This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=11380

LolHacksRule, posted Sat May 04, 2019 4:47 pm (47597)

---

I want to view the PAK files of the games, but I think they are encrypted or compressed in a way I cannot understand... Anyone willing to decompress these or find the encryption keys for me?

Upon reading the memory, I got the filelist for both games:

https://www.angrybirdsnest.com/wp-conte ... l1fups.PNG

https://www.angrybirdsnest.com/wp-conte ... 9n65yd.PNG

Others only have few JSONs and XMLs.

aluigi, posted Sat Jun 01, 2019 8:25 pm (48247)

---

The 2 samples no longer exist

LolHacksRule, posted Sat Jun 01, 2019 9:07 pm (48258)

---

I'll reup today, I promise.

LolHacksRule, posted Sun Jun 02, 2019 12:44 am (48307)

---

Both were cut by Filecutter.bms.

aluigi, posted Sun Jun 02, 2019 1:30 am (48324)

---

Encryption, encryption everywhere

LolHacksRule, posted Wed Nov 13, 2019 8:16 pm (48329)

---

Dammit. Welp, the game's ActionScripts are obfuscated, making it harder to pull the keys and possible encryption mechanism from them... http://www.zenhax.com/viewtopic.php?f=9&t=11382

Here's better links:

BF1: https://drive.google.com/open?id=1YeNeo ... L941U1dGVD
BF2: https://drive.google.com/open?id=1pZwSe ... lm1nMhPcnP

EX22222222222, posted Sat Jun 13, 2020 4:41 pm (57180)

---

Ok so I'm trying to datamine Angry Birds Breakfast's assets, unfortunately they are in troublesome PAK files which are also likely encrypted, it is a Flash game. Can someone get the encryption key to crack these? The dev's also obfuscated the game's SWF file...
Links:
1: https://drive.google.com/drive/u/1/fold ... L941U1dGVD
2: https://drive.google.com/drive/u/1/fold ... drive_open
SWF: https://drive.google.com/open?id=1ZD2UA ... kreWLS8juJ (both games use the same file)
Filelist dumps: https://www.angrybirdsnest.com/wp-conte ... l1fups.PNG
https://www.angrybirdsnest.com/wp-conte ... 9n65yd.PNG
Original thread: viewtopic.php?f=9&t=11380&p=48329

LolHacksRule, posted Sat Jun 13, 2020 6:48 pm (57186)

---

Bruh that's my comment on xentaxcord but thanks for the rebump

gamelandresearch, posted Thu Mar 25, 2021 9:56 am (63021)

---

Please help to crack it? because if was encrypted, stored XOR, compressed or obfuscated, but it was outdated

LolHacksRule, posted Fri Jun 18, 2021 8:18 pm (64580)

---

Upon painfully deobfuscating Breakfast using the secure_map xml file, I eventually found the PAK/package decryption code. It's not a string or anything easy but can someone derive the key/mechanism from it? Thanks. It appears to use a library called deng.FZip in relation to opening the files. It's possible this could be the same for other AB Flash titles using PAKs like Friends, Breakfast 3, Heikki, Eagles and so on.

LolHacksRule, posted Thu Jul 15, 2021 1:54 am (65204)

---

Turns out the code for decryption code is IDENTICAL in other entries, so if we can crack Breakfast's decryption method, we can do the same for ALL other games (Thanks Rovio). Meanwhile, here's the function that calls decryptPackage. inflate() is part of deng.FZip. References to functions that call it are below. Any advice on altering this mechanism to make the game write decrypted files to a directory when running or will a tool/script to decrypt them will be made? Thanks so much. The AB pages on TCRF would likely be greatly assisted from this being cracked.

https://raw.githubusercontent.com/Leoxi ... pFile.java
https://raw.githubusercontent.com/n1889 ... ZipFile.as

LolHacksRule, posted Mon Jul 19, 2021 6:53 pm (65263)

---

Very late but there's two unobfuscated builds of Angry Birds Friends on Rovio's mobile and madness.new-feature servers, and still has many Flash assets that were later archived by the Flashpoint team. SecureSWF obfuscates most parameter names and symbols but the unobfuscated builds of the game have them. The level files are also encrypted in a very similar way, minus SHA1 hashes, so cracking the packages will likely be related to both LVL and Lua files. Madness is newer so I'm linking that.

More info from the classes: https://github.com/LolHacksRule/AngryBi ... eLoader.as https://github.com/LolHacksRule/AngryBi ... lLoader.as

LolHacksRule, posted Sun Oct 17, 2021 9:46 pm (67073)

---

Little update:

According to IGTABP in the AB Modding Hub, they're also deflate compressed, which is funny since I thought after decryption you'd get the PAK.