main.cpp

// Example program
#include <iostream>
#include <cstdint>
#include <string.h>

//////////////////////////////////////////////////////////////////////////////////////////
#ifndef WIN32
	#include <sys/timeb.h>
	//Ref: http://www.firstobject.com/getmillicount-milliseconds-portable-c++.htm
	
	uint32_t GetTickCount()
	{
		// Something like GetTickCount but portable
		// It rolls over every ~ 12.1 days (0x100000/24/60/60)
		// Use GetMilliSpan to correct for rollover
		timeb tb;
		ftime(&tb);
		int nCount = tb.millitm + (tb.time & 0xfffff) * 1000;
		return nCount;
	}
#else
	#include <windows.h>
#endif
//////////////////////////////////////////////////////////////////////////////////////////

//Decompiled source code of the keygen
const char keys[][26+1] = {
	"WM8ZMNCHK3J92EVKE4090FC41I", //length = 0x1A
	"BFBVLAYUAYLLWO4QLIV2N04051",
	"2KICEH8SA1KW3WJIN2Q4B8XRMZ",
	"05Y2X194NCD454MKW43SSY3VK2"
};
const char alphabet[] = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"; //length = 0x24

const uint8_t secretTable[256] = { //0x408030
	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
	0xFF, 0xFF, 0x00, 0xFF, 0x01, 0xFF, 0x02, 0x03, 0x04, 0x05, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
	0xFF, 0xFF, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0xFF, 0x0D, 0x0E, 0xFF, 0x0F, 0x10, 0xFF, 
	0x11, 0xFF, 0x12, 0xFF, 0x13, 0xFF, 0x14, 0x15, 0x16, 0x17, 0x18, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
	0xFF, 0xFF, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0xFF, 0x0D, 0x0E, 0xFF, 0x0F, 0x10, 0xFF, 
	0x11, 0xFF, 0x12, 0xFF, 0x13, 0xFF, 0x14, 0x15, 0x16, 0x17, 0x18, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 
	0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF 
};

const uint8_t secretTable2[0x1D0+0x10] = { //0x4080E7
	0x09, 0x04, 0x07, 0x0F, 0x0D, 0x0A, 0x03, 0x0B, 0x01, 0x02, 0x0C, 0x08, 0x06, 0x0E, 0x05, 0x00,
	0x09, 0x0B, 0x05, 0x04, 0x08, 0x0F, 0x01, 0x0E, 0x07, 0x00, 0x03, 0x02, 0x0A, 0x06, 0x0D, 0x0C,
	0x0C, 0x0E, 0x01, 0x04, 0x09, 0x0F, 0x0A, 0x0B, 0x0D, 0x06, 0x00, 0x08, 0x07, 0x02, 0x05, 0x03,
	0x0B, 0x02, 0x05, 0x0E, 0x0D, 0x03, 0x09, 0x00, 0x01, 0x0F, 0x07, 0x0C, 0x0A, 0x06, 0x04, 0x08,
	0x06, 0x02, 0x04, 0x05, 0x0B, 0x08, 0x0C, 0x0E, 0x0D, 0x0F, 0x07, 0x01, 0x0A, 0x00, 0x03, 0x09,
	0x05, 0x04, 0x0E, 0x0C, 0x07, 0x06, 0x0D, 0x0A, 0x0F, 0x02, 0x09, 0x01, 0x00, 0x0B, 0x08, 0x03,
	0x0C, 0x07, 0x08, 0x0F, 0x0B, 0x00, 0x05, 0x09, 0x0D, 0x0A, 0x06, 0x0E, 0x02, 0x04, 0x03, 0x01,
	0x03, 0x0A, 0x0E, 0x08, 0x01, 0x0B, 0x05, 0x04, 0x02, 0x0F, 0x0D, 0x0C, 0x06, 0x07, 0x09, 0x00,
	0x0C, 0x0D, 0x01, 0x0F, 0x08, 0x0E, 0x05, 0x0B, 0x03, 0x0A, 0x09, 0x00, 0x07, 0x02, 0x04, 0x06,
	0x0D, 0x0A, 0x07, 0x0E, 0x01, 0x06, 0x0B, 0x08, 0x0F, 0x0C, 0x05, 0x02, 0x03, 0x00, 0x04, 0x09,
	0x03, 0x0E, 0x07, 0x05, 0x0B, 0x0F, 0x08, 0x0C, 0x01, 0x0A, 0x04, 0x0D, 0x00, 0x06, 0x09, 0x02,
	0x0B, 0x06, 0x09, 0x04, 0x01, 0x08, 0x0A, 0x0D, 0x07, 0x0E, 0x00, 0x0C, 0x0F, 0x02, 0x03, 0x05,
	0x0C, 0x07, 0x08, 0x0D, 0x03, 0x0B, 0x00, 0x0E, 0x06, 0x0F, 0x09, 0x04, 0x0A, 0x01, 0x05, 0x02,
	0x0C, 0x06, 0x0D, 0x09, 0x0B, 0x00, 0x01, 0x02, 0x0F, 0x07, 0x03, 0x04, 0x0A, 0x0E, 0x08, 0x05,
	0x03, 0x06, 0x01, 0x05, 0x0B, 0x0C, 0x08, 0x00, 0x0F, 0x0E, 0x09, 0x04, 0x07, 0x0A, 0x0D, 0x02,
	0x0A, 0x07, 0x0B, 0x0F, 0x02, 0x08, 0x00, 0x0D, 0x0E, 0x0C, 0x01, 0x06, 0x09, 0x03, 0x05, 0x04,
	0x0A, 0x0B, 0x0D, 0x04, 0x03, 0x08, 0x05, 0x09, 0x01, 0x00, 0x0F, 0x0C, 0x07, 0x0E, 0x02, 0x06,
	0x0B, 0x04, 0x0D, 0x0F, 0x01, 0x06, 0x03, 0x0E, 0x07, 0x0A, 0x0C, 0x08, 0x09, 0x02, 0x05, 0x00,
	0x09, 0x06, 0x07, 0x00, 0x01, 0x0A, 0x0D, 0x02, 0x03, 0x0E, 0x0F, 0x0C, 0x05, 0x0B, 0x04, 0x08,
	0x0D, 0x0E, 0x05, 0x06, 0x01, 0x09, 0x08, 0x0C, 0x02, 0x0F, 0x03, 0x07, 0x0B, 0x04, 0x00, 0x0A,
	0x09, 0x0F, 0x04, 0x00, 0x01, 0x06, 0x0A, 0x0E, 0x02, 0x03, 0x07, 0x0D, 0x05, 0x0B, 0x08, 0x0C,
	0x03, 0x0E, 0x01, 0x0A, 0x02, 0x0C, 0x08, 0x04, 0x0B, 0x07, 0x0D, 0x00, 0x0F, 0x06, 0x09, 0x05,
	0x07, 0x02, 0x0C, 0x06, 0x0A, 0x08, 0x0B, 0x00, 0x0F, 0x04, 0x03, 0x0E, 0x09, 0x01, 0x0D, 0x05,
	0x0C, 0x04, 0x05, 0x09, 0x0A, 0x02, 0x08, 0x0D, 0x03, 0x0F, 0x01, 0x0E, 0x06, 0x07, 0x0B, 0x00,
	0x0A, 0x08, 0x0E, 0x0D, 0x09, 0x0F, 0x03, 0x00, 0x04, 0x06, 0x01, 0x0C, 0x07, 0x0B, 0x02, 0x05,
	0x03, 0x0C, 0x04, 0x0A, 0x02, 0x0F, 0x0D, 0x0E, 0x07, 0x00, 0x05, 0x08, 0x01, 0x06, 0x0B, 0x09,
	0x0A, 0x0C, 0x01, 0x00, 0x09, 0x0E, 0x0D, 0x0B, 0x03, 0x07, 0x0F, 0x08, 0x05, 0x02, 0x04, 0x06,
	0x0E, 0x0A, 0x01, 0x08, 0x07, 0x06, 0x05, 0x0C, 0x02, 0x0F, 0x00, 0x0D, 0x03, 0x0B, 0x04, 0x09,
	0x03, 0x08, 0x0E, 0x00, 0x07, 0x09, 0x0F, 0x0C, 0x01, 0x06, 0x0D, 0x02, 0x05, 0x0A, 0x0B, 0x04,
	0x03, 0x0A, 0x0C, 0x04, 0x0D, 0x0B, 0x09, 0x0E, 0x0F, 0x06, 0x01, 0x07, 0x02, 0x00, 0x05, 0x08 
};

//////////////////////////////////////////////////////////////////////////////////////////
void generate_cd_key(char *new_key);	//func_401370
bool is_valid_cd_key(char *key);		//func_401340
uint16_t get_random_number();			//func_40199a
uint32_t get_cd_key_value();			//func_401000
void fun_4010a8(char *key, uint8_t *buffer); //fun_4010a8
void fun_401113(uint8_t count, uint8_t b, uint32_t *src, uint32_t *dst, uint32_t c); //fun_401113
void fun_401152(uint32_t *buffer); //fun_401152
void fun_4012A5(uint32_t *buffer); //fun_4012A5

uint32_t gRandomSeed; //g408484

//////////////////////////////////////////////////////////////////////////////////////////

int main(int argc, char* argv[])
{
	char new_key[0x1A+1];
	generate_cd_key(new_key);
	
	std::cout << "CD Key: " << new_key << std::endl;

	return 0;
}

void generate_cd_key(char *new_key) {
	gRandomSeed = GetTickCount();
	
	const char *key = keys[get_random_number() % 4];
	strcpy(new_key, key);
	
	for(uint8_t i = 0; i < 0x1A; i++) { //why? useless
		new_key[i] = alphabet[get_random_number() % 0x24];
	}
	
	get_random_number(); //why? useless
	
	for(uint8_t i = 0; i < 0x24; i++) {
		uint16_t random_pos = get_random_number() % 0x19;
		new_key[random_pos] = alphabet[i];
	
		if(is_valid_cd_key(new_key)) {
			break; //found a valid cd key
		}
		if (i == 0x24-1) i = 0;
	}
}

uint16_t get_random_number() {
	//https://en.wikipedia.org/wiki/Linear_congruential_generator
	//Microsoft Visual C++ LCG parameters (multiplier = 0x343fd, increment = 0x269ec3)
	//Looks very similar to rand and srand implementation. 
	gRandomSeed = gRandomSeed * 0x343fd + 0x269ec3;
	return (gRandomSeed >> 16) & 0x7fff;
}

uint32_t get_cd_key_value(char *key) {
	uint8_t	 buffer[0x34] = { 0 };
	uint32_t buffer2[4]   = { 0 };

	fun_4010a8(key, buffer);

	for(int8_t i = 0x34; i > 0; i--) {
		fun_401113(4, 5, buffer2, buffer2, buffer[i-1]);
	}

	fun_401152(buffer2);
	fun_4012A5(buffer2);

	uint32_t ecx = buffer2[0] >> 0xA;
	uint32_t eax = ((buffer2[0] & 0x3FF) << 0x10) | (ecx >> 0x10); //useless

	return ecx;
}

bool is_valid_cd_key(char *key) {
	uint32_t result = get_cd_key_value(key);

	return (result == 0xE) || (result == 0xF); //Game: 0xE and 0xF | Expansion pack: 0x12
}

void fun_4010a8(char *key, uint8_t *buffer) {
	uint8_t esi5 = 0x21;

	for(uint8_t i = 0; i < 0x1A; i++) {
		uint8_t ebx7 = (esi5 + 0x7b5) % 0x34;
		esi5 = (ebx7 + 0x7b5) % 0x34;

		uint8_t dec = secretTable[key[i]];

		buffer[ebx7] = dec / 5;
		buffer[esi5] = dec % 5;
	}
}

void fun_401113(uint8_t count, uint8_t b, uint32_t *src, uint32_t *dst, uint32_t c) {
	uint8_t max_index = (count - 1);

	for(int8_t i = max_index; i >= 0; i--) {
		uint64_t result = (uint64_t)src[i] * b; //Type-cast to uint64_t is very important to perform 64 bits calc
		dst[i] = (uint32_t)(result + c);
		c = result >> 32; //overflowing part of multiplication
	}
}

void fun_401152(uint32_t *buffer) {
	uint32_t _ebp = 0x1D;
	
	for(int32_t eax = 0x1D0; eax >= 0; eax -= 0x10) {
		uint32_t esi = (_ebp & 7) << 2;
		uint32_t _ecx = _ebp >> 3;
		uint32_t esp10 = (buffer[3 - _ecx] & (0xF << esi)) >> esi;

		if(eax < 0x1D0) {
			for(int32_t edx = 0x1D; edx > _ebp; edx--) {
				uint32_t ecx = (edx & 7) << 2;
				uint32_t ebp = ((buffer[3 - (edx >> 3)]) & (0xF << ecx)) >> ecx;
				esp10 = secretTable2[ebp^secretTable2[eax+esp10]+eax];
			}
		}

		for(int32_t edx = --_ebp; edx >= 0; edx--) {
			uint32_t ecx = (edx & 7) << 2;
			uint32_t ebp = (buffer[(3 -(edx >> 3))] & (0xF << ecx)) >> ecx;
			esp10 = secretTable2[ebp^secretTable2[eax+esp10]+eax];
		}

		uint32_t ebp = 3 - _ecx;
		uint32_t ebx = (secretTable2[eax+esp10] & 0xF) << esi;
		buffer[ebp] = ebx | (~(0xF << esi)) & buffer[ebp];
	}
}

void fun_4012A5(uint32_t *buffer) {
	uint32_t buffer_copy[4];
	buffer_copy[0] = buffer[0];
	buffer_copy[1] = buffer[1];
	buffer_copy[2] = buffer[2];
	buffer_copy[3] = buffer[3];

	uint32_t esi = 0;

	for(uint32_t edi = 0; edi < 0x78; edi++) {
		uint32_t edx = 3 - (edi >> 5);
		uint32_t ebp = *(uint32_t*)((uint8_t*)(&buffer_copy[3]) - ((esi >> 5) << 2));
		uint32_t ecx = esi & 0x1F;
		uint32_t eax = edi & 0x1F;

		ebp = (ebp & ( 1 << ecx )) >> ecx;
		esi += 0xB;
		buffer[edx] = ((ebp & 1) << eax) | (~(1 << eax) & buffer[edx]);

		if(esi >= 0x78) {
			esi -= 0x78;
		}
	}
}