This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=17379

LinkOFF, posted Sun Sep 04, 2022 9:00 am (73321)

---

Hello. I'm trying to extract english locale from Soul Hackers 2 but most of message files are encrypted. I tried to pick up xor key but it's not help or i doing it wrong (i think it must be a UnityFS magic in header). Game compiled by il2cpp.
Examples of files - https://drive.google.com/file/d/1p47-bO ... sp=sharing

I found hashes inside En file. They are the same as hash in .manifest files.
Also i decompile metadata and found a few methods. I not sure but it looks like asset loading method with decryption by psw and salt (AtLib.dll). Is this AES?

Code:

// RVA: 0x9B9EE0 Offset: 0x9B94E0 VA: 0x1809B9EE0
   public static AtMessageResource Load(string package, string password, byte[] salt, UnityAction action) { }

Franco, posted Sun Sep 04, 2022 6:42 pm (73327)

---

Not in Resources.assets?

spiritovod, posted Mon Sep 05, 2022 4:32 pm (73346)

---

@LinkOFF: From the first glance it looks like common method for many unity games, when aes key and iv (if any) are derived from password and salt via PasswordDeriveBytes or Rfc2898DeriveBytes and then data is decrypted. Password for external bundles is probably "lAZr7V4e", while salt is "_bKo" - but apparently salt is derived too via appending it to file name (so for common it would be "common_bKo").
Though not sure if there are no additional modifications inside decrypt function - last time I was digging into such stuff in a unity game, I just gave up and grabbed key with iv at runtime in debugger, but that game was less protected.

You can take a look at some references in those topics:
viewtopic.php?f=13&t=13947
viewtopic.php?t=14660