[Dismounted]

You've already found the formula...fetch_session_hash(). Simply trace back the constants.

TIMENOW

PHP Code:

define('TIMENOW', time()); 


SCRIPTPATH

PHP Code:

if ($_SERVER['PATH_INFO'] OR $_ENV['PATH_INFO'])
{
    $scriptpath = $_SERVER['PATH_INFO'] ? $_SERVER['PATH_INFO'] : $_ENV['PATH_INFO'];
}
else if ($_SERVER['REDIRECT_URL'] OR $_ENV['REDIRECT_URL'])
{
    $scriptpath = $_SERVER['REDIRECT_URL'] ? $_SERVER['REDIRECT_URL'] : $_ENV['REDIRECT_URL'];
}
else
{
    $scriptpath = $_SERVER['PHP_SELF'] ? $_SERVER['PHP_SELF'] : $_ENV['PHP_SELF'];
}

if ($_SERVER['QUERY_STRING'] OR $_ENV['QUERY_STRING'])
{
    $scriptpath .= '?' . ($_SERVER['QUERY_STRING'] ? $_SERVER['QUERY_STRING'] : $_ENV['QUERY_STRING']);
}

$quest_pos = strpos($scriptpath, '?');
if ($quest_pos !== false)
{
    $script = urldecode(substr($scriptpath, 0, $quest_pos));
    $scriptpath = $script . substr($scriptpath, $quest_pos);
}
else
{
    $scriptpath = urldecode($scriptpath);
}

define('SCRIPTPATH', preg_replace('/(s|sessionhash)=[a-z0-9]{32}?&?/', '', $scriptpath)); 


SESSION_IDHASH

PHP Code:

$alt_ip = $_SERVER['REMOTE_ADDR'];

if (isset($_SERVER['HTTP_CLIENT_IP']))
{
    $alt_ip = $_SERVER['HTTP_CLIENT_IP'];
}
else if (isset($_SERVER['HTTP_X_FORWARDED_FOR']) AND preg_match_all('#\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}#s', $_SERVER['HTTP_X_FORWARDED_FOR'], $matches))
{
    foreach ($matches[0] AS $ip)
    {
        if (!preg_match("#^(10|172\.16|192\.168)\.#", $ip))
        {
            $alt_ip = $ip;
            break;
        }
    }
}
else if (isset($_SERVER['HTTP_FROM']))
{
    $alt_ip = $_SERVER['HTTP_FROM'];
}

$alt_ip = implode('.', array_slice(explode('.', $alt_ip), 0, 3));

define('SESSION_IDHASH', md5($_SERVER['HTTP_USER_AGENT'] . $alt_ip)); 


SESSION_HOST

PHP Code:

define('SESSION_HOST', $_SERVER['REMOTE_ADDR']); 


SESSIONHASH

PHP Code:

$sessionhash = md5(TIMENOW . SCRIPTPATH . SESSION_IDHASH . SESSION_HOST . vbrand(1, 1000000));