1

I'm looking to edit League of Legends's WAD files, but the developers of the game have recently decided to add a sort of hash to these files to check if their content is valid. Unfortunately, no one has been able to crack the code yet. I'm hoping someone might have at least an idea on what it could be.

Here are a few files that I extracted (the ones in the "old" directory are older files that also have a hash that you can use for comparison): https://drive.google.com/file/d/0B5fV4q6wLg7bTUE2VHc5aW5Ca00

The unknown "hash" value is bytes 4 to 87 (84 bytes long). I looked at this GitHub project to get started, but the person that wrote the code does not seem to know what that header means either. What I also found odd about the header is that it seems to vary in length (the end is padded with a different amount of null values in some files). At first I thought they might be using a variant of SHA or another hashing algorithm, but I'm no longer sure if that is the case because of the varying length, and I am definitely not a hashing professional.

If it helps, you can also download the "Wooxy" program, a League of Legends file extractor/editor program, to extract, edit, and update the game files yourself.

Even if you don't know the exact answer, any bit of help is highly appreciated!

EDIT: This is what appears in the game's log when it attempts to load an edited WAD file:

000036.460|  ERROR| ?:0: attempt to call global 'GetHashedGameObjName' (a nil value)
000037.499| ALWAYS| Begin Game Object Update
000037.936| ALWAYS| WadFile mount: DATA/FINAL/Champions/Chogath.wad (FAILED)
000037.937| ALWAYS| Riot::RADS::Reader::SignalSoftRepair: Wrote soft repair file to C:/Riot Games/League of Legends/RADS/solutions/lol_game_client_sln/releases/0.0.1.163/SOFT_REPAIR. This will cause the patcher to repair your installation.
000037.937|  ERROR| Assertion failed!

Expression: ALE-18967997

Description: FATAL ERROR - WadFile mount failed: Champions/Chogath.wad
000039.411|  ERROR| Crash Occurred

EDIT 2: There also seems to be an unknown value between bytes 88 and 95 (8 bytes long). Changing the bytes doesn't seem to crash the game, though.

EDIT 3: I found out that the header looks like it's separated into 2 parts. Byte 4 indicates the total length of the header (without 00 padding). Byte 8 indicates the length of the first "chunk". After that amount of bytes, there is a 02, and the byte after that indicates the length of the second "chunk". After that second bit, there are 00s until byte 87.

Improve this question
2
  • So you're basically trying to solve this by black-box only? Did you try to look at the WAD loading part in the binary?
    – user2823000
    Mar 1, 2017 at 17:43
  • Unfortunately, yes, since I'm not sure exactly how to go about decompiling/reverse engineering the game's binaries. Also, these files are themselves stored in archives, so I'm not sure it would even be possible to look at how they are loaded through procmon or something similar.
    – Nicolas Gnyra
    Mar 2, 2017 at 2:10

1 Answer 1

Reset to default
1

Turns out the header is actually a ECDSA public key and signature, so, according to what I've read, it's basically impossible to modify the file without re-signing it with the private key (which I do not have).

Improve this answer
2
  • Is the check made on the client side or the server side? If it's the former, it should be possible to bypass the check
    – user2823000
    Mar 2, 2017 at 23:56
  • I think it's made on the client side since, if I understand how they formatted the file, there are two parts to the header: the public key and the signature. The client checks the file by using these two values.
    – Nicolas Gnyra
    Mar 3, 2017 at 0:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.