This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=15732

nezii, posted Sat Aug 28, 2021 6:28 am (65958)

---

A newbie looking for helps...

Trying to access the asset file of a mobile game Kalpa of Universe, (same producer of another game Langrisser .)

Additional Sharing:
Game Promotion Video https://www.youtube.com/watch?v=ofFByuRO-Hw
Beautiful BMG https://www.youtube.com/watch?v=3z3mtnvlHWk

Recently learnt how to use Asset Studio to browse the asset file unzipped from the apk.
Successfully access to the asset of the Langrisser,
Cant access the asset of Kalpa of Universe

I believe the files in Kalpa of Universe are encrypted? but it has normal UnityFS header?
Can anyone please check and advise what can be done?

sample of Asset file
https://we.tl/t-sw1go4HPdb
(uploaded to Wetransfer.com)

(EDIT: a more recent & smaller asset uploaded, along with the patchinfo.ini. Please check the post below)

APK LINK
Langrisser
http://mhmnzdownload.zlongame.com/MHMNZ ... -pd-ob.apk

Kalpa of Universe
http://tdjdownload.zlongame.com/TDJ/Cli ... ficial.apk

Thanks~

Drawing, posted Mon Aug 30, 2021 2:34 pm (66057)

---

Langrisser sample works well with latest assetstudio build 0.16 .

Kalpa of Universe shows an error when trying to load

einherjar007, posted Tue Aug 31, 2021 12:15 am (66069)

---

At first glance it looks like a pure UnityAssetBundle file (UnityFS), but it is encrypted.
This encryption has recently become popular in Chinese games.
I can confirm

-Punishing Gray Raven
-Castlevania Moonlight Rhapsody
-Kalpa of Universe

I have a file before encryption and a file after encryption is adopted, so I compared them, About 70 bytes of random data (probably some hash) is added to the header, and then the data is randomly replaced.

Someone already understands the method, as some people are distributing models that appear to have been extracted from Punishing Gray Raven's latest assets, but perhaps even more encryption is a concern.
Is not shared. It's understandable enough.

nezii, posted Tue Aug 31, 2021 1:41 pm (66079)

---

einherjar007 wrote:

At first glance it looks like a pure UnityAssetBundle file (UnityFS), but it is encrypted.
This encryption has recently become popular in Chinese games.
I can confirm

-Punishing Gray Raven
-Castlevania Moonlight Rhapsody
-Kalpa of Universe

I have a file before encryption and a file after encryption is adopted, so I compared them, About 70 bytes of random data (probably some hash) is added to the header, and then the data is randomly replaced.

Someone already understands the method, as some people are distributing models that appear to have been extracted from Punishing Gray Raven's latest assets, but perhaps even more encryption is a concern.
Is not shared. It's understandable enough.

Thanks for the efforts looking into it and sharing such detailed comments

(searched Punishing Gray Raven and found a related post)
https://forum.xentax.com/viewtopic.php?f=10&t=22454

There is a quickbms script shared in the post
Gonna learn about quickbms and give it a try later

Many Thanks

=========================================
Edit: Tried that BMS Script,
Realised that it's only offsetting the header, which not really helping lol
Anyway, at least learnt about QuickBMS as a gain XD

And found that you were in that post a year ago lol

Drawing, posted Tue Aug 31, 2021 4:04 pm (66083)

---

einherjar007 wrote:

At first glance it looks like a pure UnityAssetBundle file (UnityFS), but it is encrypted.
This encryption has recently become popular in Chinese games.
I can confirm

-Punishing Gray Raven
-Castlevania Moonlight Rhapsody
-Kalpa of Universe

I have a file before encryption and a file after encryption is adopted, so I compared them, About 70 bytes of random data (probably some hash) is added to the header, and then the data is randomly replaced.

Someone already understands the method, as some people are distributing models that appear to have been extracted from Punishing Gray Raven's latest assets, but perhaps even more encryption is a concern.
Is not shared. It's understandable enough.

Current Global Punishing gray Raven version is not encrypted. Just need to delete the "kuro" header before UnityFS and assetstudio is able to load files.

nezii, posted Tue Aug 31, 2021 6:23 pm (66087)

---

Update

The game has an update just then.
(I'm using the official PC client of the mobile game, instead of the Android version this time)
I located the patch files, as well as the Patch Info (as attached)



The following link contains 2 of the Asset in package09
https://we.tl/t-ASVqmlXJiD
(uploaded to Wetransfer.com)

The following codes are part of the Patch Info, that related to the above assets

Code:

[Package9]
FileCount=2
File0=client\TDJ_Data\StreamingAssets\ExportAssetBundle\ui_uiimage_selectcardimageob6_abs.b,1,15379151,8993E1E0A47B913AADC78F9196DC8942,
File1=client\TDJ_Data\StreamingAssets\ExportAssetBundle\ui_uiprefab_linkageprefab_xuanyuansword_abs.b,1,14470896,4ECD7CA02CD9021A8748E6A58638FD2A,

I also found that the Header is different to before, that it started with "CYCP." additionally

lfanguest, posted Mon Dec 20, 2021 6:02 pm (68388)

---

Drawing wrote:

einherjar007 wrote:

At first glance it looks like a pure UnityAssetBundle file (UnityFS), but it is encrypted.
This encryption has recently become popular in Chinese games.
I can confirm

-Punishing Gray Raven
-Castlevania Moonlight Rhapsody
-Kalpa of Universe

I have a file before encryption and a file after encryption is adopted, so I compared them, About 70 bytes of random data (probably some hash) is added to the header, and then the data is randomly replaced.

Someone already understands the method, as some people are distributing models that appear to have been extracted from Punishing Gray Raven's latest assets, but perhaps even more encryption is a concern.
Is not shared. It's understandable enough.

Current Global Punishing gray Raven version is not encrypted. Just need to delete the "kuro" header before UnityFS and assetstudio is able to load files.

May I ask how to delete the "Kuro" before the signature of "UnityFS"?
I want to extract its assets, but I don't know how to delete "kuro"

aluigi, posted Thu Jan 06, 2022 4:58 pm (68757)

---

@lfanguest
You can use a hex editor and doing it manually, or you can use the following script for quickbms that removes anything before "UnityFS" (no matter if it's kuro, CYCP, and so on):

Code:

findloc OFFSET binary "UnityFS"
get SIZE asize
math SIZE - OFFSET
get NAME filename
log NAME OFFSET SIZE

The output files have the same name of the input so I suggest you to select a differ output folder.

spiritovod, posted Fri Jan 13, 2023 5:25 pm (74996)

---

Modified AssetStudio for Kalpa of Universe (alternative title is Heaven and Earth Tribulation) is available here. As for Castlevania Moonlight Rhapsody (alternative title is Castlevania Moon Night Fantasy), only more recent versions are encrypted, previous ones are not, you can just look for Castlevania: Code C. Also, in recent versions global-metadata is additionally encrypted.