Steamless

• API: Changed the AES buffer size from 2048 to 16 to correct block size alignment issues.
• Unpacker v2.1 (x86) - Fixed AES decryption not properly handling the code section, leading to junk data being copied into unpacked file.
• Unpacker v2.1 (x86) - Fixed AES decryption not properly preserving non-encrypted data.
• Unpacker v3.1 (x86) - Fixed AES decryption not properly handling the code section, leading to junk data being copied into unpacked file.
• Unpacker v3.1 (x86) - Fixed AES decryption not properly preserving non-encrypted data.
• Bumped the version information for affected binaries.
• Bumped the copyright year of the project.
• Updated the bundled ExamplePlugin code in the release package.

Please Note: This update changes the AES decryption handling to heavily reduce the chunk size being processed. This may cause unpacking some files to take longer than before.

This update should fix some long-standing issues with the AES decryption handling and certain titles when being unpacked. There were edge cases that could cause some games to retain junk data or padding bytes when being unpacked, causing the file to become corrupt, unaligned incorrectly, or otherwise have garbage data added into the main code section. This should now be corrected for the listed unpackers in this update. (Other unpackers will be updated over time when samples are provided that have issues.)

• Unpacker 2.0 (x86) - Add support for additional samples. (Header size: 884)

This small recompile/update adds support for multiple older v2.x files that have a header size of 884.

• API - Add import for MapFileAndCheckSum.
• PE32 - Replace manual PE checksum calculations with Win32 API call instead.
• PE64 - Replace manual PE checksum calculations with Win32 API call instead.
• Unpacker v2.0 (x86) - Add support for multiple variants of the header.
• Unpacker v2.0 (x86) - Fix and rename some of the fields of the stub header.
• Unpacker v2.0 (x86) - Add error message for unsupported header sizes to help collect samples.

While I was trying to avoid using any kind of direct system API calls in this project, I have opt'd to go against that now. The PE file checksum is an annoying calculation that I do not want to waste more time on than I have to. Because of this, I have removed the custom implementations within Steamless and replaced the checksum replacement code with calls to MapFileAndCheckSum instead. This will now ensure all checksums are valid on PE files as the system is the one responsible for calculating it.

This update also adds multiple variant support to the v2.0 (x86) unpacker.

This release is mainly to fix a small issue with the 2.0 (x86) variant unpacker plugin. A small issue was happening with other samples causing the unpacker to fail on files with certain header information set. (This unpacker is still beta and needs more work later on when additional samples can be collected.)

This release also now includes the ability to log an error to inform the user if the file they are trying to unpack is not packed with SteamStub while using the automatic unpacking plugin. (This is done just by simply checking if a .bind section exists in the file.)

Changelog

• AutomaticPlugin - Added support for logging service usage.
• AutomaticPlugin - Added detection and logging output to mention if a file is most likely not packed with SteamStub.
• Core - Fixed issue with AutomaticPlugin not properly initializing.
• Unpacker v2.0 (x86) - Adjusted how the code section RVA is determined. (Moved a second check to 'optional feature' state for now.)

This release fixes the following bugs:

• #85 - Failure to unpack due to issue with the v2.0 (x86) plugin.

Highlights

• Steamless now includes a command line version. (Steamless.CLI.exe)

Full Changelog

• Added Steamless.CLI to run Steamless from the command line.
• Unpacker: v10x86 - Fix incorrect output path when compiled for Release mode.

Command Line Options

The command line version of Steamless allows for the following arguments to be used:

• --quiet - Disables output of debug log messages.
• --keepbind - Keeps the .bind section in the unpacked file.
• --keepstub - Keeps the DOS stub in the unpacked file.
• --dumppayload - Dumps the stub payload to disk.
• --dumpdrmp - Dumps the SteamDRMP.dll to disk.
• --realign - Realigns the unpacked file sections.
• --recalcchecksum - Recalculates the unpacked file checksum.
• --exp - Use experimental features.

Highlights

• Add new plugin to support unpacking SteamStub variant v1.0 (x86) files. (Beta until more files are found to test with.)
• Add new option to allow disabling of section realignment.
• Add support for handling files packed with TlsCallback overrides.
• Add new option to zero the DOS stub data when unpacking.
• DontRealignSections and ZeroDosStubData features are now default enabled.
• Add new option RecalculateFileChecksum to allow unpacked files to have their PE checksum recalculated.

Full Changelog

• API: PE64 - Add check for TlsDirectory.AddressOfCallBacks == 0 to prevent attempting to reference invalid data.
• Unpacker: v31.x64 - Adjust size of data searched when determining the variant version. Fixes #56
• Misc: Update project copyrights.
• Misc: Remove some unused/dead code from the UI.
• API: Add ToString overrides to the section entries to allow easier debugging.
• Unpacker: v31.x64 - Remove code section size check. (Some virtualized files will have an empty code section.)
• Unpacker: v31.x64 - Allow empty code section files to still unpack by skipping decryption step.
• API: Add new option to allow disabling of section realignment.
• Core: Add support for new disable section realignment option.
• Unpacker: v20.x86 - Add support for new disable section realignment option.
• Unpacker: v21.x86 - Add support for new disable section realignment option.
• Unpacker: v30.x86 - Add support for new disable section realignment option.
• Unpacker: v30.x64 - Add support for new disable section realignment option.
• Unpacker: v31.x86 - Add support for new disable section realignment option.
• Unpacker: v31.x64 - Add support for new disable section realignment option.
• API: PE32 - Fix SizeOfImage alignment.
• API: PE64 - Fix SizeOfImage alignment.
• Unpacker: v20.x86 - Fix SizeOfImage alignment.
• Unpacker: v21.x86 - Fix SizeOfImage alignment.
• Unpacker: v30.x64 - Fix incorrect TlsOepRva being stored and used.
• Unpacker: v30.x64 - Fix incorrect TlsOepRva calculations when reading payload and SteamDRMP.dll.
• Unpacker: v31.x64 - Fix incorrect TlsOepRva being stored and used.
• Unpacker: v31.x64 - Fix incorrect TlsOepRva calculations when reading payload and SteamDRMP.dll.
• Unpacker: v30.x64 - Renamed header field Unknown0003 to HasTlsCallback.
• Unpacker: v30.x64 - Add support for handling files packed with TlsCallback overrides.
  • This feature is currently only supported in this variant for the time being. (Until other samples are provided that have a TlsCallback override for the other variants.)
  • Notes on how this file type works can be found here: https://github.com/atom0s/Steamless/issues/20#issuecomment-1078821463
• API: PE32 Adjusted FindPattern to return a long instead of uint. Default return is now -1.
• API: PE36 Adjusted FindPattern to return a long instead of uint. Default return is now -1.
• Unpackers: Updated all usages of FindPattern to reflect new API change.
• Begin variant v1.0 x86 plugin support.
• Update project information copyrights.
• Unpacker: v10.x86 - Finish implementing SteamStub variant v1.0 (x86) unpacker.
• API: Add new option to zero the DOS stub data when unpacking.
• Core: Add UI option to enable/disable the new zero DOS stub data option.
• Unpackers: Add support for new zero DOS stub data option.
• API: DontRealignSections and ZeroDosStubData are now default enabled as this is the general 'correct' way to handle most files. (Some files do require the section alignment to happen and some files may use the DOS stub for self-validation and such. Adjust accordingly when using Steamless.)
• Core: Fix typo with new ZeroDosStubData option checkbox using wrong field bool.
• API: Add new option RecalculateFileChecksum to allow unpacked files to have their PE checksum recalculated.
• API: PE32 - Add new functionality to Pe32Helpers to recalculate a PE file checksum.
• Unpackers: (x86) Ensure all unpacked files default to a checksum of 0.
• Unpackers: (x86) Add support for new RecalculateFileChecksum setting.
• API: PE64 - Add new functionality to Pe64Helpers to recalculate a PE file checksum.
• Unpackers: (x64) Ensure all unpacked files default to a checksum of 0.
• Unpackers: (x64) Add support for new RecalculateFileChecksum setting.

Other Changes

• Repository has been heavily cleaned up.
• Labels for issues/pull requests have been redone.
• All past issues/pulls have had their labels updated to reflect the new labeling setup.
• Most old pending issues are now resolved.

• Fixed 2.1 (x86) unpacker using the wrong encryption size when the .text section is encrypted. (Fixes #57)

• Renamed SteamStub Variant 2.0 to 2.1. (This is not technically the first version of 2.0.)
• Added support for real SteamStub Variant 2.0 (Fixes/closes #37)
• General code cleanup.
• Adjusted Paypal URLs.

• Updated copyright date ranges across the project.
• Fixed issue with memory errors due to incorrect structure mapping handling.

Enjoy my project(s)? Feel free to donate via Paypal:

• https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=7U7Q2GRT6KUJN
• https://paypal.me/atom0s

• Fixed a small bug with TLS callback parsing in the 64bit PE parser.
• Added TLS callback support for the 3.0 64bit unpacker.

Donations can be made via Paypal: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=7U7Q2GRT6KUJN

• General code cleanup.
• Added new experimental features option.
• Added new SteamStub 2.x variant offset dumper. (Experimental Feature)

The new SteamStub 2.x variant offset dumper should be able to dump most of the v2 files that would fail before. This newer feature is experimental for now and uses disassembling to pull the offsets instead. This has only been tested on a few files so far, but all seems to work ok. In order to use this feature, you must check the new 'Use Experimental Features' box before attempting to unpack a file.

Donations can be made via Paypal: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=7U7Q2GRT6KUJN

• Added SteamStub 2.x variant D0 (header size) support.
• Fixed some issues with the 2.x disassembler using incorrect types.
• Updated the SharpDisasm.dll file to latest version.

• Added support for new SteamStub v3.1.2 variant. (x64)
• Updated all plugins to make use of reflection to get their versions from their assembly info.
• Added ignore for Windows image cache file. (Thumbs.db)
• Updated all copyrights to include 2018.

• Add support for new v3.1.2 variant. (x86 only at this time.)
• Adjust default window width to better display plugin name info on initial load.

• Added fallback pattern to variant 2.0 (x86) for the offset data. (Fixes #6)

• Steamless.Unpacker.Variant30.x86
  • Fixed issue with header size not unpacking properly for certain files.
  • Fixed issue with TLS callbacks not being unpacked properly when present.
• Steamless.Unpacker.Variant30.x64
  • Added support for 64bit version of SteamStub Variant 3.0.
• Steamless.Unpacker.Variant31.x64
  • Added support for 64bit version of SteamStub Variant 3.1

• Fixed issue with variant 2.0 (x86) unpacker failing to unpack files with non-encrypted code sections.

• Adjusted Steamless to use older Aero presentation library for Windows 7 support.

• General code clean up and release to Github.
• PeFile32 - Added support for reading the ImageTlsDirectory section.
• SteamStub Variant 3.1 (x86) - Adjusted the unpacker to attempt to use the Tls callback as the real OEP if general unpacking fails.