Free Game Research Forum | Official QuickBMS support | twitter @zenhax | SSL HTTPS://zenhax.com
It is currently Fri Dec 14, 2018 5:57 am

All times are UTC

Post new topic  Reply to topic  [ 2 posts ] 
Author Message
PostPosted: Sat Oct 27, 2018 11:57 pm 

Joined: Sat Oct 27, 2018 8:41 pm
Posts: 1
Hello, and good evening!

I decided to give a quick glance at the save files used for the recently released SoulCalibur VI, and it contains a file named GAME.sav, with a folder named 'GAME' that contains 19 additional SAV files. I created one character in-game to see which SAV their data's stored in, and it looks like they are transferred to the file named 'c98b42574c20a9ae74939f2675fc5e4d.sav'. I'm not too sure what the other files are for.

I threw the c98 SAV file into HxD to analyze the data, and it looks like it is encrypted. I compared it with the other SAV files in the GAME older, and it looks like the 1st 32 bytes are very similar in each one. So now I'm a bit stumped figuring out what encryption method was used for these files to decrypt them. I've attached my save data to this post, if anyone wants to take a look at these files for themselves.

Thank you to whomever may be of assistance to this!


76561198042237818 (SoulCalibur VI).rar [173.17 KiB]
Downloaded 14 times
PostPosted: Tue Nov 27, 2018 2:15 pm 

Joined: Sun Aug 17, 2014 5:50 pm
Posts: 16
Updated the script to version 1.2.
SC6_Save_Enc_Decryptor_v1.2.bms [1.86 KiB]
Downloaded 7 times

# SoulCalibur 6 Save Encryptor/Decryptor v1.2
# Keys: 61, 29, 126

get SIZE asize
get HDR long

if HDR == 0x1B || HDR == 0x9E2A83C1
  print "Encryption key:"
  set KEY ? ?
  if KEY == ""
    set KEY short 0x3D
   # set KEY short 0x7E
   # set KEY short 0x21D
  print "KEY: %KEY%"
  callfunction Encrypt 1
  goto 6
  get NUM short
  ReverseShort NUM
  set NUMX short 0
  for k = 0 < 0x201
    for j = 6 < 8
     math NUMX u< 8
      math KEY1 = k
      callfunction Calculate 1
      math KEY3 ^ 0x64
     math KEY3 & 0xFF
     math NUMX + KEY3
    next j
   math NUMX & 0xFFFF
   if NUMX == NUM
     math KEY = k
     math k = 0x201
   elif k == 0x200
     print "Encryption key not found."
  next k
  print "Encryption key = %KEY%"
  callfunction Encrypt 1

get NAME basename
string NAME += _out.sav

startfunction Encrypt
  for j = 0 < SIZE
   math KEY1 = KEY
   callfunction Calculate 1
   getvarchr NUM MEMORY_FILE j byte
   math KEY3 ^ NUM
   math KEY3 ^ 0x64
   putvarchr MEMORY_FILE j KEY3 byte
  next j

startfunction Calculate
  math FLAG = 0
  math KEY5 = j
  math KEY5 * j
  math KEY2 = KEY5
  math KEY2 * j
  math KEY1 * j
  callfunction CDQ 1
  math FLAG = 1
  math KEY3 = KEY1
  math KEY1 = KEY2
  math KEY1 * j
  math KEY3 ^ KEY4
  math KEY3 - KEY4
  math KEY1 < 3
  callfunction CDQ 1
  math TMP = KEY2
  math TMP * 0xB
  math KEY1 = TMP
  callfunction CDQ 1
  math TMP = KEY5
  math TMP * 0x11
  math KEY1 = TMP
  callfunction CDQ 1
startfunction CDQ
  math KEY1 & 0x1FF
  math KEY1 - 0xFF
  if KEY1 >= 0
    math KEY4 = 0
    math KEY4 = -1
  if FLAG != 0
    math KEY1 ^ KEY4
    math KEY1 - KEY4
    math TMP = KEY1
    math TMP & 0xFF
    math KEY3 ^ TMP

Display posts from previous:  Sort by  
Post new topic  Reply to topic  [ 2 posts ] 

All times are UTC

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Powered by phpBB® Forum Software © phpBB Limited