This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=12756

LolHacksRule, posted Mon Nov 04, 2019 5:56 pm (51889)

---

Cannot open these SAR files, not plain ZIP/7Z/RAR. https://we.tl/t-a2YLBOoNja, they appear to contain all the game data. Offzip doesn't help.

Ekey, posted Mon Nov 04, 2019 7:41 pm (51894)

---

Probably encrypted. Share apk or ipa.

LolHacksRule, posted Mon Nov 04, 2019 7:55 pm (51896)

---

https://we.tl/t-Zc5euE5oUK

Ekey, posted Mon Nov 04, 2019 7:56 pm (51897)

---

Temporary script : viewtopic.php?p=38006#p38006

LolHacksRule, posted Mon Nov 04, 2019 8:00 pm (51898)

---

Sorry about that, I think the APK is partially incomplete... But thanks anyway also sorry about this accidental repost on this game.

Ekey, posted Mon Nov 04, 2019 9:07 pm (51900)

---

Do you have iOS version ?

LolHacksRule, posted Mon Nov 04, 2019 10:59 pm (51904)

---

Err no, I focus only on Android. https://we.tl/t-wLv4GHHaUt proper upload of APK split.

Ekey, posted Mon Nov 04, 2019 11:19 pm (51905)

---

Nwm. I just found algorithm for decrypt. At the moment, I'm studying it how it works.

Ekey, posted Tue Nov 05, 2019 4:01 pm (51914)

---

Well, there was a problem with decompressing data. Some files cannot be decompressed (95% of files ). Always same error.

Code:

Info:  algorithm   478
       offset      00000008
       input size  0x00000199 409
       output size 0x00000a6a 2666
       result      0xffffffe0 -32
       
Error: the uncompressed data (-32) is bigger than the allocated buffer (2666)
       It usually means that data is not compressed or uses another algorithm

I will tryed to use comtype scanner, but it didn't give good results. Header of compressed files always start like:

Code:

dwSignature -> ZSTD
dwDecompressedSize

PS: Files data decrypted correctly!

Example files is attached. Maybe someone can tell what the problem is?

Edited: I compiled ZSTD library from source's and tool give error like :

Code:

Decoding error (36) : Dictionary mismatch

Edited2: Everything works fine on textures, but something is wrong on files like plaintext (json, lua, dat and etc..).

Some pics.

Ekey, posted Tue Nov 05, 2019 7:46 pm (51920)

---

Okay, i solved this puzzle. A dictionary file is sometimes present in archives and named like:

Code:

pkgcdict_pc.dat
pkgcdict_ios.dat
pkgcdict_android.dat

We can use it for decompress. Example decompress file with using zstd tool > loc\english\pc\locale.json

Code:

zstd -D pkgcdict_pc.dat --decompress locale.json

We get normal unpacked data

https://pastebin.com/5ni2rvdP

Now the most important question: How can we use this dictionary to work in QuickBMS?

Edited: I tryed use dictionary like that but doesn't work. Bug?

Code:

set DICTIONARY compressed ".....compressed_dict_here...."
strlen DICTIONARY_SIZE DICTIONARY 1
comtype zstd DICTIONARY DICTIONARY_SIZE

Ekey, posted Sun Nov 10, 2019 2:38 pm (52007)

---

I could not get QuickBMS to work with the dictionary, so I wrote my unpacking tool! Tested on

Code:

Marvel Puzzle Quest (PC and Android)
SEGA Heroes: Match-3 RPG Quest (Android)

Code:

[Usage]
    SARUnpacker  

Code:

[Example]
    SARUnpacker D:\Android_BaseContent.sar D:\Unpacked\Android_BaseContent

SARUnpacker-bin.rar

LolHacksRule, posted Mon Nov 18, 2019 7:35 pm (52016)

---

Thank you so much! Some JSON files aren't auto-double-decompressed and have ZSTD in the compressed data. There's also a new JSON binary data serializer used in newer versions, not asking how to break it but I'll see soon (looks tough), LBC files have two LuaJit files compiled in them with the exact same data. Also how would I repack them?

Code:

LJ LBC data:

5bytes: Always F3 82 C8 A3 01, header
3bytes: zero
1byte: 20
3bytes: zero
1-3bytes: LuaJit binary size, data count above 255 uses 1-2 extra bytes in little endian.
1byte: zero
1-3bytes: Some data size? Filesize?, data count above 255 uses 1-2 extra bytes in little endian.
1byte: zero
1-3bytes: LuaJit binary size, data count above 255 uses 1-2 extra bytes in little endian.
9bytes: zero
beyond: LuaJit binary data, always repeated twice, idk why.

zeaofsuos, posted Wed Mar 18, 2020 11:37 am (54712)

---

ADMIN, DELETE.

billymays, posted Tue Oct 13, 2020 1:32 pm (59399)

---

Sorry for the necropost, but I was wondering if Ekey (or someone else) could help with reconstructing a SAR. It should be theoretically simple, I want to reconstruct Android_ClientSettings.sar with contains just one file (a JSON), and I could probably even work from the SARUnpacker source if Ekey is willing to provide it. Like I said, it's just trying to repack a single file.

plizard, posted Mon May 10, 2021 7:44 pm (63877)

---

Hi, sorry for the necropost

First off, EKey's tool works wonderfully. However, I was wondering if anyone could help me understand why this all works, as I'm trying to get a better grasp of things.

From reading through it all, it seems like, quickBMS is first used to decompress the *.sar archive based on the bms script provided by aluigi. Afterwards, it seems like zstd is used to apply the dictionary key to the individual extracted items. My guess is the tool just encapsulates both steps? However, where I seem to be at a loss is why it seems to work with the pc_config.sar file. When I open it up in HxD, I don't see a ZSTD header, yet the tool seems to work on it just fine. Is there something that I'm missing?

Thanks in advance

Ekey, posted Tue May 11, 2021 11:32 am (63890)

---

I'm a lazy ass, so if someone wants to make a packer, then I attach the source code :B

SAR.Unpacker-bin-src.rar

plizard, posted Tue May 11, 2021 2:07 pm (63893)

---

Hi Ekey,

Thanks for the source code! I'll try to take a look at it later. In the meantime, maybe you can help me with something. I tried running your tool on the latest updates, and got this error:

Code:

Demiurge Studios SAR Unpacker
(c) 2019 Ekey (h4x0r) / v1.0.0.0

Unhandled Exception: System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.IO.IOException: Unknown frame descriptor
   at Zstandard.Net.ZstandardInterop.ThrowIfError(UIntPtr code)
   at Zstandard.Net.ZstandardStream.Read(Byte[] buffer, Int32 offset, Int32 count)
   at System.IO.Stream.InternalCopyTo(Stream destination, Int32 bufferSize)
   at System.IO.Stream.CopyTo(Stream destination)
   at SARUnpacker.Core.Compression.ZSTD.iDecompress(Byte[] lpSrcBuffer, Int32 dwZSize)
   at ????????.????????(String ?????T??, String ????????)
   at SARUnpacker.Program.Main(String[] args)
   --- End of inner exception stack trace ---
   at System.RuntimeMethodHandle.InvokeMethod(Object target, Object[] arguments, Signature sig, Boolean constructor)
   at System.Reflection.RuntimeMethodInfo.UnsafeInvokeInternal(Object obj, Object[] parameters, Object[] arguments)
   at System.Reflection.RuntimeMethodInfo.Invoke(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   at CompressShell.Main(String[] args)

I'm not quite sure if they changed the way they did compression. I have the *.sar file uploaded here:
https://filebin.net/fij4amv0vmcidthx

Thanks in advance

Ekey, posted Tue May 11, 2021 2:21 pm (63895)

---

Probably something has changed in the encryption. Where is this file from?

plizard, posted Tue May 11, 2021 2:31 pm (63896)

---

So the game goes through two different types of updates: a release update every two weeks, and a daily data push. This file came from the daily data push. When you run the game, it downloads the update files into your /appdata/local/demiurge studios/marvel puzzle quest/data folder.

There was a release update yesterday, and your tool worked fine on that config file, but failed on the configUpdate file, where it's been working on in the past.

Ekey, posted Tue May 11, 2021 3:24 pm (63897)

---

Well, problem in building encryption key

replace this line in Reader.cs

Code:

string lpEncryptionKey = String.Format("{0}{1}", wBuildVersionMinor   wBuildVersionMajor, dwBuildChangeList);

to this

Code:

string lpEncryptionKey = String.Format("{0}{1}", wBuildVersionMajor, dwBuildChangeList);

plizard, posted Tue May 11, 2021 3:39 pm (63898)

---

Awesome, that worked! so from the looks of it, they just simplified the encryption key?

Ekey, posted Tue May 11, 2021 3:46 pm (63899)

---

?\_(?)_/?

plizard, posted Tue May 11, 2021 3:47 pm (63900)

---

LOL. I'm curious as to how you were able to spot this, as I'm trying to get better at it. I'm going through the archive in HxD and getting a bit overwhelmed trying to decipher the header

Either way, you have my thanks!