Rev 270 | Go to most recent revision | Details | Compare with Previous | Last modification | View Log | RSS feed
| Rev | Author | Line No. | Line |
|---|---|---|---|
| 267 | daniel-mar | 1 | # Obfuscated filters |
| 2 | |||
| 3 | ## Location |
||
| 4 | |||
| 5 | Obfuscated standalone filters: |
||
| 6 | - Windows resource: RCDATA\16001\0 |
||
| 7 | - MacOS resource: 'DATA' 16001 |
||
| 8 | |||
| 9 | Normal standalone filters: |
||
| 10 | - Windows resource: PARM\16000\0 |
||
| 11 | - MacOS resource: 'PARM' 16000 |
||
| 12 | |||
| 271 | daniel-mar | 13 | ## Implementation |
| 270 | daniel-mar | 14 | |
| 271 | daniel-mar | 15 | Defined in **ff.h**, implemented in **make.c**: |
| 267 | daniel-mar | 16 | |
| 271 | daniel-mar | 17 | void obfusc(PARM_T* pparm); |
| 18 | void deobfusc(PARM_T* pparm); |
||
| 19 | |||
| 20 | ### Obfuscation "Version 3" |
||
| 21 | |||
| 267 | daniel-mar | 22 | Introduced in **Filter Foundry 1.7.0.5** [30-Jul-2021] |
| 23 | |||
| 24 | It is compiler-dependant, therefore the resource cannot be exchanged between plugins! |
||
| 25 | |||
| 270 | daniel-mar | 26 | Algorithm: XOR with a modified `rand()`-stream with seed that is stored at position 0x30 |
| 267 | daniel-mar | 27 | (this field is not used in the `PARM` resource). |
| 28 | |||
| 270 | daniel-mar | 29 | The rand() function is a bit altered: |
| 30 | |||
| 31 | int randInRange(int min, int max) { |
||
| 32 | double scale = 1.0 / (RAND_MAX + 1); |
||
| 33 | double range = (double)max - (double)min + 1; |
||
| 34 | return min + (int)(rand() * scale * range); |
||
| 35 | } |
||
| 36 | |||
| 37 | 32 bit plugin is built with OpenWatcom (for Win95 compatibility) which has following formula: |
||
| 38 | |||
| 39 | int rand_openwatcom(unsigned int* seed) { |
||
| 40 | *seed = *seed * 1103515245L + 12345L; |
||
| 41 | return (*seed >> 16) & 0x7fff; /* Scale between 0 and RAND_MAX */ |
||
| 42 | } |
||
| 43 | |||
| 271 | daniel-mar | 44 | 64 bit plugin is built with Visual C++ which has following formula: |
| 270 | daniel-mar | 45 | |
| 46 | int rand_msvcc(unsigned int* seed) { |
||
| 47 | *seed = *seed * 214013L + 2531011L; |
||
| 48 | return (*seed >> 16) & 0x7fff; /* Scale between 0 and RAND_MAX */ |
||
| 49 | } |
||
| 50 | |||
| 271 | daniel-mar | 51 | ### Obfuscation "Version 2" |
| 267 | daniel-mar | 52 | |
| 53 | Introduced in **Filter Foundry 1.7b1** [20-Sep-2019] |
||
| 54 | |||
| 55 | It is compiler-independant! |
||
| 56 | |||
| 57 | Algorithm: [XOR-Shift](https://de.wikipedia.org/wiki/Xorshift "XOR-Shift") with hardcoded seed `0x95d4a68f`. |
||
| 58 | |||
| 59 | x32 = 0x95d4a68f; |
||
| 60 | for(i = size, p = pparm; i--;) { |
||
| 270 | daniel-mar | 61 | x32 ^= x32 << 13; |
| 62 | x32 ^= x32 >> 17; |
||
| 63 | x32 ^= x32 << 5; |
||
| 64 | *p++ ^= x32; |
||
| 267 | daniel-mar | 65 | } |
| 66 | |||
| 271 | daniel-mar | 67 | ### Obfuscation "Version 1" |
| 267 | daniel-mar | 68 | |
| 69 | Introduced in **Filter Foundry 1.4b8,9,10** |
||
| 70 | |||
| 71 | It is compiler-dependant, therefore the resource cannot be exchanged between plugins! |
||
| 72 | |||
| 73 | Algorithm: XOR with `rand()`-stream with hardcoded seed `0xdc43df3c`. |
||
| 74 | |||
| 75 | srand(0xdc43df3c); |
||
| 76 | for(i = size, p = pparm; i--;) { |
||
| 77 | *p++ ^= rand(); |
||
| 271 | daniel-mar | 78 | } |
| 79 | |||
| 80 | The plugin is built with Visual C++ which has following formula: |
||
| 81 | |||
| 82 | int rand_msvcc(unsigned int* seed) { |
||
| 83 | *seed = *seed * 214013L + 2531011L; |
||
| 84 | return (*seed >> 16) & 0x7fff; /* Scale between 0 and RAND_MAX */ |
||
| 85 | } |
||
| 86 |