Hashes

The hash is a segment commonly sent in requests, which is checked by the GD Client to ensure the validity of the request. This was added in 2.02 to combat GDPSes (GD Private Servers).

The hash is commonly generated by adding some segments from the response all into one string, then adding a salt and SHA-1 hashing it.

getGJLevels

For each level, add these segments:

• The first digit of the level ID
• The last digit of the level ID
• The stars the level awards
• The amount of coins in the level
• 0 if the level has unverified coins, 1 if verified

Salt: xI25fpAapCQg

downloadGJLevel

This endpoint has 2 hashes, the first of which is generated differently from most of the hashes.

downloadGJLevel Hash 1

This hash is generated from the undecoded level string by splitting the level string into 40 equal segments and taking 40 characters evenly, then adding the salt and SHA-1 hashing the result. Here’s a JS function that does just that:

function generateDownloadHash(levelString) {
    if (levelString.length < 41) return sha1(`${levelString}xI25fpAapCQg`);
    let hash = `????????????????????????????????????????xI25fpAapCQg`;
    let m = Math.floor(levelString.length / 40);
    let i = 40;
    while (i) {
        hash = hash.slice(0, --i) + levelString[i*m] + hash.slice(i+1);
    }
    return sha1(hash);
}

downloadGJLevel Hash 2

Segments:

• Player ID of the creator
• The stars the level awards
• 0 if the level is not demon, 1 if the level is demon
• The ID of the level
• 0 if the coins are unverified, 1 if verified
• The level’s feature score. 0 if not featured
• The level’s password (0 for no copy, 1 for free copy, and for any other password if the number is less than 1,000,000, add 1,000,000 to it)
• The level’s daily number (if the level was never daily or you don’t get a daily number from the response, just put 0)

Salt: xI25fpAapCQg

getGJMapPacks

For each pack, add these segments:

• The first digit of the pack ID
• The last digit of the pack ID
• The stars the pack awards
• The coins the pack awards

Salt: xI25fpAapCQg

getGJGauntlets

For each gauntlet, add these segments:

• The gauntlet ID
• The IDs of the levels in the gauntlet, separated by ,

Salt: xI25fpAapCQg

getGJChallenges

The hash just takes the entire undecoded response string (excluding the 5 characters appended to the front).

Salt: oC36fpYaPtdg

getGJRewards

The hash is generated the same way as getGJChallenges, with the exception of a different salt.

Salt: pC26fpYaQCtg

getGJLevelLists

This endpoint returns a hash, but since the GD client doesn’t check it, the way to generate this hash is unknown.