DLMF - library for decrypting container files (rsdf, ccf, ncf and dlc)

geskill · Jul 29, 2010

Hello,
i like to present another minor project for application developers, particularly for download managers. some other download program coders developed files (called container files), which store the directlinks encrypted to prevent abuse. However many programs especially smaller ones have no algorithm to read these files, because the decryption is secret.
i developed in cooperation with some other coders a all-in-one solution to decrypt these files securely and easy.
In order to prevent mass-abusing - i ll not share a GUI or any kind of a end-user program, but these libraries with the corresponding interfaces.

i ll not share the source code - under no circumstances! don't ask .!.

Download (Linux, Windows): dlmf.zip
the interface is written in delphi, but is COM-based

Delphi: Widestring
C++: BSTR*

the Linux solution is not tested, cause i'm not familiar with this kind of system, just cross compiled

Delphi:

Code:

procedure(RSDFFile: Widestring; out Result: Widestring); stdcall; external 'DLMF.dll';

VC++ (not tested)

Code:

extern "C" __declspec(dllimport) __stdcall void RSDFToPlain(BSTR* RSDFFile, [out] BSTR* Result);

C#

Code:

[DllImport("DLMF.dll", EntryPoint = "RSDFToPlain", ExactSpelling = true, CallingConvention = CallingConvention.StdCall, CharSet = CharSet.Ansi)]
        public static extern void RSDFToPlain([MarshalAs(UnmanagedType.BStr)]string RSDFFile, [MarshalAs(UnmanagedType.BStr)]out string Result);

Hyperz · Jul 29, 2010

Nice. But why use the library when implementing it is quite easy (http://www.superwayne.org/papers/ccf3/)?

Just tried it, according to VS2010 it's not a valid COM component.

geskill · Jul 29, 2010

you miss-understood me, i'm using COM-based parameters no COM component, sorry. The link you provided is just a technique for 1 container, furthermore there is missing something =) AND this container format is discontinued.

Delphi (original):

Code:

function CCF30ToPlain(CCFFile: Widestring): Widestring; external 'DLMF.dll';

C++ (maybe this works, but i'm not a c++ dev)

Code:

void __stdcall  CCF30ToPlain(BSTR* result, BSTR* CCFFile);

C# (maybe this works, but i'm not a c# dev)

Code:

[DllImport("DLMF.dll", EntryPoint="CCF30ToPlain", CallingConvention=CallingConvention.StdCall)]
public static extern string CCF30ToPlain(string CCFFile);

Hyperz · Jul 29, 2010

Ah I see. Still, these sort of file formats are easy to implement. Anyway, do you have a reference somewhere for the lib? I'd like to test the performance impact of .NET interop over C++.

Edit:
Your C# method is indeed the correct way (apart from string, should be StringBuilder in this case I think, don't know the delphi types).

Edit2:
Nope it's string

.

http://www.netcoole.com/delphi2cs/datatype.htm

geskill · Jul 29, 2010

Code:

[DllImport("DLMF.dll", EntryPoint="CCF30ToPlain", CallingConvention=CallingConvention.StdCall, CharSet=CharSet.Ansi)]
public static extern string CCF30ToPlain(string CCFFile);

hmmm, maybe you need to set the encoding => Ansi
the parameter "CCFFile" is the file name "C:\mytestfile.ccf", not the file content

EDIT:
pls try this file: DLMF.dll i think i have a error in the calling convention...

Hyperz · Jul 29, 2010

Neither work. "External component has thrown an exception."

Code:

    class Program
    {
        [DllImport("DLMF.dll", EntryPoint = "CCF30ToPlain", CallingConvention = CallingConvention.StdCall)]
        public static extern string CCF30ToPlain(string CCFFile);

        static void Main(string[] args)
        {
            string file = Environment.CurrentDirectory + "\\Simpsons_Staffel_4_Komplett.rsdf";
            string data = CCF30ToPlain(file);

            Console.WriteLine(data);
            Console.ReadKey(true);
        }
    }

Tried passing the string by reference but that didn't work either. But nevermind. I'll do the testing with Win32 interop instead.

geskill · Jul 29, 2010

for rsdf files you should use:

Code:

    class Program
    {
        [DllImport("DLMF.dll", EntryPoint = "RSDFToPlain", CallingConvention = CallingConvention.StdCall)]
        public static extern string RSDFToPlain(string RSDFFile);

        static void Main(string[] args)
        {
            string file = Environment.CurrentDirectory + "\\Simpsons_Staffel_4_Komplett.rsdf";
            string data = RSDFToPlain(file);

            Console.WriteLine(data);
            Console.ReadKey(true);
        }
    }

i don't understand why u use 2 slashes here:

Code:

string file = Environment.CurrentDirectory + "\\Simpsons_Staffel_4_Komplett.rsdf";

// i would use it this way
string file = Environment.CurrentDirectory + "\Simpsons_Staffel_4_Komplett.rsdf";

Hyperz · Jul 29, 2010

It's called escaping characters. The \ has a special meaning in most languages. I tried it on 3 ccf files before I tried the rsdf.

geskill · Jul 29, 2010

hmm.. okay did you tried the charset?

Code:

[DllImport("DLMF.dll", EntryPoint="CCF30ToPlain", CallingConvention=CallingConvention.StdCall, CharSet=CharSet.Ansi)]
public static extern string CCF30ToPlain(string CCFFile);

[DllImport("DLMF.dll", EntryPoint = "RSDFToPlain", CallingConvention=CallingConvention.StdCall, CharSet=CharSet.Ansi)]
public static extern string RSDFToPlain(string RSDFFile);

Hyperz · Jul 29, 2010

Ansi is assumed, there's no need to explicitly specify it. But yes I did try that. The problem is not with the interop since the exception comes from the dll. So something is wrong there or there's an issue with using string as data type.

geskill · Jul 29, 2010

puh... after many hours i found a solution:

Code:

[DllImport("DLMF.dll", EntryPoint = "RSDFToPlain", ExactSpelling = true, CallingConvention = CallingConvention.StdCall, CharSet = CharSet.Ansi)]
public static extern void RSDFToPlain([MarshalAs(UnmanagedType.BStr)]string RSDFFile, [MarshalAs(UnmanagedType.BStr)]out string Result);

            string _file = Environment.CurrentDirectory + "\\a.rsdf";
            string _data;

            RSDFToPlain(_file, out _data);
            Console.WriteLine(_data);
            Console.ReadKey(true);

like in c++ its not possible to give a string as return value.. so i needed to change this

EDIT:
btw. you need to download the dlmf.zip again, i've updated the files etc. sorry for all these problems, code is tested and works now

KZEE · Jul 26, 2012

Avira Virus Alert !
DLMF.dll - TR/Dldr.Boltolog.ldw

bluefrogx · Jul 26, 2012

I have a similar script, except coded in PHP

jokerhacker · Jul 26, 2012

bluefrogx, can you share?

bluefrogx · Jul 27, 2012

DLC

PHP:

function decrypt_dlc($str_filename, $return_array)
{
	if(!isset($str_filename) || !isset($return_array) || empty($str_filename) || empty($str_filename) || !file_exists($str_filename))
		die("Pass correct parameter");
	
	$return_array ? $links = array() : $links = '';
	
	$key = 'xxxx';
	$IV = 'xxxx';
	
	$dlc_whole_content = file_get_contents($str_filename);
	
	$dlc_content = substr($dlc_whole_content, 0, -88); 	//base64 encoded dlc content
	$dlc_content = base64_decode($dlc_content); 		//dlc content
	$dlc_key = substr($dlc_whole_content, -88); 		//dlc key

	/*
	 * Send an HTTP-Request, remove <rc> and </rc> of response and decode it with base64
	 */
	$result = file_get_contents("http://service.jdownloader.org/dlcrypt/service.php?destType=load&srcType=dlc&data=$dlc_key");
	$result = explode("<rc>", $result);
	$result = explode("</rc>",$result[1]);
	$result = $result[0];
	$result = base64_decode($result);
	
	if(empty($result))
		die("Got wrong or no response from server!");

	/*
	 * Decrypt the base64 decoded server response
	 * (128 Bit AES in CBC mode with your key and IV)
	 */
	$hdlDLCCrypt = mcrypt_module_open(MCRYPT_RIJNDAEL_128,'','cbc','');
	@mcrypt_generic_init($hdlDLCCrypt,$key,$IV);
	$dlckey = mdecrypt_generic($hdlDLCCrypt, $result);
	
	/*
	 * Decrypt your content
	 * (128 Bit AES in CBC mode with your previously decrypted result as key and IV)
	 */
	$hdlDLCCrypt = mcrypt_module_open(MCRYPT_RIJNDAEL_128,'','cbc','');
	@mcrypt_generic_init($hdlDLCCrypt,$dlckey,$dlckey);
	$data = mdecrypt_generic($hdlDLCCrypt, $dlc_content);
	$data = base64_decode($data);

	/*
	 * Simple and dirty XML parsing
	 */
	$parser = xml_parser_create();
	xml_parse_into_struct($parser, $data, $vals);
	xml_parser_free($parser);

	for($i = 0;; ++$i)
	{
		if($vals[$i]["tag"] == "DLC" && $vals[$i]["type"] == "close") // break at </dlc> (end of dlc content)
			break;
			
		if($vals[$i]["tag"] == "URL") // filter the links
		{
			/*
			 * <dlc>[...]<url>___LINKS___</url>[...]</dlc>
			 */
			
			$return_array 
			? $links[] = base64_decode($vals[$i]["value"]) 		// append link to array
			: $links .= base64_decode($vals[$i]["value"])."\n";	// append link to string
		}
	}
	return $links;
}

DLMF - library for decrypting container files (rsdf, ccf, ncf and dlc)

geskill

Active Member

Hyperz

Active Member

geskill

Active Member

Hyperz

Active Member

geskill

Active Member

Hyperz

Active Member

geskill

Active Member

Hyperz

Active Member

geskill

Active Member

Hyperz

Active Member

geskill

Active Member

KZEE

Active Member

bluefrogx

Active Member

jokerhacker

Active Member

bluefrogx

Active Member