This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=299

Viserion, posted Sun Oct 26, 2014 1:12 pm (1214)

---

Hi guys,

Someone can help descrypt *.ecf? *.ecf is an file encrypted file of *.cfg

Download: https://mega.co.nz/#!98UEDJbR!dbE253cEJ ... PwN0vVKc_0

Thanks!

aluigi, posted Sun Oct 26, 2014 2:13 pm (1216)

---

In another game QQ used a charset based obfuscation (basically each char corresponds to a different one) and used also hexadecimal representation of the data.

Considering that it's for sure not a fixed xor/rot string (there is a file with sequences of 0xc4 bytes) and the range of these bytes it's ever above 0x80, I suspect they did something similar like that game also here.

Obviously I tried the same charset encryption of that game, but doesn't work here so it's different.

Viserion, posted Sun Oct 26, 2014 2:44 pm (1217)

---

.
Hi aluigi, maybe it help you?
http://pastebin.com/KSyg6GuM

aluigi, posted Sun Oct 26, 2014 3:15 pm (1219)

---

Yes it contains the obfuscation algorithm:
http://aluigi.org/papers/bms/others/qconfig.bms

Viserion, posted Sun Oct 26, 2014 3:33 pm (1220)

---

Thank you so much!
Now I can see the configuration files of the client. Just missing the *.ueni and *.tbl for me to completely manipulate the client.

Viserion, posted Mon Oct 27, 2014 11:14 am (1239)

---

*.tbl files are encripted files of *.csv

*.tbl examples: https://mega.co.nz/#!dp0mAYgT!cMXrrKj6W ... CxWgU4RVqY
Encription: http://pastebin.com/ii8yW8s4
Maybe is necessary the Rijndael (setkey): http://pastebin.com/jMqNL0zV

Thanks.

aluigi, posted Mon Oct 27, 2014 12:42 pm (1243)

---

That key is wrong.
I have updated the script just for supporting that file when a valid key will be provided

Viserion, posted Mon Oct 27, 2014 1:17 pm (1246)

---

.
Hi aluigi, thanks!
But .csv is still encripted.

aluigi, posted Mon Oct 27, 2014 1:18 pm (1247)

---

I told you that the key in that code is wrong.
No right key = no valid csv

Viserion, posted Mon Oct 27, 2014 1:22 pm (1248)

---

.
Oh sorry, i understand now.
But, this key is from old source code and i tried in unpack old version of *.tbl too and same problem.

*.tbl (old version): https://mega.co.nz/#!88NFWYbT!ord9Z_bT1 ... 1A5t8KER7I
*.tbl (current version): https://mega.co.nz/#!dp0mAYgT!cMXrrKj6W ... CxWgU4RVqY

aluigi, posted Mon Oct 27, 2014 1:26 pm (1249)

---

That's the only key available so I can do nothing.
If you have other keys, they are welcome.

Viserion, posted Mon Oct 27, 2014 1:28 pm (1250)

---

.
Try unpack this old version:
https://mega.co.nz/#!88NFWYbT!ord9Z_bT1 ... 1A5t8KER7I

Client automatically converts the .csv files to .tbl

aluigi, posted Mon Oct 27, 2014 1:47 pm (1251)

---

Are you 100% sure that the old client uses the same key of that source code?

Viserion, posted Mon Oct 27, 2014 1:56 pm (1252)

---

.
Yes, I compiled Client with this key and generate *.tbl with this key.

aluigi, posted Mon Oct 27, 2014 2:15 pm (1253)

---

Now I found the reason, the AES source code you provided doesn't correspond to the one used in that QDataTable.cpp ("setkey" doesn't exist).
Additionally it looks like it's customized and not the standard AES (pi and pj are a custom number of cycles).

Anyway if you have the source code, why don't you just fix and recompile it?

Viserion, posted Mon Oct 27, 2014 2:26 pm (1256)

---

.
AES source code you found here: http://pastebin.com/jMqNL0zV

I need decompile assets from client official.

Ekey, posted Mon Oct 27, 2014 2:42 pm (1259)

---

del.

Viserion, posted Mon Oct 27, 2014 3:47 pm (1266)

---

ueni.ueni use same encript too.

Ekey, posted Mon Oct 27, 2014 3:57 pm (1268)

---

Viserion wrote:

ueni.ueni use same encript too.

You provide only CPP source without including H files with defines. Anyway job done.

Code:

[Usage]
        QQXYTBLTool  [ ]
[Commands]
        -e - Encrypt
        -d - Decrypt
[Examples]
        QQXYTBLTool -d formula_table.tbl formula_table.csv
        QQXYTBLTool -e formula_table.csv formula_table.tbl

PS: Can you provide game link and game name?

QQXYTBLTool.rar

Viserion, posted Mon Oct 27, 2014 4:09 pm (1272)

---

@Ekey
Thanks Ekey, is working. A question, this method works too with ueni.ueni?
Topic(have ueni.ueni example and source code of PackUI): viewtopic.php?f=9&t=243

About game -
Name: QQ?? (or QQXY)
Web: http://qqxy.qq.com

Ragezone have old source code released.

--
I answered your pm.

Ekey, posted Mon Oct 27, 2014 4:22 pm (1274)

---

Viserion wrote:

@Ekey
Thanks Ekey, is working. A question, this method works too with ueni.ueni?
Topic(have ueni.ueni example and source code of PackUI): viewtopic.php?f=9&t=243

About game -
Name: QQ?? (or QQXY)
Web: http://qqxy.qq.com

Ragezone have old source code released.

--
I answered your pm.

Tool for ueni released later.

Ekey, posted Mon Oct 27, 2014 4:42 pm (1278)

---

Job doooooone! ;}

Code:

QXY UENI Tool
c) 2014 / Ekey (h4x0r) / v0.1a

Usage]
       QQXYUENITool  [ ]
Commands]
       -e - Encrypt
       -d - Decrypt
Examples]
       QQXYUENITool -d MY.ueni MY.ueni.dec
       QQXYUENITool -e MY.ueni.dec MY.ueni

QQXYUENITool.rar

Viserion, posted Tue Oct 28, 2014 7:49 pm (1329)

---

PS: Ekey is still working on the tool UENI.ueni, need to finish the function to extract the files to directory.