PKHeX/PKHeX.Core/Saves/Encryption/MemeCrypto/MemeCrypto.cs

using System;
using System.Security.Cryptography;
using static System.Buffers.Binary.BinaryPrimitives;

namespace PKHeX.Core
{
    /// <summary>
    /// MemeCrypto V1 - The Original Series
    /// </summary>
    /// <remarks>
    /// A variant of <see cref="SaveFile"/> encryption and obfuscation used in <see cref="GameVersion.Gen7"/>.
    /// <br> The save file stores a dedicated block to contain a hash of the savedata, computed when the block is zeroed. </br>
    /// <br> This signing logic is reused for other authentication; refer to <see cref="MemeKeyIndex"/>. </br>
    /// <br> The save file first computes a SHA256 Hash over the block checksum region.
    /// The logic then applies a SHA1 hash over the SHA256 hash result, encrypts it with a <see cref="MemeKey"/>, and signs it with an RSA private key in a non-straightforward manner. </br>
    /// </remarks>
    public static class MemeCrypto
    {
        private const uint POKE = 0x454B4F50;

        public static bool VerifyMemePOKE(ReadOnlySpan<byte> input, out byte[] output)
        {
            if (input.Length < 0x60)
                throw new ArgumentException("Invalid POKE buffer!");
            var memeLen = input.Length - 8;
            var memeIndex = MemeKeyIndex.PokedexAndSaveFile;
            for (var i = input.Length - 8; i >= 0; i--)
            {
                if (ReadUInt32LittleEndian(input[i..]) != POKE)
                    continue;

                var keyIndex = ReadInt32LittleEndian(input[(i+4)..]);
                if (!MemeKey.IsValidPokeKeyIndex(keyIndex))
                    continue;

                memeLen = i;
                memeIndex = (MemeKeyIndex)keyIndex;
                break;
            }

            foreach (var len in new[] { memeLen, memeLen - 2 }) // Account for Pokédex QR Edge case
            {
                if (VerifyMemeData(input, out output, 0, len, memeIndex))
                    return true;

                if (VerifyMemeData(input, out output, 0, len, MemeKeyIndex.PokedexAndSaveFile))
                    return true;
            }

            output = Array.Empty<byte>();
            return false;
        }

        public static bool VerifyMemeData(ReadOnlySpan<byte> input, out byte[] output)
        {
            foreach (MemeKeyIndex keyIndex in Enum.GetValues(typeof(MemeKeyIndex)))
            {
                if (VerifyMemeData(input, out output, keyIndex))
                    return true;
            }
            output = Array.Empty<byte>();
            return false;
        }

        public static bool VerifyMemeData(ReadOnlySpan<byte> input, out byte[] output, MemeKeyIndex keyIndex)
        {
            if (input.Length < 0x60)
            {
                output = Array.Empty<byte>();
                return false;
            }
            var key = new MemeKey(keyIndex);
            output = input.ToArray();

            var sigBuffer = key.RsaPublic(input[^0x60..]);
            using var sha1 = SHA1.Create();
            if (DecryptCompare(output, sigBuffer, key, sha1))
                return true;
            sigBuffer[0x0] |= 0x80;
            if (DecryptCompare(output, sigBuffer, key, sha1))
                return true;

            output = Array.Empty<byte>();
            return false;
        }

        private static bool DecryptCompare(byte[] output, ReadOnlySpan<byte> sigBuffer, MemeKey key, SHA1 sha1)
        {
            sigBuffer.CopyTo(output.AsSpan(output.Length - 0x60));
            key.AesDecrypt(output).CopyTo(output);
            // Check for 8-byte equality.
            var hash = sha1.ComputeHash(output, 0, output.Length - 0x8);
            var computed = ReadUInt64LittleEndian(hash.AsSpan());
            var existing = ReadUInt64LittleEndian(output.AsSpan(output.Length - 0x8));
            return computed == existing;
        }

        public static bool VerifyMemeData(ReadOnlySpan<byte> input, out byte[] output, int offset, int length)
        {
            var data = input.Slice(offset, length).ToArray();
            if (VerifyMemeData(data, out output))
            {
                var newOutput = input.ToArray();
                output.CopyTo(newOutput, offset);
                output = newOutput;
                return true;
            }
            output = Array.Empty<byte>();
            return false;
        }

        public static bool VerifyMemeData(ReadOnlySpan<byte> input, out byte[] output, int offset, int length, MemeKeyIndex keyIndex)
        {
            var data = input.Slice(offset, length);
            if (VerifyMemeData(data, out output, keyIndex))
            {
                var newOutput = input.ToArray();
                output.CopyTo(newOutput, offset);
                output = newOutput;
                return true;
            }
            output = Array.Empty<byte>();
            return false;
        }

        public static byte[] SignMemeData(ReadOnlySpan<byte> input, MemeKeyIndex keyIndex = MemeKeyIndex.PokedexAndSaveFile)
        {
            // Validate Input
            if (input.Length < 0x60)
                throw new ArgumentException("Cannot memesign a buffer less than 0x60 bytes in size!");
            var key = new MemeKey(keyIndex);
            if (!key.CanResign)
                throw new ArgumentException("Cannot sign with the specified memekey!");

            var output = input.ToArray();

            // Copy in the SHA1 signature
            using (var sha1 = SHA1.Create())
            {
                var hash = sha1.ComputeHash(output, 0, output.Length - 8);
                hash.AsSpan(0, 8).CopyTo(output.AsSpan(output.Length - 8, 8));
            }

            // Perform AES operations
            output = key.AesEncrypt(output);
            var sigBuffer = output.AsSpan(output.Length - 0x60, 0x60);
            sigBuffer[0] &= 0x7F;
            var signed = key.RsaPrivate(sigBuffer);
            signed.CopyTo(sigBuffer);
            return output;
        }

        /// <summary>
        /// Resigns save data.
        /// </summary>
        /// <param name="sav7">Save file data to resign</param>
        /// <returns>The resigned save data. Invalid input returns null.</returns>
        public static byte[] Resign7(ReadOnlySpan<byte> sav7)
        {
            if (sav7.Length is not (SaveUtil.SIZE_G7SM or SaveUtil.SIZE_G7USUM))
                throw new ArgumentException("Should not be using this for unsupported saves.");

            // Save Chunks are 0x200 bytes each; Memecrypto signature is 0x100 bytes into the 2nd to last chunk.
            var isUSUM = sav7.Length == SaveUtil.SIZE_G7USUM;
            var ChecksumTableOffset = sav7.Length - 0x200;
            var MemeCryptoOffset = isUSUM ? 0x6C100 : 0x6BB00;
            var ChecksumSignatureLength = isUSUM ? 0x150 : 0x140;
            const int MemeCryptoSignatureLength = 0x80;

            var result = sav7.ToArray();

            // Store current signature
            var oldSig = sav7.Slice(MemeCryptoOffset, MemeCryptoSignatureLength).ToArray();

            using var sha256 = SHA256.Create();
            var newSig = sha256.ComputeHash(result, ChecksumTableOffset, ChecksumSignatureLength);
            Span<byte> sigSpan = stackalloc byte[MemeCryptoSignatureLength];
            newSig.CopyTo(sigSpan);

            if (VerifyMemeData(oldSig, out var memeSig, MemeKeyIndex.PokedexAndSaveFile))
                memeSig.AsSpan()[0x20..0x80].CopyTo(sigSpan[0x20..]);

            SignMemeData(sigSpan).CopyTo(result, MemeCryptoOffset);
            return result;
        }
    }
}