This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=16976

zhiqieou, posted Tue Jun 07, 2022 4:38 am (71886)

---

Because the files are encrypted so AssetStudio error
please

https://drive.google.com/file/d/1qqR-FM ... sp=sharing

einherjar007, posted Tue Jun 07, 2022 6:52 am (71887)

---

Chinese title: ???

This is an encryption method that has become very common in recent Chinese games.
0xA6 XOR is used after the res information, and then 0x1000 bytes or so are encrypted using some other encryption method.
There was a previous thread on Xentax asking about Abyss Horizon encryption, and presumably the encryption method is similar to that.

What these games have in common is that il2cpp is obfuscated through some process.
It is not encryption; tools such as il2cppdumper are not available.
Presumably, they are using encryption support such as virbox. The encryption of the asset is also probably an effect of that.

If we can do a RAM dump, you may be able to get it from there,
but Chinese games block gameplay from outside of China, so I can't get a confirmation.

zhiqieou, posted Tue Jun 07, 2022 8:22 am (71888)

---

einherjar007 wrote:

Chinese title: ???

This is an encryption method that has become very common in recent Chinese games.
0xA6 XOR is used after the res information, and then 0x1000 bytes or so are encrypted using some other encryption method.
There was a previous thread on Xentax asking about Abyss Horizon encryption, and presumably the encryption method is similar to that.

What these games have in common is that il2cpp is obfuscated through some process.
It is not encryption; tools such as il2cppdumper are not available.
Presumably, they are using encryption support such as virbox. The encryption of the asset is also probably an effect of that.

If we can do a RAM dump, you may be able to get it from there,
but Chinese games block gameplay from outside of China, so I can't get a confirmation.

How do I do a RAM dump?

zhiqieou, posted Tue Jun 07, 2022 10:15 am (71891)

---

The complete APK of ??? has been uploaded
https://drive.google.com/file/d/1izvvJ4 ... sp=sharing

einherjar007, posted Tue Jun 07, 2022 12:28 pm (71892)

---

Game Guardian can be used for dump. If you want to check if the decrypted data exists in RAM, the fastest way is to check the binary data of the process with HxD, but it is difficult to judge without some knowledge.

zhiqieou, posted Tue Jun 07, 2022 11:06 pm (71897)

---

einherjar007 wrote:

Game Guardian can be used for dump. If you want to check if the decrypted data exists in RAM, the fastest way is to check the binary data of the process with HxD, but it is difficult to judge without some knowledge.

thank you