Luigi Auriemma

if the codmpdata tool didn't show the "hash doesn't match" error/warning means that the file has been decrypted corretly.
there are absolutely no doubts on this: if the hash matches means that the file is EXACTLY the same of the original decrypted one.

Metrium, I was in a similar situation last night. I had successfully decrypted my file, and was looking at it in a hex editor. I assumed the decrypt was successful because a) Luigi's tool didn't give the error message, and b) because a lot of the values were 00, which I assumed means they were unused, or kept just in case they wanted to store new things there in a later patch.

So I took my known kills value, 29900 and worked out the hex equivalent by googling "29900 in hex", which gave me 0x74CC

Rememver that the 0x is just an indicator that the rest of the number is in hex. So I was looking for 74CC, but I couldnt find it. My editor was in big endian format, so I was a bit lost, but then I looked for CC, and there was a 74 to the RIGHT of it, i.e. CC 74. I checked this out with other known numbers, deaths, headshots etc, and it always checked out. It's like you read the pairs backwards. So look for that.

I'm yet to work out what happens when I pass 0xFFFF kills, could it take up another pair? And what actually are those pairs, each letter is 2 bytes arent they? so a pair is 4 bytes? I'm still new to this myself :)

Thinking about it, each letter can be 0 to F, or 16 possibilities, or 2^4, 4 bits, or half a byte. So each pair of number in your hex editor is a byte.

Now it comes down to what type of number they are (http://www.angelfire.com/fl3/mwalling/V ... Types3.htm) for me to work out how many bytes to read to get a value.

Just figured I would drop in here, sorry for the couple of weeks grave digging :3

Anyhow, I changed computers about 3 days ago and lost all my profiles for cod5, which I couldn't be bothered getting manually again, so I went looking for a way of increasing them again. I noticed your decryptor here and decided to see how much of the file format I could reverse engineer. In the last couple of days I came up with this little profile editor, hope it helps people :3. (btw luigi hope you don't mind me packaging your codmpdatadec.exe file in this).

http://www.binaryphoenix.com/screenshot1.png
http://www.binaryphoenix.com/CoD5PE-110909.rar

If anyone wants the source (its in C#, .NET 3.5), feel free to ask, though its a pretty ugly hack job :3.

Very cool! Nice work Infini.

Thank you :3.

I've added a CoD4 profile editor too, seeing as they use an almost identical file format.

http://www.binaryphoenix.com/screenshot2.png
http://www.binaryphoenix.com/CoD4&5PE-110909.rar

Infini - Thats neat man, nice work! Nice UI. It motivates me to finish my stats app :) It's just that after a day's coding at work, it's hard to come home and code some more.

What I'm still trying to get my head around was how Luigi worked out the encryption scheme in the first place. It's a modified version of a standard algorithm to boot. I'm in awe.

THANK YOU FOR THE HELPFUL INFORMATION!!!!

My son was playing on a server today that turned out to be a rank boost server. He was so excited about the points assigned for each frag but not so happy when a frag score that was displayed was actually an algorithm. The algorithm set his rank to 1 (was 58), kills, deaths, streak and headshot to zero and his XP points to -2146783546. Luckily it did not destroy his accumulated arsenal and other unlocked items as has happened to several posters on other forums.

I downloaded the utilities discussed on this site and was able to restore his rank and other statistics. He's a VERY happy young man :-)

Nice tool Infini - I wanted to... but I just couldn't find enough motivation to do that!

Any chance you'll be posting the source? I might get re-motivated with the next version.

Good job Infini. I'm glad that i just checked these forums again as i was about to do one myself.

I am trying to download the cod4and5 archive but every time its broken, please any one upload it or email me at azfarhashmi@gmail.com" onclick="window.open(this.href);return false

I think the connection to server is breaking before completion of download.

Ok here is the problem, I am using the cod4 ripped version (no installer) so the tool is unable to locate the profile folder path, any chance of manually provide it? and will it work with cod4 v1.7?

whats the key type i choose (to create registry)

Ok I have imported the reg key but same error.

i have noticed that in win 7 (and in vista i think) the mpdata is stored in
"c:\users\*username*\AppData\Local\Virtualstore\Program Files\Activision"...etc

I has the same problem as azfar, and got it working by copying the Players folder from the above location ot here "c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\", changing the data via the abovcee program, and copying it back.

would you be so kind to share the code? i'd like to practice programming and would like to add a feature that would let you choose the path to your profile. thanks.

First of all, respect for Luigi and Infini for their coding skills.

Second,
Since there is no reaction about the code, here's a simple tip:
http://www.red-gate.com/products/reflector/

And ofcourse for Infini a tip: (if he doesn't want his code to be decompiled)
http://msdn.microsoft.com/en-us/library/ms227240.aspx

little help here guys i'm trying to use pbguidchecker with key2pb the guid checker works fine, but key2pb doesnt give me the right 32 char guid whats the seed i need to use with CoD4?. i even tried no seed for all possible ones none matched the guid that pb gave me..so?? little help please

Matt, use Luigi's key2pb tool with the seed 0x00b684a3, first 16 characters of the full cd-key, no dashes. So for example on cdkey ABCD-1234-DEFG-5678-HIJL:

key2pb.exe ABCD1234DEFG5678 0x00b684a3

Hey i tried the seed 0x00b684a3 and it doesn't give the the right Guid. the guid i get is 5c594dc395f6e2c46ed1a3b6686767b8, when the one i should be getting is 1e5e03822fd7853fe73e8d76021b9758

nvm, i didn't use the 1st 16chars of the key, thanks SomaFM

Luigi whether it is possible to recover the cd-key from a file "mpdata" or other?

no, I guess it's technical impossibile, even knowing the original mpdata file (that we know since it's usually composed by various zeroes at the beginning).
it's a custom xtea + md4 hmac algorithm, so in any case the key is used only for the hash (key->hash, NOT hash->key)