This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=9525

akintos, posted Mon Feb 18, 2019 12:11 pm (43615)

---

I'm trying to implement my own UE4 archive un/repacker in .Net and its working well for not encrypted files.

The problem is that I can't decrypt encrypted UE4 data blocks.

the code I used is below.

Code:

byte[] key = {
    0x45, 0xDD, 0x15, 0xD6, 0xDD, 0x2D, 0xA5, 0x0A, 0xEB, 0x71, 0xCE, 0x7A, 0x52, 0x84, 0xCF, 0x8E,
    0xA4, 0x98, 0xB2, 0xEC, 0x3D, 0x52, 0xB7, 0xE3, 0x36, 0xF3, 0xEA, 0x00, 0x71, 0xCE, 0x44, 0xB3
};

byte[] encryptedData = File.ReadAllBytes(encryptedFIlePath);
byte[] decryptedData;

using (RijndaelManaged rDel = new RijndaelManaged())
{
    rDel.Key = key;
    rDel.KeySize = 256;
    rDel.BlockSize = 128;
    rDel.Mode = CipherMode.ECB;
    rDel.Padding = PaddingMode.None;

    using (var decryptor = rDel.CreateDecryptor())
    {
        decryptedData = decryptor.TransformFinalBlock(encryptedData, 0, encryptedData.Length);
    }
}

File.WriteAllBytes(decryptedFIlePath, decryptedData);

I have tried 256 BlockSize, other CipherModes but nothing worked.

The sample data I'm using is from PUBG and quickbms can easily decrypt it.

Code:

encryption aes "45DD15D6DD2DA50AEB71CE7A5284CF8EA498B2EC3D52B7E336F3EA0071CE44B3" "" 0 32
get FILESIZE asize
log "decrypted.bin" 0 FILESIZE

What am I doing wrong?
Please help me. Thanks.

akintos, posted Mon Feb 18, 2019 1:23 pm (43619)

---

I was dumb, using key as ASCII string worked. I thought the key is hexstring... I wasted almost 8 hours on this.

Code:

byte[] key = Encoding.ASCII.GetBytes("45DD15D6DD2DA50AEB71CE7A5284CF8E");

aluigi, posted Tue Feb 19, 2019 4:05 am (45010)

---

eh sometimes it's just unluck.
In fact often the recent ue4 keys are hex but they usually start with a "0x" prefix or the "\x" escapes for tagging them as hex.