Found it in the ram! Finally.
This is the actual nextUInt64() func:
(The comments are refering to the the code in http://aluigi.org/bms/quake_champions.bms)Code: Select all
mov r8,rcx
mov rcx,27BB2EE687B0B0FD { -2018463491 }
mov rax,[r8] // ulong U
imul rax,rcx // U *= 2862933555777941757ULL
mov rcx,61C8864680B583BF
add rax,rcx // U += 7046029254386353087ULL
mov [r8],rax // save U
mov rdx,[r8+08] // RDX = ulong V
shr rdx,11 // V >> 17
xor rdx,[r8+08] // ^= V
mov rcx,rdx
shl rcx,1F // V << 31
xor rcx,rdx // ^= V
mov edx,FFFFDA61 // 4294957665U
mov rax,rcx
shr rax,08 { 8 } // V >> 8
xor rax,rcx // ^= V
mov [r8+08],rax // save V
mov rcx,[r8+10] // RCX = ulong W
mov eax,ecx
imul rdx,rax // ???!!!!
shr rcx,20 { 32 } // W >> 32
add rdx,rcx // W + ?!
mov [r8+10],rdx // save W
mov rcx,[r8] // RCX = ulong X (= U)
shl rcx,15 { 21 } // U << 21
xor rcx,[r8] // ^ U = X
mov rax,rcx // RAX = X
shr rax,23 { 35 } // X >> 35
xor rcx,rax // ^= X
mov rax,rcx // RAX = RCX
shl rax,04 { 4 } // X << 4
xor rax,rcx // ^= X
add rax,[r8+08] // (x + v)
xor rax,rdx // ^ w
ret
I tried to analyze it as good as I possibly could. I am lacking a lot of practice tho, as you may see
If I am not mistaken, they changed the line
Code: Select all
w = 4294957665U * (w & 0xffffffff) + (w >> 32);
to something like
Code: Select all
v ^= v >> 17;
ulong a = v; // rdx?
v ^= v << 31;
v ^= v >> 8;
ulong b = v; // rax?
w = (a * b) + (w >> 32); // a * b -> imul rdx, rax??
But what is happing to the 4294957665U constant?
This is a bit over my head actually, can someone back me up here please?
EDIT: This is the NrRandom() function, which contains iterations of NextUInt64() since NrRandom() calls it a few times:
Code: Select all
mov rax,38ECAC5FB3251641 { -1289415103 }
mov r8,rcx
mov [rcx+08],rax
mov qword ptr [rcx+10],00000001 { 1 }
mov rax,[QuakeChampions.NvOptimusEnablement+4A77E0] { [148F2BB98F0] }
test rax,rax
je QuakeChampions.apProcessExceptionDllCall+1D99A8
xor rdx,[rax]
mov rax,[rcx+08]
mov r11,27BB2EE687B0B0FD { -2018463491 }
xor rax,rdx
mov r10,61C8864680B583BF { -2135587905 }
imul rax,r11
mov r9d,FFFFDA61 { -9631 }
add rax,r10
mov [rcx],rax
mov rcx,[rcx+08]
shr rcx,11 { 17 }
xor rcx,[r8+08]
mov rdx,rcx
shl rdx,1F { 31 }
xor rdx,rcx
mov rax,rdx
shr rax,08 { 8 }
xor rax,rdx
mov [r8+08],rax
mov rcx,[r8+10]
mov eax,ecx
imul rax,r9
shr rcx,20 { 32 }
add rax,rcx
mov [r8+10],rax
mov rax,[r8]
mov [r8+08],rax
mov rax,[r8]
imul rax,r11
add rax,r10
mov [r8],rax
mov rcx,[r8+08]
shr rcx,11 { 17 }
xor rcx,[r8+08]
mov rdx,rcx
shl rdx,1F { 31 }
xor rdx,rcx
mov rax,rdx
shr rax,08 { 8 }
xor rax,rdx
mov [r8+08],rax
mov rcx,[r8+10]
mov eax,ecx
imul rax,r9
shr rcx,20 { 32 }
add rax,rcx
mov [r8+10],rax
mov rax,[r8+08]
mov [r8+10],rax
mov rax,[r8]
imul rax,r11
add rax,r10
mov [r8],rax
mov rcx,[r8+08]
shr rcx,11 { 17 }
xor rcx,[r8+08]
mov rdx,rcx
shl rdx,1F { 31 }
xor rdx,rcx
mov rax,rdx
shr rax,08 { 8 }
xor rax,rdx
mov [r8+08],rax
mov rcx,[r8+10]
mov eax,ecx
imul rax,r9
shr rcx,20 { 32 }
add rax,rcx
mov [r8+10],rax
ret
I've recently learned that r9 = r9d, so 4294957665U is in fact multiplied with W?
EDIT2: Here's everything I found in the memory (each function seperated, still messy):
https://pastebin.com/5TMBEQWS
Well, except for a heckton of 0x15 and 0x23 matches that didn't really get me any further