ZenHAX

Free Game Research Forum | Official QuickBMS support | twitter @zenhax | SSL HTTPS://zenhax.com
It is currently Fri Dec 14, 2018 5:57 am

All times are UTC




Post new topic  Reply to topic  [ 2 posts ] 
Author Message
PostPosted: Sat Oct 27, 2018 11:57 pm 

Joined: Sat Oct 27, 2018 8:41 pm
Posts: 1
Hello, and good evening!

I decided to give a quick glance at the save files used for the recently released SoulCalibur VI, and it contains a file named GAME.sav, with a folder named 'GAME' that contains 19 additional SAV files. I created one character in-game to see which SAV their data's stored in, and it looks like they are transferred to the file named 'c98b42574c20a9ae74939f2675fc5e4d.sav'. I'm not too sure what the other files are for.

I threw the c98 SAV file into HxD to analyze the data, and it looks like it is encrypted. I compared it with the other SAV files in the GAME older, and it looks like the 1st 32 bytes are very similar in each one. So now I'm a bit stumped figuring out what encryption method was used for these files to decrypt them. I've attached my save data to this post, if anyone wants to take a look at these files for themselves.

Thank you to whomever may be of assistance to this!

-S.S.


Attachments:
76561198042237818 (SoulCalibur VI).rar [173.17 KiB]
Downloaded 14 times
Top
   
PostPosted: Tue Nov 27, 2018 2:15 pm 

Joined: Sun Aug 17, 2014 5:50 pm
Posts: 16
Updated the script to version 1.2.
Attachment:
SC6_Save_Enc_Decryptor_v1.2.bms [1.86 KiB]
Downloaded 7 times

Code:
# SoulCalibur 6 Save Encryptor/Decryptor v1.2
# Keys: 61, 29, 126

get SIZE asize
get HDR long
log MEMORY_FILE 0 SIZE

if HDR == 0x1B || HDR == 0x9E2A83C1
  print "Encryption key:"
  set KEY ? ?
  if KEY == ""
    set KEY short 0x3D
   # set KEY short 0x7E
   # set KEY short 0x21D
  endif
  print "KEY: %KEY%"
  callfunction Encrypt 1
else
  goto 6
  get NUM short
  ReverseShort NUM
  set NUMX short 0
  for k = 0 < 0x201
    for j = 6 < 8
     math NUMX u< 8
      math KEY1 = k
      callfunction Calculate 1
      math KEY3 ^ 0x64
     math KEY3 & 0xFF
     math NUMX + KEY3
    next j
   math NUMX & 0xFFFF
   if NUMX == NUM
     math KEY = k
     math k = 0x201
   elif k == 0x200
     print "Encryption key not found."
     cleanexit
    endif
  next k
  print "Encryption key = %KEY%"
  callfunction Encrypt 1
endif

get NAME basename
string NAME += _out.sav
log NAME 0 SIZE MEMORY_FILE

startfunction Encrypt
  for j = 0 < SIZE
   math KEY1 = KEY
   callfunction Calculate 1
   getvarchr NUM MEMORY_FILE j byte
   math KEY3 ^ NUM
   math KEY3 ^ 0x64
   putvarchr MEMORY_FILE j KEY3 byte
  next j
endfunction

startfunction Calculate
  math FLAG = 0
  math KEY5 = j
  math KEY5 * j
  math KEY2 = KEY5
  math KEY2 * j
  math KEY1 * j
  callfunction CDQ 1
  math FLAG = 1
  math KEY3 = KEY1
  math KEY1 = KEY2
  math KEY1 * j
  math KEY3 ^ KEY4
  math KEY3 - KEY4
  math KEY1 < 3
  callfunction CDQ 1
  math TMP = KEY2
  math TMP * 0xB
  math KEY1 = TMP
  callfunction CDQ 1
  math TMP = KEY5
  math TMP * 0x11
  math KEY1 = TMP
  callfunction CDQ 1
endfunction
 
startfunction CDQ
  math KEY1 & 0x1FF
  math KEY1 - 0xFF
  if KEY1 >= 0
    math KEY4 = 0
  else
    math KEY4 = -1
  endif
  if FLAG != 0
    math KEY1 ^ KEY4
    math KEY1 - KEY4
    math TMP = KEY1
    math TMP & 0xFF
    math KEY3 ^ TMP
  endif
endfunction


Top
   
Display posts from previous:  Sort by  
Post new topic  Reply to topic  [ 2 posts ] 

All times are UTC


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Powered by phpBB® Forum Software © phpBB Limited