This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=1756

TRDaz, posted Wed Nov 11, 2015 7:30 am (9596)

---

Would anyone have any idea how to decrypt these files? These are from a Unity game, One Piece Dance Battle, the files within the apk are completely fine, the extra data that is downloaded when the game is launched is just these .fe files that seem to be encrypted.

TRDaz, posted Fri Nov 13, 2015 10:13 am (9666)

---

Can anyone help with this? I tried using the comtype scanner to see if it was compressed but I couldn't tell which compression algorithm is the one is used. I would have used the encryption scanner but I don't know the key used. I can upload more samples if needed. There is also some .so files for criware that I have, those may help in some way.

aluigi, posted Fri Nov 13, 2015 5:07 pm (9674)

---

Tried a scan from offset 0x30 but nothing.
Probably it's encrypted with blowfish or *tea (or even aes with the size specified there which is the real unaligned size).

TRDaz, posted Fri Nov 13, 2015 6:06 pm (9675)

---

Is there any chance of decrypting it or isn't it possible?

aluigi, posted Fri Nov 13, 2015 6:21 pm (9677)

---

If someone has desire and time to check the executable, sure

TRDaz, posted Fri Nov 13, 2015 6:23 pm (9678)

---

Oh I see, thanks for checking the file though!

Ekey, posted Fri Nov 13, 2015 8:58 pm (9682)

---

It's AES/128/CBC. IV you can get from encrypted files at offset 0x20. For each file is different key. Key you can take from packlist file. Encrypted data begins at offset 0x30. GZip used as compression.

Packlist format for each entry.

Code:

    GROUP,
    FE_MD5,
    FE_DECODE_KEY, -> AES key
    FILENAME_MD5,
    DATE,
    TIME,
    FILENAME

aluigi, posted Fri Nov 13, 2015 9:09 pm (9683)

---

@TRDaz
can you provide the Packlist file?

TRDaz, posted Fri Nov 13, 2015 11:45 pm (9688)

---

I'm not entirely sure which the packlist file is.

TRDaz, posted Sat Nov 14, 2015 8:39 am (9694)

---

Mhm I assume the packlist is just .packlist. I don't seem to have that file, I'll try to locate it.

Ekey, posted Sat Nov 14, 2015 9:01 am (9696)

---

This file must be ~100-300kb in plain text format, located in OBB cache or on SDCard if you have installed game on your device.

TRDaz, posted Sat Nov 14, 2015 9:20 am (9701)

---

I'll take a look, the game doesn't store extra data in an OBB and hides the files rather well on the SDCard.

Ekey, posted Sat Nov 14, 2015 9:38 am (9703)

---

Look for a folder com.bandainamcogames.onepiecedancebattle

Ekey, posted Sat Nov 14, 2015 10:26 am (9706)

---

I found this file.

iOS

Code:

https://opa-dance-channel-or-jp.s3.amazonaws.com/PackedResource_MTX/iOS/ios_list.dat

Android

Code:

https://opa-dance-channel-or-jp.s3.amazonaws.com/PackedResource_MTX/Android/android_list.dat

aluigi, posted Sat Nov 14, 2015 11:06 am (9710)

---

I tried both the list files but the output file is not decrypted correctly:
*edit*

Ekey, posted Sat Nov 14, 2015 11:59 am (9717)

---

No ideas > http://pastebin.com/FqDjvmrh

aluigi, posted Sat Nov 14, 2015 12:17 pm (9719)

---

Do you mean that you have tried that code with the key d41faf462c3d6ef2 (from android_list.dat) with the file provided by TRDaz, and you get the correct result?

Ekey, posted Sat Nov 14, 2015 12:25 pm (9720)

---

Did I say that I got the correct result? I just shared info about encryption.

aluigi, posted Sat Nov 14, 2015 12:28 pm (9721)

---

ah ok. so it's simply possible that such file has not been encrypted with that key and my script is correct.
In the meantime I put the script online because I don't see errors in it:
http://aluigi.org/bms/one_piece_dance_battle.bms

Ekey, posted Sat Nov 14, 2015 12:42 pm (9723)

---

Anyway output file has the strange data.

TRDaz, posted Sat Nov 14, 2015 11:29 pm (9733)

---

I have found a different list.dat file within the files. It doesn't seem to have the same format as the android_list.dat linked above.
This is the one I found.
https://www.sendspace.com/file/5utoi6
I've tested the current script with the list file linked by Ekey and some of the files outputted are openable with Unity Studio so it is probably correct, I am going to test the script on all .fe files and see if I can find any files that holds models.

EDIT: The script works perfectly! Thank you so much! There are files that outputs "Asset_MC####" files that contain models and textures!

aluigi, posted Sun Nov 15, 2015 12:53 am (9737)

---

Code:

EDIT: The script works perfectly! Thank you so much! There are files that outputs "Asset_MC####" files that contain models and textures!

Cool

Ekey, posted Sun Nov 15, 2015 9:49 am (9754)

---

Well, ok

Golubowski, posted Sun Jan 03, 2016 6:28 pm (10689)

---

TRDaz wrote:

EDIT: The script works perfectly! Thank you so much! There are files that outputs "Asset_MC####" files that contain models and textures!

have you extracted the models? if yes, can you upload them pls?