ZenHAX

Free Game Research Forum | Official QuickBMS support | twitter @zenhax | SSL HTTPS://zenhax.com
It is currently Tue Jan 23, 2018 4:18 am

All times are UTC




Post new topic  Reply to topic  [ 4 posts ] 
Author Message
PostPosted: Sat Dec 09, 2017 10:44 am 
User avatar

Joined: Sat Aug 09, 2014 2:28 pm
Posts: 23
EDIT: Looks like CriPakGUI, the tool I used to extract the cpks, is just doing something wrong here. I tried some other cpk extractors and the extracted files look ok.
Hi,

I was looking at the files of the game 428: Shibuya Scramble for the Wii. Most of the files are encrypted. But at the end of each file there is a part that is not encrypted. This part seem to be the first 256 bytes of the original file. See:
Image

At 0xC is a pointer (little endian) that points to the end of the encrypted file (0x01D0 + 0x10 (header size maybe) = 0x01E0). The orignial file is a TPL (image) with the identifier "00 20 AF 30".

Any idea how to decrypt this?


Attachments:
enc.zip [33.32 KiB]
Downloaded 17 times

_________________
That feeling when you hit F7 to create a new folder inside a windows save prompt...


Last edited by RetroHelix on Tue Jan 09, 2018 4:45 pm, edited 2 times in total.
Top
   
PostPosted: Sun Jan 07, 2018 8:37 pm 
User avatar

Joined: Sat Aug 09, 2014 2:28 pm
Posts: 23
Looks like the data is not encrypted but compressed... Luckily there are some uncompressed files on the disc and I was able to find an uncompressed and a compressed version of the same file. When I did a comtypescan with quickbms I got mostly garbage but there was one compressiontype which was able to extract at least a small part right. With comtype 629 COMP_LZW_STELLAR7 the string "DUMMY_LABEL" was extracted correctly:
Image

For the archiveformat:
long unk #always 0x0000
long unk #always 0x0000
SIZE long
ZSIZE long

Can anyone make sense of this?


Attachments:
files.zip [3.14 KiB]
Downloaded 9 times

_________________
That feeling when you hit F7 to create a new folder inside a windows save prompt...
Top
   
PostPosted: Sun Jan 07, 2018 10:00 pm 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 7478
Probably that "DUMMY_LABEL" comes from your memory, that's quite normal with wrong compression algorithms that read data outside their buffers.


Top
   
PostPosted: Mon Jan 08, 2018 8:02 pm 
User avatar

Joined: Sat Aug 09, 2014 2:28 pm
Posts: 23
aluigi wrote:
Probably that "DUMMY_LABEL" comes from your memory, that's quite normal with wrong compression algorithms that read data outside their buffers.

I see. Thanks for the information :)

_________________
That feeling when you hit F7 to create a new folder inside a windows save prompt...


Top
   
Display posts from previous:  Sort by  
Post new topic  Reply to topic  [ 4 posts ] 

All times are UTC


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Powered by phpBB® Forum Software © phpBB Limited