NdsModcryptTransform.cs

using System.Security.Cryptography;
 
#pragma warning disable CA5358 // CTR mode requires raw AES block encryption; ECB is not used to encrypt payload blocks.
 
namespace NdsForge;

internal sealed class NdsModcryptTransform : IDisposable
{
    private readonly Aes _aes;
    private readonly ICryptoTransform _encryptor;
    private readonly byte[] _aesKey;
    private readonly byte[] _counter;
    private readonly byte[] _aesCounter = new byte[NdsModcrypt.BlockSize];
    private readonly byte[] _keyStream = new byte[NdsModcrypt.BlockSize];
    private int _keyStreamIndex = NdsModcrypt.BlockSize;
    private bool _disposed;

    internal NdsModcryptTransform(ReadOnlySpan<byte> key, ReadOnlySpan<byte> initialCounter, long byteOffset)
    {
        _aes = Aes.Create();
        _aes.Mode = CipherMode.ECB;
        _aes.Padding = PaddingMode.None;
        _aesKey = key.ToArray();
        Array.Reverse(_aesKey);
        _aes.Key = _aesKey;
        _encryptor = _aes.CreateEncryptor();
        _counter = initialCounter.ToArray();
        AddBlocks(_counter, (ulong)(byteOffset / NdsModcrypt.BlockSize));
        int skip = (int)(byteOffset % NdsModcrypt.BlockSize);
        if (skip != 0)
        {
            GenerateKeyStream();
            _keyStreamIndex = skip;
        }
    }

    internal void Transform(ReadOnlySpan<byte> source, Span<byte> destination)
    {
        ObjectDisposedException.ThrowIf(_disposed, this);
        if (destination.Length < source.Length)
        {
            throw new ArgumentException("The modcrypt destination is shorter than the source.", nameof(destination));
        }
 
        for (int index = 0; index < source.Length; index++)
        {
            if (_keyStreamIndex == NdsModcrypt.BlockSize)
            {
                GenerateKeyStream();
                _keyStreamIndex = 0;
            }
 
            destination[index] = (byte)(source[index] ^ _keyStream[_keyStreamIndex++]);
        }
    }

    public void Dispose()
    {
        if (_disposed)
        {
            return;
        }
 
        _encryptor.Dispose();
        _aes.Dispose();
        CryptographicOperations.ZeroMemory(_aesKey);
        CryptographicOperations.ZeroMemory(_counter);
        CryptographicOperations.ZeroMemory(_aesCounter);
        CryptographicOperations.ZeroMemory(_keyStream);
        _disposed = true;
    }

    private void GenerateKeyStream()
    {
        for (int index = 0; index < _counter.Length; index++)
        {
            _aesCounter[index] = _counter[^(index + 1)];
        }
 
        _ = _encryptor.TransformBlock(_aesCounter, 0, _aesCounter.Length, _keyStream, 0);
        Array.Reverse(_keyStream);
        Increment(_counter);
    }

    private static void AddBlocks(Span<byte> counter, ulong blocks)
    {
        ulong carry = blocks;
        for (int index = 0; index < counter.Length && carry != 0; index++)
        {
            ulong sum = counter[index] + (carry & 0xFF);
            counter[index] = (byte)sum;
            carry = (carry >> 8) + (sum >> 8);
        }
 
        if (carry != 0)
        {
            throw new ArgumentOutOfRangeException(nameof(blocks), "The byte offset overflows the 128-bit modcrypt counter.");
        }
    }

    private static void Increment(Span<byte> counter)
    {
        for (int index = 0; index < counter.Length; index++)
        {
            counter[index]++;
            if (counter[index] != 0)
            {
                return;
            }
        }
    }
}
 
#pragma warning restore CA5358