This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=3480

LDSTD, posted Sun Dec 04, 2016 1:10 am (19260)

---

I think this post related to viewtopic.php?f=9&t=3402

Homepage : http://hu.nexon.com/Main/Index

download : http://www.mediafire.com/file/yr84mo41h ... - Copy.rar

I think this files are just normal unity assets but I can't find any texture of models.

I need help : (

chrrox, posted Sun Dec 04, 2016 6:26 pm (19268)

---

They are encrypted.
This might help.
https://www.sendspace.com/file/8juar1

FileDecryptor.zip

chrrox, posted Mon Dec 05, 2016 1:38 am (19276)

---

not sure if this helps but I know this seems to pop up every where with this archive here
https://www.sendspace.com/file/x2nrnz

89ab2c01f06c64b48876e7c150221f07

this might be the aes key
according to the decryption it should be

aesManaged.BlockSize = 128;
aesManaged.KeySize = 128;
aesManaged.Mode = CipherMode.CBC;
aesManaged.Padding = PaddingMode.PKCS7;

here is a dump from ram looks like lzma?
https://www.sendspace.com/file/psd62c

chrrox, posted Sun Sep 17, 2017 8:12 pm (26581)

---

The files just have the first x bytes of the compressed section xored.
The xor key is the costumes name.
the file name is got from the model name also.
they jsut add some extra bytes like a checksum or something into the name.

OriginOfWaves, posted Mon Feb 05, 2018 3:09 pm (32217)

---

chrrox wrote:

The files just have the first x bytes of the compressed section xored.
The xor key is the costumes name.
the file name is got from the model name also.
they jsut add some extra bytes like a checksum or something into the name.

could you explain this process a bit more? how to figure out witch bytes are xored and which costume name is used for which file?

gorodork, posted Thu Mar 22, 2018 11:28 am (33501)

---

chrrox wrote:

The files just have the first x bytes of the compressed section xored.
The xor key is the costumes name.
the file name is got from the model name also.
they jsut add some extra bytes like a checksum or something into the name.

I'm also interested in this procedure. Could you explain a little more please?

kurupeko100, posted Tue Feb 25, 2020 6:00 pm (54247)

---

chrrox wrote:

The files just have the first x bytes of the compressed section xored.
The xor key is the costumes name.
the file name is got from the model name also.
they jsut add some extra bytes like a checksum or something into the name.

Hello, I need ur help
I have found the xored bytes ur talking about but I don't know how to get the xor key.
The costumes name you are talking about, I can't find it.
I am attaching the 2 example files I am trying to decrypt.
https://drive.google.com/file/d/1-qLdlp ... sp=sharing
I noticed that some files are related. See, these two files Im giving you have this: ?azgoka_ after the xored bytes


In short, I need ur help to find the xor key
Thank u a lot

chrrox, posted Thu Feb 27, 2020 10:23 am (54284)

---

those are not xored bytes.
that is just the cab name.
the ? part you have underlined is what needs to be xored.
here are the costume names for the bazooka character.
Bazooka_S2
Bazooka_S1
Bazooka_C1
Bazooka
It will be one of those keys.
Here is a list of strings to look for costume names in.
https://pastebin.com/Y7hykmxy

kurupeko100, posted Thu Feb 27, 2020 4:10 pm (54294)

---

chrrox wrote:

those are not xored bytes.
that is just the cab name.
the ? part you have underlined is what needs to be xored.
here are the costume names for the bazooka character.
Bazooka_S2
Bazooka_S1
Bazooka_C1
Bazooka
It will be one of those keys.
Here is a list of strings to look for costume names in.
https://pastebin.com/Y7hykmxy

I still haven't managed to make it. I attached this example file at the bottom of the post so you can download it
Sorry, I am very new at this. Here is what I am trying to do. Please tell me if something is wrong.
First I look for a character in the Pastebin you gave me. For this example I'm taking "TutorialGirl".



Now I do a file search with the last 3 digits from the reference on the pastebin, in the folder which has 506 encrypted files, like so:


I believe those 3 last digits point to the right file, but I'm not sure.

Now, supposing the xor key can be one of these:
TutorialGirl, TutorialGirl_C1, TutorialGirl_S1, or TutorialGirl_S2.

This is how I replace the xored bytes. I'm sure doing it wrong.

I have tried using this website I'm linking, and another one, but they haven't worked:
https://www.dcode.fr/xor-cipher

First I copy the hex value and then paste it on the website.




I follow those steps and get another hex value which I then paste in the hex editor.



Next, I save the file and open it with UABE.



I have tried all possible TutorialGirl, TutorialGirl_C1... combinations but I always get the error.

So to recap, the things I might be doing wrong are:
1. This "last 3 digit search" I am doing is wrong and doesnt point to the right file.
2. I am not choosing the right xored bytes.
3. I am not calculating well with the xor key, or the website doesn't work and I'm supposed to use other tools.
4. I am a noob

Thanks very much, a lot for ur help. And your patience.

The file is below. Also, here is the full game if you need to download it (3GB): https://drive.google.com/file/d/1UfnU6F0h1VCT0wu8zcEAczfyzSG4oHm0/view?usp=sharing

chrrox, posted Thu Feb 27, 2020 8:53 pm (54296)

---

you need to look at the file and search for the matching string.
in your example
,uemnofw
is the model
QueenOfWar
you need to lower case the model name
queenofwar
You can get the start of the model name by xoring the first 8 bytes of the name with
5D 00 00 08 00 00 00 00

kurupeko100, posted Thu Feb 27, 2020 9:45 pm (54301)

---

OK! I understand now. I would have never figured it out. You are an absolute genius, man
THANK YOU SO MUCH!

gorodork, posted Fri Apr 10, 2020 12:25 pm (55732)

---

I still can't get anything, what should I do after the XOR? Because in the end I just have a dead type of file that can't be extracted with any Unity Asset Extractor.

chrrox wrote:

you need to look at the file and search for the matching string.
in your example
,uemnofw
is the model
QueenOfWar
you need to lower case the model name
queenofwar
You can get the start of the model name by xoring the first 8 bytes of the name with
5D 00 00 08 00 00 00 00

Edit: OK! After a few hours trying to understand this stuff, I'm starting to comprehend it!
How do you know how to identify each file? Where did you find that ",uemnofw" equals "QueenOfWar"? And why did you XORed 10 bytes instead of 8?

joeyq1, posted Sat Apr 11, 2020 12:39 pm (55755)

---

Could anyone post a quick tutorial with steps on how to do this, or maybe a quickbms file which does this automatically? Thanks in advance!

gorodork, posted Sat Apr 11, 2020 7:34 pm (55766)

---

joeyq1 wrote:

Could anyone post a quick tutorial with steps on how to do this, or maybe a quickbms file which does this automatically? Thanks in advance!

Sure, you are going to need a hex editor and a XOR cipher. All the files inside the 0000 folder (probably) are unity assets and each one of them contains textures, 3d objects and animations of a specific hyper, but they are encripted and the character name was used as a key to do it.

The file we are going to use is abf44elykkwraeind2fde4d9d8c85a98d0956db520 because chrrox already told us previously that is the Queen of War file (athena). I don't know how to identify it by just looking at the hex information.

Now we need the confirmation that "queenofwar" is the correct key for this file and to do it we are going to XOR the first 8 bytes with the key (in this case "queenofwar" is the key) and see the result.

The first step is to open the abf44 file in hex editor and copy the first 8 bytes of this section


1 - paste the data in the https://www.dcode.fr/xor-cipher
2 - select ASCII key
3 - copy queenofwar and paste in it
4 - select result format in hexadecimal
5 - hit encrypt/decrypt
6 - copy the result of the XOR


That would be the correct file name but before we paste it back into the abf44 file we are going to confirm it by making another XOR.
1 - paste the result of the previous step in the INPUT II XOR calculator http://xor.pw/#
2 - go back into the abf44 file and copy again the first 8 bytes and paste int the INPUT I and hit Calculate XOR
3 - copy the result


Now you paste the result in the same section you first copied in the abf44 file, if it appears the correct name then you used the correct key


With that confirmation you just need to copy again the result in the second step and paste it in the abf44, but there is a catch! Instead of 8 bytes you need to copy the first 10 bytes, xor them and paste it back! This would be the correct file:


Now save it and you can use Asset Studio V.0.14 to open/extract the content


I added the encrypted and unencrypted files in the attachments so other people can try to reproduce the extraction. And I still don't know how to identify the characters by just looking at the hex information and there is a lot of hypers so I can't manually test the xor keys one by one until I find the correct one.

chrrox, posted Sun Apr 12, 2020 2:41 am (55787)

---

You can get the start of the model name by xoring the first 8 bytes of the name with
5D 00 00 08 00 00 00 00

then search the string list to find the name.

gorodork, posted Sun Apr 12, 2020 3:39 am (55788)

---

chrrox wrote:

You can get the start of the model name by xoring the first 8 bytes of the name with
5D 00 00 08 00 00 00 00
then search the string list to find the name.

Right! Thanks!

Well, after using this method I found out that the 1eb5d484cdf9c2ywr1hf1qho3effde9ac45f00def85 file its from the Kunoichi hyper.
After trying to XOR the first 8 bytes with kunoichi, kunoichi_c1 and kunoichi_s1, none of them worked so far.

What I'm doing wrong? The name lenght dictates how many bytes do I XOR? I tried that but it didn't work too.

chrrox, posted Sun Apr 12, 2020 11:43 am (55815)

---

its kunoichi_c2

einherjar007, posted Sun Apr 12, 2020 11:49 am (55816)

---

gorodork wrote:

chrrox wrote:

You can get the start of the model name by xoring the first 8 bytes of the name with
5D 00 00 08 00 00 00 00
then search the string list to find the name.

Right! Thanks!

Well, after using this method I found out that the 1eb5d484cdf9c2ywr1hf1qho3effde9ac45f00def85 file its from the Kunoichi hyper.
After trying to XOR the first 8 bytes with kunoichi, kunoichi_c1 and kunoichi_s1, none of them worked so far.

What I'm doing wrong? The name lenght dictates how many bytes do I XOR? I tried that but it didn't work too.

try kunoichi_c2. I can get a correct result.

It's interesting, so I download client data and try XOR.
ex, 0a3ec1bd05b28d335niwt3isn1ihfq0j4fed90aca3327951 is grandpatriach_s1.

but 0aaxrpknc16330f9a907665ec2fad88f2e8dc is probably filename(key)'s "boxer", but XOR did not give correct results.
Does the algorithm change depending on the length of the file name?

If we can play the game at least, can get the header by memory dump...

*EDIT
sorry, that is my misunderstanding. XOR is valid even for short strings.

joeyq1, posted Sun Apr 12, 2020 1:21 pm (55822)

---

I'm confused, do you have to dive inside each of the files in '0000' with a hex editor to figure out which character or object it is or can you see from the filename itself?
For example if I want 'Hero/SuperRobot' from the list of strings found in https://pastebin.com/Y7hykmxy
How do I find the corresponding file in '0000' folder?

Edit: Also, how did you find 'kunoichi_c2', it was not in the list. was it guesswork or is there a more complete list?

gorodork, posted Sun Apr 12, 2020 4:12 pm (55827)

---

einherjar007 wrote:

try kunoichi_c2. I can get a correct result.

It's interesting, so I download client data and try XOR.
ex, 0a3ec1bd05b28d335niwt3isn1ihfq0j4fed90aca3327951 is grandpatriach_s1.

but 0aaxrpknc16330f9a907665ec2fad88f2e8dc is probably filename(key)'s "boxer", but XOR did not give correct results.
Does the algorithm change depending on the length of the file name?

If we can play the game at least, can get the header by memory dump...

*EDITsorry, that is my misunderstanding. XOR is valid even for short strings.

But there isnt any "kunoichi_c2" in the string list, how did you knew that was the key? And yes, looks like you need to XOR bytes with the same lenght of the character name. If the name have 5 bytes, you XOR 5 bytes, if its 10 bytes you XOR 10 bytes, etc.

joeyq1 wrote:

I'm confused, do you have to dive inside each of the files in '0000' with a hex editor to figure out which character or object it is or can you see from the filename itself?
For example if I want 'Hero/SuperRobot' from the list of strings found in https://pastebin.com/Y7hykmxy
How do I find the corresponding file in '0000' folder?

Yes, you have to search the file names one by one in the 0000 folder, using hex editor and XORing the names with "5D 00 00 08 00 00 00 00" to discover the real name. I'm manually identifying the files and I found three superrobot files, they are:

5beda22aed43f2bc75bd7cb78950y3knnrxrsqhjb19c5
9a5902cf22c200ac5f19522b8ae0y3knnrxrsqhoc82b3
0881e40y3knnrxrs3d524bfcb54674f7dbf86c7629

joeyq1, posted Mon Apr 13, 2020 10:34 pm (55879)

---

Alright, I found most of the xor strings, animations work fine with corresponding models, so for example Hero "Celine" with codename "elfarcher":
-"elfarcher", "elfarcher_c1", "elfarcher_c2" goes with animations in "anim_elfarcher" (_c# suffix is just color variant of main model).
-"elfarcher_s1" goes with animations in "anim_elfarcher_s1" etc..

The only thing is Blender sucks at fbx import (at the moment).



Please help me find the ones I could not find.
Copy paste the attached tab limited csv file in your spreadsheet program of choice, Calc or Excel, to see which I could not find.

Edit: colums of csv are:
sorted_by_xor_prefix, file, size, xor_prefix, xor_code, xor_found, xor_not_found, character

Edit 2020-04-14 12:46: I should not bash on Blender, it's an awesome free opensource program!
I used the newest version of AssetStudio.x64.v0.14.38 => https://ci.appveyor.com/project/Perfare ... /artifacts
In AssetStudio > "Options" > "Export Options" > set "FBXversion" to 7.5.
Now animations import correctly in Blender!

gorodork, posted Tue Apr 14, 2020 6:37 pm (55937)

---

Thank you so much for sharing that spreadsheet joeyq1! I was about to go crazy trying to identify the characters key one by one.
How did you managed to import the FBX animations into blender? I can import a FBX with armature no problem but If I import an animation some weird stuff starts to happen.


Looks like the animation is separated from the armature and its looks like is just some "plain axes" moving around. I tried that trick to select fbx 7.5 in the unity asset exporter, with that I got some error while importing.

joeyq1, posted Tue Apr 14, 2020 11:43 pm (55948)

---

Tutorial for the noobs like me:

Requirements:
-Python 3.x installed, I'm doing this with python 3.4 => https://www.python.org/downloads/
-AssetStudio.x64.v0.14.38 => https://ci.appveyor.com/project/Perfare ... /artifacts
-Blender 2.79 or 2.8x, I'm using Blender 2.82 for this => https://www.blender.org/download/
-Disk Space of at least 6.32 gb (the game of 3GB plus decrypted copies of encrypted files).
-Full game (3GB), thanks to kurupeko100 for providing this on post 9 of this thread => https://drive.google.com/file/d/1UfnU6F ... 4oHm0/view
-A small python script and text file provided in "hyperuniverse.zip" file in the attachment of this post.

1. Unpack full game "HyperUniverse.rar" in folder with not so long folder path just in case, I'm doing this f.e. in "D:\projects\games\HyperUniverse".
2. Go into folder "D:\projects\games\HyperUniverse\HyperUniverse\HyperUniverse_Data\0000" and extract files "hyperuniverse.py" and "hyperuniverse.txt" from ""hyperuniverse.zip" attached in this post.
3. Open "hyperuniverse.py" and run (shortcut F5) with python 3's own IDLE or other IDE of preference.
It reads the tab seperated csv file "hyperuniverse.txt" and copies and converts the files in "0000" folder where I did find the xor string and puts them in handy separate sub folders in "D:\projects\games\HyperUniverse\HyperUniverse\HyperUniverse_Data\0000", where models and corresponding animations are put together.
It also moves the encrypted files I could find the xor string to folder "0000\succes_original", leaving all the files I couldn't succesfully find in folder "0000" (at the moment 83 unfound xor strings).
The decrypted files are named after the xor string and it also renamed the cab-xxxxxxx inside the files for easier navigation in AssetStudio, don't know if that screws up the files, I haven't had any trouble with it.
This script takes in my case 15 seconds.

4. Run "AssetStudioGUI.exe" in AssetStudio, File > Load folder and browse to sub folders of folder "0000" to choose a desired hero, I'll take "Tatyana" c0 (main costume) as an example.



5. Go to Asset List Tab and press type column to make sure you get all the "Animation Clips", then shift select them. Make sure you don't accidentally also select an Animator file, cause that sometimes caused an error for me.



6. Go to Scene Hierarchy Tab and select bazooka sign (or bazooka_c1 or bazooka_c2), then "Bazooka", if sub node has "Bip001" then you're good to go.



7. Select "Model" > "Export Selected Objects Selected AnimationClips", press Select Folder. If everything goes right AssetStudio opens a a window to the exported files.



8. Open Blender, as of this writing I'm using blender 2.8, but I tested 2.79 and that's also fine.
File > Import > FBX (.fbx). Copy paste window address that AssetStudio so conveniently opened for you, press enter.



doubleclick Bazooka.fbx and viola, imported into blender.

The Armature object's scale is 0.011 so in 3D View Editor, go to transform tab and press backspace shortcut on one of the scale value to set all scale to 1.





End of tutorial

Thanks to kurupeko100, chrrox, gorodork, google and stackoverflow!

hyperunivers.zip

HyperDude, posted Wed Apr 15, 2020 12:28 am (55949)

---

I registered just to tell you thank you, seriously.
I've been looking for model rips of this game ever since it came out, it has been 3 years and when it got shut down I started losing hope, I even kept the game installed on my HDD just in case someone figured out how to rip the characters from it and thanks to the python script that joeyq1 posted I finally managed to get what I wanted.
thank you.