Data.Codec.Blizz.CDHash

Exploring the CD key hash used to authenticate the game with Battle.net.

Documentation

data Sniff

Data accessible to an attacker observing traffic. All plaintext.

Only missing piece of CD key info is the private value, which gets hashed.

Constructors

Sniff

Fields

snClientTok :: Word32

nonce

snServerTok :: Word32

nonce

snProduct :: Word32

decoded from key: 6 classic D2, 10 xpac D2 are common values

snPublic :: Word32

decoded from key, server has mapping to the private value

Instances

Eq Sniff

Ord Sniff

Show Sniff

hash

Arguments

:: Sniff

-> N

private value

-> Vector N

Sample D2 CD key hash buffer. XSHA1 of this is sent to the server.

Test values. (CD keys stripped, get your own.)

sniff1, sniff2 :: Sniff

result1, result2 :: (N, N, N, N, N)

Expand stage analysis.

view :: Vector N -> IO ()

Print infix equations for buffer.

classify :: Vector N -> String

Classify DWORDs based on how much knowledge an eavesdropper has of them.

X = known value

? = unknown (32 bit CD key private value)

# = depends on 5 LSBs of private value

Traffic sniffing attack.

space :: Sniff -> [Vector N]

Possible hash buffer construction from data known to eavesdroper.

Since most of the expanded buffer depends just on 5 secret bits, 32 different buffers will cover all the possibilities for all but one DWORD. That DWORD is the private key value, and is unknown.

Only the relevant 5 bits on the private value are set. It should be re-set afterwards, to a better guess or and unknown.

setPriv :: N -> Vector N -> Vector N

test :: Regs

alpha :: Vector N -> Regs

Unknown value is the pivot point.

Register states before and after it are marked alpha and beta. Beta has 32 possible values. Alpha just one. Solve for 32 private values.

beta :: Vector N -> Regs -> Regs

getUnk :: Regs -> Vector N -> N

guessedUnknowns :: Sniff -> Regs -> [N]

unhash :: Sniff -> (N, N, N, N, N) -> IO ()

Get private values from sniffed data.

Some false positives, Binomial(n=31, p=1/32)

Straightforward to encode back into human-readable CD key.

Debug stuff

printReg :: PrintfType t => (N, N, N, N, N) -> t

hfoldl :: (a -> t -> a) -> a -> [t] -> (a, [a])

Foldl that keeps history.