├── README.md
└── attest.py


/README.md:
--------------------------------------------------------------------------------
1 | # scgdp
2 | SC games documentation project
3 | * You can find any info in wiki: https://github.com/OpegitStudio/scgdp/wiki
4 | 


--------------------------------------------------------------------------------
/attest.py:
--------------------------------------------------------------------------------
  1 | # attest.py: some Python code to generate some 80 bytes based on some other 32 bytes to show you have outstanding byte generation skills
  2 | # or to put it simply, Hot Garbage Generator
  3 | # Usage: attest(request) -> bytes, where request is 32 bytes
  4 | 
  5 | 
  6 | import hashlib
  7 | import hmac
  8 | import struct
  9 | import secrets
 10 | import time
 11 | 
 12 | # REPLACE THIS VALUE WITH THE ACTUAL COMPANY NAME, FIRST LETTER IS CAPITALIZED 
 13 | COMPANY_NAME = b"AcmeCorporation"
 14 | 
 15 | 
 16 | def HASH_INTERNAL(REQUEST_PART1, SERVER_TIME, SERVER_MASK_FOR_HASH, SERVER_RANDOM):
 17 |     # I haven't followed chain of dependent values for this key, because it's content looks very much constant in nature
 18 |     SOME_KEY = COMPANY_NAME + b"APIkey0"
 19 | 
 20 |     # NOT COVERED BY TRACING: this was done but never used later. There is a chance it was just not covered, for example look at SERVER_MASK_FOR_HASH note below
 21 |     HINPUT_PARTIAL = hmac.new(SOME_KEY, struct.pack("<QQQ", REQUEST_PART1, SERVER_TIME, SERVER_MASK_FOR_HASH), digestmod="sha256").digest()
 22 | 
 23 |     if SERVER_MASK_FOR_HASH > 0xe:
 24 |         print("UNEXPECTED")
 25 |     
 26 |     SOME_WEIRD_HASH1 = None
 27 |     SOME_WEIRD_HASH2 = None
 28 |     SOME_WEIRD_HASH3 = None
 29 |     SOME_WEIRD_HASH4 = None
 30 | 
 31 |     if (SERVER_MASK_FOR_HASH & 0x1):
 32 |         SOME_WEIRD_HASH1 = hashlib.sha256(struct.pack("<QB", 1, SERVER_MASK_FOR_HASH)).digest()
 33 |     if (SERVER_MASK_FOR_HASH & 0x2):
 34 |         SOME_WEIRD_HASH2 = hashlib.sha256(struct.pack("<QB", 2, SERVER_MASK_FOR_HASH)).digest()
 35 |     if (SERVER_MASK_FOR_HASH & 0x4):
 36 |         SOME_WEIRD_HASH3 = hashlib.sha256(struct.pack("<QB", 4, SERVER_MASK_FOR_HASH)).digest()
 37 |     if (SERVER_MASK_FOR_HASH & 0x8):
 38 |         SOME_WEIRD_HASH4 = hashlib.sha256(struct.pack("<QB", 8, SERVER_MASK_FOR_HASH)).digest()
 39 | 
 40 |     HWEIRD1 = hmac.new(SOME_KEY, digestmod="sha256")
 41 |     HWEIRD2 = hmac.new(SOME_KEY, digestmod="sha256")
 42 | 
 43 |     # WARN: Code flow approximation below is probably wildly incorrect because it is based on incomplete tracing of data flow
 44 |     # SERVER_MASK_FOR_HASH was ONLY 0xe in all sample REQUESTs provided by the server, all the time
 45 |     # So other cases were NOT COVERED BY TRACING
 46 |     # Synthesizing own REQUESTs doesn't sound like a good idea because it would be very easy to violate constraints imposed on the values, if any
 47 |     # Speculation: for example I think HWEIRD_COMBINED could be not updated with HWEIRD1/2 if no updates were done to any of them
 48 |     # or HWEIRD_COMBINED itself could be not used at all if both HWEIRD weren't updated (less likely)
 49 |     # Even though all of this should be trivial to fix spending some time chasing values in disassembler, I don't want to. 
 50 |     # Let's left it as an exercise to the reader.
 51 | 
 52 |     if SOME_WEIRD_HASH1:
 53 |         HWEIRD1.update(SOME_WEIRD_HASH1)
 54 |     if SOME_WEIRD_HASH4:
 55 |         HWEIRD1.update(SOME_WEIRD_HASH4)
 56 | 
 57 |     if SOME_WEIRD_HASH2:
 58 |         HWEIRD2.update(SOME_WEIRD_HASH2)
 59 |     if SOME_WEIRD_HASH3:
 60 |         HWEIRD2.update(SOME_WEIRD_HASH3)
 61 | 
 62 | 
 63 |     HWEIRD_COMBINED = hmac.new(SOME_KEY, digestmod="sha256")
 64 |     HWEIRD_COMBINED.update(HWEIRD2.digest())
 65 |     HWEIRD_COMBINED.update(HWEIRD1.digest())
 66 | 
 67 |     RESULT = hmac.new(struct.pack("<QQQQ", REQUEST_PART1, SERVER_TIME, SERVER_MASK_FOR_HASH, SERVER_RANDOM), HWEIRD_COMBINED.digest(), digestmod="sha256").digest()
 68 | 
 69 |     # END WARN
 70 | 
 71 |     return RESULT
 72 | 
 73 | 
 74 | def MADD_64(a, b, c):
 75 |     return (a * b + c) & 0xFFFFFFFFFFFFFFFF
 76 | 
 77 | 
 78 | def ATTEST_INTERNAL(request: bytes, client_time: int, random: bytes):
 79 |     REQUEST = request
 80 |     CLIENT_TIME = client_time
 81 |     RANDOM, = struct.unpack("<Q", random)
 82 | 
 83 |     REQUEST_PART1, REQUEST_PART2, REQUEST_PART3, REQUEST_PART4 = struct.unpack("<QQQQ", REQUEST)
 84 | 
 85 |     SERVER_RANDOM = MADD_64(REQUEST_PART3, 0xfffffffffffffbfd, REQUEST_PART4)
 86 |     SERVER_MASK_FOR_HASH = MADD_64(REQUEST_PART2, 0xfffffffffffffbfd, REQUEST_PART3)
 87 |     SERVER_TIME = MADD_64(REQUEST_PART1, 0xfffffffffffffbfd, REQUEST_PART2)
 88 | 
 89 |     HASH_OUTPUT = HASH_INTERNAL(REQUEST_PART1, SERVER_TIME, SERVER_MASK_FOR_HASH, SERVER_RANDOM)
 90 | 
 91 |     REQUEST_DERIVED_HASH1, REQUEST_DERIVED_HASH2, REQUEST_DERIVED_HASH3, REQUEST_DERIVED_HASH4 = struct.unpack("<QQQQ", HASH_OUTPUT)
 92 | 
 93 |     RESULT_PART1 = RANDOM
 94 |     RESULT_PART2 = MADD_64(RESULT_PART1, 0x403, CLIENT_TIME)
 95 |     RESULT_PART3 = MADD_64(RESULT_PART2, 0x403, REQUEST_PART1)
 96 |     RESULT_PART4 = MADD_64(RESULT_PART3, 0x403, SERVER_TIME)
 97 |     RESULT_PART5 = MADD_64(RESULT_PART4, 0x403, SERVER_MASK_FOR_HASH)
 98 |     RESULT_PART6 = MADD_64(RESULT_PART5, 0x403, SERVER_RANDOM)
 99 |     RESULT_PART7 = MADD_64(RESULT_PART6, 0x403, REQUEST_DERIVED_HASH1)
100 |     RESULT_PART8 = MADD_64(RESULT_PART7, 0x403, REQUEST_DERIVED_HASH2)
101 |     RESULT_PART9 = MADD_64(RESULT_PART8, 0x403, REQUEST_DERIVED_HASH3)
102 |     RESULT_PART10 = MADD_64(RESULT_PART9, 0x403, REQUEST_DERIVED_HASH4)
103 | 
104 |     RESULT = (
105 |         RESULT_PART1, RESULT_PART2, RESULT_PART3, RESULT_PART4, RESULT_PART5,
106 |         RESULT_PART6, RESULT_PART7, RESULT_PART8, RESULT_PART9, RESULT_PART10
107 |     )
108 | 
109 |     result = struct.pack("<QQQQQQQQQQ", *RESULT)
110 | 
111 |     return result
112 | 
113 | 
114 | def attest(request: bytes):
115 |     assert len(request) == 32
116 |     time_ = int(time.time())
117 |     random = secrets.token_bytes(8)
118 |     return ATTEST_INTERNAL(request, time_, random)
119 | 
120 | 
121 | # If some parts of the code above can be considered copyrightable they are distributed under the following license:
122 | 
123 | # Copyright 2025 Opegit Studio
124 | 
125 | # Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), 
126 | # to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, 
127 | # and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
128 | 
129 | # The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
130 | 
131 | # THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 
132 | # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, 
133 | # WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
134 | 


--------------------------------------------------------------------------------