures implemented by Blizzard for SCII, please post somewhere else for anything not related to that.
Thanks
P.S - I'll start organizing all the source code from past projects, which I do have all of them, and make a pinned reference topic in this section, after I think about ways to properly do so, without Blizzard saying those authors breached their contracts with them. So staytuned.
Also don't bother replying to me in regards to this post. Just keep the discussion about bypassing these encryptions.
Quote from: Myst on July 20, 2010, 12:52:50 PM
As a reminder please read the Rules of this section:
Quote from: From Rules Topic
This section is for the discussion of Starcraft II Development (Hacking/Reversal/Research).
Anything not related to the above mentioned will be either moved or deleted.
Make sure you visit the Wiki also.
For actual good examples of what research related topics mean, check out the Starcraft section in research area for posts on research.
This topic is just turning out into where to get a crack. If you have nothing useful to post or discuss, please don't post in here, but rather another section to discuss where to find a crack.
Unless you have info or want to discuss how to bypass the security measures implemented by Blizzard for SCII, please post somewhere else for anything not related to that.
Thanks
P.S - I'll start organizing all the source code from past projects, which I do have all of them, and make a pinned reference topic in this section, after I think about ways to properly do so, without Blizzard saying those authors breached their contracts with them. So staytuned.
Also don't bother replying to me in regards to this post. Just keep the discussion about bypassing these encryptions.
too many ppl that wanna be usefull Myst but does not have the right knowledge to do it... do as the chinese guys do on their forums write a "support" word and stop writing hundreds of unusefull data lines. you are helping more doing so... tnx
The latest news from the Chinese sites are that they are still looking for the key to decrypt the files, BUT they claim that they didn't find anything in the Installer.exe and I dunno if they would be able to find it anywhere else in the install files...
P.S. Check this block scheme it should explain to everyone what is going on with the Installer atm(sry for the crappy look, but I made it in 10 mins, I am at work after all):
(http://i29.tinypic.com/aauh4z.png)
maybe the key needs to be place in several places?
anyone tried to disassemble the Mac installator?
Quote from: berrykerry789 on July 21, 2010, 04:49:33 AM
maybe the key needs to be place in several places?
that's right, the key must be in a place that the crackers must know... but if it doenst accept the fake keys then it is the doom of the sc2 crack...
cracking seems so complicated :P
Wait darkrei9n sad
QuoteUpdate. After some careful hex editing we have no bypassed the first error achieved, FAILURE TO OPEN <EULA>, it now opens the eula window properly and goes onto install WITHOUT any XML editing. We need to get it to decrypt however still.
but the EULA is in the
Installer UI 2.MPQE so the installer is should be able to open
MPQE'sor did it open just the window not the EULA?
:'( looks like blue won... wont get to play before the 27... :'(
I've been paying attention to this since the first thread opened up, and here's something I'm not getting. The authentication key is supposedly 30 characters (assuming blizz didn't add useless characters to the string); is alphanumeric (sans 0,o,1, and i; leaving a 32 character set); salsa20 uses a 256-bit key (again assuming standard implementation). This means that the mpqe's should only be (truly) protected by an 8 character code (from their 32-bit character set).
From what I'm reading, the authentication code should either go through some kind of conversion to become the mpqe key, or the mpqe key should be stored somewhere. It seems that most people get this.
Hopefully atleast one person who can follow assembly is working on this, so my question is: What does the installer do when you manually type in the code? A 30 character string can't just disappear.
I'll try looking at it again myself, see if inspiration hits.
Kremnari
Blackcode- confirmed that the authentication key is actually 32 characters. A bunch of people were confusing me as well and saying it was 30. The fact that it is 32 makes it a lot more simple now :p.
The thing is, blizzards implementation of the system is very far from perfect. Like you said the key is limited to alphanumeric characters. Plus the installer preforms a validation check. Someone could potentially reverse engineer the validation algorithm, generate all the possible keys and then try brute forcing. There probably would be a lot, but it would be a lot less than 2^256 options (which is more than a fucktonne). Blizzard is kinda defeating the purpose of using a 256 bit key, if they are just going to limit it to alphanumeric characters + supply us with an algorithm which will exclude a bunch of options.
That said, I don't think it'll get cracked :p.
If anyone has source for bruteforcing*, I have over two teraflops at my disposal. The standard 2^256 would still take a significant amount of time, but a reduced set may be within the realm of possibility.
Actually, limiting the character set to 32 allows them to express a 2^5 sequence as a unique character with no leftovers.
It's odd, 32 char set with a 32 char key... this is well above the 256-bit salsa key (4x). It just seems to me that Blizzard could have this with irony...
Anyways, somebody want's to drop me some code, I can run it.
Kremnari
P.S, has anybody checked for differences in the enGB vs enUS installers?
*Either direct bruteforcing the mpqe, or generating a list of potentially valid keys would work.
Just my two cents: if Blizzard has allowed this to be installed off-line with authentication key then it should be possible to crack the installation without resorting to brute-forcing decryption keys. In other words: it is a matter of simple serial cracking, lots of tutorials are available, for example:
http://www.reversing.be/article.php?story=20060630073513417&query=serial (http://www.reversing.be/article.php?story=20060630073513417&query=serial)
I used to do this back in the day when Soft-Ice was the king but haven't touched any debuggers since then :)
just a thought mabee your looking at this the wrong way its quite possible that the intall exe is scripted to check for a valid code by opening the mpqe and reading a file inside it aswell as doing all the other shit i know nothing about cracking i just thought id put my two cents in in an effort to get peaple thinking outside the box XD good luck guys/girls
I just thought I'd post, the installers (bootstrapped) for enUS, enGB and zhTW are all identical. This leads me to believe that there still may by separate keys for/as each version points to it's on web address for the authentication key.
seems like the installer must decrypt the mpqe file in order to get the bootstrap installer...
The SC2WOL DVD has 2 keys??? http://picasaweb.google.com/drivex.info/Starcraft2?feat=directlink#5496762898265175202 (http://picasaweb.google.com/drivex.info/Starcraft2?feat=directlink#5496762898265175202)
The second one is trial version buddy invite key.
Quote from: tomsons26 on July 21, 2010, 06:03:07 AM
anyone tried to disassemble the Mac installator?
Nobody cares about Macs.
Only 3 more days, pointless for working on the crack installer anymore.
The crack is here
http://sc2.nibbits.com/assets/starcrack-allin1/files/351/ (http://sc2.nibbits.com/assets/starcrack-allin1/files/351/)