This topic was archived here:

https://web.archive.org/web/20230000000000fw_/https://www.zenhax.com/viewtopic.php?t=16219

misorasyu, posted Fri Dec 17, 2021 5:27 pm (68315)

---

AssetStudio is a fantastic tool which can extract most of .unity3d files of this game.
However some strange files without version 6 follow by UnityFS cannot be recognized by AssetStudio/UABEA/UABE.


The common UnityFS should be


I think the header part of the 1st one has been encrypted or compressed.
How to decrypt/decompress it?

The attachment contains two .unity3d files.
One is the normal case can be extracted by AssetStudio and the other is the abnormal case with strange header.
Both two .unity3d files come from the same game, that is Alice Gear Aegis, and have similar binary structure because they are two models of the same character.

aluigi, posted Thu Jan 06, 2022 5:42 pm (68760)

---

I think it just has 128 bytes xored with a fixed key.

Since I don't know if the key is fixed for all your files, I have made a script for quickbms that automatically retrieve it and decrypts the file:

Code:

get NAME basename
get EXT extension
string NAME p "%s_new.%s" NAME EXT

encryption xor "\0\0\0\x065.x.x\x002018.4"
log MEMORY_FILE 8 16
encryption "" ""
getdstring KEY 16 MEMORY_FILE

log NAME 0 8
append
encryption xor KEY "" 0 16
log NAME 8 0x88
encryption "" ""
get SIZE asize
math SIZE - 0x88
log NAME 0x88 SIZE
append

*update* I forgot to set the size of the key in Encryption, now fixed

LuigiwithTHEDoNg, posted Fri Jan 07, 2022 4:02 am (68787)

---

I also saw it uses Blowfish and AES encryption in the game's mono scripts for those assets.

LuigiwithTHEDoNg, posted Fri Jan 07, 2022 4:04 am (68788)

---

Plus, some assets which have a lower version of unity don't have that odd header than the ones from 2018.4.32 and above.

LuigiwithTHEDoNg, posted Fri Jan 07, 2022 12:20 pm (68796)

---

but...there are some files that are not opening in assetstudio (even from your script)

einherjar007, posted Sat Jan 08, 2022 12:07 am (68810)

---

Code:

encryption xor KEY "" 0 16
log NAME 8 0x80

There seems to be files with different cut lengths.
I checked only the sample. Change 0x88 at this point to 0x80. Only one of the three.