PKHeX/PKHeX.Core/Saves/Encryption/SwishCrypto/SwishCrypto.cs

using System;
using System.Collections.Generic;
using System.IO;
using System.Security.Cryptography;

namespace PKHeX.Core;

/// <summary>
/// MemeCrypto V2 - The Next Generation
/// </summary>
/// <remarks>
/// A variant of <see cref="SaveFile"/> encryption and obfuscation used in <see cref="GameVersion.SWSH"/> and <see cref="GameVersion.PLA"/>.
/// <br> Individual save blocks are stored in a hash map, with some object-type details prefixing the block's raw data. </br>
/// <br> Once the raw save file data is dumped, the binary is hashed with SHA256 using a static Intro salt and static Outro salt. </br>
/// <br> With the hash computed, the data is encrypted with a repeating irregular-sized static xor cipher. </br>
/// </remarks>
public static class SwishCrypto
{
    private const int SIZE_HASH = 0x20;

    private static readonly byte[] IntroHashBytes =
    {
        0x9E, 0xC9, 0x9C, 0xD7, 0x0E, 0xD3, 0x3C, 0x44, 0xFB, 0x93, 0x03, 0xDC, 0xEB, 0x39, 0xB4, 0x2A,
        0x19, 0x47, 0xE9, 0x63, 0x4B, 0xA2, 0x33, 0x44, 0x16, 0xBF, 0x82, 0xA2, 0xBA, 0x63, 0x55, 0xB6,
        0x3D, 0x9D, 0xF2, 0x4B, 0x5F, 0x7B, 0x6A, 0xB2, 0x62, 0x1D, 0xC2, 0x1B, 0x68, 0xE5, 0xC8, 0xB5,
        0x3A, 0x05, 0x90, 0x00, 0xE8, 0xA8, 0x10, 0x3D, 0xE2, 0xEC, 0xF0, 0x0C, 0xB2, 0xED, 0x4F, 0x6D,
    };

    private static readonly byte[] OutroHashBytes =
    {
        0xD6, 0xC0, 0x1C, 0x59, 0x8B, 0xC8, 0xB8, 0xCB, 0x46, 0xE1, 0x53, 0xFC, 0x82, 0x8C, 0x75, 0x75,
        0x13, 0xE0, 0x45, 0xDF, 0x32, 0x69, 0x3C, 0x75, 0xF0, 0x59, 0xF8, 0xD9, 0xA2, 0x5F, 0xB2, 0x17,
        0xE0, 0x80, 0x52, 0xDB, 0xEA, 0x89, 0x73, 0x99, 0x75, 0x79, 0xAF, 0xCB, 0x2E, 0x80, 0x07, 0xE6,
        0xF1, 0x26, 0xE0, 0x03, 0x0A, 0xE6, 0x6F, 0xF6, 0x41, 0xBF, 0x7E, 0x59, 0xC2, 0xAE, 0x55, 0xFD,
    };

    private static readonly byte[] StaticXorpad =
    {
        0xA0, 0x92, 0xD1, 0x06, 0x07, 0xDB, 0x32, 0xA1, 0xAE, 0x01, 0xF5, 0xC5, 0x1E, 0x84, 0x4F, 0xE3,
        0x53, 0xCA, 0x37, 0xF4, 0xA7, 0xB0, 0x4D, 0xA0, 0x18, 0xB7, 0xC2, 0x97, 0xDA, 0x5F, 0x53, 0x2B,
        0x75, 0xFA, 0x48, 0x16, 0xF8, 0xD4, 0x8A, 0x6F, 0x61, 0x05, 0xF4, 0xE2, 0xFD, 0x04, 0xB5, 0xA3,
        0x0F, 0xFC, 0x44, 0x92, 0xCB, 0x32, 0xE6, 0x1B, 0xB9, 0xB1, 0x2E, 0x01, 0xB0, 0x56, 0x53, 0x36,
        0xD2, 0xD1, 0x50, 0x3D, 0xDE, 0x5B, 0x2E, 0x0E, 0x52, 0xFD, 0xDF, 0x2F, 0x7B, 0xCA, 0x63, 0x50,
        0xA4, 0x67, 0x5D, 0x23, 0x17, 0xC0, 0x52, 0xE1, 0xA6, 0x30, 0x7C, 0x2B, 0xB6, 0x70, 0x36, 0x5B,
        0x2A, 0x27, 0x69, 0x33, 0xF5, 0x63, 0x7B, 0x36, 0x3F, 0x26, 0x9B, 0xA3, 0xED, 0x7A, 0x53, 0x00,
        0xA4, 0x48, 0xB3, 0x50, 0x9E, 0x14, 0xA0, 0x52, 0xDE, 0x7E, 0x10, 0x2B, 0x1B, 0x77, 0x6E,
    };

    public static void CryptStaticXorpadBytes(Span<byte> data)
    {
        var xp = StaticXorpad;
        var region = data[..^SIZE_HASH];
        for (var i = 0; i < region.Length; i++)
            region[i] ^= xp[i % xp.Length];
    }

    private static byte[] ComputeHash(byte[] data)
    {
#if !NET46
        using var h = IncrementalHash.CreateHash(HashAlgorithmName.SHA256);
        h.AppendData(IntroHashBytes);
        h.AppendData(data, 0, data.Length - SIZE_HASH);
        h.AppendData(OutroHashBytes);
        return h.GetHashAndReset();
#else
            var intro = IntroHashBytes;
            var outro = OutroHashBytes;
            using var stream = new MemoryStream(intro.Length + data.Length - SIZE_HASH + outro.Length);
            stream.Write(intro, 0, intro.Length);
            stream.Write(data, 0, data.Length - SIZE_HASH); // hash is at the end
            stream.Write(outro, 0, outro.Length);
            stream.Seek(0, SeekOrigin.Begin);
            using var sha = SHA256.Create();
            return sha.ComputeHash(stream);
#endif
    }

    /// <summary>
    /// Checks if the file is a rough example of a save file.
    /// </summary>
    /// <param name="data">Encrypted save data</param>
    /// <returns>True if hash matches</returns>
    public static bool GetIsHashValid(byte[] data)
    {
        var hash = ComputeHash(data);
        var span = data.AsSpan()[^hash.Length..];
        return span.SequenceEqual(hash);
    }

    /// <summary>
    /// Decrypts the save data in-place, then unpacks the blocks.
    /// </summary>
    /// <param name="data">Encrypted save data</param>
    /// <returns>Decrypted blocks.</returns>
    /// <remarks>
    /// Hash is assumed to be valid before calling this method.
    /// </remarks>
    public static IReadOnlyList<SCBlock> Decrypt(Span<byte> data)
    {
        CryptStaticXorpadBytes(data);
        return ReadBlocks(data);
    }

    private const int BlockDataRatioEstimate1 = 777; // bytes per block, on average (generous)
    private const int BlockDataRatioEstimate2 = 555; // bytes per block, on average (stingy)

    private static IReadOnlyList<SCBlock> ReadBlocks(ReadOnlySpan<byte> data)
    {
        var result = new List<SCBlock>(data.Length / BlockDataRatioEstimate2);
        int offset = 0;
        while (offset < data.Length - SIZE_HASH)
        {
            var block = SCBlock.ReadFromOffset(data, ref offset);
            result.Add(block);
        }

        return result;
    }

    /// <summary>
    /// Tries to encrypt the save data.
    /// </summary>
    /// <param name="blocks">Decrypted save data</param>
    /// <returns>Encrypted save data.</returns>
    public static byte[] Encrypt(IReadOnlyList<SCBlock> blocks)
    {
        var result = GetDecryptedRawData(blocks);
        CryptStaticXorpadBytes(result);

        var hash = ComputeHash(result);
        hash.CopyTo(result, result.Length - SIZE_HASH);

        return result;
    }

    /// <summary>
    /// Tries to encrypt the save data.
    /// </summary>
    /// <returns>Raw save data without the final xorpad layer.</returns>
    public static byte[] GetDecryptedRawData(IReadOnlyList<SCBlock> blocks)
    {
        using var ms = new MemoryStream(blocks.Count * BlockDataRatioEstimate1);
        using var bw = new BinaryWriter(ms);
        foreach (var block in blocks)
            block.WriteBlock(bw);

        // Allocate hash bytes at the end
        for (int i = 0; i < SIZE_HASH; i++)
            bw.Write((byte)0);

        return ms.ToArray();
    }
}