This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=2692

Shine, posted Tue Jun 28, 2016 9:31 am (14855)

---

I need help on unpack this mobile game call ?????(MxM)
website: http://mxm.qq.com/

sample: https://mega.nz/#!GpkDSRDK!Bz3y5P_No_eH ... UZrUQxewB0

aluigi, posted Tue Jun 28, 2016 11:21 am (14861)

---

This format doesn't have much sense, probably it's encrypted and chunked.

If someone wants to work on it this is a debug work-in-progress script (NOT FOR USERS):

Code:

idstring "whpackage1.0"
padding 16
get DUMMY long
get ALIGN long
get ZERO long
get DUMMY long
getdstring HASH 16
padding ALIGN
get DPK_SIZE asize
do
    get ZERO long
    if ZERO == 0
        get DUMMY1 long
        get DUMMY2 long
        get DUMMY3 long
        get DUMMY4 long
        padding 16
        getdstring NAME 16
        getdstring HASH 16
        get ZERO long
        get DUMMY5 long
        get DUMMY6 long
        get DUMMY7 long
    else
        get DUMMY long
    endif
    padding ALIGN
    savepos TMP
while TMP != DPK_SIZE

Shine, posted Fri Jul 01, 2016 7:55 am (14933)

---

I did some research base on your format and I am sure each file is divided by 0x400 size.

example1: at 0x5800 after "whsc1.0" 16-bytes header, then 16-bytes hash.
after that a 32-bits integer 0? then Uncompressed size(0x8F3)? Compressed size(0x304) and unknown
so the uncompressed data start at 0x5850 to 0x5B54




example2: at 0x1A4C00 Uncompressed size = 0xAFB7 , Compressed size = 0x1F58
since Compressed size > 0x400. So it is divided into 8 block
1 block start at 0x1A4C50 and it had 0x3B0 (0x400 - 0x50 header, etc)
2 block start at 0x1A5000 with 8 bytes indexs (previous block and next block?)
so it had 3F8 bytes of Compressed data
3 block start at 0x1A5400 also with 8 bytes indexs and 3F8 bytes of Compressed data

7 block start at 0x1A6400 also with 8 bytes indexs and 3F8 bytes of Compressed data
8 block start at 0x1A6800 with 8 bytes indexs (previous block and 0(no next block)) and 0x3D8 bytes of Compressed data

total 3B0 3F8 3F8 3F8 3F8 3F8 3F8 3D8 = 1F58

but I cannot found the compression method. Please help.

aluigi, posted Fri Jul 01, 2016 8:53 am (14936)

---

If it's encrypted you have to decrypt first and then understanding what compression it uses.

Ekey, posted Fri Jul 01, 2016 10:30 am (14937)

---

Upload the apk file.

Shine, posted Fri Jul 01, 2016 10:59 am (14938)

---

Thanks aluigi and Ekey
Here is the apk: https://mega.nz/#!m8VA3arL!PWzH6wegYM1y ... Sxzei7O_No

Ekey, posted Fri Jul 01, 2016 11:48 am (14940)

---

Unfortunately, that is all I could find

Code:

byte_750CA0 = 0;

aThisIsMyikeyex DCB "This is MyIKeyExchanger to generate a new key pair",0

  do
  {
    *((_BYTE *)&byte_750CA0   v5) = aThisIsMyikeyex[v5];
      v5;
  }
  while ( v5 != 32 );
  
int __fastcall sub_4994E4(int a1, int a2)
{
  int v2; // r3@1
  int j; // r2@1
  int v4; // r4@2
  char v5; // r5@2
  char v6; // r12@2

  v2 = a1   35;
  j = 0;
  do
  {
    v4 = a1   j;
    v5 = byte_750CA0[j];
    v6 = *(_BYTE *)(a2   j  );
    *(_BYTE *)(v2     1) = v5 ^ v6 ^ *(_BYTE *)(v4   4);
  }
  while ( j != 32 );
  return 0;
}

Code:

whcmn15WHCompress_ZLib
whcmn15WHCompress_GZip
whcmn17ICryptFactory_CSM10MyICryptor
whcmn17ICryptFactory_CSM15MyIKeyExchanger

Code:

key123456