Rev 408 | Rev 503 | Go to most recent revision | Show entire file | Regard whitespace | Details | Blame | Last modification | View Log | RSS feed
| Rev 408 | Rev 489 | ||
|---|---|---|---|
| Line 217... | Line 217... | ||
| 217 | } |
217 | } |
| 218 | else if ((obfusc_info >= 4) && (obfusc_info <= 0xFF)) { // xx 00 00 00 |
218 | else if ((obfusc_info >= 4) && (obfusc_info <= 0xFF)) { // xx 00 00 00 |
| 219 | // Version 4 obfuscation (Filter Foundry 1.7.0.7) |
219 | // Version 4 obfuscation (Filter Foundry 1.7.0.7) |
| 220 | // Version 5 obfuscation (Filter Foundry 1.7.0.8) |
220 | // Version 5 obfuscation (Filter Foundry 1.7.0.8) |
| 221 | // Version 6 obfuscation (Filter Foundry 1.7.0.10) |
221 | // Version 6 obfuscation (Filter Foundry 1.7.0.10) |
| 222 | // Future: Version 6, 7, 8, ... 255 |
222 | // Future: Version 7, 8, ... 255 |
| 223 | return obfusc_info; |
223 | return obfusc_info; |
| 224 | } |
224 | } |
| 225 | else { |
225 | else { |
| 226 | // Version 3 obfuscation (Filter Foundry 1.7.0.5) |
226 | // Version 3 obfuscation (Filter Foundry 1.7.0.5) |
| 227 | // obfusc_info is the srand() seed and is equal to the time(0) build timestamp |
227 | // obfusc_info is the srand() seed and is equal to the time(0) build timestamp |
| Line 343... | Line 343... | ||
| 343 | } |
343 | } |
| 344 | case 4: |
344 | case 4: |
| 345 | case 5: { |
345 | case 5: { |
| 346 | // Version 4 obfuscation (Filter Foundry 1.7.0.7) |
346 | // Version 4 obfuscation (Filter Foundry 1.7.0.7) |
| 347 | // Version 5 obfuscation (Filter Foundry 1.7.0.8) |
347 | // Version 5 obfuscation (Filter Foundry 1.7.0.8) |
| 348 | // Not compiler dependent, but individual for each build |
348 | // Not compiler dependent, but individual for each standalone filter |
| 349 | // It is important that this code works for both x86 and x64 indepdently from the used compiler, |
349 | // It is important that this code works for both x86 and x64 indepdently from the used compiler, |
| 350 | // otherwise, the cross-make x86/x64 won't work! |
350 | // otherwise, the cross-make x86/x64 won't work! |
| 351 | // Version 5 contains a seed requirement (checksum). |
351 | // Version 5 contains a seed requirement (checksum). |
| 352 | 352 | ||
| 353 | unsigned char* p; |
353 | unsigned char* p; |
| Line 380... | Line 380... | ||
| 380 | 380 | ||
| 381 | break; |
381 | break; |
| 382 | } |
382 | } |
| 383 | case 6: { |
383 | case 6: { |
| 384 | // Version 6 obfuscation (Filter Foundry 1.7.0.10) |
384 | // Version 6 obfuscation (Filter Foundry 1.7.0.10) |
| 385 | // Not compiler dependent, but individual for each build |
385 | // Not compiler dependent, but individual for each standalone filter |
| 386 | // It is important that this code works for both x86 and x64 indepdently from the used compiler, |
386 | // It is important that this code works for both x86 and x64 indepdently from the used compiler, |
| 387 | // otherwise, the cross-make x86/x64 won't work! |
387 | // otherwise, the cross-make x86/x64 won't work! |
| 388 | 388 | ||
| 389 | unsigned char* p; |
389 | unsigned char* p; |
| 390 | uint32_t xorseed, checksum; |
390 | uint32_t xorseed, checksum; |
| Line 428... | Line 428... | ||
| 428 | (pparm->cbSize != PARM_SIG_MAC)) { |
428 | (pparm->cbSize != PARM_SIG_MAC)) { |
| 429 | memset(pparm, 0, sizeof(PARM_T)); // invalidate everything |
429 | memset(pparm, 0, sizeof(PARM_T)); // invalidate everything |
| 430 | } |
430 | } |
| 431 | 431 | ||
| 432 | if (obfusc_version >= 3) { |
432 | if (obfusc_version >= 3) { |
| 433 | // Filter Foundry >= 1.7.0.5 builds combines obfuscation and protection |
433 | // Filter Foundry >= 1.7.0.5 combines obfuscation and protection |
| 434 | // when a standalone filter is built. Theoretically, you can un-protect a |
434 | // when a standalone filter is built. Theoretically, you can un-protect a |
| 435 | // plugin, even if it is obfuscated, just by bit-flipping the LSB of byte 0x164. |
435 | // plugin, even if it is obfuscated, just by bit-flipping the LSB of byte 0x164. |
| 436 | // Therefore, we enforce that the plugin is protected! |
436 | // Therefore, we enforce that the plugin is protected! |
| 437 | pparm->iProtected = 1; |
437 | pparm->iProtected = 1; |
| 438 | 438 | ||