From f42ff48dd5d7ffc55e24fa868f30a00bc6cd24ce Mon Sep 17 00:00:00 2001 From: Prodaft <203627012+prodaftcatalyst@users.noreply.github.com> Date: Mon, 7 Jul 2025 15:42:48 +0200 Subject: [PATCH 1/2] Added castleloader hash --- algorithms/castle_loader.py | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 algorithms/castle_loader.py diff --git a/algorithms/castle_loader.py b/algorithms/castle_loader.py new file mode 100644 index 0000000..58cbca6 --- /dev/null +++ b/algorithms/castle_loader.py @@ -0,0 +1,22 @@ +DESCRIPTION = "Castle Loader API hash" +TYPE = "unsigned_int" +TEST_1 = 420894349 + + +def hash(data): + hash_val = 0xAAAAAAAA + is_odd = 0 + for _, char_val in enumerate(data): + curr_char = ord(char_val) + tmp = 0 + if (is_odd & 1) != 0: + val1 = (hash_val << 11) & 0xFFFFFFFF + val2 = (curr_char ^ (hash_val >> 5)) & 0xFFFFFFFF + tmp = (~(val1 + val2)) & 0xFFFFFFFF + else: + val1 = (hash_val << 7) & 0xFFFFFFFF + val2 = (curr_char * (hash_val >> 3)) & 0xFFFFFFFF + tmp = (val1 ^ val2) & 0xFFFFFFFF + hash_val = (hash_val ^ tmp) & 0xFFFFFFFF + is_odd += 1 + return hash_val From 39de4120134af0ddc9761c28e85e9161823032b3 Mon Sep 17 00:00:00 2001 From: Prodaft <203627012+prodaftcatalyst@users.noreply.github.com> Date: Wed, 16 Jul 2025 16:04:41 +0200 Subject: [PATCH 2/2] fix castleloader byte issue --- algorithms/castle_loader.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/algorithms/castle_loader.py b/algorithms/castle_loader.py index 58cbca6..7e477bb 100644 --- a/algorithms/castle_loader.py +++ b/algorithms/castle_loader.py @@ -6,8 +6,7 @@ def hash(data): hash_val = 0xAAAAAAAA is_odd = 0 - for _, char_val in enumerate(data): - curr_char = ord(char_val) + for _, curr_char in enumerate(data): tmp = 0 if (is_odd & 1) != 0: val1 = (hash_val << 11) & 0xFFFFFFFF