This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=14245

radix01, posted Tue Oct 13, 2020 12:26 pm (59397)

---

I want to find somebody unpacks data file game TS2 ONLINE for me
this game website https://ts2.chinesegamer.net/ or somebody has bms script
THANK YOU

contact me discord: Master#7272

radix01, posted Tue Oct 13, 2020 12:31 pm (59398)

---

atom0s, posted Tue Oct 13, 2020 10:31 pm (59408)

---

Most of the .dat files for this game are encrypted/encoded differently than each other. You would need to be more specific on which file you are looking to get the data from. Also, they mostly seem to be serialized / binary data for the most part.

An example of what I mean, each file has its own reader/processor function that looks like this:

Code:

int __fastcall sub_70471C(int a1)
{
  int v1; // eax
  signed int v2; // ebx
  int v3; // esi
  int v4; // ecx
  int v5; // eax
  signed int v6; // ebx
  int v7; // esi
  int v8; // ecx
  int result; // eax
  unsigned int v10; // [esp-Ch] [ebp-34h]
  void *v11; // [esp-8h] [ebp-30h]
  int *v12; // [esp-4h] [ebp-2Ch]
  int v13; // [esp Ch] [ebp-1Ch]
  int v14; // [esp 10h] [ebp-18h]
  int v15; // [esp 14h] [ebp-14h]
  int v16; // [esp 18h] [ebp-10h]
  void *v17; // [esp 1Ch] [ebp-Ch]
  void *v18; // [esp 20h] [ebp-8h]
  int v19; // [esp 24h] [ebp-4h]
  int savedregs; // [esp 28h] [ebp 0h]

  v19 = a1;
  v12 = &savedregs;
  v11 = &loc_70489C;
  v10 = __readfsdword(0);
  __writefsdword(0, (unsigned int)&v10);
  v17 = &unk_9695E4;
  v18 = &unk_9695F9;
  v14 = 21;
  v1 = *(unsigned __int16 *)(a1   4230);
  if ( v1 > 0 )
  {
    v13 = v1;
    v2 = 1;
    do
    {
      v16 = v19   21 * v2   8;
      v15 = v2 % 2;
      if ( v14 - 1 >= 0 )
      {
        v3 = v14;
        v4 = 0;
        do
        {
          *(_BYTE *)(v16   v4) ^= (unsigned __int8)((223 * v2   *((unsigned __int8 *)*(&v17   v15)   v4)   162) % 255)
                                  1;
            v4;
          --v3;
        }
        while ( v3 );
      }
      v5 = 21 * v2;
      *(_BYTE *)(v19   v5   8) ^= 0x5Du;
      *(_BYTE *)(v19   v5   9) ^= 0x85u;
      *(_WORD *)(v19   v5   10) ^= 0x3FECu;
      *(_BYTE *)(v19   v5   12) ^= 0x5Du;
      *(_BYTE *)(v19   v5   13) ^= 0x85u;
      *(_BYTE *)(v19   v5   14) ^= 0x5Du;
      *(_DWORD *)(v19   v5   15) ^= 0x370A0724u;
      *(_BYTE *)(v19   v5   19) ^= 0x85u;
      *(_DWORD *)(v19   v5   20) ^= 0x1FB9DC0Bu;
      *(_BYTE *)(v19   v5   24) ^= 0x5Du;
      *(_DWORD *)(v19   v5   25) ^= 0x370A0724u;
        v2;
      --v13;
    }
    while ( v13 );
  }
  if ( (signed int)*(unsigned __int16 *)(v19   4230) > 0 )
  {
    v13 = *(unsigned __int16 *)(v19   4230);
    v6 = 1;
    do
    {
      v16 = v19   21 * v6   8;
      v15 = v6 % 2;
      if ( v14 - 1 >= 0 )
      {
        v7 = v14;
        v8 = 0;
        do
        {
          *(_BYTE *)(v16   v8) ^= *((_BYTE *)*(&v17   v15)   v8);
            v8;
          --v7;
        }
        while ( v7 );
      }
        v6;
      --v13;
    }
    while ( v13 );
  }
  result = 0;
  __writefsdword(0, v10);
  return result;
}

The main launcher loads Agree.dat which is just basic xor encoded though with the key of: 0x33

radix01, posted Wed Oct 14, 2020 3:42 am (59411)

---

how do you know that file xor with 0x33 . can contact me on discord. i need you help

atom0s, posted Wed Oct 14, 2020 3:56 am (59412)

---

The agree.dat is loaded inside of TS2Online.exe via this function:

Code:

int __usercall sub_4D5114@(int a1@, int a2@)
{
  int v2; // ebx
  int v3; // ecx
  int v4; // ecx
  int v5; // ecx
  int v6; // ecx
  unsigned int v8; // [esp-18h] [ebp-188h]
  void *v9; // [esp-14h] [ebp-184h]
  int *v10; // [esp-10h] [ebp-180h]
  unsigned int v11; // [esp-Ch] [ebp-17Ch]
  int v12; // [esp-4h] [ebp-174h]
  int v13; // [esp Ch] [ebp-164h]
  int v14; // [esp 15Ch] [ebp-14h]
  char v15; // [esp 162h] [ebp-Eh]
  char v16; // [esp 163h] [ebp-Dh]
  int v17; // [esp 164h] [ebp-Ch]
  int v18; // [esp 168h] [ebp-8h]
  int v19; // [esp 16Ch] [ebp-4h]
  int savedregs; // [esp 170h] [ebp 0h]

  v13 = 0;
  v14 = 0;
  v18 = a2;
  v19 = a1;
  sub_404D78();
  v11 = __readfsdword(0);
  __writefsdword(0, (unsigned int)&v11);
  v2 = 0;
  v15 = 0x33;
  if ( (unsigned __int8)sub_4095D8(v11, &loc_4D5250, &savedregs) )
  {
    v10 = &savedregs;
    v9 = &loc_4D51F3;
    v8 = __readfsdword(0);
    __writefsdword(0, (unsigned int)&v8);
    sub_402F0C(v3, v18);
    sub_403434(v4, 1);
    sub_402924();
    ((void (*)(void))sub_4048D8)();
    do
    {
      sub_403070(&v17);
      sub_402924();
      LOBYTE(v2) = v15 ^ v16;
      sub_404AB8(v5, v2);
      sub_404B98(v6, v13);
    }
    while ( v17 );
    sub_4030B0();
    sub_402924();
    __writefsdword(0, v8);
    (*(void (**)(void))(**(_DWORD **)(v19   756)   220))();
    (*(void (__fastcall **)(_DWORD, int))(**(_DWORD **)(*(_DWORD *)(v19   756)   544)   56))(
      **(_DWORD **)(*(_DWORD *)(v19   756)   544),
      v14);
    LOBYTE(v2) = 1;
  }
  __writefsdword(0, v11);
  sub_4048D8(&loc_4D5257);
  sub_4048D8(v12);
  sub_4048D8(v12);
  return v2;
}

The xor key is set in v15 (0x33) and applied byte-per-byte in the loop here:

Code:

    do
    {
      sub_403070(&v17);
      sub_402924();
      LOBYTE(v2) = v15 ^ v16;
      sub_404AB8(v5, v2);
      sub_404B98(v6, v13);
    }
    while ( v17 );

radix01, posted Wed Oct 14, 2020 4:04 am (59413)

---

xor 0x33 for Agree.dat right ?

radix01, posted Wed Oct 14, 2020 5:08 am (59415)

---

what's is programs to get Code

atom0s, posted Sat Apr 16, 2022 8:26 pm (71164)

---

IDA Pro with HexRays plugin.