This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=5141

Mikeee, posted Wed Oct 25, 2017 11:23 pm (27697)

---

Example:

There's this strange file that I see the FSB5 header inside. But not sure how to extract it, or what this file is?

aluigi, posted Thu Oct 26, 2017 10:52 am (27710)

---

What you see there is just a sequence of "FSB5" chars, it can be just a false positive moreover because there are no filenames visible there.
I don't know what type of compression is applied to that unity3d file.

Mikeee, posted Thu Oct 26, 2017 5:19 pm (27720)

---

aluigi wrote:

What you see there is just a sequence of "FSB5" chars, it can be just a false positive moreover because there are no filenames visible there.
I don't know what type of compression is applied to that unity3d file.

These unity3d files come from a bigger file. https://download-cdn-ac-pocketcamp.akam ... 9ac8d.zdat

The game splits them up and saves them locally. That zdat has more unity3ds with more FSB5 headers.

Mikeee, posted Mon Oct 30, 2017 12:38 pm (28113)

---

I found out if you XOR the first character with 'G', then xor the next character with that result, and then xor the next character with that result, etc.. you will obtain the original 'UnityFS' header. There is a certain point you need to stop because it looks like the body of the file is not xored and you begin encrypting the body instead.