This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=11093

moiennepe, posted Mon Mar 25, 2019 3:15 pm (46010)

---

Hi all, I've found the decryption func in dffnt.exe here:
https://pastebin.com/KvkjYUrr

The Key is ahcTaNwLcATRE... and three bytes E2,5E,C8.

I am a noob to Cryptography and cannot recognize this, hope some of you can help.

BTW KT's doaxvv use the same algorithm.

chrrox, posted Mon Mar 25, 2019 4:36 pm (46011)

---

is the key the same in vv?

moiennepe, posted Mon Mar 25, 2019 4:49 pm (46012)

---

chrrox wrote:

is the key the same in vv?

different keys

chrrox, posted Mon Mar 25, 2019 4:51 pm (46013)

---

Can you post the vv key I think I know how it works inthat game

chrrox, posted Mon Mar 25, 2019 10:43 pm (46020)

---

Here is that function in psuedo code from ida.
https://pastebin.com/raw/mQuwMy4x

moiennepe, posted Tue Mar 26, 2019 3:21 am (46023)

---

chrrox wrote:

Can you post the vv key I think I know how it works inthat game

I haven't update vv, and it's not runable on my pc now...

you can try find the key yourself, take the (outdated) doax_vv.exe below as example:
https://mega.nz/#!LjpABYpR!Y7FaF06WYfuS ... UyLvbIdSHA

1400FEEA0 (file offset FE2A0) is the decrypt function, find that in the current vv executable,
then you can get the key string in ram.

chrrox, posted Tue Mar 26, 2019 10:07 pm (46037)

---

Thanks I thought that was the function I found it in the latest exe.
I am going to try to follow what is happening.

chrrox, posted Thu Mar 28, 2019 9:33 am (46125)

---

in your dissidia code I know how it works we just need to find how to generate the 4 byte key for the file.
in the example

Code:

v57 = *(_BYTE *)(v13 % v50   v51) ^ *((_BYTE *)v9   v13 % v52   40);
v57 = v9[(v13 % v52)   40] ^  v51[v13 % v50]

we need to figure out how to generate v9 if you can figure that out or tell me the function name and ill look at it.

in the older game v9 was generated with

Code:

def generate_key(num):
        A = num 0x3e7
        B = A*8 # FIXME: missing sth here to catch the possible overflow
        B -= A
        C = int(B / 0xB)   int(num % 0x11)   0x1AC
        key=[]
        sh = 24
        while sh>=0:
                val = (C >> sh)&0xff
                if val > 0: key.append(val)
                sh-=8
        return bytes( key )

anyway how the encryption works is.
take the secret xor seed you posted
and the 4 byte secret per file key and xor them.
then take that result and xor the entire encrypted file with it starting at offset 0x4 (after the file size)
and you skip xoring the byte if it is 0 or the same byte as the xor.
thats it.

moiennepe, posted Thu Mar 28, 2019 5:11 pm (46145)

---

chrrox wrote:

in your dissidia code I know how it works we just need to find how to generate the 4 byte key for the file.
in the example

Code:

v57 = *(_BYTE *)(v13 % v50   v51) ^ *((_BYTE *)v9   v13 % v52   40);
v57 = v9[(v13 % v52)   40] ^  v51[v13 % v50]

we need to figure out how to generate v9 if you can figure that out or tell me the function name and ill look at it.

in the older game v9 was generated with

Code:

def generate_key(num):
        A = num 0x3e7
        B = A*8 # FIXME: missing sth here to catch the possible overflow
        B -= A
        C = int(B / 0xB)   int(num % 0x11)   0x1AC
        key=[]
        sh = 24
        while sh>=0:
                val = (C >> sh)&0xff
                if val > 0: key.append(val)
                sh-=8
        return bytes( key )

anyway how the encryption works is.
take the secret xor seed you posted
and the 4 byte secret per file key and xor them.
then take that result and xor the entire encrypted file with it starting at offset 0x4 (after the file size)
and you skip xoring the byte if it is 0 or the same byte as the xor.
thats it.

Thanks, by your hint I have successfully decrypted the TOC file

Other files do not have first 4 bytes as unzipped size, they are recorded in the TOC.

Also the zip structure:
int32[zlib_blob size 0x8000]
zlib_blob
align 0x10
int32[zlib_blob size 0x8000]
....

some zip may have uncompressed ending data, see log.

cryptfixed.rar

ktcry_test.rar

chrrox, posted Fri Mar 29, 2019 12:34 pm (46172)

---

Very nice going to try this on vv tonight

Panzerdroid, posted Mon Apr 01, 2019 1:58 am (46294)

---

Tools generate errors about missing files on Q: drive. I think you have hard-coded those links by mistake.

moiennepe, posted Mon Apr 01, 2019 2:27 am (46296)

---

Panzerdroid wrote:

Tools generate errors about missing files on Q: drive. I think you have hard-coded those links by mistake.

The messy C# source here: pastebin.com/ySWUFhai (not more readable than dnspy .etc output i think)

The purpose of deRest.exe is to decompress all the asset ( which already moved to their real path ) and make them work with a patched TOC and dffnt.exe
I don't think anyone else needs that so...
I put that in package is for if someone wants a ktcry.dll usage example...

cyberspeed, posted Tue Apr 02, 2019 12:57 am (46364)

---

moiennepe wrote:

The purpose of deRest.exe is to decompress all the asset ( which already moved to their real path ) and make them work with a patched TOC and dffnt.exe

Unfortunately I cant make it work, any chance for an example on how to use this stuff?

DeathChaos, posted Wed Apr 17, 2019 5:18 am (47017)

---

It would be really nice if it could be properly explained how to use this to decrypt PC game files, I'd love to extract assets such as audio (character voices) and poke at the various message archive files.

EclipsedVisions, posted Mon May 13, 2019 9:35 am (47740)

---

anything?

Doctor Loboto, posted Fri May 17, 2019 11:42 pm (47812)

---

So any word on a method to extract Dissidia NT's files? It'd be really helpful for my projects.

xperiagenerator, posted Sun Jun 16, 2019 7:28 am (48830)

---

Please make a step by step guide for DOAXVV

ChaoticFusion40, posted Sat Jun 22, 2019 1:07 pm (48967)

---

the key for the latest doaxvv version is "4686048e796cd48ad484ec7f6d22a8ea"

ChaoticFusion40, posted Sat Jun 22, 2019 6:47 pm (48968)

---

ChaoticFusion40 wrote:

the key for the latest doaxvv version is "4686048e796cd48ad484ec7f6d22a8ea"

the files uses aes instead of xor and are compressed in zlib inside the encryption.

ChaoticFusion40, posted Mon Jun 24, 2019 9:30 pm (49027)

---

open the game in memory and look for the type of encryption

xperiagenerator, posted Wed Mar 18, 2020 6:58 pm (54715)

---

How to retrieve doaxvv real name files? they are encrypted