This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=16682

ManGuy12, posted Sat Mar 19, 2022 8:25 pm (70610)

---

Game: CYOA Cat up a tree (NSFW Warning)
Trying to access this game's files but it's encrypted in an "archive.vna" file?
This game runs on .NET Core 3.1 so it was easy to decompile but the encryption algorithm went over my head.
I looked everywhere to figure this out but I'm not sure if I can do it.
Thanks in advance!

UH-VNV-CYOA2-Portable.7z

spiritovod, posted Sun Mar 20, 2022 1:34 am (70612)

---

Here are two scripts for decrypting vna container: quickbms adaptation (very ineffective and works correctly only with 32-bit quickbms, but easy to understand) and with native code through calldll function (recommended).
P.S. It's actually a good example for RE beginners, kinda recommended to dig into it for learning basic stuff.

Update: Extracting functionality added to calldll version of the script. Note that output folder must be the same as input folder, otherwise you'll get error.

cyoa2_decrypt_extract.zip

ManGuy12, posted Sun Mar 20, 2022 3:25 am (70613)

---

spiritovod wrote:

Here are two scripts for decrypting vna container: quickbms adaptation (very ineffective and works correctly only with 32-bit quickbms, but easy to understand) and with native code through calldll function (recommended).
P.S. It's actually a good example for RE beginners, kinda recommended to dig into it for learning basic stuff.

Yeah the first script runs slow for me, the second one I'm not sure if it's working. I'm getting these warnings.

Code:

:36: warning: implicit declaration of function 'malloc'
:37: warning: implicit declaration of function 'memcpy'
:44: warning: implicit declaration of function 'free'

It does spits out a decrypted file but doesn't extract the files?
Or is that something I'm supposed to figure out?

spiritovod, posted Sun Mar 20, 2022 12:15 pm (70619)

---

Those warnings are normal thing for this case. I've updated calldll version of the script with extraction functionality in my post above. All images in the archive are named as png, but some of them are actually bmp/gif - most editors can handle wrong headers though.

ManGuy12, posted Sun Mar 20, 2022 2:53 pm (70622)

---

spiritovod wrote:

Those warnings are normal thing for this case. I've updated calldll version of the script with extraction functionality in my post above. All images in the archive are named as png, but some of them are actually bmp/gif - most editors can handle wrong headers though.

Worked like a charm. Thank you very much!