This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=660

AlphaTwentyThree, posted Mon Feb 23, 2015 7:11 pm (3376)

---

Hello guys!
Can somebody look at this format? Might be encrypted.
http://*USE_ANOTHER_FILEHOSTING*/b1d7aee ... samples.7z
Thanks for your help!

aluigi, posted Mon Feb 23, 2015 10:05 pm (3381)

---

Blowfish with a key coming from a constant array where each byte must be converted to negative.
I have the array of the demo, can you provide the exe of the full game?

AlphaTwentyThree, posted Mon Feb 23, 2015 10:56 pm (3387)

---

sure: http://*USE_ANOTHER_FILEHOSTING*/156bbf6 ... eden_en.7z

aluigi, posted Mon Feb 23, 2015 11:40 pm (3389)

---

No luck with the full game, I can decrypt the index table but the files are not decrypted correctly.

The demo instead is ok but the 2 files of mov.paz are not decrypted correctly.

Script:
http://aluigi.org/papers/bms/others/eden_.bms

AlphaTwentyThree, posted Tue Feb 24, 2015 9:44 am (3393)

---

I've uploaded some other samples: http://*USE_ANOTHER_FILEHOSTING*/d38839a ... de4/paz.7z
Does that help?

aluigi, posted Tue Feb 24, 2015 10:28 am (3396)

---

This is really senseless.
Inside the SYS folder we have BGMtest.wav which is perfectly decrypted and many PNG which aren't.

Note that this is NOT a bug but it's something intentional, probably the same method used for the 2 files in mov.paz.
I will check it again later.

AlphaTwentyThree, posted Tue Feb 24, 2015 11:14 am (3400)

---

Thanks a lot for checking this out!

aluigi, posted Tue Feb 24, 2015 2:02 pm (3404)

---

The good news is that I have found and implemented the second method for the 2 AVI files in mov.paz, script 0.2.

The bad news is that this method doesn't work with the png/ogg/sc files of the full game, in fact this method needs a 0x100 bytes header in the PAZ file that doesn't exist in the full game.
Probably it uses a third method (a fixed 32bit xor after ReadFile?) but I have enough of this game moreover because I have only the demo working.

Sorry, anyway the script is awesome

AlphaTwentyThree, posted Tue Feb 24, 2015 10:09 pm (3432)

---

Thanks for trying nevertheless.