Reverse code check

Question

I'm currently only patching this code to return true, do you guys have any idea of how I could start making a generator to make valid codes? I can't understand the logic here.

  public static bool ValidateQrCode(string code)
    {
        if (code.Substring(0, 2) != "DC")
        {
            return false;
        }
        if (code.Length != 0x1a)
        {
            return false;
        }
        string s = code.Substring(2, 14);
        byte[] buffer1 = new SHA256Managed().ComputeHash(Encoding.UTF8.GetBytes(s));
        string str2 = ConvertToB36(Convert.ToInt32(buffer1[13])).PadLeft(2, '0');
        string str3 = ConvertToB36(Convert.ToInt32(buffer1[10])).PadLeft(2, '0');
        string str4 = ConvertToB36(Convert.ToInt32(buffer1[5])).PadLeft(2, '0');
        string str5 = ConvertToB36(Convert.ToInt32(buffer1[0x11])).PadLeft(2, '0');
        string str6 = ConvertToB36(Convert.ToInt32(buffer1[0x19])).PadLeft(2, '0');
        return ((((code.Substring(0x10, 2) == str2) && (code.Substring(0x12, 2) == str3)) && ((code.Substring(20, 2) == str4) && (code.Substring(0x16, 2) == str5))) && (code.Substring(0x18, 2) == str6));
    }
    public static string ConvertToB36(int value)
    {
        string str = "";
        while (value > 0)
        {
            str = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ"[value % 0x24].ToString() + str;
            value /= 0x24;
        }
        return str;
    }

Answer 1

Well the algo is quite simple, let's try to break it down:

if (code.Substring(0, 2) != "DC")

It has to start with DC

if (code.Length != 0x1a)

and be of length 26 chars

string s = code.Substring(2, 14);

byte[] buffer1 = new SHA256Managed().ComputeHash(Encoding.UTF8.GetBytes(s));

then take the 14 chars starting from third (skip DC) and calculate SHA256 on it.

After that the checks are (extracted)

string str2 = ConvertToB36(Convert.ToInt32(buffer1[13])).PadLeft(2, '0');

code.Substring(0x10, 2) == str2

so value on 13 index of SHA has to be equal (converted to BASE36) to 2 chars from the input starting from pos 16.

The rest of the checks are similar.

So your keygen would consist only the functions that you already has in the code.

So the general key is in this form (psudocode)

input = ""
sha = SHA256(input)
print "DC"+input+sha[13].encode('base36')+sha[10].encode('base36')+sha[5].encode('base36')+sha[17].encode('base36')+sha[25].encode('base36')