ZenHAX

Free Game Research Forum | Official QuickBMS support | twitter @zenhax | SSL HTTPS://zenhax.com
It is currently Thu May 25, 2017 12:24 pm

All times are UTC




Post new topic  Reply to topic  [ 6 posts ] 
Author Message
PostPosted: Thu Oct 15, 2015 5:54 pm 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 6009
NoScrubs Iris Online
http://noscrubs.net

All the dat and ns files in the data folder are ZIP files protected by password, except pet.dat which is not protected at all.
7zip and other archivers may have some problems to open the DAT files so you can use my zip.bms script and setting the passord in the ZIP_PASSWORD string with a text editor:
http://aluigi.org/bms/zip.bms

DAT files:
Code:
Failed open dat


NS files:
Code:
#7qlcRkfanwlrodld 


Top
   
PostPosted: Sat Apr 22, 2017 12:12 pm 

Joined: Fri Sep 12, 2014 11:02 pm
Posts: 53
Yo aluigi,

NoScrubs has added a new file (*.NSS) with new password, can you help?

Link (with exe and nss files): https://mega.nz/#!K9ogzDKA!My1bitRY2h1_ ... UghbMz3pBg


Top
   
PostPosted: Sat Apr 22, 2017 12:25 pm 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 6009
I don't remember what executable/dll container the other passwords, can you "grep" the exe/dll searching one of the two passwords I posted?
When you find the right file, then upload it.


Top
   
PostPosted: Sat Apr 22, 2017 12:37 pm 

Joined: Fri Sep 12, 2014 11:02 pm
Posts: 53
You can find in this *.exe I have to uploaded uploaded, here in HxD: http://prntscr.com/ezhclj
But I can't find pw: #7qlcRkfanwlrodld in this exe.


Top
   
PostPosted: Sat Apr 22, 2017 9:32 pm 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 6009
Right, the passwords are generated at runtime.
Anyway there are many of them, for example the map*.nss archives use a password that is the reverted map number and so on.
The following is the current full list of NSS archives and their relative passwords:
Code:
05s00r0ss0cc00  cha_accessories5.nss
01r0mr00    cha_armor1.nss
02r0mr00    cha_armor2.nss
03r0mr00    cha_armor3.nss
020m0ts0c0  cha_costume2.nss
001n0p00w0  cha_weapon1a.nss
002n0p00w0  cha_weapon2a.nss
004n0p00w0  cha_weapon4a.nss
005n0p00w0  cha_weapon5a.nss
006n0p00w0  cha_weapon6a.nss
0100p0m0    map_map001.nss
0330p0m0    map_map033.nss
0430p0m0    map_map034.nss
0530p0m0    map_map035.nss
0601p0m0    map_map106.nss
0902p0m0    map_map209.nss
033p0m0     mon_map33.nss
0043p0m0    mon_map34a.nss
0b43p0m0    mon_map34b.nss
0c43p0m0    mon_map34c.nss
0d43p0m0    mon_map34d.nss
0043p0m0    mon_map34e.nss
0f43p0m0    mon_map34f.nss
0g43p0m0    mon_map34g.nss
0h43p0m0    mon_map34h.nss
0043p0m0    mon_map34i.nss
0j43p0m0    mon_map34j.nss
0k43p0m0    mon_map34k.nss
0l43p0m0    mon_map34l.nss
0053p0m0    mon_map35a.nss
0b53p0m0    mon_map35b.nss
0c53p0m0    mon_map35c.nss
0d53p0m0    mon_map35d.nss
0053p0m0    mon_map35e.nss
0f53p0m0    mon_map35f.nss
0g53p0m0    mon_map35g.nss
0h53p0m0    mon_map35h.nss
0053p0m0    mon_map35i.nss
043p0m0     npc_map34.nss
053p0m0     npc_map35.nss
0100lc0h0v  vehicle01.nss


Top
   
PostPosted: Sat Apr 22, 2017 11:39 pm 
Site Admin
User avatar

Joined: Wed Jul 30, 2014 9:32 pm
Posts: 6009
After watching the passwords I posted I guessed the algorithm, this is the script to retrieve the ZIP password from any NSS file:
Code:
get DATA basename
string DATA $ "_"
print "%DATA%"
string DATA r DATA
string DATA R "_" "0"
string DATA R "a" "0"
string DATA R "e" "0"
string DATA R "i" "0"
string DATA R "o" "0"
string DATA R "u" "0"
print "PASSWORD: 0%DATA%"


Top
   
Display posts from previous:  Sort by  
Post new topic  Reply to topic  [ 6 posts ] 

All times are UTC


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Powered by phpBB® Forum Software © phpBB Limited