This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=2100

shadow_lonely, posted Fri Feb 05, 2016 11:22 am (11219)

---

Hi everyone! This game just released. Maybe *.xfbin are compressed by new method.

Here is example file:
https://drive.google.com/file/d/0B44CD2 ... sp=sharing

Thanks for anyhelp!

Panzerdroid, posted Fri Feb 05, 2016 2:44 pm (11221)

---

Some CPK files can be extracted, but most of the content seems to be encrypted

offset filesize filename
--------------------------------------
000000000003c000 4101954 data/boss/02/b0202_bkkx_anm.xfbin

-------------------
*EXCEPTION HANDLER*
-------------------
An error or crash occurred:

*EH* ExceptionCode 80000001 guard page violation
*EH* ExceptionFlags 00000000
*EH* ExceptionAddress 013a3740
01380000 00023740 quickbms_4gb_files.exe
*EH* NumberParameters 00000002
*EH* 00000000
*EH* 06b5c9e6

*EH* Stack Trace:
0x13a3740 : quickbms_4gb_files.exe : [unknown file]
0x13d1934 : quickbms_4gb_files.exe : [unknown file]
0x13e96b3 : quickbms_4gb_files.exe : [unknown file]
0x13f43f7 : quickbms_4gb_files.exe : [unknown file]
0x14266fd : quickbms_4gb_files.exe : [unknown file]
0x1425bd4 : quickbms_4gb_files.exe : [unknown file]
0x141f031 : quickbms_4gb_files.exe : [unknown file]
0x1425e8e : quickbms_4gb_files.exe : [unknown file]
0x142660f : quickbms_4gb_files.exe : [unknown file]
0x19425e8 : quickbms_4gb_files.exe : tripledes_LTX__mcrypt_algorithm_version
0x13810fd : quickbms_4gb_files.exe : [unknown file]
0x77a59ed2 : C:\Windows\SysWOW64\ntdll.dll : RtlInitializeExceptionChain
0x77a59ea5 : C:\Windows\SysWOW64\ntdll.dll : RtlInitializeExceptionChain

Last script line before the error or that produced the error:
154 clog file_name file_offset file_size extract_size

Luigi, I can provide you with an EXE, if you think that decryption key could be hidden in there.

aluigi, posted Fri Feb 05, 2016 3:34 pm (11223)

---

I stay away from encrypted cpk

Panzerdroid, posted Fri Feb 05, 2016 4:32 pm (11225)

---

aluigi wrote:

I stay away from encrypted cpk

Sad

AnonBaiter, posted Fri Feb 05, 2016 5:06 pm (11226)

---

Panzerdroid wrote:

aluigi wrote:

I stay away from encrypted cpk

Sad

Encrypted .cpk archives are sometimes harder to sort out than unencrypted ones. Case in point: the .cpk from the PS3 remaster of Okami couldn't even extract some files correctly.

shadow_lonely, posted Fri Feb 05, 2016 11:59 pm (11231)

---

I thinks real text stored in patch folder, messageInfo.bin with other encrypt, start with "CRILAYLA?-" in per files.
https://drive.google.com/file/d/0B44CD2 ... sp=sharing

Dakilla, posted Sat Feb 06, 2016 7:20 pm (11259)

---

I tried every idea I had to decrypt this stuff, since it does not look like I can do this on my own at all
I'm telling you everything I know and asking for help...

I'm almost absolutely certain this is some sort of byte for byte operation encryption, that's because every encrypted file starts with the same exact Hexadecimals

Code:

8F CF 31 40 76 41 95 D1

which after decrypted with whatever substitution method translates to

Code:

43 52 49 4C 41 59 4C 41 -> CRILAYLA

At first, I thought this would be an XOR encryption and that if I could find the key then it would work...
I have 4 files in the attachments that are basically the same version of 2 files, but one encrypted and another decrypted...
XORing the 2 pairs of files, I would assume that both xor file results would at least share a resemblence and that I could find the XOR key that way but not really.

I'm attaching the files to this post so anyone can try and see if they can break the encryption and tell me how...if not, at least point me in the direction of commonly simple used encryption methods other then XOR so I can see if I can find it myself

Note : The encrypted and decrypted files aren't 100% identical but if you correctly decrypt the encrypted file, you should end with a close enough file to the decrypted I sent you (maybe 99%)
The reason for that is that the decrypted version is a copy of the encrypted one patched with a few changes (the game reads the patched files first rather then the originals)

KCMaster, posted Sat Feb 06, 2016 11:55 pm (11267)

---

Hey guys, I'm totally new to the forum, but I found some bytes out there that I think would be useful

they are: 9F 07 E1 F1 BE D5 3B 89 1F 22 5C 68 ED DF 59 C7

I am a modder for the NUNS Saga games so I'll do anything possible to help to decrypt s4's files.

EDIT: These bytes were found during a decryption of a PS3 game

aluigi, posted Sun Feb 07, 2016 12:03 am (11268)

---

As far as I know CRILAYLA is a compression which is available in quickbms as comtype cpk.
It's the same algorithm that is used in the CPK archives.
Anyway here it doesn't work (crash) for some unknown reasons:

Code:

comtype cpk
idstring "CRILAYLA"
get SIZE long
get ZSIZE long
savepos OFFSET
clog "out.dat" OFFSET ZSIZE SIZE

Dakilla, posted Sun Feb 07, 2016 12:40 am (11271)

---

aluigi wrote:

As far as I know CRILAYLA is a compression which is available in quickbms as comtype cpk.
It's the same algorithm that is used in the CPK archives.
Anyway here it doesn't work (crash) for some unknown reasons:

Code:

comtype cpk
idstring "CRILAYLA"
get SIZE long
get ZSIZE long
savepos OFFSET
clog "out.dat" OFFSET ZSIZE SIZE

Hmm, i may be wrong but I think you misunderstood me

The issue here is not decompress the CRILAYLA... That can already be done with a few tools...
The main problem is decrypting the file from it's original encrypted version "ia_common_script_encrypted.xfbin" to the decrypted and decompressable version "ia_common_script_Decrypted.xfbin"

The file is just one : "ia_common_script.xfbin" and it is encrypted by default, I just managed to get a copy of it decrypted that happened to be in another .cpk and wanted help to figure out the decryption method

aluigi, posted Tue Feb 16, 2016 5:36 pm (11463)

---

http://aluigi.org/bms/naruto_uns4.bms

shadow_lonely, posted Wed Feb 17, 2016 1:21 am (11477)

---

aluigi wrote:

http://aluigi.org/bms/naruto_uns4.bms

Nice!

shadow_lonely, posted Sat Feb 04, 2017 9:48 am (20604)

---

aluigi wrote:

http://aluigi.org/bms/naruto_uns4.bms

I think the files have a new decryption key. Could you update it? Thanks!
Example file: http://www.mediafire.com/file/19e1u2zb9 ... .bin.xfbin

shadow_lonely, posted Sat Feb 11, 2017 4:36 am (20766)

---

A part of text data (I dumped from ram memory), hope can help! Another, I can't read.
Example: https://drive.google.com/file/d/0B6Dq8e ... sp=sharing

sergop, posted Wed May 22, 2019 5:55 pm (47948)

---

I found this script but it doesn't work on the latest version of the game. Can anyone edit it? I've included a file from the latest archive.