A golang implementation of Redline99's x-value decryption code

xval.go

package xval

import (
    "bytes"
	"crypto/des"
	"crypto/hmac"
	"crypto/sha1"
	"encoding/binary"
	"encoding/hex"
	"errors"
	"fmt"
	"strings"
)

const FlagNone = 0
const (
	FlagAuthExFailure           = 1 << iota
	FlagAuthExNoTable           = 1 << iota
	FlagAuthExReserved          = 1 << iota
	FlagInvalidDVDGeometry      = 1 << iota
	FlagInvalidDVDDMI           = 1 << iota
	FlagDVDKeyvaultPairMismatch = 1 << iota
	FlagCRLDataInvalid          = 1 << iota
	FlagCRLCertificateRevoked   = 1 << iota
	FlagUnauthorizedInstall     = 1 << iota
	FlagKeyvaultPolicyViolation = 1 << iota
	FlagConsoleBanned           = 1 << iota
	FlagODDViolation            = 1 << iota
)

func DecryptXVal(serial, xval string) ([]byte, []byte, error) {
	if strings.Contains(xval, "-") {
		xval = strings.Replace(xval, "-", "", -1)
	}
	if len(xval) != 16 {
		return nil, nil, errors.New("Invalid X value. Without dashes, length is not 16")
	}
	if len(serial) != 0xC {
		return nil, nil, errors.New(fmt.Sprintf("Invalid console serial number. Length is not %d", 0xC))
	}

	mac := hmac.New(sha1.New, []byte(serial))
	mac.Write([]byte("XBOX360SSB"))
	desKey := mac.Sum(nil)[0:8]

	if len(desKey) != 8 {
		return nil, nil, errors.New(fmt.Sprintf("Error decrypting (invalid DES key length of %d). Key: %v", len(desKey), desKey))
	}

	xvalAsHex, _ := hex.DecodeString(xval)

	cipher, err := des.NewCipher(desKey)
	if err != nil {
		return nil, nil, err
	}
	cipher.Decrypt(xvalAsHex, xvalAsHex)
	return desKey, xvalAsHex, nil
}

func TextResult(dec []byte) []string {
	fmt.Printf("Decrypted xdata: %x\n", dec)
	var result []string

	buf := new(bytes.Buffer)
	buf.Write(dec[0:4])

	var l, h int32
	binary.Read(buf, binary.BigEndian, &h)
	buf.Reset()
	buf.Write(dec[4:8])
	binary.Read(buf, binary.BigEndian, &l)
	fmt.Println(h, l)

	if l == 0 && h == 0 {
		return []string{"Secdata is clean"}
	} else if l == -1 && h == -1 {
		return []string{"Secdata is invalid"}
	} else if l != 0 && h != 0 {
		return []string{"Secdata decryption error"}
	} else {
		if l&FlagAuthExFailure != 0 {
			result = append(result, "AuthEx challenge failure (AP 2.5 related)")
		}
		if l&FlagAuthExNoTable != 0 {
			result = append(result, "AuthEx table missing (AP 2.5 related")
		}
		if l&FlagAuthExReserved != 0 {
			result = append(result, "AuthEx reserved flag (AP 2.5 related)")
		}
		if l&FlagInvalidDVDGeometry != 0 {
			result = append(result, "Invalid DVD geometry")
		}
		if l&FlagInvalidDVDDMI != 0 {
			result = append(result, "Invalid DVD DMI")
		}
		if l&FlagCRLDataInvalid != 0 {
			result = append(result, "Invalid CRL data")
		}
		if l&FlagCRLCertificateRevoked != 0 {
			result = append(result, "CRL certificate revoked")
		}
		if l&FlagUnauthorizedInstall != 0 {
			result = append(result, "Unauthorized install")
		}
		if l&FlagKeyvaultPolicyViolation != 0 {
			result = append(result, "Keyvault policy violation")
		}
		if l&FlagConsoleBanned != 0 {
			result = append(result, "Console is banned")
		}
		if l&FlagODDViolation != 0 {
			result = append(result, "ODD violation")
		}
		if l&-0x7FFF != 0 {
			result = append(result, "Unknown violation(s)")
		}
	}
	return result
}