This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=5049

JeffMakesGames, posted Thu Oct 05, 2017 2:11 pm (27061)

---

Hey, I got referred to here for help on this.

I tried a few file extractors like Xripper and dragon unpcker, but they can't seem to look into TipTop.dat. I assume it is the archive since it is the largest file. Both the exe and dat file is included.

http://www.jeffmakesgames.com/misc/TipTop.zip

As for what Tip Top is, it's a very old Popcap game.

aluigi, posted Thu Oct 05, 2017 9:34 pm (27074)

---

I'm quite sure that the obfuscation used in the whole archive is a custom bit rotation of each byte because the byte 0 remains 0.
Can you upload the executable too?
Just in case someone wants to do the job without doing tentatives by hand

JeffMakesGames, posted Thu Oct 05, 2017 11:48 pm (27079)

---

Sure thing!

I took both files and packed them into a zip and will update the link above.

Ekey, posted Thu Oct 05, 2017 11:51 pm (27080)

---

Code:

char ttd_decrypt(unsigned char *pBuffer, int dwSize)
{
  unsigned char t1;
  unsigned char t2;
  unsigned char t3;
  char temp;
  char result;

  if ( dwSize )
  {
    do
    {
      t1 = *pBuffer & 0xFA | 4 * (*pBuffer & 1) | (*pBuffer >> 2) & 1;
      t2 = t1 & 0xBD | 32 * (t1 & 2) | (t1 >> 5) & 2;
      t3 = t2 & 0x77 | (t2 >> 4) & 8 | 16 * (t2 & 0xF8);
      temp = 2 * (t3 & 0x10) | (t3 >> 1) & 0x10;
      result = t3 & 0xCF;
      *pBuffer   = result | temp;
      --dwSize;
    }
    while ( dwSize );
  }
  return result;
}

JeffMakesGames, posted Fri Oct 06, 2017 12:25 am (27082)

---

Is that a bms script?

aluigi, posted Fri Oct 06, 2017 11:45 am (27087)

---

Now yes:
http://aluigi.org/bms/tiptop_deluxe.bms

JeffMakesGames, posted Fri Oct 06, 2017 5:01 pm (27094)

---

Hmm, for some reason, the script did not work.

When trying to run it, QuickBMS says: The script has requested to load a function from the dll MEMORY_FILE10. Do you want to continue? (Y/N)

Telling it yes results in an error:

- Library MEMORY_FILE10 loaded at address 08530000

Error: The input library is handled as raw data so can't have a function name.

Last script line before the error or that produced the error:
35 call dll MEMORY_FILE10 "ttd_decrypt" "tcc" MEMORY_FILE SIZE

aluigi, posted Fri Oct 06, 2017 5:33 pm (27095)

---

You are using an old version of quickbms.
Latest is 0.8.1

JeffMakesGames, posted Fri Oct 06, 2017 6:22 pm (27101)

---

Yay! Got it! Thanks!