ZenHAX

Free Game Research Forum | Official QuickBMS support | twitter @zenhax | SSL HTTPS://zenhax.com
It is currently Sat Sep 21, 2019 4:02 pm

All times are UTC




Post new topic  Reply to topic  [ 3 posts ] 
Author Message
PostPosted: Mon Feb 18, 2019 12:11 pm 
User avatar

Joined: Tue May 08, 2018 7:48 pm
Posts: 72
I'm trying to implement my own UE4 archive un/repacker in .Net and its working well for not encrypted files.

The problem is that I can't decrypt encrypted UE4 data blocks.

the code I used is below.

Code:
byte[] key = {
    0x45, 0xDD, 0x15, 0xD6, 0xDD, 0x2D, 0xA5, 0x0A, 0xEB, 0x71, 0xCE, 0x7A, 0x52, 0x84, 0xCF, 0x8E,
    0xA4, 0x98, 0xB2, 0xEC, 0x3D, 0x52, 0xB7, 0xE3, 0x36, 0xF3, 0xEA, 0x00, 0x71, 0xCE, 0x44, 0xB3
};

byte[] encryptedData = File.ReadAllBytes(encryptedFIlePath);
byte[] decryptedData;

using (RijndaelManaged rDel = new RijndaelManaged())
{
    rDel.Key = key;
    rDel.KeySize = 256;
    rDel.BlockSize = 128;
    rDel.Mode = CipherMode.ECB;
    rDel.Padding = PaddingMode.None;

    using (var decryptor = rDel.CreateDecryptor())
    {
        decryptedData = decryptor.TransformFinalBlock(encryptedData, 0, encryptedData.Length);
    }
}

File.WriteAllBytes(decryptedFIlePath, decryptedData);


I have tried 256 BlockSize, other CipherModes but nothing worked.

The sample data I'm using is from PUBG and quickbms can easily decrypt it.

Code:
encryption aes "45DD15D6DD2DA50AEB71CE7A5284CF8EA498B2EC3D52B7E336F3EA0071CE44B3" "" 0 32
get FILESIZE asize
log "decrypted.bin" 0 FILESIZE


What am I doing wrong?
Please help me. Thanks.


Attachments:
decrypted.bin [1.69 KiB]
Downloaded 63 times
encrypted.bin [1.69 KiB]
Downloaded 59 times
Top
   
PostPosted: Mon Feb 18, 2019 1:23 pm 
User avatar

Joined: Tue May 08, 2018 7:48 pm
Posts: 72
I was dumb, using key as ASCII string worked. I thought the key is hexstring... I wasted almost 8 hours on this.

Code:
byte[] key = Encoding.ASCII.GetBytes("45DD15D6DD2DA50AEB71CE7A5284CF8E");


Top
   
PostPosted: Tue Feb 19, 2019 4:05 am 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 10569
eh sometimes it's just unluck.
In fact often the recent ue4 keys are hex but they usually start with a "0x" prefix or the "\x" escapes for tagging them as hex.


Top
   
Display posts from previous:  Sort by  
Post new topic  Reply to topic  [ 3 posts ] 

All times are UTC


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Powered by phpBB® Forum Software © phpBB Limited