Printable View
Yes, I've finally broken this evil encryption scheme. It took me a lot of work, but here it is: CB2crypt.
This program will decrypt and encrypt _any_ cheat code for CodeBreaker PS2, including version 7 or higher.
UPDATE: Current version is 1.21
You can download CB2crypt here.
I've also included the source code, so you can use/modify it under the terms of the GNU GPL.
Let's get hacking! :)
-misfire
does CMX know about this
Nice job, misfire. I know it couldn't have been easy. I think I got about halfway through reversing whatever bastardized version of RSA they were using, which as I recall, contained at least one subroutine with around 6,000 op codes in it, before I decided I had better things to do with my time.
pyriel, are you going to add CB V.7+ encryption to maxconvert anytime soon
The RSA decryption routines are a total of ~1600 opcodes (altogether ~2800). Actually, I did _not_ reverse engineer this huge amount of assembly code. But I assumed that it was another reliable encryption algorithm like RC4.Quote:
Originally Posted by Pyriel
All I had were some input values and the corresponding output values:
f(0x4591FB89686F1774) = 0x194EDB45C445E8C6
f(0x6156AD2A65C8AC6E) = 0x49658946C445E8C6
f(0xD708CB0A5DB2906C) = 0x961C726B17405B2A
The problem was to find f. Among the parameters of f are two constants: d = 11, n = 0xFFFFFFFFFFFFFFF5
At this point I've tried the RSA decryption formula intuitively:
c^d mod n = m
0x4591FB89686F1774**11 mod 0xFFFFFFFFFFFFFFF5 = 0x194EDB45C445E8C6
0x6156AD2A65C8AC6E**11 mod 0xFFFFFFFFFFFFFFF5 = 0x49658946C445E8C6
0xD708CB0A5DB2906C**11 mod 0xFFFFFFFFFFFFFFF5 = 0x961C726B17405B2A
And the encryption was broken. :)
is there a reason you not factor the 64-bit number?
This 64-bit number is the RSA modulus. You don't have to factor it for decryption cause the key is already known (d = 11).
Nice. My general encryption knowledge is passing, and my math is all around 10 years old. I started from the assumption that they were taking pieces of the basic routines and perverting them the way they did the RC4 cipher boxes. I didn't discover the second layer was RSA until I'd gotten well into it, when I could take portions of what I'd reversed and compare them to known algorithms. The enormous routines I ran into might have been portions of an algorithm to compute coprimes, and thus may not have been used in actually applying the encryption. I don't remember exactly.
That was about the time I looked at what was left to do, and taking into account that I'd told CMX I wouldn't release it, decided it wasn't worth the effort to finish the project.
Your way is definitely quicker and easier than mine, except perhaps for the knowledge prerequisites.
While cracking the CB V7 encryption I developed a nice reverse engineering technique, which allowed me to verify my ported C code.
Using PS2SDK I've written a PS2 program that loads the crypto routines of the CodeBreaker ELF into memory. I knew the function prototypes/addresses from IDA; therefore, it was no problem to call them in C. That way, I was able to test my functions by comparing the outputs.
Btw, RSA is also used for digitally signing Day1 files. I remember seeing some cross references, so it actually wasn't all about intuition. ;)
Yeah, I did something similar to verify my outputs. I never got quite far enough with the RSA layer to have much worth checking though.