ZenHAX

Free Game Research Forum | Official QuickBMS support | twitter @zenhax | SSL HTTPS://zenhax.com
It is currently Thu Jan 20, 2022 1:40 pm

All times are UTC




Post new topic  Reply to topic  [ 10 posts ] 
Author Message
PostPosted: Sat Jan 15, 2022 9:50 am 

Joined: Sat Jan 08, 2022 10:09 pm
Posts: 7
Hi all, I have a side-by-side comparison of Dragon Quest Rivals for mobile vs switch. The mobile files appear to be encrypted, whereas switch is not. Would anyone mind taking a look at the attached .tga file encryption for example? Is this possible to decrypt?

My latest available switch dump contains fewer files (game service ended and it cannot be updated anymore). The latest mobile dump I have available has many more files which I would like to access and preserve.

Thanks for everyone's time. Is this something solvable with xor/bms/debugger etc? Or not possible?


Attachments:
DQ_Rivals_mobile vs switch.zip [4.75 MiB]
Downloaded 11 times
Top
   
PostPosted: Sat Jan 15, 2022 11:25 am 

Joined: Fri Sep 20, 2019 7:55 am
Posts: 26
The "ENC" is probably followed by the compressed file size.
And since the file size is a number that is neatly divisible, can see that padding is applied at the time of compression.


Top
   
PostPosted: Sun Jan 16, 2022 2:25 am 

Joined: Sat Jan 08, 2022 10:09 pm
Posts: 7
Hi! I've looked at the contents using HxD, but it's a bit foreign to me still. Thanks for the tips. I'll try to work at it and see what I can learn. Is this example something I could decipher on my own and make my own quickbms script? Any advice welcome. I wanted to make sure it's doable (and not a hundreds of thousands of hours unbreakable code scenario) before I spend a long time trying to learn to do it.


Top
   
PostPosted: Sun Jan 16, 2022 3:48 am 

Joined: Fri Sep 20, 2019 7:55 am
Posts: 26
Me too.
I posted it on xentax, but I used to have a switch and could get the data myself, but then I let go of the switch and deleted the data I got, so I don't have the data now...
I don't think the compression and encryption methods used by this game are easy to analyze. It seems that it is processed by a function called SQEXEncrypter, but I could not understand it.

If this game was running in DirectX, I could have used NinjaRipper, but Cocos2D only runs in OpenGL, so I couldn't use that method either.


Top
   
PostPosted: Sun Jan 16, 2022 3:51 pm 

Joined: Sat Jan 08, 2022 10:09 pm
Posts: 7
Have you ever tried using GLXtractor (GL extractor)? Similar to Ninja Ripper but for OpenGL. Maybe that could work for you. I successfully used GLXtractor for some Double Dragon Neon assets. I haven't ever used Cocos2D though. Maybe the mobile Rivals version can be ripped with GLXtractor?

Anyway, I will continue looking at the mobile file encryption and see what I can figure out. I think I am out of my league though.


Top
   
PostPosted: Sun Jan 16, 2022 10:05 pm 

Joined: Sat Sep 28, 2019 7:00 pm
Posts: 493
The game is using standard aes-128-cbc encryption, except that the key and IV are statically generated at runtime. Attached script was tested on mobile version of Dragon Quest Rivals Ace v3.8.0 and samples from the first post.

I suppose tga textures are using ETC1 compression (for more info read here).

Update: Script is updated to automatically decompress decrypted assets in case if they're compressed (like samples from the first post).

Update 2: Updated script can now convert/fix tga textures for usage with etc1tool from Android SDK platform tools, available here. Simply run script on already decrypted and decompressed texture and it will be replaced with fixed one, just don't forget to launch quickbms with "-w" option to allow write operations.


Attachments:
dq_rivals_decrypt-convert.zip [671 Bytes]
Downloaded 4 times

_________________
You can request AES keys on rin forums (the list with keys is also there)
AES keys finder and latest UE4 bms scripts: in this post


Last edited by spiritovod on Mon Jan 17, 2022 1:42 pm, edited 3 times in total.
Top
   
PostPosted: Mon Jan 17, 2022 2:39 am 

Joined: Sat Jan 08, 2022 10:09 pm
Posts: 7
Wow! Thanks so much. Thanks for your time and thanks for the info. Still learning (a lot...) but hopefully one day I'll be able to help out rather than just ask questions.

I will check it out tonight and let you know how it goes.

Can I ask, about the key and IV being statically generated at runtime- does that mean it was simpler to decrypt? Because all that info is in the encrypted file rather than being stored elsewhere? (Sorry if I'm way off.) Just trying to understand a little better.

Thanks again for the help!


Top
   
PostPosted: Mon Jan 17, 2022 8:54 am 

Joined: Sat Jan 08, 2022 10:09 pm
Posts: 7
The script works really well on every file I've tried so far. Using Joschka's .c3b noesis plugin, I've attached a few screen captures of successful models + animations extracted from the mobile game into blender.

I haven't gotten as far as doing anything with the compressed ETC1 .tga. I threw a few existing tools at it to see if it'd be so easy, but seems not (so far). Mali Texture Compression Tool doesn't seem to load any of the .tga files, and the etcpack.exe (included with Mali) via command line throws an error that it's not the right format. Another tool, etc1tool.exe, works but the output .tga doesn't have a familiar header and can't be opened with anything as far as I can tell (maybe it's raw and just needs a header added manually afterward?). I'll have to inspect/compare a resulting .tga vs a switch .tga to see if it's familiar at all or not.

Anyway that's a success with the models! But on first attempt I've struck out with the textures, haha.


Attachments:
DQRivals_decrypted_m5012_000.JPG [35.83 KiB]
Not downloaded yet
DQRivals_decrypted_ch0131_000.JPG [29.42 KiB]
Not downloaded yet
DQRivals_decrypted_ch0106_000.JPG [30.34 KiB]
Not downloaded yet
Top
   
PostPosted: Mon Jan 17, 2022 1:38 pm 

Joined: Sat Sep 28, 2019 7:00 pm
Posts: 493
@Boxy: I've updated script and also the post with more info about how to convert tga textures. Not sure if result is totally correct, but at least it works.

_________________
You can request AES keys on rin forums (the list with keys is also there)
AES keys finder and latest UE4 bms scripts: in this post


Top
   
PostPosted: Mon Jan 17, 2022 4:08 pm 

Joined: Sat Jan 08, 2022 10:09 pm
Posts: 7
Thanks again. The update is working on all textures I have tried so far. Working really well. (some examples attached)

I also attached a comparison for a texture, between mobile and switch versions. For anyone who is curious to see. There is some color banding and noise in the decoded mobile version, but I think that's probably to be expected given that ETC1 is lossy, right? No complaints at all, your work is really well done. If I happen to encounter any textures that do not work, I will let you know. But everything I have tried works.


Attachments:
ch0027_001_compare_left-mobile_right-switch.png [98.66 KiB]
Not downloaded yet
DQRivals_ch0108_000_texture decode_.JPG [32.8 KiB]
Not downloaded yet
DQRivals_ch0106_000_texture decode.JPG [26.33 KiB]
Not downloaded yet
Top
   
Display posts from previous:  Sort by  
Post new topic  Reply to topic  [ 10 posts ] 

All times are UTC


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Powered by phpBB® Forum Software © phpBB Limited