This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=4178

AnonBaiter, posted Sun May 07, 2017 5:00 pm (22993)

---

Here are the samples.

aluigi, posted Sun May 07, 2017 6:36 pm (22998)

---

It looks like the obfuscation algorithm or the lookup table have been changed
https://forum.xentax.com/viewtopic.php?p=41566#p41566
https://forum.xentax.com/viewtopic.php?f=21&t=5899

I made even a test script on the fly to be sure that wasn't a bug and the result is wrong:

Code:

quickbmsver "0.8.0"
set MEMORY_FILE10 binary "

    void msf_decrypt(unsigned char *data, int FileSize, unsigned char *table) {
        unsigned int    EAX, EBX;
        unsigned char   AL, CL;

        EAX = FileSize -1;

        while(EAX)
        {
          CL = data[EAX -1];
          CL >>= 1;
          EBX = EAX & 0xFFFF;
          CL ^= table[EBX];
          data[EAX] ^= CL;
          EAX--;
        }

        AL = data[FileSize -1];
        AL >>= 1;
        AL ^= table[0];
        AL ^= data[0]; // AL is now 0x00
        data[0] = AL;
    }
"

set TABLE compressed "eNrEXMMaKMwOO c/tm3btm3btm3btm3btm3b9r1ZdJNNF130DaZpZ742yXTWoOibkqdfdal4 VP1fz3qvjRPkr1Rxk4N0 Xt1zZH6xS5W/raucr/Gvd Ni9w7GGpt63L/LJDi481Dt4skGPhzgQjI4SYmGbr2ixzg8QZ rdJn6dlrp6tMip88EnZF 2KX/3Qrfyv2jf/1ODnwx4XS1Q4uTFFhpUBZw6Mcax24Xud331rHXnctNDLcifeV/PAjYIvOrb8MCJiyAk5F xI LtZv8flLp ulm7z6myzg8UbHHXMlLBL8ibdc6Ru0Ttd33xpuz5VpuWBpveP1ej7/V7nS1U63u3153aH6xW7vThfst3RRk8Od6FkxRMNfzzo d MATE3pMy4Itf87YmGRwo1/nmnVu9r7b9eaE7QuEPSblmTteyVM1X/NO37BGfC2XBGnBVnwtlwRpwVMSE2xIhYERNiQ4yIFZgAG2AErIAJsAFGwAqYAltgHOD/WANTYAuMgTXOhLPhjDgrzoSz4Yw4K2JCbIgRsSImxIYYESswATbACFgBE2ADjIAVMAW2wBhYA1NgC4yBteAkuAmOgqvgJLgJjoKr5EnyJnmUvEqeJG SR8mr1InUjdSR1JXUidSN1JHUldSp1K3UMbAG5lKnUrdSx1LXgpPgJjgKroKT4CY4Cq6SJ8mb5FHyKnmSvEkeJa9SJ1I3UkdSV1InUjdSR1JXUqdSt1LHUtdSp1K3UsdS14HnDYu9LXXmdddKVz7X N z3gtzJNgZYeTEEB1efmxxsEaBm8UvnSr/q373R7MCRB UfNOq9G 7tPla5 jdInmW7k0yNkqYqSk2rswwM2CMgT8b9HhY4uLJCuMih56We9m xLWP3Sv8rnPrb03 Pu1ztUyVs1vTZFkbZO7QOIeq57/V/tWn5uFHTQq KHv8XXWP3Cn6pmvbL2Oihp2Sd8mepN8b9bpf6vzxSqnWL880PVCs/hFHTAi5IGfCHQdqFrzR8cWHlpvTZVsdbPbgeM1 P 53uVy1052ev2 1v1ah6/NzJdoeafj4UFfKVj3T9M TvkHnDIm7JW3WNfkW7042Olq4ya 7tftc7/DtYjP izkg5YYVGUteOFHxR8OeD3AmnA1nxFlxJpwNZ8RZERNiQ4yIFTEhNsSIWIEJsAFGwAqYABtgBKyAKbAFxsAamAJbYAyscSacDWfEWXEmnA1nxFkRE2JDjIgVMSE2xIhYgQmwAUbACpgAG2AErIApsAXGwBqYAltgDKwFJ8FNcBRcBSfBTXAUXCVPkjfJo RV8iR5kzxKXqVOpG6kjqSupE6kbqSOpK6kTqVupY6lrqVOpW6ljqWuBSfBTXAUXAUnwU1wFFwlT5I3yaPkVfIkeZM8Sl6lTqRupI6krqROpG6kjqSupE6lbqWOpa6lTqVupY6lroNPGhV V/zsi27lr36o adX7ddmSbM1ztC5Qfo8/dvkbJUyVwvfO1b7W vO76aFjjwu8b5luR/2aPCzwsmLJTKs3JhiYIyAM5PsXZpnapgoY7 26fK2yN2jdQZFDzAr/apNycufulT8Uff6v1p8fNnhZoEaB3cmyLEwxMSREc5VLn2t97N/jWMPmxd4XebU2yqeuFDyQc GPwbE/G9GxhUbUn5u1 11sduH6yXbvTjf5HDRRscdMifomqxpt5ypWvZK3yd/mm5PlGt qPHDI7V6/7zT9UK19vd7/LvZ6WrlLq/Olm5zvMGzg90oWPNAyw8vOoacMCLijoQ5F2Ravj5V/1iBpt/v1eh7pePnS00JG3VM0j1L8ha9c6Tul7Zd3 BMOBvOiLPiTDgbzoizIibEhhgRK2JCbIgRsQITYAOMgBUwATbACFgBU2ALjIE1MAW2wBhY40w4G86Is JMOBvOiLMiJsSGGBErYkJsiBGxAhNgA4yAFTABNsAIWAFTYAuMgTUwBbbAGFgLToKb4Ci4Ck6Cm AouEqeJG SR8mr5EnyJnmUvEqdSN1IHUldSZ1I3UgdSV1JnUrdSh1LXUudSt1KHUtdC06Cm AouApOgpvgKLhKniRvkkfJq RJ8iZ5lLxKnUjdSB1JXUmdSN1IHUldSZ1K3UodS11LnUrdSh1LXYeeNi7yvsS5l90rXPtY62/vOq/MkGJjjIEzA/Z4 LPByQolLua/daj6p btX00KHn5U/F2Lsj/t0 RvlbNXy2RZuzXN0DhB5ibYuTDHxBARRn5s0eFlgZsHawyLHXhe5nXbUlc d630s96N/7X5 rbL3SJ1ju5NkmdpmKljo5wqX/xS90e/6kcfNCvAqvTJN1U9c6Xsk75N/wyJG3RO1jVb0r5v1el5oev7ayXaPj/X FCRhsccMOO/FRlTbjhRseSFng9 NNydLN/icJNHR2v3 XW328XqHe51/3uj45VKnV eKdX6WP2nB7pTtO6Rtl/edA07ZUzUPUnzLsm2enO6wfGCzX7cr9nvaqcvl5sQMuKIhDsW5Cx440DNDy07vsCZcDacEWfFmXA2nBFnRUyIDTEiVsSE2BAjYgUmwAYYAStgAmyAEbACpsAWGANrYApsgTGwxplwNpwRZ8WZcDacEWdFTIgNMSJWxITYECNiBSbABhgBK2ACbIARsAKmwBYYA2tgCmyBMbAWnAQ3wVFwFZwEN8FRcJU8Sd4kj5JXyZPkTfIoeZU6kbqROpK6kjqRupE6krqSOpW6lTqWupY6lbqVOpa6FpwEN8FRcBWcBDfBUXCVPEneJI SV8mT5E3yKHmVOpG6kTqSupI6kbqROpK6kjqVupU6lrqWOpW6lTqWutb6K60/0/orrT/T kutP9X6S60/1forrT/T iutP9P6S60/1fpLrT/V5ittPtPmK20 0 ZLbT7V5kttPtXmK20 0 YrbT7T5kttPtXmS20 1fgVjZ/R BWNn9H4JY2f0vgljZ/S BWNn9H4FY2f0fgljZ/S CWNn9L4VY2f1fhVjZ/V OUACj t8csaP63xqxo/q/GrGj r8csaP63xyxo/rfVXWn m9Vdaf6b1l1p/qvWXWn q9Vdaf6b1V1p/pvWXWn q9Zdaf6rNV9p8ps1X2nymzZfafKrNl9p8qs1X2nymzVfafKbNl9p8qs2X2nyq8SsaP6PxKxo/o/FLGj l8UsaP6XxKxo/o/ErGj j8UsaP6XxSxo/pfGrGj r8asaP6vxyxo/rfHLGj t8asaP6vxqxo/q/HLGj t8csaP23lr6z8mZW/svJnVv7Syp9a Usrf2rlr6z8mZW/svJnVv7Syp9a Usrf2rVr6z6mVW/supnVv3Sqp9a9UurfmrVr6z6mVW/supnVv3Sqp9a9Uurfmr1r1j9M1b/itU/Y/UvWf1TVv S1T9l9a9Y/TNW/4rVP2P1L1n9U1b/ktU/ZfWvWv2zVv q1T9r9S8HMPqnrf5lq3/a6l 1 met/lWrf9bqX7b6p63 Zat/2spfWfkzK39l5c s/KWVP7Xyl1b 1MpfWfkzK39l5c s/KWVP7Xyl1b 1KpfWfUzq35l1c s qVVP7Xql1b91KpfWfUzq35l1c s qVVP7Xql1b91OpfsfpnrP4Vq3/G6l y qes/iWrf8rqX7H6Z6z Fat/xupfsvqnrP4lq3/K6l 1 met/lWrf9bqX7b6p63 Zat/2upftfpnrf5Vq3/W6l 2 qet/mWrf9rbf XtP/P2X3n7z7z9l97 U2//pbf/1Nt/5e0/8/ZfefvPvP2X3v5Tb/ lt//U / V9/8z7/9X3v/PvP9fev8/9f5/6f3/1Pv/lff/M //V97/z7z/X3r/P/X f n9/9R7/4r3/hnv/Sve 2e89y9575/y3r/kvX/Ke/ K9/4Z7/0r3vtnvPcvee f8t6/5L1/ynv/qvf We/9q977Z733Lwdw3j/tvX/Ze/ 09/5V7/2z3vtXvffPeu9f9t4/7b1/2Xv/tLf/ytt/5u2/8vafefsvvf2n3v5Lb/ pt//K23/m7b/y9p95 y 9/afe/ktv/6n3/yvv/2fe/6 8/595/7/0/n/q/f/S / p9/8r7/9n3v vvP fef /9P5/6v3/0vv/qff Fe/9M977V7z3z3jvX/LeP W9f8l7/5T3/hXv/TPe 1e8989471/y3j/lvX/Je/ U9/5V7/2z3vtXvffPeu9f9t4/7b1/2Xv/tPf Ve/9s977V733z3rvX/beP 29f9l7/zTfN76PfN/4PvJ94/vI943vI783/B7xe8PvEb83/B7xe8PvEd83vo983/g 8n3j 8j3je8jvzf8HvF7w 8Rvzf8HvF7w 8R3ze j3zf D7yfeP7yPeN7yO/N/we8XvD7xG/N/we8XvD7xHfN76PfN/4PvJ94/vI943vI783/B7xe8PvEb83/B7xe8PvEffb3I9zv839OPfb3I9zv839OM8bPI/wvMHzCM8bPI/wvMHzCPfb3I9zv839OPfb3I9zv839OM8bPI/wvMHzCM8bPI/wvMHzCPfb3I9zv839OPfb3I9zv839OM8bPI/wvMHzCM8bPI/wvMHzCPfb3I9zv839OPfb3I9zv839OM8bPI/wvMHzCM8bPI/wvMHzCPNtzMcx38Z8HPNtzMcx38Z8HPONzEcy38h8JPONzEcy38h8JPNtzMcx38Z8HPNtzMcx38Z8HPONzEcy38h8JPONzEcy38h8JPNtzMcx38Z8HPNtzMcx38Z8HPONzEcy38h8JPONzEcy38h8JPNtzMcx38Z8HPNtzMcx38Z8HPONzEcy38h8JPONzEcy38h8JOttrMex3sZ6HOttrMex3sZ6HOuNrEey3sh6JOuNrEey3sh6JOttrMex3sZ6HOttrMex3sZ6HOuNrEey3sh6JOuNrEey3sh6JOttrMex3sZ6HOttrMex3sZ6HOuNrEey3sh6JOuNrEey3sh6JOttrMex3sZ6HOttrMex3sZ6HOuNrEey3sh6JOuNrEey3sh6pNZfaf2Z1l9p/ZnWX2r9qdZfav2p1l9p/ZnWX2n9mdZfav2p1l9q/ak2X2nzmTZfafOZNl9q86k2X2rzqTZfafOZNl9p85k2X2rzqTZfavOpxq9o/IzGr2j8jMYvafyUxi9p/JTGr2j8jMavaPyMxi9p/JTGL2n8lMavavysxq9q/KzGL2v8tMYva/y0xq9q/KzGr2r8rMYva/y0xi9r/LTWX2n9mdZfaf2Z1l9q/anWX2r9qdZfaf2Z1l9p/ZnWX2r9qdZfav2pNl9p85k2X2nzmTZfavOpNl9q86k2X2nzmTZfafOZNl9q86k2X2rzqcavaPyMxq9o/IzGL2n8lMYvafyUxq9o/IzGr2j8jMYvafyUxi9p/JTGr2r8rMavavysxi9r/LTGL2v8tMavavysxq9q/KzGL2v8tMYva/y0lb y8mdW/srKn1n5Syt/auUvrfyplb y8mdW/srKn1n5Syt/auUvrfypVb y6mdW/cqqn1n1S6t atUvrfqpVb y6mdW/cqqn1n1S6t atUvrfqp1b9i9c9Y/StW/4zVv2T1T1n9S1b/lNW/YvXPWP0rVv M1b9k9U9Z/UtW/5TVv2r1z1r9q1b/rNW/bPVPW/3LVv 01b9q9c9a/atW/6zVv2z1T1v9y1b/tJW/svJnVv7Kyp9Z Usrf2rlL638qZW/svJnVv7Kyp9Z Usrf2rlL638qVW/supnVv3Kqp9Z9UurfmrVL636qVW/supnVv3Kqp9Z9UurfmrVL636qdW/YvXPWP0rVv M1b9k9U9Z/UtW/5TVv2L1z1j9K1b/jNW/ZPVPWf1LVv U1b9q9c9a/atW/6zVv2z1T1v9y1b/tNW/avXPWv2rVv s1b9s9U9b/ctW/7S3/8rbf btv/L2n3n7L739p97 S2//qbf/ytt/5u2/8vafefsvvf2n3v5Lb/ p9/8r7/9n3v vvP fef /9P5/6v3/0vv/qff/K //Z97/r7z/n3n/v/T f r9/9L7/6n3/hXv/TPe 1e8989471/y3j/lvX/Je/ U9/4V7/0z3vtXvPfPeO9f8t4/5b1/yXv/lPf Ve/9s977V733z3rvX/beP 29f9l7/7T3/lXv/bPe 1e9989671/23j/tvX/Ze/ 0t//K23/m7b/y9p95 y 9/afe/ktv/6m3/8rbf btv/L2n3n7L739p97 S2//qff/K //Z97/r7z/n3n/v/T f r9/9L7/6n3/yvv/2fe/6 8/595/7/0/n/6v2LuQAAAAABA0P7UYwRS2l9qf6r/Ff3P6H9F/zP6X9L/lP6X9D l/xX9z h/Rf8z l/S/5T l/Q/pf9V/c/qf1X/s/pf1v 0/pf1P63/Vf3P6n9V/7P6X9b/tP6X9T/dw0SHcg=="

get SIZE asize
log MEMORY_FILE 0 SIZE
calldll MEMORY_FILE10 "msf_decrypt" "tcc" RET MEMORY_FILE SIZE TABLE
get NAME basename
string NAME   ".zip"
log NAME 0 SIZE MEMORY_FILE

AnonBaiter, posted Sun May 07, 2017 6:44 pm (22999)

---

The output is garbled.

Do you want me to upload the rest of the files that aren't .mrs files at all? Perhaps there is a hint as to how the files were encrypted in some way.

aluigi, posted Sun May 07, 2017 7:17 pm (23004)

---

I think the best way is someone working with the whole game and a debugger

AnonBaiter, posted Sun May 07, 2017 7:22 pm (23005)

---

I doubt I can run even that on my VM machine...