1 /*****************************************************************************
3 *****************************************************************************
4 * Copyright (C) 2004 VideoLAN
5 * $Id: drms.c,v 1.1 2004/01/05 12:37:52 jlj Exp $
7 * Author: Jon Lech Johansen <jon-vl@nanocrew.net>
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 2 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, write to the Free Software
21 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111, USA.
22 *****************************************************************************/
24 #include <stdlib.h> /* malloc(), free() */
35 #include "drmstables.h"
37 #define TAOS_INIT( tmp, i ) \
38 memset( tmp, 0, sizeof(tmp) ); \
39 tmp[ i + 0 ] = 0x67452301; \
40 tmp[ i + 1 ] = 0xEFCDAB89; \
41 tmp[ i + 2 ] = 0x98BADCFE; \
42 tmp[ i + 3 ] = 0x10325476;
44 #define ROR( x, n ) (((x) << (32-(n))) | ((x) >> (n)))
46 static void init_ctx( uint32_t *p_ctx, uint32_t *p_input )
51 p_ctx[ 0 ] = sizeof(*p_input);
53 memset( &p_ctx[ 1 + 4 ], 0, sizeof(*p_input) * 4 );
54 memcpy( &p_ctx[ 1 + 0 ], p_input, sizeof(*p_input) * 4 );
56 p_tmp[ 0 ] = p_ctx[ 1 + 3 ];
58 for( i = 0; i < sizeof(p_drms_tab1)/sizeof(p_drms_tab1[ 0 ]); i++ )
60 p_tmp[ 0 ] = ROR( p_tmp[ 0 ], 8 );
62 p_tmp[ 5 ] = p_drms_tab2[ (p_tmp[ 0 ] >> 24) & 0xFF ]
63 ^ ROR( p_drms_tab2[ (p_tmp[ 0 ] >> 16) & 0xFF ], 8 )
64 ^ ROR( p_drms_tab2[ (p_tmp[ 0 ] >> 8) & 0xFF ], 16 )
65 ^ ROR( p_drms_tab2[ p_tmp[ 0 ] & 0xFF ], 24 )
67 ^ p_ctx[ 1 + ((i + 1) * 4) - 4 ];
69 p_ctx[ 1 + ((i + 1) * 4) + 0 ] = p_tmp[ 5 ];
70 p_tmp[ 5 ] ^= p_ctx[ 1 + ((i + 1) * 4) - 3 ];
71 p_ctx[ 1 + ((i + 1) * 4) + 1 ] = p_tmp[ 5 ];
72 p_tmp[ 5 ] ^= p_ctx[ 1 + ((i + 1) * 4) - 2 ];
73 p_ctx[ 1 + ((i + 1) * 4) + 2 ] = p_tmp[ 5 ];
74 p_tmp[ 5 ] ^= p_ctx[ 1 + ((i + 1) * 4) - 1 ];
75 p_ctx[ 1 + ((i + 1) * 4) + 3 ] = p_tmp[ 5 ];
77 p_tmp[ 0 ] = p_tmp[ 5 ];
80 memcpy( &p_ctx[ 1 + 64 ], &p_ctx[ 1 ], sizeof(*p_ctx) * 4 );
82 for( i = 4; i < sizeof(p_drms_tab1); i++ )
84 p_tmp[ 2 ] = p_ctx[ 1 + 4 + (i - 4) ];
86 p_tmp[ 0 ] = (((p_tmp[ 2 ] >> 7) & 0x01010101) * 27)
87 ^ ((p_tmp[ 2 ] & 0xFF7F7F7F) << 1);
88 p_tmp[ 1 ] = (((p_tmp[ 0 ] >> 7) & 0x01010101) * 27)
89 ^ ((p_tmp[ 0 ] & 0xFF7F7F7F) << 1);
90 p_tmp[ 4 ] = (((p_tmp[ 1 ] >> 7) & 0x01010101) * 27)
91 ^ ((p_tmp[ 1 ] & 0xFF7F7F7F) << 1);
93 p_tmp[ 2 ] ^= p_tmp[ 4 ];
95 p_tmp[ 3 ] = ROR( p_tmp[ 1 ] ^ p_tmp[ 2 ], 16 )
96 ^ ROR( p_tmp[ 0 ] ^ p_tmp[ 2 ], 8 )
97 ^ ROR( p_tmp[ 2 ], 24 );
99 p_ctx[ 1 + 4 + 64 + (i - 4) ] = p_tmp[ 3 ] ^ p_tmp[ 4 ]
100 ^ p_tmp[ 1 ] ^ p_tmp[ 0 ];
104 static void ctx_xor( uint32_t *p_ctx, uint32_t *p_in, uint32_t *p_out,
105 uint32_t p_table1[ 256 ], uint32_t p_table2[ 256 ] )
108 uint32_t p_tmp1[ 4 ];
109 uint32_t p_tmp2[ 4 ];
113 p_tmp1[ 0 ] = p_ctx[ 1 + i + 24 ] ^ p_in[ 0 ];
114 p_tmp1[ 1 ] = p_ctx[ 1 + i + 25 ] ^ p_in[ 1 ];
115 p_tmp1[ 2 ] = p_ctx[ 1 + i + 26 ] ^ p_in[ 2 ];
116 p_tmp1[ 3 ] = p_ctx[ 1 + i + 27 ] ^ p_in[ 3 ];
120 #define XOR_ROR( p_table, p_tmp, i_ctx ) \
121 p_table[ (p_tmp[ y > 2 ? y - 3 : y + 1 ] >> 24) & 0xFF ] \
122 ^ ROR( p_table[ (p_tmp[ y > 1 ? y - 2 : y + 2 ] >> 16) & 0xFF ], 8 ) \
123 ^ ROR( p_table[ (p_tmp[ y > 0 ? y - 1 : y + 3 ] >> 8) & 0xFF ], 16 ) \
124 ^ ROR( p_table[ p_tmp[ y ] & 0xFF ], 24 ) \
127 for( x = 0; x < 1; x++ )
129 memcpy( p_tmp2, p_tmp1, sizeof(p_tmp1) );
131 for( y = 0; y < 4; y++ )
133 p_tmp1[ y ] = XOR_ROR( p_table1, p_tmp2, 1 + i - x + y );
139 memcpy( p_tmp2, p_tmp1, sizeof(p_tmp1) );
141 for( y = 0; y < 4; y++ )
143 p_tmp1[ y ] = XOR_ROR( p_table1, p_tmp2,
144 1 + i - x - ((x * 3) - y) );
148 for( y = 0; y < 4; y++ )
150 p_out[ y ] = XOR_ROR( p_table2, p_tmp1,
151 1 + i - x - ((x * 3) - y) );
157 static void taos( uint32_t *p_buffer, uint32_t *p_input )
161 uint32_t p_tmp1[ 4 ];
162 uint32_t p_tmp2[ 4 ];
164 memcpy( p_tmp1, p_buffer, sizeof(p_tmp1) );
166 p_tmp2[ 0 ] = ((~p_tmp1[ 1 ] & p_tmp1[ 3 ])
167 | (p_tmp1[ 2 ] & p_tmp1[ 1 ])) + p_input[ x ];
168 p_tmp1[ 0 ] = p_tmp2[ 0 ] + p_tmp1[ 0 ] + p_drms_tab_taos[ x++ ];
170 for( i = 0; i < 4; i++ )
172 p_tmp2[ 0 ] = ((p_tmp1[ 0 ] >> 0x19)
173 | (p_tmp1[ 0 ] << 0x7)) + p_tmp1[ 1 ];
174 p_tmp2[ 1 ] = ((~p_tmp2[ 0 ] & p_tmp1[ 2 ])
175 | (p_tmp1[ 1 ] & p_tmp2[ 0 ])) + p_input[ x ];
176 p_tmp2[ 1 ] += p_tmp1[ 3 ] + p_drms_tab_taos[ x++ ];
178 p_tmp1[ 3 ] = ((p_tmp2[ 1 ] >> 0x14)
179 | (p_tmp2[ 1 ] << 0xC)) + p_tmp2[ 0 ];
180 p_tmp2[ 1 ] = ((~p_tmp1[ 3 ] & p_tmp1[ 1 ])
181 | (p_tmp1[ 3 ] & p_tmp2[ 0 ])) + p_input[ x ];
182 p_tmp2[ 1 ] += p_tmp1[ 2 ] + p_drms_tab_taos[ x++ ];
184 p_tmp1[ 2 ] = ((p_tmp2[ 1 ] >> 0xF)
185 | (p_tmp2[ 1 ] << 0x11)) + p_tmp1[ 3 ];
186 p_tmp2[ 1 ] = ((~p_tmp1[ 2 ] & p_tmp2[ 0 ])
187 | (p_tmp1[ 3 ] & p_tmp1[ 2 ])) + p_input[ x ];
188 p_tmp2[ 2 ] = p_tmp2[ 1 ] + p_tmp1[ 1 ] + p_drms_tab_taos[ x++ ];
190 p_tmp1[ 1 ] = ((p_tmp2[ 2 ] << 0x16)
191 | (p_tmp2[ 2 ] >> 0xA)) + p_tmp1[ 2 ];
194 p_tmp2[ 1 ] = ((~p_tmp1[ 3 ] & p_tmp1[ 2 ])
195 | (p_tmp1[ 3 ] & p_tmp1[ 1 ])) + p_input[ 1 ];
199 p_tmp2[ 1 ] = ((~p_tmp1[ 1 ] & p_tmp1[ 3 ])
200 | (p_tmp1[ 2 ] & p_tmp1[ 1 ])) + p_input[ x ];
202 p_tmp1[ 0 ] = p_tmp2[ 0 ] + p_tmp2[ 1 ] + p_drms_tab_taos[ x++ ];
205 for( i = 0; i < 4; i++ )
207 uint8_t p_table[ 4 ][ 4 ] =
215 p_tmp2[ 0 ] = ((p_tmp1[ 0 ] >> 0x1B)
216 | (p_tmp1[ 0 ] << 0x5)) + p_tmp1[ 1 ];
217 p_tmp2[ 1 ] = ((~p_tmp1[ 2 ] & p_tmp1[ 1 ])
218 | (p_tmp1[ 2 ] & p_tmp2[ 0 ]))
219 + p_input[ p_table[ i ][ 0 ] ];
220 p_tmp2[ 1 ] += p_tmp1[ 3 ] + p_drms_tab_taos[ x++ ];
222 p_tmp1[ 3 ] = ((p_tmp2[ 1 ] >> 0x17)
223 | (p_tmp2[ 1 ] << 0x9)) + p_tmp2[ 0 ];
224 p_tmp2[ 1 ] = ((~p_tmp1[ 1 ] & p_tmp2[ 0 ])
225 | (p_tmp1[ 3 ] & p_tmp1[ 1 ]))
226 + p_input[ p_table[ i ][ 1 ] ];
227 p_tmp2[ 1 ] += p_tmp1[ 2 ] + p_drms_tab_taos[ x++ ];
229 p_tmp1[ 2 ] = ((p_tmp2[ 1 ] >> 0x12)
230 | (p_tmp2[ 1 ] << 0xE)) + p_tmp1[ 3 ];
231 p_tmp2[ 1 ] = ((~p_tmp2[ 0 ] & p_tmp1[ 3 ])
232 | (p_tmp1[ 2 ] & p_tmp2[ 0 ]))
233 + p_input[ p_table[ i ][ 2 ] ];
234 p_tmp2[ 1 ] += p_tmp1[ 1 ] + p_drms_tab_taos[ x++ ];
236 p_tmp1[ 1 ] = ((p_tmp2[ 1 ] << 0x14)
237 | (p_tmp2[ 1 ] >> 0xC)) + p_tmp1[ 2 ];
240 p_tmp2[ 1 ] = (p_tmp1[ 3 ] ^ p_tmp1[ 2 ] ^ p_tmp1[ 1 ])
241 + p_input[ p_table[ i ][ 3 ] ];
245 p_tmp2[ 1 ] = ((~p_tmp1[ 3 ] & p_tmp1[ 2 ])
246 | (p_tmp1[ 3 ] & p_tmp1[ 1 ]))
247 + p_input[ p_table[ i ][ 3 ] ];
249 p_tmp1[ 0 ] = p_tmp2[ 0 ] + p_tmp2[ 1 ] + p_drms_tab_taos[ x++ ];
252 for( i = 0; i < 4; i++ )
254 uint8_t p_table[ 4 ][ 4 ] =
262 p_tmp2[ 0 ] = ((p_tmp1[ 0 ] >> 0x1C)
263 | (p_tmp1[ 0 ] << 0x4)) + p_tmp1[ 1 ];
264 p_tmp2[ 1 ] = (p_tmp1[ 2 ] ^ p_tmp1[ 1 ] ^ p_tmp2[ 0 ])
265 + p_input[ p_table[ i ][ 0 ] ];
266 p_tmp2[ 1 ] += p_tmp1[ 3 ] + p_drms_tab_taos[ x++ ];
268 p_tmp1[ 3 ] = ((p_tmp2[ 1 ] >> 0x15)
269 | (p_tmp2[ 1 ] << 0xB)) + p_tmp2[ 0 ];
270 p_tmp2[ 1 ] = (p_tmp1[ 3 ] ^ p_tmp1[ 1 ] ^ p_tmp2[ 0 ])
271 + p_input[ p_table[ i ][ 1 ] ];
272 p_tmp2[ 1 ] += p_tmp1[ 2 ] + p_drms_tab_taos[ x++ ];
274 p_tmp1[ 2 ] = ((p_tmp2[ 1 ] >> 0x10)
275 | (p_tmp2[ 1 ] << 0x10)) + p_tmp1[ 3 ];
276 p_tmp2[ 1 ] = (p_tmp1[ 3 ] ^ p_tmp1[ 2 ] ^ p_tmp2[ 0 ])
277 + p_input[ p_table[ i ][ 2 ] ];
278 p_tmp2[ 1 ] += p_tmp1[ 1 ] + p_drms_tab_taos[ x++ ];
280 p_tmp1[ 1 ] = ((p_tmp2[ 1 ] << 0x17)
281 | (p_tmp2[ 1 ] >> 0x9)) + p_tmp1[ 2 ];
284 p_tmp2[ 1 ] = ((~p_tmp1[ 3 ] | p_tmp1[ 1 ]) ^ p_tmp1[ 2 ])
285 + p_input[ p_table[ i ][ 3 ] ];
289 p_tmp2[ 1 ] = (p_tmp1[ 3 ] ^ p_tmp1[ 2 ] ^ p_tmp1[ 1 ])
290 + p_input[ p_table[ i ][ 3 ] ];
292 p_tmp1[ 0 ] = p_tmp2[ 0 ] + p_tmp2[ 1 ] + p_drms_tab_taos[ x++ ];
295 for( i = 0; i < 4; i++ )
297 uint8_t p_table[ 4 ][ 4 ] =
305 p_tmp2[ 0 ] = ((p_tmp1[ 0 ] >> 0x1A)
306 | (p_tmp1[ 0 ] << 0x6)) + p_tmp1[ 1 ];
307 p_tmp2[ 1 ] = ((~p_tmp1[ 2 ] | p_tmp2[ 0 ]) ^ p_tmp1[ 1 ])
308 + p_input[ p_table[ i ][ 0 ] ];
309 p_tmp2[ 1 ] += p_tmp1[ 3 ] + p_drms_tab_taos[ x++ ];
311 p_tmp1[ 3 ] = ((p_tmp2[ 1 ] >> 0x16)
312 | (p_tmp2[ 1 ] << 0xA)) + p_tmp2[ 0 ];
313 p_tmp2[ 1 ] = ((~p_tmp1[ 1 ] | p_tmp1[ 3 ]) ^ p_tmp2[ 0 ])
314 + p_input[ p_table[ i ][ 1 ] ];
315 p_tmp2[ 1 ] += p_tmp1[ 2 ] + p_drms_tab_taos[ x++ ];
317 p_tmp1[ 2 ] = ((p_tmp2[ 1 ] >> 0x11)
318 | (p_tmp2[ 1 ] << 0xF)) + p_tmp1[ 3 ];
319 p_tmp2[ 1 ] = ((~p_tmp2[ 0 ] | p_tmp1[ 2 ]) ^ p_tmp1[ 3 ])
320 + p_input[ p_table[ i ][ 2 ] ];
321 p_tmp2[ 1 ] += p_tmp1[ 1 ] + p_drms_tab_taos[ x++ ];
323 p_tmp1[ 1 ] = ((p_tmp2[ 1 ] << 0x15)
324 | (p_tmp2[ 1 ] >> 0xB)) + p_tmp1[ 2 ];
328 p_tmp2[ 1 ] = ((~p_tmp1[ 3 ] | p_tmp1[ 1 ]) ^ p_tmp1[ 2 ])
329 + p_input[ p_table[ i ][ 3 ] ];
330 p_tmp1[ 0 ] = p_tmp2[ 0 ] + p_tmp2[ 1 ] + p_drms_tab_taos[ x++ ];
334 p_buffer[ 0 ] += p_tmp2[ 0 ];
335 p_buffer[ 1 ] += p_tmp1[ 1 ];
336 p_buffer[ 2 ] += p_tmp1[ 2 ];
337 p_buffer[ 3 ] += p_tmp1[ 3 ];
340 static void taos_add1( uint32_t *p_buffer,
341 uint8_t *p_in, uint32_t i_len )
345 uint32_t p_tmp[ 16 ];
346 uint32_t i_offset = 0;
348 x = p_buffer[ 6 ] & 63;
351 p_buffer[ 6 ] += i_len;
355 memcpy( &((uint8_t *)p_buffer)[ 48 + x ], p_in, i_len );
361 memcpy( &((uint8_t *)p_buffer)[ 48 + x ], p_in, y );
362 taos( &p_buffer[ 8 ], &p_buffer[ 12 ] );
369 for( i = 0; i < i_len / 64; i++ )
371 memcpy( p_tmp, &p_in[ i_offset ], sizeof(p_tmp) );
372 taos( &p_buffer[ 8 ], p_tmp );
380 memcpy( &p_buffer[ 12 ], &p_in[ i_offset ], i_len );
385 static void taos_end1( uint32_t *p_buffer, uint32_t *p_out )
389 x = p_buffer[ 6 ] & 63;
392 ((uint8_t *)p_buffer)[ 48 + x++ ] = 128;
396 memset( &((uint8_t *)p_buffer)[ 48 + x ], 0, y );
397 taos( &p_buffer[ 8 ], &p_buffer[ 12 ] );
402 memset( &((uint8_t *)p_buffer)[ 48 + x ], 0, y );
404 p_buffer[ 26 ] = p_buffer[ 6 ] * 8;
405 p_buffer[ 27 ] = p_buffer[ 6 ] >> 29;
406 taos( &p_buffer[ 8 ], &p_buffer[ 12 ] );
408 memcpy( p_out, &p_buffer[ 8 ], sizeof(*p_out) * 4 );
411 static void taos_add2( uint32_t *p_buffer, uint8_t *p_in, uint32_t i_len )
414 uint32_t p_tmp[ 16 ];
416 x = (p_buffer[ 0 ] / 8) & 63;
417 i = p_buffer[ 0 ] + i_len * 8;
419 if( i < p_buffer[ 0 ] )
425 p_buffer[ 1 ] += i_len >> 29;
427 for( i = 0; i < i_len; i++ )
429 ((uint8_t *)p_buffer)[ 24 + x++ ] = p_in[ i ];
434 memcpy( p_tmp, &p_buffer[ 6 ], sizeof(p_tmp) );
435 taos( &p_buffer[ 2 ], p_tmp );
439 static void taos_add2e( uint32_t *p_buffer, uint32_t *p_in, uint32_t i_len )
442 uint32_t p_tmp[ 32 ];
446 for( x = i_len; x; x -= y )
450 for( i = 0; i < y; i++ )
452 p_tmp[ i ] = U32_AT(&p_in[ i ]);
457 taos_add2( p_buffer, (uint8_t *)p_tmp, i_len * sizeof(p_tmp[ 0 ]) );
460 static void taos_end2( uint32_t *p_buffer )
463 uint32_t p_tmp[ 16 ];
465 p_tmp[ 14 ] = p_buffer[ 0 ];
466 p_tmp[ 15 ] = p_buffer[ 1 ];
468 x = (p_buffer[ 0 ] / 8) & 63;
470 taos_add2( p_buffer, p_drms_tab_tend, 56 - x );
471 memcpy( p_tmp, &p_buffer[ 6 ], 56 );
472 taos( &p_buffer[ 2 ], p_tmp );
473 memcpy( &p_buffer[ 22 ], &p_buffer[ 2 ], sizeof(*p_buffer) * 4 );
476 static void taos_add3( uint32_t *p_buffer, uint8_t *p_key, uint32_t i_len )
481 x = (p_buffer[ 4 ] / 8) & 63;
482 p_buffer[ 4 ] += i_len * 8;
484 if( p_buffer[ 4 ] < i_len * 8 )
487 p_buffer[ 5 ] += i_len >> 29;
493 memcpy( &((uint8_t *)p_buffer)[ 24 + x ], p_key, y );
494 taos( p_buffer, &p_buffer[ 6 ] );
501 for( ; y < i_len; y += 64, i += 64 )
503 taos( p_buffer, (uint32_t *)&p_key[y - 63] );
512 memcpy( &((uint8_t *)p_buffer)[ 24 + x ], &p_key[ i ], i_len - i );
515 static int taos_osi( uint32_t *p_buffer )
526 static LPCTSTR p_reg_keys[ 3 ][ 2 ] =
529 _T("HARDWARE\\DESCRIPTION\\System"),
530 _T("SystemBiosVersion")
534 _T("HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0"),
535 _T("ProcessorNameString")
539 _T("SOFTWARE\\Microsoft\\Windows\\CurrentVersion"),
544 taos_add1( p_buffer, "cache-control", 13 );
545 taos_add1( p_buffer, "Ethernet", 8 );
547 GetVolumeInformation( _T("C:\\"), NULL, 0, &i_serial,
548 NULL, NULL, NULL, 0 );
549 taos_add1( p_buffer, (uint8_t *)&i_serial, 4 );
551 for( i = 0; i < sizeof(p_reg_keys)/sizeof(p_reg_keys[ 0 ]); i++ )
553 if( RegOpenKeyEx( HKEY_LOCAL_MACHINE, p_reg_keys[ i ][ 0 ],
554 0, KEY_READ, &i_key ) == ERROR_SUCCESS )
556 if( RegQueryValueEx( i_key, p_reg_keys[ i ][ 1 ],
558 &i_size ) == ERROR_SUCCESS )
560 p_reg_buf = malloc( i_size );
562 if( p_reg_buf != NULL )
564 if( RegQueryValueEx( i_key, p_reg_keys[ i ][ 1 ],
565 NULL, NULL, p_reg_buf,
566 &i_size ) == ERROR_SUCCESS )
568 taos_add1( p_buffer, (uint8_t *)p_reg_buf,
576 RegCloseKey( i_key );
587 static int get_sci_data( uint32_t p_sci[ 11 ][ 4 ] )
593 DWORD i_size, i_read;
594 TCHAR p_path[ MAX_PATH ];
595 TCHAR *p_filename = _T("\\Apple Computer\\iTunes\\SC Info\\SC Info.sidb");
597 if( SUCCEEDED( SHGetFolderPath( NULL, CSIDL_COMMON_APPDATA,
598 NULL, 0, p_path ) ) )
600 _tcsncat( p_path, p_filename, min( _tcslen( p_filename ),
601 (MAX_PATH-1) - _tcslen( p_path ) ) );
603 i_file = CreateFile( p_path, GENERIC_READ, 0, NULL,
604 OPEN_EXISTING, 0, NULL );
605 if( i_file != INVALID_HANDLE_VALUE )
607 i_read = sizeof(p_sci[ 0 ]) * 11;
608 i_size = GetFileSize( i_file, NULL );
609 if( i_size != INVALID_FILE_SIZE && i_size >= i_read )
611 i_size = SetFilePointer( i_file, 4, NULL, FILE_BEGIN );
612 if( i_size != INVALID_SET_FILE_POINTER )
614 if( ReadFile( i_file, p_sci, i_read, &i_size, NULL ) &&
622 CloseHandle( i_file );
630 static void acei_taxs( uint32_t *p_acei, uint32_t i_val )
634 i = (i_val / 16) & 15;
635 x = (~(i_val & 15)) & 15;
637 if( (i_val & 768) == 768 )
642 p_acei[ 25 + i ] = p_acei[ 25 + ((16 - x) & 15) ]
643 + p_acei[ 25 + (15 - x) ];
645 else if( (i_val & 512) == 512 )
647 p_acei[ 25 + i ] ^= p_drms_tab_xor[ 15 - i ][ x ];
649 else if( (i_val & 256) == 256 )
651 p_acei[ 25 + i ] -= p_drms_tab_sub[ 15 - i ][ x ];
655 p_acei[ 25 + i ] += p_drms_tab_add[ 15 - i ][ x ];
659 static void acei( uint32_t *p_acei, uint8_t *p_buffer, uint32_t i_len )
662 uint32_t p_tmp[ 26 ];
664 for( i = 5; i < 25; i++ )
668 acei_taxs( p_acei, p_acei[ i ] );
672 TAOS_INIT( p_tmp, 2 );
673 taos_add2e( p_tmp, &p_acei[ 25 ], sizeof(*p_acei) * 4 );
676 x = i_len < 16 ? i_len : 16;
680 for( i = 0; i < x; i++ )
682 p_buffer[ i ] ^= ((uint8_t *)&p_tmp)[ 88 + i ];
687 static uint32_t ttov_calc( uint32_t *p_acei )
690 uint32_t p_tmp[ 26 ];
692 TAOS_INIT( p_tmp, 2 );
693 taos_add2e( p_tmp, &p_acei[ 0 ], 4 );
694 taos_add2e( p_tmp, &p_acei[ 4 ], 1 );
699 i_val = ((int32_t)U32_AT(&p_tmp[ 22 ])) % 1024;
701 return( i_val < 0 ? i_val * -1 : i_val );
704 static void acei_init( uint32_t *p_acei, uint32_t *p_sys_key )
708 for( i = 0; i < 4; i++ )
710 p_acei[ i ] = U32_AT(&p_sys_key[ i ]);
713 p_acei[ 4 ] = 0x5476212A;
715 for( i = 5; i < 25; i++ )
717 p_acei[ i ] = ttov_calc( p_acei );
720 p_acei[ 25 + 0 ] = p_acei[ 0 ];
721 p_acei[ 25 + 1 ] = 0x68723876;
722 p_acei[ 25 + 2 ] = 0x41617376;
723 p_acei[ 25 + 3 ] = 0x4D4B4F76;
725 p_acei[ 25 + 4 ] = p_acei[ 1 ];
726 p_acei[ 25 + 5 ] = 0x48556646;
727 p_acei[ 25 + 6 ] = 0x38393725;
728 p_acei[ 25 + 7 ] = 0x2E3B5B3D;
730 p_acei[ 25 + 8 ] = p_acei[ 2 ];
731 p_acei[ 25 + 9 ] = 0x37363866;
732 p_acei[ 25 + 10 ] = 0x30383637;
733 p_acei[ 25 + 11 ] = 0x34333661;
735 p_acei[ 25 + 12 ] = p_acei[ 3 ];
736 p_acei[ 25 + 13 ] = 0x37386162;
737 p_acei[ 25 + 14 ] = 0x494F6E66;
738 p_acei[ 25 + 15 ] = 0x2A282966;
741 static inline void block_xor( uint32_t *p_in, uint32_t *p_key,
746 for( i = 0; i < 4; i++ )
748 p_out[ i ] = p_key[ i ] ^ p_in[ i ];
752 int drms_get_sys_key( uint32_t *p_sys_key )
754 uint32_t p_tmp[ 128 ];
755 uint32_t p_tmp_key[ 4 ];
757 TAOS_INIT( p_tmp, 8 );
758 if( taos_osi( p_tmp ) )
762 taos_end1( p_tmp, p_tmp_key );
764 TAOS_INIT( p_tmp, 2 );
765 taos_add2( p_tmp, "YuaFlafu", 8 );
766 taos_add2( p_tmp, (uint8_t *)p_tmp_key, 6 );
767 taos_add2( p_tmp, (uint8_t *)p_tmp_key, 6 );
768 taos_add2( p_tmp, (uint8_t *)p_tmp_key, 6 );
769 taos_add2( p_tmp, "zPif98ga", 8 );
772 memcpy( p_sys_key, &p_tmp[ 2 ], sizeof(*p_sys_key) * 4 );
777 int drms_get_user_key( uint32_t *p_sys_key, uint32_t *p_user_key )
782 uint32_t p_acei[ 41 ];
783 uint32_t p_ctx[ 128 ];
784 uint32_t p_sci[ 2 ][ 11 ][ 4 ];
786 uint32_t p_sci_key[ 4 ] =
788 0x6E66556D, 0x6E676F70, 0x67666461, 0x33373866
791 if( p_sys_key == NULL )
793 if( drms_get_sys_key( p_tmp ) )
801 if( get_sci_data( p_sci[ 0 ] ) )
806 init_ctx( p_ctx, p_sys_key );
808 for( i = 0, p_cur_key = p_sci_key;
809 i < sizeof(p_sci[ 0 ])/sizeof(p_sci[ 0 ][ 0 ]); i++ )
811 ctx_xor( p_ctx, &p_sci[ 0 ][ i ][ 0 ], &p_sci[ 1 ][ i ][ 0 ],
812 p_drms_tab3, p_drms_tab4 );
813 block_xor( &p_sci[ 1 ][ i ][ 0 ], p_cur_key, &p_sci[ 1 ][ i ][ 0 ] );
815 p_cur_key = &p_sci[ 0 ][ i ][ 0 ];
818 acei_init( p_acei, p_sys_key );
820 for( i = 0; i < sizeof(p_sci[ 1 ])/sizeof(p_sci[ 1 ][ 0 ]); i++ )
822 acei( p_acei, (uint8_t *)&p_sci[ 1 ][ i ][ 0 ],
823 sizeof(p_sci[ 1 ][ i ]) );
826 memcpy( p_user_key, &p_sci[ 1 ][ 10 ][ 0 ], sizeof(p_sci[ 1 ][ i ]) );
842 uint32_t p_ctx[ 128 ];
845 #define P_DRMS ((struct drms_s *)p_drms)
849 struct drms_s *p_drms;
851 p_drms = malloc( sizeof(struct drms_s) );
855 memset( p_drms, 0, sizeof(struct drms_s) );
857 p_drms->i_tmp_len = 1024;
858 p_drms->p_tmp = malloc( p_drms->i_tmp_len );
859 if( p_drms->p_tmp == NULL )
861 free( (void *)p_drms );
866 return( (void *)p_drms );
869 void drms_free( void *p_drms )
871 if( P_DRMS->p_name != NULL )
873 free( (void *)P_DRMS->p_name );
876 if( P_DRMS->p_iviv != NULL )
878 free( (void *)P_DRMS->p_iviv );
881 if( P_DRMS->p_tmp != NULL )
883 free( (void *)P_DRMS->p_tmp );
889 void drms_decrypt( void *p_drms, uint32_t *p_buffer, uint32_t i_len )
892 uint32_t *p_cur_key = P_DRMS->p_key;
894 x = (i_len / sizeof(P_DRMS->p_key)) * sizeof(P_DRMS->p_key);
896 if( P_DRMS->i_tmp_len < x )
898 free( (void *)P_DRMS->p_tmp );
900 P_DRMS->i_tmp_len = x;
901 P_DRMS->p_tmp = malloc( P_DRMS->i_tmp_len );
904 if( P_DRMS->p_tmp != NULL )
906 memcpy( P_DRMS->p_tmp, p_buffer, x );
908 for( i = 0, x /= sizeof(P_DRMS->p_key); i < x; i++ )
910 y = i * sizeof(*p_buffer);
912 ctx_xor( P_DRMS->p_ctx, P_DRMS->p_tmp + y, p_buffer + y,
913 p_drms_tab3, p_drms_tab4 );
914 block_xor( p_buffer + y, p_cur_key, p_buffer + y );
916 p_cur_key = P_DRMS->p_tmp + y;
921 int drms_init( void *p_drms, uint32_t i_type,
922 uint8_t *p_info, uint32_t i_len )
930 if( i_len != sizeof(P_DRMS->p_key) )
936 init_ctx( P_DRMS->p_ctx, (uint32_t *)p_info );
942 if( i_len != sizeof(P_DRMS->p_key) )
948 P_DRMS->p_iviv = malloc( i_len );
949 if( P_DRMS->p_iviv == NULL )
955 memcpy( P_DRMS->p_iviv, p_info, i_len );
956 P_DRMS->i_iviv_len = i_len;
962 P_DRMS->p_name = malloc( i_len );
963 if( P_DRMS->p_name == NULL )
969 memcpy( P_DRMS->p_name, p_info, i_len );
970 P_DRMS->i_name_len = i_len;
977 uint32_t p_priv[ 64 ];
978 uint32_t p_tmp[ 128 ];
986 TAOS_INIT( p_tmp, 0 );
987 taos_add3( p_tmp, P_DRMS->p_name, P_DRMS->i_name_len );
988 taos_add3( p_tmp, P_DRMS->p_iviv, P_DRMS->i_iviv_len );
989 memcpy( p_priv, &p_tmp[ 4 ], sizeof(p_priv[ 0 ]) * 2 );
990 i = (p_tmp[ 4 ] / 8) & 63;
991 i = i >= 56 ? 120 - i : 56 - i;
992 taos_add3( p_tmp, p_drms_tab_tend, i );
993 taos_add3( p_tmp, (uint8_t *)p_priv, sizeof(p_priv[ 0 ]) * 2 );
995 memcpy( p_priv, p_info, 64 );
996 memcpy( P_DRMS->p_key, p_tmp, sizeof(P_DRMS->p_key) );
997 drms_decrypt( p_drms, p_priv, sizeof(p_priv) );
999 init_ctx( P_DRMS->p_ctx, &p_priv[ 6 ] );
1000 memcpy( P_DRMS->p_key, &p_priv[ 12 ], sizeof(P_DRMS->p_key) );
1002 free( (void *)P_DRMS->p_name );
1003 P_DRMS->p_name = NULL;
1004 free( (void *)P_DRMS->p_iviv );
1005 P_DRMS->p_iviv = NULL;