3545 lines
144 KiB
XML
Executable File
3545 lines
144 KiB
XML
Executable File
<?xml version="1.0" encoding="utf-8" standalone="no" ?>
|
|
<guardSpec xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="file:///$RAGE_3RDPARTY/bin/Arxan/GuardIT/$ARXAN_VERSION/plugins/com.arxan.guardit_$ARXAN_VERSION/bin64/x86_windows_guardlibs/guardit.xsd">
|
|
|
|
|
|
<seed_cmd>
|
|
$SEED_VALUE
|
|
</seed_cmd>
|
|
|
|
<config_cmd>
|
|
<file>$PROTECTION_PATH/guardit_project_config.xml</file>
|
|
</config_cmd>
|
|
|
|
<image_cmd name="rgsc">
|
|
|
|
<image_elements>
|
|
<input_file>$RAGE_DIR\suite\src\rgsc\rgsc\x64\$RELEASE\socialclub.dll</input_file>
|
|
<guard_obfuscation>$OBFUSCATION_LEVEL</guard_obfuscation>
|
|
<dir>
|
|
<path>$RAGE_DIR\suite\src\rgsc\rgsc\x64\$RELEASE</path>
|
|
<path>$RAGE_DIR\suite\src\rgsc\rgsc</path>
|
|
<path>$RAGE_DIR\lib</path>
|
|
</dir>
|
|
<map_file>$RAGE_DIR\suite\src\rgsc\rgsc\x64\$RELEASE\socialclub.map</map_file>
|
|
<output_file>$PROTECTION_PATH/generated/socialclub_$RELEASE_$CURR_TIME.dll</output_file>
|
|
<clone_import_table>true</clone_import_table>
|
|
<disable_pps>false</disable_pps>
|
|
<garbage_code>true</garbage_code>
|
|
<debug>false</debug>
|
|
<advanced_antidebug_algorithms>false</advanced_antidebug_algorithms>
|
|
</image_elements>
|
|
|
|
<image_config_cmd>
|
|
<description>SCDLL_0000_IMG_CFG_A</description>
|
|
<expansion>0</expansion>
|
|
<compiler>
|
|
<vs2012>
|
|
</vs2012>
|
|
</compiler>
|
|
<destroy_load_config_table>true</destroy_load_config_table>
|
|
</image_config_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0000_ENC_A">
|
|
<encryption_wrapper>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0000_ENC_A</message>
|
|
<exit_code>0</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<exclude>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">__NLG_Dispatch2</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">__crt_debugger_hook</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">_debugger_hook_dummy</code>
|
|
</range>
|
|
</exclude>
|
|
<algorithm_decryption>
|
|
<use>AES256</use>
|
|
</algorithm_decryption>
|
|
<algorithm_integrity>
|
|
<use>fast</use>
|
|
</algorithm_integrity>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</encryption_wrapper>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0004_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="substring">@rlRos@rage@@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="substring">SaveOffline</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="substring">LoadOffline</code>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="substring">?Update</code>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<level>2</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0005_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="substring">?Decode@rlV2EntitlementDataBlock@rage</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="substring">?DoesDataBlockGrantEntitlement@rlRosEntitlement@rage</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>3</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0000_HKD_A">
|
|
<hook_detection>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0000_HKD_A</message>
|
|
<exit_code>0000</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>MAIN_INITGAMEHEAP_ADDALLOCATOR</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<hook_type>
|
|
<exports>
|
|
<hook_targets>
|
|
|
|
$HOOK_TARGETS
|
|
</hook_targets>
|
|
</exports>
|
|
</hook_type>
|
|
<mode>default</mode>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>true</disable>
|
|
</hook_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0000_OBF_A">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>1</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0000_OBF_B">
|
|
<obfuscation>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code>DownloadGamerPicTask</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code>?Decode@rlV2EntitlementDataBlock@rage@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code>?DoesEntitlementBlockGrantEntitlement@CommerceManager@rgsc@@</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code>?DoesDataBlockGrantEntitlement@rlRosEntitlement@rage</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<level>2</level>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</obfuscation>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0001_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code>TFIT_key_iAES4</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_BTON_VERSION</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>false</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0001_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code>TFIT_key_iAES4</code>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODEVERIFY_LENGTH</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>false</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0001_ADB_A">
|
|
<debugger_detection>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0001_ADB_A</message>
|
|
<exit_code>0001</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<invocation>
|
|
<rangeSet>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0001_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0001_REP_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</rangeSet>
|
|
</invocation>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</debugger_detection>
|
|
</guard_cmd>
|
|
|
|
<patch_cmd name="SCDLL_0001_DMG_A">
|
|
<rangeSet>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code>TFIT_key_iAES4</code>
|
|
</range>
|
|
</include>
|
|
</rangeSet>
|
|
<byte_sequence>
|
|
<byte>0x0e</byte>
|
|
<byte>0xf1</byte>
|
|
<byte>0xc3</byte>
|
|
<byte>0x97</byte>
|
|
</byte_sequence>
|
|
<all>false</all>
|
|
<disable>false</disable>
|
|
</patch_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0001_VVG_A">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>FILESYSTEM_INIT_SET_ROS_ENV</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code>TFIT_key_iAES4</code>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<constant>0x97C3F10E</constant>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0001_REP_A</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0001_VVG_B">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLROSENTITLEMENT_DOESDATABLOCKGRANTENTITLEMENT_GET_CURRENT_TIME</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0001_REP_A</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0001_REP_A</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0001_VVG_E">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLROSENTITLEMENT_DOESDATABLOCKGRANTENTITLEMENT_FOUND_ENTITLEMENTS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0001_REP_B</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0001_REP_B</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0001_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0001_CHK_A</message>
|
|
<exit_code>0001</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0001_ADB_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0001_VVG_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0001_CHK_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_CHK_B</guard_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0001_CHK_B</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<label>?Init@RgscNetwork@</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0001_VVG_D">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>COMMERCEMANAGER_UPDATEVOUCHINGCONSUMING_SUCCEDED_SET_ENTITLEMENTS_ARRAY</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>REQUESTENTITLEMENTBLOCKTASK_CONFIGURE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0001_CHK_A</guard_name>
|
|
<guard_symbol_name>checksum</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0001_CHK_A</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0001_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0001_CHK_B</message>
|
|
<exit_code>0001</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0001_VVG_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0001_VVG_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0001_CHK_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_CHK_D</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLPCPROFILEMANAGER_LOADPROFILE_GET_PLATFORM_DIRECTORY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0001_VVG_C">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLROSENTITLEMENTSAVEOFFLINETASK_ENTITLEMENTSAVEFILEWORKER_PERFORM_MEM_CPY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0001_CHK_B</guard_name>
|
|
<guard_symbol_name>checksum</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0001_CHK_B</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>true</return_address>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0002_ADB_A">
|
|
<debugger_detection>
|
|
<description>asdf</description>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0002_ADB_A</message>
|
|
<exit_code>0002</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<label>?AllocateOfflineEntitlementBlob@RgscCommerceManager@rgsc@</label>
|
|
</location>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<label>?ClearOfflineEntitlement@RgscCommerceManager@rgsc@@</label>
|
|
</location>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<label>?DoesEntitlementBlockGrantEntitlement@RgscCommerceManager</label>
|
|
</location>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<label>?GetOfflineEntitlement@RgscCommerceManager@rgsc@@</label>
|
|
</location>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<label>?GetOfflineEntitlementLength@RgscCommerceManager@rgsc@@</label>
|
|
</location>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<label>?LoadOfflineEntitlement@RgscCommerceManager@rgsc@@</label>
|
|
</location>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<label>?SaveOfflineEntitlement@RgscCommerceManager@rgsc@@</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.005</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</debugger_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0002_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>RLV2ENTITLEMENTDATABLOCK_DECODE_C</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_SET_SIGNATURE_LENGTH</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0002_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>RLV2ENTITLEMENTDATABLOCK_DECODE_C</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_EXIT_A</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_EXIT_B</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_EXIT_D</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_EXIT_E</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0002_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0002_CHK_A</message>
|
|
<exit_code>0002</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>RLV2ENTITLEMENTDATABLOCK_DECODE_C</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_VVG_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_BTON_ROCKSTARID</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0002_VVG_B">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_HASH_PTR_CALC</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_CHK_A</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_CHK_A</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_REP_O</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</tamper_target>
|
|
<tamper_value>2807154035</tamper_value>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0002_REP_H">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_CHK_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_VVG_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_FINAL_SHA</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0002_REP_I">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_CHK_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_VVG_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_SKIP_HASH</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0002_VVG_A">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<label>?Init@netHttpRequest@</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0000_ENC_A</guard_name>
|
|
<guard_symbol_name>actual_integrity</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0000_ENC_A</guard_name>
|
|
<guard_symbol_name>expected_integrity</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>true</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_REP_M</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0002_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0002_CHK_B</message>
|
|
<exit_code>0002</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_VVG_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_REP_O</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0001_VVG_C</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>ACHIEVEMENTS_CONSTRUCTOR</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0002_REP_J">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_REP_H</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_CHK_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>NETTASK_UPDATE_SET_SUCCEEDED</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.004</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0002_REP_L">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>RLROSENTITLEMENT_DOESDATABLOCKGRANTENTITLEMENT_CHECK_ENTITLED_A</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>RLROSENTITLEMENT_DOESDATABLOCKGRANTENTITLEMENT_CHECK_ENTITLED_B</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLROSENTITLEMENT_DOESDATABLOCKGRANTENTITLEMENT_VERIFY_ROCKSTAR_ID</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0002_REP_N">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>RLROSENTITLEMENT_DOESDATABLOCKGRANTENTITLEMENT_CHECK_ENTITLED_A</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>RLROSENTITLEMENT_DOESDATABLOCKGRANTENTITLEMENT_CHECK_ENTITLED_B</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLROSENTITLEMENT_DOESDATABLOCKGRANTENTITLEMENT_AFTER_CHECKS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0002_REP_M">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>RLROSENTITLEMENT_DOESDATABLOCKGRANTENTITLEMENT_CHECK_ENTITLED_A</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>RLROSENTITLEMENT_DOESDATABLOCKGRANTENTITLEMENT_CHECK_ENTITLED_B</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLROSENTITLEMENT_DOESDATABLOCKGRANTENTITLEMENT_CALL_GMTIME</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0002_CHK_C">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0002_CHK_C</message>
|
|
<exit_code>0002</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_REP_H</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_REP_I</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_REP_D</guard_name>
|
|
</range>
|
|
<!--
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_REP_C</guard_name>
|
|
</range>
|
|
-->
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_CHK_E</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>MAIN_INITGAMEHEAP_ADDALLOCATOR</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0002_CHK_D">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0002_CHK_D</message>
|
|
<exit_code>0002</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_REP_L</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>RLPCPROFILEMANAGER_SAVESIGNINTRANSFERDATA_SAVE_DATA</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0004_CHK_E</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<rangeSet>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_CHK_C</guard_name>
|
|
</range>
|
|
</include>
|
|
</rangeSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<default>
|
|
</default>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0002_REP_D">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_REP_L</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLPCGAMERPIC_DOWNLOADGAMERPICTASK_UPDATE_GET_SMALL_PIC</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0002_REP_E">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_CHK_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_CHK_D</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>MAIN_INITGAMEHEAP_SETFRAGMEMORY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0002_REP_F">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_CHK_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_CHK_D</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>MAIN_INITGAMEHEAP_SET_CURRENT_ALLOCATOR</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0002_REP_G">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_REP_J</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_REP_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_ADB_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RGSC_INITRAGE_QUERY_V2_INTERFACE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<default>
|
|
</default>
|
|
</protected_types>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0002_REP_K">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_REP_G</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_REP_F</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_REP_P</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RGSC_INIT_UPDATE_REGISTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<default>
|
|
</default>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
<!--
|
|
<guard_cmd name="SCDLL_0002_REP_Q">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>RGSC_GRAPHICS_D3D9_MAPMOUSE</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_REP_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>MAPNUMFROMRANGETORANGE_CALC_RNG_A</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.005</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0002_REP_C">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_REP_Q</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_CHK_J</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>FILESYSTEM_INIT_SET_ROS_ENV</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
-->
|
|
<guard_cmd name="SCDLL_0002_REP_O">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_REP_L</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_REP_M</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_REP_N</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>NETTASK_REMOVE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.05</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0002_REP_P">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_REP_O</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>REQUESTENTITLEMENTBLOCKTASK_CONSTRUCTOR</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<range_cmd name="SCDLL_0003_RNG_RLROS_AES_DECODE_TFIT">
|
|
<description>Restoring</description>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">wbw_apicbc_classical_dec</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">wbaes_wrapper_mode_string</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">wbaes_update</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">wbaes_obf_string</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">wbaes_init_wrapper_with_iv</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">wbaes_init_wrapper</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">wbaes_init_cbc</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">wbaes_get_oxdid</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">wbaes_final</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">wbaes_direction_string</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">wbaes_api_ctr_standard_increment_m128</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">getBufferSize</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">check_output_buffer</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">bytecomp</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">block_xor</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">aes_wbcbc_decrypt</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">aes_cbc_decrypt_api</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">aes_cbc_decrypt</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">WB_SLICE_MAGIC</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">TFIT_validate_key_id_iAES4</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">TFIT_op_iAES4</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">TFIT_key_iAES4</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">TFIT_get_oxd_id_out_iAES4</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">TFIT_get_oxd_id_in_iAES4</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">TFIT_aes_ecb_iAES4</code>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="exact">wbaes_init_ecb_buffer</code>
|
|
</range>
|
|
</include>
|
|
<disable>false</disable>
|
|
</range_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0003_REP_C">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>SCDLL_0003_RNG_RLROS_AES_DECODE_TFIT</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_BTON_VERSION</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0003_REP_D">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>SCDLL_0003_RNG_RLROS_AES_DECODE_TFIT</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_RVERIFY_LENGTH</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0003_REP_E">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_D</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_CONSTRUCTOR</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0003_REP_F">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_D</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLROSGETENTITLEMENTBLOCK_VALID_CREDS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0003_VVG_C">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLROSENTITLEMENTSAVEOFFLINETASK_ENTITLEMENTSAVEFILEWORKER_START</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_READ_IV_FROM_BLOB_TWO</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_E</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_E</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code>TFIT_key_iAES4</code>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0003_ADB_A">
|
|
<debugger_detection>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0003_ADB_A</message>
|
|
<exit_code>0003</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLROSENTITLEMENTSAVEOFFLINETASK_ENTITLEMENTSAVEFILEWORKER_PERFORM_CREATE_FILE</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLROSENTITLEMENTSAVEOFFLINETASK_ENTITLEMENTSAVEFILEWORKER_PERFORM_CLOSE_FILE</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_BTON_VERSION</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</debugger_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0003_CHK_C">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0003_CHK_C</message>
|
|
<exit_code>0003</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_VVG_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_F</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_CHK_B</guard_name>
|
|
</range>
|
|
<!--
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0000_HKD_A</guard_name>
|
|
</range>
|
|
-->
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>DATPROTECT_DERIVED_KEY_ENCRYPT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0003_REP_G">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_F</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_ADB_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_CHK_C</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLPCACHIEVEMENT_INIT_LOAD_METADATA</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0003_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>RLROSENTITLEMENTSAVEOFFLINETASK_ENTITLEMENTSAVEFILEWORKER_PERFORM</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLROSENTITLEMENTSAVEOFFLINETASK_ENTITLEMENTSAVEFILEWORKER_PERFORM_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0003_REP_H">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>RLROSENTITLEMENTSAVEOFFLINETASK_ENTITLEMENTSAVEFILEWORKER_PERFORM</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLROSENTITLEMENTSAVEOFFLINETASK_ENTITLEMENTSAVEFILEWORKER_PERFORM_EXIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0003_VVG_B">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLROSENTITLEMENT_DOESDATABLOCKGRANTENTITLEMENT_STRCMP_EXPIRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_C</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_C</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>true</stack>
|
|
<return_address>true</return_address>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0003_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0003_CHK_B</message>
|
|
<exit_code>0003</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_H</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_VVG_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_CHK_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_VVG_E</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_CHK_E</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RGSC_INITRAGE_INITRLINE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0003_VVG_D">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RGSC_INITRLINE_CHECK_TITLEV5</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_CHK_B</guard_name>
|
|
<guard_symbol_name>checksum</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_CHK_B</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_E</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0003_ADB_B">
|
|
<debugger_detection>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0003_ADB_B</message>
|
|
<exit_code>0003</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLROSENTITLEMENTLOADOFFLINETASK_ENTITLEMENTLOADFILEWORKER_PERFORM_OPEN_ENTITLEMENT</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLROSENTITLEMENTLOADOFFLINETASK_ENTITLEMENTLOADFILEWORKER_PERFORM_DECRYPT_SIGNATURE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</debugger_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0003_VVG_F">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>REQUESTENTITLEMENTBLOCKTASK_CONFIGURE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_CHK_A</guard_name>
|
|
<guard_symbol_name>checksum</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_CHK_A</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_B</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0003_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>RLROSENTITLEMENTLOADOFFLINETASK_ENTITLEMENTLOADFILEWORKER_PERFORM</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_ADB_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLROSENTITLEMENTLOADOFFLINETASK_ENTITLEMENTLOADFILEWORKER_PERFORM_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<static></static>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0003_REP_I">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>RLROSENTITLEMENTLOADOFFLINETASK_ENTITLEMENTLOADFILEWORKER_PERFORM</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLROSENTITLEMENTLOADOFFLINETASK_ENTITLEMENTLOADFILEWORKER_PERFORM_EXIT_A</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLROSENTITLEMENTLOADOFFLINETASK_ENTITLEMENTLOADFILEWORKER_PERFORM_EXIT_B</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<dynamic></dynamic>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0003_CHK_E">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0003_CHK_E</message>
|
|
<exit_code>0003</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>RLROSENTITLEMENTLOADOFFLINETASK_ENTITLEMENTLOADFILEWORKER_PERFORM</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLROSENTITLEMENTLOADOFFLINETASK_ENTITLEMENTLOADFILEWORKER_PERFORM_GET_SIGNIN_INFO</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0003_CHK_D">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0003_CHK_D</message>
|
|
<exit_code>0003</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_I</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_VVG_F</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLPCTASK_DESTROYTASK</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0003_VVG_E">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLROSENTITLEMENTLOADOFFLINETASK_ONUPDATE_LOADING_FINISHED</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_CHK_E</guard_name>
|
|
<guard_symbol_name>checksum</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_CHK_E</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_E</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0003_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0003_CHK_A</message>
|
|
<exit_code>0003</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_VVG_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_CHK_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_G</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLPCPROFILEMANAGER_SIGNINTASK_CONFIGURE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0003_VVG_A">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_BTON_ROCKSTARID</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_D</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_D</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>true</stack>
|
|
<return_address>true</return_address>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0003_REP_K">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_J</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_CHK_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>COMMERCEMANAGER_UPDATE_FETCHING</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>COMMERCEMANAGER_UPDATEVOUCHERGETTINGCONTENTS_PUSH_RESULT</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>COMMERCEMANAGER_UPDATEVOUCHINGCONSUMING_FAILED_PREVIEW_DATA</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>COMMERCEMANAGER_UPDATEVOUCHINGCONSUMING_SUCCEDED_SET_ENTITLEMENTS_ARRAY</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>NETTASK_SCHEDULE_QUEUE_BEFORE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.02</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0003_CHK_J">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0003_CHK_J</message>
|
|
<exit_code>0003</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_K</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_VVG_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0004_CHK_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_TFIT_FINAL_AES</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0003_REP_J">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_VVG_D</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>FILESTYSTEM_GETTITLEDIRECTORY_GET_ROCKSTAR_DIRECTORY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0004_ADB_A">
|
|
<debugger_detection>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0004_ADB_A</message>
|
|
<exit_code>0004</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<invocation>
|
|
<rangeSet>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="substring">@rlRos@rage@@</code>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="substring">?Update</code>
|
|
</range>
|
|
</exclude>
|
|
</rangeSet>
|
|
</invocation>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</debugger_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0004_CHK_A">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0004_CHK_A</message>
|
|
<exit_code>0004</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>RLPCPROFILEMANAGER_ISONLINE_RANGE</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>RLROS_ISONLINE</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0004_ADB_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLROSENTITLEMENTLOADOFFLINETASK_ENTITLEMENTLOADFILEWORKER_PERFORM_OPEN_ENTITLEMENT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0004_CHK_B">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0004_CHK_B</message>
|
|
<exit_code>0004</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>RLPCPROFILEMANAGER_ISONLINE_RANGE</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>RLROS_ISONLINE</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>RLROS_GETLOGINSTATUS</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLPCPROFILE_TOJSON</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.12</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0004_REP_A">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="substring">@rlRos@rage@@</code>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<code matching="substring">?Update</code>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLPCTASK_CREATEASYNCSTATUS_NEW_STATUS</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0004_REP_B">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>RLPCPROFILEMANAGER_ISONLINE_RANGE</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>RLROS_ISONLINE</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>RLROS_GETLOGINSTATUS</range_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0004_ADB_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>FILESTYSTEM_GETTITLEDIRECTORY_GET_ROCKSTAR_DIRECTORY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0004_REP_C">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0004_REP_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLWORKER_PROCESS_PERFORM_WORKER</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0004_REP_D">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0004_CHK_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0004_REP_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>AES_DECRYPT_GENERAL_DECRYPT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>1</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0004_REP_F">
|
|
<repair>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0004_ADB_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0004_CHK_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0004_REP_B</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLPCPROFILEMANAGER_SIGNINTASK_UPDATE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<damage>
|
|
<none></none>
|
|
</damage>
|
|
<instances>0</instances>
|
|
<protected_types>
|
|
<custom>
|
|
<data>true</data>
|
|
<native_code>true</native_code>
|
|
<unused_areas>false</unused_areas>
|
|
</custom>
|
|
</protected_types>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</repair>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0004_VVG_A">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>DATUNPROTECT_CREATE_DERIVED_KEY_TWO</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0004_REP_D</guard_name>
|
|
<guard_symbol_name>has_run</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0004_REP_D</guard_name>
|
|
<guard_symbol_name>has_run_expected</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>false</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0004_REP_B</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0004_ADB_B">
|
|
<debugger_detection>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0004_ADB_B</message>
|
|
<exit_code>0004</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<invocation>
|
|
<rangeSet>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0004_REP_F</guard_name>
|
|
</range>
|
|
</include>
|
|
</rangeSet>
|
|
</invocation>
|
|
<instances>0</instances>
|
|
<execution_probability>
|
|
<value>0.0001</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</debugger_detection>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0004_CHK_D">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0004_CHK_D</message>
|
|
<exit_code>0004</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0004_REP_F</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0004_ADB_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0004_CHK_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0001_VVG_D</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLPCPROFILE_AUTHENTICATE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<execution_probability>
|
|
<value>0.17</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0004_CHK_F">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0004_CHK_F</message>
|
|
<exit_code>0004</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0004_REP_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0004_REP_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0001_CHK_C</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLV2ENTITLEMENTDATABLOCK_DECODE_READ_IV_FROM_BLOB</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0004_CHK_C">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0004_CHK_C</message>
|
|
<exit_code>0004</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0004_REP_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0004_REP_B</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_REP_A</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLROSENTITLEMENTLOADOFFLINETASK_CONFIGURE_CALL_CONFIGURE</location_name>
|
|
</location>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>REQUESTENTITLEMENTBLOCKTASK_CONFIGURE</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0004_CHK_E">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0004_CHK_E</message>
|
|
<exit_code>0004</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0004_CHK_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0004_VVG_A</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0004_CHK_F</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0004_CHK_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_J</guard_name>
|
|
</range>
|
|
</include>
|
|
<exclude>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0003_REP_J</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</exclude>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLPCTELEMETRY_INIT_CALL_INIT</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0001_CHK_C">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0001_CHK_C</message>
|
|
<exit_code>0001</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0001_VVG_C</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0001_VVG_D</guard_name>
|
|
</range>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_VVG_C</guard_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>AES_AES_ENTRY</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<execution_probability>
|
|
<value>0.14</value>
|
|
<seed_source>all</seed_source>
|
|
</execution_probability>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0002_VVG_C">
|
|
<value_verification>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<label>?Init@netHttpRequest@</label>
|
|
</location>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<label>?Init@rlFriendsReader@rage@</label>
|
|
</location>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<label>?Init@rlClanMembershipData@</label>
|
|
</location>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<label>?Init@Host@rlRosPresenceInfo@</label>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<verified_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0000_ENC_A</guard_name>
|
|
<guard_symbol_name>actual_integrity</guard_symbol_name>
|
|
</range>
|
|
<offset>0</offset>
|
|
</verified_value>
|
|
<expected_value>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0000_ENC_A</guard_name>
|
|
<guard_symbol_name>expected_integrity</guard_symbol_name>
|
|
</range>
|
|
</expected_value>
|
|
<algorithm>
|
|
<jump>false</jump>
|
|
<register>false</register>
|
|
<flags>false</flags>
|
|
<stack>true</stack>
|
|
<return_address>false</return_address>
|
|
<symbol>
|
|
<tamper_target>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<guard_name>SCDLL_0002_REP_M</guard_name>
|
|
<guard_symbol_name>key</guard_symbol_name>
|
|
</range>
|
|
</tamper_target>
|
|
</symbol>
|
|
</algorithm>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</value_verification>
|
|
</guard_cmd>
|
|
|
|
<guard_cmd name="SCDLL_0002_CHK_E">
|
|
<checksum>
|
|
<action>
|
|
<notify_user>
|
|
<message>SCDLL_0002_CHK_E</message>
|
|
<exit_code>0002</exit_code>
|
|
</notify_user>
|
|
</action>
|
|
<protected_range>
|
|
<include>
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
<range_name>RLROSENTITLEMENT_DOESDATABLOCKGRANTENTITLEMENT_EARLY_OUTS</range_name>
|
|
</range>
|
|
</include>
|
|
</protected_range>
|
|
<invocation>
|
|
<locationSet>
|
|
<include>
|
|
<location>
|
|
<image_name>rgsc</image_name>
|
|
<location_name>RLROSENTITLEMENT_DOESDATABLOCKGRANTENTITLEMENT_CALL_GMTIME</location_name>
|
|
</location>
|
|
</include>
|
|
</locationSet>
|
|
</invocation>
|
|
<algorithm>
|
|
<use>fast</use>
|
|
</algorithm>
|
|
<instances>0</instances>
|
|
<debug>false</debug>
|
|
<disable>false</disable>
|
|
</checksum>
|
|
</guard_cmd>
|
|
|
|
<print_cmd name="print_image">
|
|
<range>
|
|
<image_name>rgsc</image_name>
|
|
</range>
|
|
<disable>$FAST_PROTECT</disable>
|
|
</print_cmd>
|
|
</image_cmd>
|
|
|
|
</guardSpec>
|