This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=11186

Siengried, posted Tue Apr 09, 2019 5:57 pm (46713)

---

Hi all...
i found this file that should contains text file of this game.
But i can't open it. Someone can help me?
https://www23.zippyshare.com/v/iGuCWa9Y/file.html

Haoose, posted Wed Apr 10, 2019 3:50 pm (46764)

---

Decrypt script for text-files:

Code:

encryption Rijndael "\x35\x38\x9A\xFF\xF2\x61\xB3\xE8\x87\x22\x24\x0B\x6B\x0B\x25\xC8" "\x01\x85\x40\xA5\x57\xDE\x8C\x4E\x86\xE4\x23\xE3\x3A\xB9\x77\x84"
get SIZE asize
log "decrypted_file.dat" 0 SIZE

Ogoshi, posted Wed Apr 10, 2019 6:28 pm (46776)

---

Haoose wrote:

Decrypt script for text-files:

Code:

encryption Rijndael "\x35\x38\x9A\xFF\xF2\x61\xB3\xE8\x87\x22\x24\x0B\x6B\x0B\x25\xC8" "\x01\x85\x40\xA5\x57\xDE\x8C\x4E\x86\xE4\x23\xE3\x3A\xB9\x77\x84"
get SIZE asize
log "decrypted_file.dat" 0 SIZE

And how i use this script? QuickBMS?

Haoose, posted Wed Apr 10, 2019 8:10 pm (46778)

---

Ogoshi

Code:

quickbms.exe -w DecryptAceAttorney.bms option_text_u.bin UnPack\

Ogoshi, posted Wed Apr 10, 2019 10:32 pm (46781)

---

Haoose wrote:

Ogoshi

Code:

quickbms.exe -w DecryptAceAttorney.bms option_text_u.bin UnPack\

Thanks Haoose!

Siengried, posted Thu Apr 11, 2019 6:18 am (46783)

---

How did you found the way to decrypt?

Dj_Mike238, posted Thu Apr 11, 2019 10:57 am (46804)

---

Haoose wrote:

Decrypt script for text-files:

Code:

encryption Rijndael "\x35\x38\x9A\xFF\xF2\x61\xB3\xE8\x87\x22\x24\x0B\x6B\x0B\x25\xC8" "\x01\x85\x40\xA5\x57\xDE\x8C\x4E\x86\xE4\x23\xE3\x3A\xB9\x77\x84"
get SIZE asize
log "decrypted_file.dat" 0 SIZE

This works successfully with .bin text files, but it doesn't work with .mdt script files.

Has anyone got any luck with those ones?

Kaplas, posted Thu Apr 11, 2019 2:05 pm (46814)

---

Siengried wrote:

How did you found the way to decrypt?

If you open "Assembly-CSharp.dll" with dnSpy (or another .NET disassembler) you can find the decryption code:

Code:

public byte[] load(string in_path)
{
    byte[] array = File.ReadAllBytes(in_path);
    RijndaelManaged rijndaelManaged = new RijndaelManaged();
    rijndaelManaged.KeySize = 128;
    rijndaelManaged.BlockSize = 128;
    string password = "u8DurGE2";
    string s = "6BBGizHE";
    byte[] bytes = Encoding.UTF8.GetBytes(s);
    Rfc2898DeriveBytes rfc2898DeriveBytes = new Rfc2898DeriveBytes(password, bytes);
    rfc2898DeriveBytes.IterationCount = 1000;
    rijndaelManaged.Key = rfc2898DeriveBytes.GetBytes(rijndaelManaged.KeySize / 8);
    rijndaelManaged.IV = rfc2898DeriveBytes.GetBytes(rijndaelManaged.BlockSize / 8);
    ICryptoTransform cryptoTransform = rijndaelManaged.CreateDecryptor();
    byte[] result = cryptoTransform.TransformFinalBlock(array, 0, array.Length);
    cryptoTransform.Dispose();
    return result;
}

Dj_Mike238 wrote:

This works successfully with .bin text files, but it doesn't work with .mdt script files.

Has anyone got any luck with those ones?

.mdt are encrypted in the same way, but then you have to substract 128 from every text character to get the real character. The problem is that .mdt files contains the game scripts, so I'm still looking for a way to extract just the texts without breaking anything else.

Siengried, posted Thu Apr 11, 2019 2:35 pm (46815)

---

Well, we have first to find a way to expand files without to cause crash in games... How we can do? Files don't seems to have a size check

Siengried, posted Sun Apr 14, 2019 4:09 pm (46932)

---

How we can make the file bigger without to make the game crash?

Kaplas, posted Sun Apr 14, 2019 7:36 pm (46936)

---

What do you mean? I've been able to add text without crashing the game.

Siengried, posted Mon Apr 15, 2019 12:20 pm (46954)

---

Kaplas wrote:

What do you mean? I've been able to add text without crashing the game.

How? If i just add two bytes the game crash... did you modified something else?

Kaplas, posted Mon Apr 15, 2019 1:16 pm (46955)

---

Once decrypted, .mdt files have the following header:

Code:

ushort numberOfScenesInFile;
ushort dummy; // 0
uint[numberOfScenesInFile] sceneStartOffset;

And after this header goes the data.

If you add or remove bytes, you have to update the "sceneStartOffset" pointers.

Siengried, posted Mon Apr 15, 2019 1:20 pm (46956)

---

Kaplas wrote:

Once decrypted, .mdt files have the following header:

Code:

ushort numberOfScenesInFile;
ushort dummy; // 0
uint[numberOfScenesInFile] sceneStartOffset;

And after this header goes the data.

If you add or remove bytes, you have to update the "sceneStartOffset" pointers.

I know it. But i added two bytes at the very last word:
E?O??0A?A?E?D?O?N?I?L?A??? ORIGINAL
E?O??0A?A?E?D?O?N?I?L?A?A???NEW
And the game crash. The last scene is the last, so no pointer have to be modified(pointer=Scene offset)

Kaplas, posted Mon Apr 15, 2019 1:51 pm (46958)

---

Have you encrypted the file after modifying?

Siengried, posted Mon Apr 15, 2019 1:51 pm (46959)

---

Kaplas wrote:

Have you encrypted the file after modifying?

Yes, i have.

Kaplas, posted Mon Apr 15, 2019 1:58 pm (46960)

---

What file are you trying to modify? I've tried with "sc0_text_u.mdt" in "GS1\scenario" folder and it works, may be other files have other structure.

Siengried, posted Mon Apr 15, 2019 2:03 pm (46961)

---

Kaplas wrote:

What file are you trying to modify? I've tried with "sc0_text_u.mdt" in "GS1\scenario" folder and it works, may be other files have other structure.

I have modified the same. Can i send you the file decripted and none? The modified one i mean

Kaplas, posted Mon Apr 15, 2019 2:11 pm (46962)

---

Yes, send me the file and I'll take a look

Siengried, posted Mon Apr 15, 2019 2:12 pm (46963)

---

I added some bytes at the offset 016F95
https://www109.zippyshare.com/v/zhiVAZkf/file.html
Obliously i change everytime the name in sc0_text_u.mdt and encrypt it again with reimport.bat(tried the reimport2 too)

Kaplas, posted Mon Apr 15, 2019 2:55 pm (46965)

---

I think the QuickBMS script is not encrypting the file properly.

Here you have a small app to decrypt/encrypt game files: https://we.tl/t-nQILZCBPcw

If you drag&drop a game file, the app will create the decrypted version with ".decrypted" extension.
If you drag&drop a ".decrypted" file, the app will encrypt it.

Siengried, posted Mon Apr 15, 2019 3:14 pm (46966)

---

Kaplas wrote:

I think the QuickBMS script is not encrypting the file properly.

Here you have a small app to decrypt/encrypt game files: https://we.tl/t-nQILZCBPcw

If you drag&drop a game file, the app will create the decrypted version with ".decrypted" extension.
If you drag&drop a ".decrypted" file, the app will encrypt it.

Thanks m8

Dj_Mike238, posted Mon Apr 15, 2019 4:48 pm (46971)

---

Kaplas wrote:

Once decrypted, .mdt files have the following header:

Code:

ushort numberOfScenesInFile;
ushort dummy; // 0
uint[numberOfScenesInFile] sceneStartOffset;

And after this header goes the data.

If you add or remove bytes, you have to update the "sceneStartOffset" pointers.

Do you use any specific tools to do that or do you just edit the file with an hex editor?

Kaplas, posted Mon Apr 15, 2019 5:22 pm (46976)

---

I'm coding a tool to make a translation, but it isn't finished yet.