This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=15644

Krysics, posted Mon Aug 09, 2021 1:36 pm (65650)

---

I've been trying to reverse the encryption on this but haven't had much luck yet. I've been able to use xforce's neox-tools to unpack the NPKs and have had the most success with that. It successfully unpacks much of the res.npk though some of it is still encrypted with what I'm assuming is XOR rotor. I've tried bruteforcing with no luck. With QuickBMS I had even less luck with just the extraction only yielding encrypted files. I've tried debugging with ghidra & ida but I'm not very experienced in either. Ghidra gives the winlicense error, ida bypasses it but I was a bit lost for where to look. I've attached the OOB at the following link. https://www.mediafire.com/file/weqaojw6 ... e.zip/file

Additionally I've attached the smaller script.npk if you want to look at that without downloading the larger fileset. https://www.mediafire.com/file/06nfbrbp ... t.npk/file

Lastly I've also attached the results from neox-tools here. https://www.mediafire.com/file/f5robxir ... t.zip/file

Krysics, posted Sat Aug 14, 2021 4:01 pm (65722)

---

Thoughts anyone?

StackOverflow, posted Sun Nov 21, 2021 1:37 pm (67631)

---

From what I understand the script files are encrypted with what they call "disrete" and then encrypted with a Rotor. Were you able to go further ?