Skip to main content

Obfuscation: Constant (C-String)

R5AC uses a simple XOR algorithm where the decryption key length and encrypted content length are identical.

 

Referenced & encoded C-Strings Analysis

 

0x20ea35 KERNEL32.dll
0x3a3e51 ntdll.dll
0x54ee61 ADVAPI32.dll
0x542551 steamnetworkingsockets.dll
0x542691 steam_api64.dll
0x2f1cc2 EOSSDK-Win64-Shipping.dll
0x54ee31 EasyAntiCheat_EOS
0x3a3e81 wine_get_version

 

0x20ea60 K32GetMappedFileNameA
0x20ee00 VirtualQuery
0x20f160 GetLastError
0x7df831 VirtualProtect
0x54ee91 OpenSCManagerA
0x54eec1 OpenServiceA
0x54eef1 QueryServiceStatusEx
0x54ef21 CloseServiceHandle
0x543471 WideCharToMultiByte
0x541fc0 RtlCaptureStackBackTrace

 

Control Flow Analysis / Game Functions

0x20e9f0 CS_CEngineClient::Engine_SetViewAngles
0x26c540 CS_CNetChan::SetTimeout
0x26dfe0 CS_CNetChan::SendReliableMessages
0x270511 CS_CNetChan::SendDatagram
0x2744c1 CS_CNetChan::SendNetMsg
0x275210 CS_CNetChan::SendData
0x3ae540 CS_Playlist_GetPlaylistVar
0x7cf601 CS_C_BaseEntity::CalcAbsoluteVelocity
0x878620 CS_CViewRender::GetMostRecentClipTransform
0x951be1 CS_CInput::Input_CreateMove
0x952811 VTP_CInput::Input_CreateMove
0x59ebd0 CS_CCommandBuffer::AddText
0x69b830 CS_UTIL_TraceRay_Client
0xa58200 CS_C_BaseEntity::GetEntityNameAsCStr
0xabe800 CS_C_MoveData::MoveData_Init
0xcc4e10 CS_Pak_RequireSignedPaks
0xcc8c51 CS_Pak_ValidateSignatureForCurrentReadingFile
0xcd89a1 CS_WrappedFileSystem_Open

 

Virtual Method Table Analysis

0x22ee01 VTP_GetEngineTraceClient
0x22f271 VTP_GetEngineTraceClientDecals
0x479351 VTP_GetFilesystemInterface
0x817371 VTP_C_Player::Spawn
0x865491 VTP_GetEntityList
0x9f13b1 VTP_GetViewRenderInstance