ZenHAX

Free Game Research Forum | Official QuickBMS support | twitter @zenhax | SSL HTTPS://zenhax.com
It is currently Wed Dec 19, 2018 2:02 pm

All times are UTC




Post new topic  Reply to topic  [ 9 posts ] 
Author Message
PostPosted: Fri May 26, 2017 5:28 am 
User avatar

Joined: Tue Aug 02, 2016 7:46 am
Posts: 17
Good Day.

Looks game uses some kind of cycled XOR encription for archives header. I found some regularity and tryed to rebuild xor sequence, but no luck with bytes different from zero.
Code:
  xo1:=$d9;
  for k:=0 to $FF do begin
    cryp[k]:=xo1;
    if k mod 2=1 then xo1:=xo1-1;
    if k mod 8=0 then xo1:=xo1+$B;
    if k mod 8=2 then xo1:=xo1+$3;
    if k mod 8=4 then xo1:=xo1-$5;
    if k mod 8=6 then xo1:=xo1+$3;
    if k mod 16=7 then begin
      if ((k shr 4) mod 4)=0 then xo1:=xo1-$30-$10;
      if ((k shr 4) mod 4)=2 then xo1:=xo1+$50-$10;
    end;
  end;


Can anybody help with decryption? Free Demo available on Steam http://store.steampowered.com/app/619760/

Seems first value in header is file count, after that goes 0x30 bytes blocks for each file, that contained padded filename, offset and size.

Raw archive.
Image Image

False decrypted header.
Image


Top
   
PostPosted: Sun May 28, 2017 9:13 pm 

Joined: Sat Dec 26, 2015 6:36 pm
Posts: 6
Maybe the following help:
https://github.com/shlainn/game-file-fo ... .FIL-files

and: https://github.com/jimmypw/constructor-fil


Top
   
PostPosted: Sun May 28, 2017 11:24 pm 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 9478
Yes, useful information but it's an old format (*.fil) and a slightly different encryption (cn.ini).
Script:
http://aluigi.org/bms/constructor.bms

Please let me know if there is any problem with any FIL archive because I had to "guess" if the archive uses the old or new format.


Top
   
PostPosted: Mon May 29, 2017 9:27 am 

Joined: Sat Dec 26, 2015 6:36 pm
Posts: 6
FIL archives and cn.ini work without any problems. (Tested with my purchased game)
The TEXT.* files are not decrypted at least not as plain text.


Top
   
PostPosted: Mon May 29, 2017 11:22 am 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 9478
Can you upload a couple of these TEXT files?
There are no *.TEXT in the demo


Top
   
PostPosted: Mon May 29, 2017 12:40 pm 

Joined: Sat Dec 26, 2015 6:36 pm
Posts: 6
Sure. Here you go


Attachments:
ConstructorTextFiles.zip [1.25 MiB]
Downloaded 38 times
Top
   
PostPosted: Tue May 30, 2017 3:11 pm 

Joined: Sat Dec 26, 2015 6:36 pm
Posts: 6
Any news ? :)


Top
   
PostPosted: Tue May 30, 2017 4:17 pm 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 9478
I did just a "one minute" quick check by using the original obfuscation algorithm with different constants but no luck.
I have only updated the script to catch the "TEXT.*" files because the original script checked the "*.TEXT", anyway these files are NOT supported at the moment.


Top
   
PostPosted: Mon Dec 17, 2018 8:37 am 

Joined: Thu Aug 17, 2017 7:30 am
Posts: 5
Hi! I have a file ".fil". That I would like to unzip and recompress the files it contains(or is that I suppose).It contains files ".dat", ".bin", ".tiz" and others. It is a file from the year 1999. Is there any possibility of extracting the files?

Quote:
Image


Quote:


Top
   
Display posts from previous:  Sort by  
Post new topic  Reply to topic  [ 9 posts ] 

All times are UTC


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Powered by phpBB® Forum Software © phpBB Limited