This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=12942

Drawing, posted Tue Dec 24, 2019 10:03 pm (52772)

---

Hi guys.
Found this game with nice models and I would like to unpack the content that is stored in .kfs archive



site: https://yh.duoyi.com/

Sample: https://www.mediafire.com/file/pmhu3apann6su89/Model.kfs/file

Ekey, posted Wed Dec 25, 2019 7:49 pm (52785)

---

Seems data is xor'ed. Upload main executable with all modules.

Drawing, posted Wed Dec 25, 2019 8:52 pm (52787)

---

Here you are

https://www.mediafire.com/file/o5l2lw5colhcl6l/exemodules.rar/file

Drawing, posted Sat Jan 04, 2020 9:13 pm (52978)

---

any news ?
If you need other files just ask

atom0s, posted Sun Jan 05, 2020 3:15 am (52981)

---

em_start.exe has some KFS file reading/referencing in it.

Key: Z.j^eihLui4e923@91WkBN19f_3x?Ubq
Key Size: 32

Decryption method is done via:

Code:

sub_417880((int)off_4224B0, dword_4224B8, (int)v8, v9, 0);

Code:

int __cdecl sub_417880(int a1, int a2, int a3, int a4, int a5)
{
  int v5; // edx
  int i; // eax

  v5 = a5 % a2;
  for ( i = 0; i < a4;   i )
  {
    *(_BYTE *)(i   a3) -= *(_BYTE *)(v5     a1);
    if ( v5 >= a2 )
      v5 = 0;
  }
  return 0;
}

off_4224B0 points to the encryption key.
dword_4224B8 points to the encryption key size. (32)
v8 is a pointer to a buffer of the data to decrypt.
v9 is the size of the buffer.

Should be all the info needed to decrypt it.

Ekey, posted Sun Jan 05, 2020 6:41 am (52983)

---

Ok, decryption is simple

Code:

unsigned char lpKey[32] = {
    0x5A, 0x2E, 0x6A, 0x5E, 0x65, 0x69, 0x68, 0x4C, 0x75, 0x69, 0x34, 0x65, 0x39, 0x32, 0x33, 0x40, 
    0x39, 0x31, 0x57, 0x6B, 0x42, 0x4E, 0x31, 0x39, 0x66, 0x5F, 0x33, 0x78, 0x3F, 0x55, 0x62, 0x71};
  
void iDecrypt(unsigned char* lpBuffer, int dwSize)
{
   for (int i = 0; i    {
      lpBuffer[i] -= lpKey[i % 32];
   }
}

The header and entry table is at the end of the file.

Code:

fseek(fi, -16, SEEK_END);

Code:

struct KFSHeader
{
   uint32_t   dwID; //0xFF0D2C3A
   uint32_t   dwTotalFiles;
   uint32_t   dwTableSize;
   uint32_t   dwTableOffset;
};

struct KFSEntry
{
   uint16_t   wFileNameLength; //shl 1 or *2 = as you wish :)
   uint8_t    bUnknown1; //0
   uint32_t   dwUnknown1; //1
   uint32_t   dwSize;
   uint32_t   dwZSize;
   uint32_t   dwOffset; //???? -> IMUL ECX,DWORD PTR DS:[EAX],0x9E3779B1 , AND ECX,0x7FFFFFFF
};

Currently not clear with dwOffset field.

Drawing, posted Mon Jan 13, 2020 3:44 pm (53205)

---

waiting for aluigi's help

aluigi, posted Wed Mar 25, 2020 2:16 pm (55078)

---

I made the script but I don't understand if the files are xored with some specific byte or not:
http://aluigi.org/bms/eternal_magic_kfs.bms