Decrypt IS file failed

[Musyanon]

Hello,

I tried to decrypt the IS file by following th the wiki, but I can't do it.
My key is definitely bad, but I don't understand why :(

Here is what I got with wmic
BaseBoardManufacturer.txt
BaseBoardSerialNumber.txt
BIOSManufacturer.txt
BIOSSerialNumber.txt
ProcessorManufacturer.txt
ProcessorName.txt
ProcessorProcessorId.txt
PVideoControllerNPDeviceId.txt

And my volume serial is 748AF423.

The rendering should be :
Micro-Star International Co., Ltd. ;To be filled by O.E.M. ;American Megatrends International, LLC. ;To be filled by O.E.M. ;748AF423;PCI\VEN_1002&DEV_73A5&SUBSYS_441D1DA2&REV_C0\6&20C1D3AD&0&00000019 ROOT\DISPLAY\0000 ;AuthenticAMD;178BFBFF00A20F10;AMD Ryzen 5 5600X 6-Core Processor ;

I have a doubt with videoControllerDeviceId because there are line breaks, should I include them?
I also have a doubt with the volumeSerialNumber, is it possible that it is the same as doing a "dir" in cmd.exe?

To finish
My SHA1 with what's above is b2895e59b9d0713820e5d63b4de042d0ae1a8cb6
An my SHA3_256 is f3abd302f1963cddb38a116be0462a866436bf9cfe598d197c5972d12255e55a

But can't read my file :(
IS.zip

Thanks for any help !

[erri120]

Have you tried running the example? I've set up the CI workflow to publish builds of the example on every commit: https://github.com/erri120/GameFinder/suites/12799382184/artifacts/688986744. The example will log your decryption key.

[Musyanon]

Just tried.

But they are no key in log.

2023-05-10 21:17:47.3022|INFO|Program|Operating System: Microsoft Windows 10.0.22621
2023-05-10 21:17:47.3212|INFO|SteamHandler|Found SteamGame { AppId = 1465360, Name = SnowRunner, Path = C:\Program Files (x86)\Steam\steamapps\common\SnowRunner }
2023-05-10 21:17:47.3220|INFO|SteamHandler|Found SteamGame { AppId = 228980, Name = Steamworks Common Redistributables, Path = C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared }
2023-05-10 21:17:47.3220|INFO|SteamHandler|Found SteamGame { AppId = 1172380, Name = STAR WARS Jedi: Fallen Order™ , Path = D:\SteamLibrary\steamapps\common\Jedi Fallen Order }
2023-05-10 21:17:47.3220|INFO|SteamHandler|Found SteamGame { AppId = 1774580, Name = STAR WARS Jedi: Survivor™, Path = D:\SteamLibrary\steamapps\common\Jedi Survivor }
2023-05-10 21:17:47.3220|ERROR|GOGHandler|Unable to open HKEY_LOCAL_MACHINE\Software\GOG.com\Games
2023-05-10 21:17:47.3220|ERROR|EGSHandler|The manifest directory C:\ProgramData\Epic\EpicGamesLauncher\Data\Manifests does not exist!
2023-05-10 21:17:47.3220|ERROR|OriginHandler|Manifest folder C:\ProgramData\Origin\LocalContent does not contain any .mfst files
2023-05-10 21:17:47.3220|ERROR|XboxHandler|Neither D:\Program Files\ModifiableWindowsApps nor D:.GamingRoot exist on the current drive.
2023-05-10 21:17:47.3220|ERROR|XboxHandler|Neither E:\Program Files\ModifiableWindowsApps nor E:.GamingRoot exist on the current drive.
2023-05-10 21:17:47.3220|ERROR|XboxHandler|Neither F:\Program Files\ModifiableWindowsApps nor F:.GamingRoot exist on the current drive.
2023-05-10 21:17:47.3220|ERROR|XboxHandler|App folder C:\Program Files\ModifiableWindowsApps does not contain any sub directories!

[erri120]

Could you try this build: https://gofile.io/d/8uVMB4

[Musyanon]

I have tried on other computer, but same, no key in the log. No mention of EA.
It work with Windows 11 ? I have the latest release.

Thanks for your help !

2023-05-10 23:56:51.9923|INFO|Program|Operating System: Microsoft Windows 10.0.22621
2023-05-10 23:56:53.3667|INFO|SteamHandler|Found SteamGame { AppId = 1172380, Name = STAR WARS Jedi: Fallen Order™ , Path = C:\Program Files (x86)\Steam\steamapps\common\Jedi Fallen Order }
2023-05-10 23:56:53.3667|INFO|SteamHandler|Found SteamGame { AppId = 228980, Name = Steamworks Common Redistributables, Path = C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared }
2023-05-10 23:56:53.7415|ERROR|GOGHandler|Unable to open HKEY_LOCAL_MACHINE\Software\GOG.com\Games
2023-05-10 23:56:54.1021|ERROR|EGSHandler|The manifest directory C:\ProgramData\Epic\EpicGamesLauncher\Data\Manifests does not exist!
2023-05-10 23:56:54.6614|ERROR|OriginHandler|Manifest folder C:\ProgramData\Origin\LocalContent does not contain any .mfst files
2023-05-10 23:56:55.0500|ERROR|XboxHandler|Neither D:\Program Files\ModifiableWindowsApps nor D:.GamingRoot exist on the current drive.
2023-05-10 23:56:55.0500|ERROR|XboxHandler|App folder C:\Program Files\ModifiableWindowsApps does not contain any sub directories!

Edit: Ok I think there is a problem with the app, I started with cmd to see what happened and I got this :

Path = C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared }
2023-05-11 00:04:46.7254|ERROR|GOGHandler|Unable to open HKEY_LOCAL_MACHINE\Software\GOG.com\Games
2023-05-11 00:04:46.7254|ERROR|EGSHandler|The manifest directory C:\ProgramData\Epic\EpicGamesLauncher\Data\Manifests does not exist!
2023-05-11 00:04:46.7254|ERROR|OriginHandler|Manifest folder C:\ProgramData\Origin\LocalContent does not contain any .mfst files
2023-05-11 00:04:46.7254|ERROR|XboxHandler|Neither D:\Program Files\ModifiableWindowsApps nor D:.GamingRoot exist on the current drive.
2023-05-11 00:04:46.7254|ERROR|XboxHandler|App folder C:\Program Files\ModifiableWindowsApps does not contain any sub directories!
Unhandled exception. Exception while getting property Manufacturer from class Win32_BaseBoard
System.TypeInitializationException: The type initializer for 'System.Management.ManagementPath' threw an exception.
---> System.TypeInitializationException: The type initializer for 'System.Management.WmiNetUtilsHelper' threw an exception.
---> System.TypeLoadException
at System.Runtime.InteropServices.Marshal.GetDelegateForFunctionPointerInternal(IntPtr, Type)
at System.Runtime.InteropServices.Marshal.GetDelegateForFunctionPointerTDelegate
at System.Management.WmiNetUtilsHelper.LoadDelegate[TDelegate](TDelegate&, IntPtr, String)
at System.Management.WmiNetUtilsHelper..cctor()
--- End of inner exception stack trace ---
at System.Management.MTAHelper.IsNoContextMTA()
at System.Management.MTAHelper.CreateInMTA(Type)
at System.Management.ManagementPath.CreateWbemPath(String)
at System.Management.ManagementPath..cctor()
--- End of inner exception stack trace ---
at System.Management.ManagementScope.Clone(ManagementScope, IdentifierChangedEventHandler)
at System.Management.ManagementObjectSearcher..ctor(ManagementScope, ObjectQuery, EnumerationOptions)
at GameFinder.StoreHandlers.EADesktop.Crypto.Windows.WMIHelper.GetWMIProperty(String, String) in //src/GameFinder.StoreHandlers.EADesktop/Crypto/Windows/WMIHelper.cs:line 34

And this for the last build :

PS C:\Users\Sami\Desktop\win-x64> .\GameFinder.Example.exe
2023-05-11 00:04:04.6710|INFO|Program|Operating System: Microsoft Windows 10.0.22621
2023-05-11 00:04:04.7193|INFO|SteamHandler|Found SteamGame { AppId = 1172380, Name = STAR WARS Jedi: Fallen OrderT , Path = C:\Program Files (x86)\Steam\steamapps\common\Jedi Fallen Order }
2023-05-11 00:04:04.7193|INFO|SteamHandler|Found SteamGame { AppId = 228980, Name = Steamworks Common Redistributables, Path = C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared }
2023-05-11 00:04:04.7193|ERROR|GOGHandler|Unable to open HKEY_LOCAL_MACHINE\Software\GOG.com\Games
2023-05-11 00:04:04.7274|ERROR|EGSHandler|The manifest directory C:\ProgramData\Epic\EpicGamesLauncher\Data\Manifests does not exist!
2023-05-11 00:04:04.7546|ERROR|OriginHandler|Manifest folder C:\ProgramData\Origin\LocalContent does not contain any .mfst files
2023-05-11 00:04:04.7590|ERROR|XboxHandler|Neither D:\Program Files\ModifiableWindowsApps nor D:.GamingRoot exist on the current drive.
2023-05-11 00:04:04.7590|ERROR|XboxHandler|App folder C:\Program Files\ModifiableWindowsApps does not contain any sub directories!
Unhandled exception. Exception while getting property PNPDeviceId from class Win32_VideoController
System.Exception: Query returned 4 elements instead of one
at GameFinder.StoreHandlers.EADesktop.Crypto.Windows.WMIHelper.GetWMIProperty(String className, String propertyName) in /mnt/ssd1/projects/GameFinder/src/GameFinder.StoreHandlers.EADesktop/Crypto/Windows/WMIHelper.cs:line 39

[erri120]

Thanks for testing! The CI artifact fails due to trimming, and the custom build fails because of some bug I need to fix.

[erri120]

Could you try these two builds:

• trimmed: win-x64.zip
• not trimmed

[EzioTheDeadPoet]

trimmed: log.log
not trimmed: could not download

[Musyanon]

Could you try these two builds:

• trimmed: win-x64.zip
• not trimmed

Hello,

With trimmed :

PS C:\Users\Sami\Desktop\win-x64 (1)\win-x64> .\GameFinder.Example.exe
2023-05-11 18:21:36.8001|INFO|Program|Operating System: Microsoft Windows 10.0.22621
2023-05-11 18:21:36.8223|INFO|SteamHandler|Found SteamGame { AppId = 1172380, Name = STAR WARS Jedi: Fallen OrderT , Path = C:\Program Files (x86)\Steam\steamapps\common\Jedi Fallen Order }
2023-05-11 18:21:36.8223|INFO|SteamHandler|Found SteamGame { AppId = 228980, Name = Steamworks Common Redistributables, Path = C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared }
2023-05-11 18:21:36.8223|ERROR|GOGHandler|Unable to open HKEY_LOCAL_MACHINE\Software\GOG.com\Games
2023-05-11 18:21:36.8223|ERROR|EGSHandler|The manifest directory C:\ProgramData\Epic\EpicGamesLauncher\Data\Manifests does not exist!
2023-05-11 18:21:36.8223|ERROR|OriginHandler|Manifest folder C:\ProgramData\Origin\LocalContent does not contain any .mfst files
2023-05-11 18:21:36.8223|ERROR|XboxHandler|Neither D:\Program Files\ModifiableWindowsApps nor D:.GamingRoot exist on the current drive.
2023-05-11 18:21:36.8223|ERROR|XboxHandler|App folder C:\Program Files\ModifiableWindowsApps does not contain any sub directories!
Unhandled exception. Exception while getting property Manufacturer from class Win32_BaseBoard
System.NotSupportedException: Built-in COM has been disabled via a feature switch. See https://aka.ms/dotnet-illink/com for more information.
at WmiLight.WmiConnection.Open()
at WmiLight.WmiConnection.InternalExecuteQuery(WmiQuery query)
at WmiLight.WmiConnection.ExecuteQuery(WmiQuery query)
at System.Linq.Enumerable.TryGetFirst[TSource](IEnumerable`1, Boolean& )
at GameFinder.StoreHandlers.EADesktop.Crypto.Windows.WMIHelper.GetWMIProperty(String, String) in /mnt/ssd1/projects/GameFinder/src/GameFinder.StoreHandlers.EADesktop/Crypto/Windows/WMIHelper.cs:line 41

Log :

2023-05-11 18:21:36.8001|INFO|Program|Operating System: Microsoft Windows 10.0.22621
2023-05-11 18:21:36.8223|INFO|SteamHandler|Found SteamGame { AppId = 1172380, Name = STAR WARS Jedi: Fallen Order™ , Path = C:\Program Files (x86)\Steam\steamapps\common\Jedi Fallen Order }
2023-05-11 18:21:36.8223|INFO|SteamHandler|Found SteamGame { AppId = 228980, Name = Steamworks Common Redistributables, Path = C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared }
2023-05-11 18:21:36.8223|ERROR|GOGHandler|Unable to open HKEY_LOCAL_MACHINE\Software\GOG.com\Games
2023-05-11 18:21:36.8223|ERROR|EGSHandler|The manifest directory C:\ProgramData\Epic\EpicGamesLauncher\Data\Manifests does not exist!
2023-05-11 18:21:36.8223|ERROR|OriginHandler|Manifest folder C:\ProgramData\Origin\LocalContent does not contain any .mfst files
2023-05-11 18:21:36.8223|ERROR|XboxHandler|Neither D:\Program Files\ModifiableWindowsApps nor D:.GamingRoot exist on the current drive.
2023-05-11 18:21:36.8223|ERROR|XboxHandler|App folder C:\Program Files\ModifiableWindowsApps does not contain any sub directories!

Without trimmed :

PS C:\Users\Sami\Desktop\win-x64 (2)\win-x64> .\GameFinder.Example.exe
2023-05-11 18:24:11.0827|INFO|Program|Operating System: Microsoft Windows 10.0.22621
2023-05-11 18:24:11.1338|INFO|SteamHandler|Found SteamGame { AppId = 1172380, Name = STAR WARS Jedi: Fallen OrderT , Path = C:\Program Files (x86)\Steam\steamapps\common\Jedi Fallen Order }
2023-05-11 18:24:11.1338|INFO|SteamHandler|Found SteamGame { AppId = 228980, Name = Steamworks Common Redistributables, Path = C:\Program Files (x86)\Steam\steamapps\common\Steamworks Shared }
2023-05-11 18:24:11.1338|ERROR|GOGHandler|Unable to open HKEY_LOCAL_MACHINE\Software\GOG.com\Games
2023-05-11 18:24:11.1338|ERROR|EGSHandler|The manifest directory C:\ProgramData\Epic\EpicGamesLauncher\Data\Manifests does not exist!
2023-05-11 18:24:11.1338|ERROR|OriginHandler|Manifest folder C:\ProgramData\Origin\LocalContent does not contain any .mfst files
2023-05-11 18:24:11.1512|ERROR|XboxHandler|Neither D:\Program Files\ModifiableWindowsApps nor D:.GamingRoot exist on the current drive.
2023-05-11 18:24:11.1512|ERROR|XboxHandler|App folder C:\Program Files\ModifiableWindowsApps does not contain any sub directories!
2023-05-11 18:24:11.2763|DEBUG|Program|EA Decryption Key: 71b7f789c38bee7c8f32bbbb3d94a01a0a19f17acfb93fcde03487694b6c9faf
2023-05-11 18:24:11.3329|ERROR|EADesktopHandler|Exception while decrypting file C:\ProgramData\EA Desktop\530c11479fe252fc5aabc24935b9776d4900eb3ba58fdc271e0d6229413ad40e\IS:
System.Security.Cryptography.CryptographicException: Padding is invalid and cannot be removed.
at System.Security.Cryptography.SymmetricPadding.GetPaddingLength(ReadOnlySpan1 block, PaddingMode paddingMode, Int32 blockSize) at System.Security.Cryptography.UniversalCryptoDecryptor.UncheckedTransformFinalBlock(ReadOnlySpan1 inputBuffer, Span1 outputBuffer) at System.Security.Cryptography.UniversalCryptoDecryptor.UncheckedTransformFinalBlock(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount) at System.Security.Cryptography.UniversalCryptoTransform.TransformFinalBlock(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount) at System.Security.Cryptography.CryptoStream.ReadAsyncCore(Memory1 buffer, CancellationToken cancellationToken, Boolean useAsync)
at System.Security.Cryptography.CryptoStream.Read(Byte[] buffer, Int32 offset, Int32 count)
at System.IO.StreamReader.ReadBuffer()
at System.IO.StreamReader.ReadToEnd()
at GameFinder.StoreHandlers.EADesktop.Crypto.Decryption.DecryptFile(Byte[] fileContents, Byte[] key, Byte[] iv) in /mnt/ssd1/projects/GameFinder/src/GameFinder.StoreHandlers.EADesktop/Crypto/Decryption.cs:line 59
at GameFinder.StoreHandlers.EADesktop.EADesktopHandler.DecryptInstallInfoFile(IFileSystem fileSystem, AbsolutePath installInfoFile, IHardwareInfoProvider hardwareInfoProvider) in /mnt/ssd1/projects/GameFinder/src/GameFinder.StoreHandlers.EADesktop/EADesktopHandler.cs:line 129

[erri120]

Enabling trimming disabled COM entirely, which basically makes the feature completely useless. I'll take a look at the cryptography exception, that is likely a bug in my code or EA updated their encryption.

[Musyanon]

Enabling trimming disabled COM entirely, which basically makes the feature completely useless. I'll take a look at the cryptography exception, that is likely a bug in my code or EA updated their encryption.

Ok, I hope you will succeed!
Anyway thank you for your work ;)

[ZenMaxe]

GameFinder Can't Decrypt IS file in my laptop.

error : System.Security.Cryptography.CryptographicException: Padding is invalid and cannot be removed.

[clshortfuse]

I'm getting the same issue. I even tried both my PNPDeviceID values since i have an iGPU. Same result as the sample:

System.Security.Cryptography.CryptographicException: Padding is invalid and cannot be removed.
   at System.Security.Cryptography.SymmetricPadding.GetPaddingLength(ReadOnlySpan`1 block, PaddingMode paddingMode, Int32 blockSize)
   at System.Security.Cryptography.UniversalCryptoDecryptor.UncheckedTransformFinalBlock(ReadOnlySpan`1 inputBuffer, Span`1 outputBuffer)
   at System.Security.Cryptography.UniversalCryptoDecryptor.UncheckedTransformFinalBlock(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount)
   at System.Security.Cryptography.UniversalCryptoTransform.TransformFinalBlock(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount)
   at System.Security.Cryptography.CryptoStream.ReadAsyncCore(Memory`1 buffer, CancellationToken cancellationToken, Boolean useAsync)
   at System.Security.Cryptography.CryptoStream.Read(Byte[] buffer, Int32 offset, Int32 count)
   at System.IO.StreamReader.ReadBuffer()
   at System.IO.StreamReader.ReadToEnd()
   at GameFinder.StoreHandlers.EADesktop.Crypto.Decryption.DecryptFile(Byte[] fileContents, Byte[] key, Byte[] iv) in /_/src/GameFinder.StoreHandlers.EADesktop/Crypto/Decryption.cs:line 59
   at GameFinder.StoreHandlers.EADesktop.EADesktopHandler.DecryptInstallInfoFile(IFileSystem fileSystem, AbsolutePath installInfoFile, IHardwareInfoProvider hardwareInfoProvider) in /_/src/GameFinder.StoreHandlers.EADesktop/EADesktopHandler.cs:line 129

seems they have updated their code maybe.

By the way, SELECT VolumeSerialNumber from Win32_LogicalDisk WHERE DeviceID = 'C:' would work for a WMIC query as well.

[Jeshibu]

Same as @clshortfuse here. I'm trying to reproduce the steps from your blog, but the post has been deleted now for some reason. I'm really struggling with reverse engineering in general, particularly correlating x64dbg locations with ghidra locations. Any help or pointers would be welcome.

[BellezaEmporium]

I'm getting the same issue. I even tried both my PNPDeviceID values since i have an iGPU. Same result as the sample:

System.Security.Cryptography.CryptographicException: Padding is invalid and cannot be removed.
   at System.Security.Cryptography.SymmetricPadding.GetPaddingLength(ReadOnlySpan`1 block, PaddingMode paddingMode, Int32 blockSize)
   at System.Security.Cryptography.UniversalCryptoDecryptor.UncheckedTransformFinalBlock(ReadOnlySpan`1 inputBuffer, Span`1 outputBuffer)
   at System.Security.Cryptography.UniversalCryptoDecryptor.UncheckedTransformFinalBlock(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount)
   at System.Security.Cryptography.UniversalCryptoTransform.TransformFinalBlock(Byte[] inputBuffer, Int32 inputOffset, Int32 inputCount)
   at System.Security.Cryptography.CryptoStream.ReadAsyncCore(Memory`1 buffer, CancellationToken cancellationToken, Boolean useAsync)
   at System.Security.Cryptography.CryptoStream.Read(Byte[] buffer, Int32 offset, Int32 count)
   at System.IO.StreamReader.ReadBuffer()
   at System.IO.StreamReader.ReadToEnd()
   at GameFinder.StoreHandlers.EADesktop.Crypto.Decryption.DecryptFile(Byte[] fileContents, Byte[] key, Byte[] iv) in /_/src/GameFinder.StoreHandlers.EADesktop/Crypto/Decryption.cs:line 59
   at GameFinder.StoreHandlers.EADesktop.EADesktopHandler.DecryptInstallInfoFile(IFileSystem fileSystem, AbsolutePath installInfoFile, IHardwareInfoProvider hardwareInfoProvider) in /_/src/GameFinder.StoreHandlers.EADesktop/EADesktopHandler.cs:line 129

seems they have updated their code maybe.

By the way, SELECT VolumeSerialNumber from Win32_LogicalDisk WHERE DeviceID = 'C:' would work for a WMIC query as well.

Last time i've tried to RE the program, i've found CIM calls to OS data. incl. Serial Number and Installation Date.

I do reckon it being used for hardware hash, but mostly for the PC signature in the authentication system.