the encryption used is part of the libtomcrypt library.
the following is the function that does the job included in a quick tester using the packet you supplied:
Code:
/*
by Luigi Auriemma
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <tomcrypt.h>
int ts3_crypt(unsigned char *key /*includes nonce*/, unsigned char *data, int data_len, int encrypt) {
static int already_reg = 0;
static const unsigned char default_key[] = "c:\\windows\\system\\firewall32.cpl";
unsigned long tag = 8;
int err,
stat;
if(data_len < 13) return(data_len);
if(!key) key = (unsigned char *)default_key;
if(!already_reg) {
register_cipher(&aes_desc);
already_reg = 1;
}
#define ts3_crypt_args \
0, \
key, 16, /* key */ \
key + 16, 16, /* nonce */ \
data + 8, 5, /* header */ \
data + 13, data_len - 13, /* input */ \
data + 13, /* output */ \
data /* tag */
if(encrypt) {
err = eax_encrypt_authenticate_memory(ts3_crypt_args, &tag);
} else {
err = eax_decrypt_verify_memory(ts3_crypt_args, tag, &stat);
}
if(err != CRYPT_OK) return(-1);
return(data_len);
}
int main(void) {
int len;
unsigned char data[] =
"\xd7\xc1\x32\x95\x35\x84\x20\x27\x00\x00\x00\x00\x02\x9d\x74\x8b"
"\x45\xaa\x7b\xef\xb9\x9e\xfe\xad\x08\x19\xba\xcf\x41\xe0\x16\xa2"
"\x2b\x4b\xfa\x92\x95\xcf\x11\x33\xfd\xd5\xa7\x02\x25\x49\x90\x95"
"\x23\x3e\x00\x97\x2b\x1c\x71\xb2\x4e\xc0\x61\xf1\xd7\x6f\xc5\x7e"
"\xf6\x48\x52\xbf\x82\x6e\x93\x7e\x43\xde\x6d\x76\x3a\x15\xca\x98"
"\x30\xfd\x69\xcb\xd4\x0a\x89\xf3\x5e\xb8\x83\x67\x0e\xf7\x83\x1e"
"\x14\x1a\x71\x80\x72\x78\xb8\xc2\x01\x2e\xbe\xd0\x70\xed\x49\xb0"
"\xea\xc7\x2e\xd4\x0c\xa8\x74\x71\x31\x24\xeb\xd8\x86\x46\x0b\x07"
"\x56\x38\x9e\x1f\xe9\xfc\xe1\x1a\xb3\xa7\x6d\xf0\xff\xbd\x58\x1c"
"\xfb\x32\x4d\xa8\xe6\x08\x0f\xe7\xb3\xab\xc0\xa5\x9c\xd7\x0b";
// decrypt
len = ts3_crypt(NULL, data, sizeof(data)-1, 0);
data[len] = 0;
printf("%s\n", data + 13);
// re-encrypt
len = ts3_crypt(NULL, data, sizeof(data)-1, 1);
return(0);
}
NOTE that the research is not finished because the key for the subsequent packets differs and some of its bytes (of the new one) change for each packet.
I will finish the research and will release it officially on my website another day because now I was interested only to a quick test and nothing else.
