Quote:
Originally Posted by LepEatWorld
Thank you for the reply, I updated the first link to be the iop. Also the file version has nothing to do with it. I have the 1.2 manager. I don't have version 2.0 but I can extract and upload stuff to the old iop, but not to the new one due to a different password. I'm not sure where the option to change the password is, but that's the reason I'm not able to get any files aside from not knowing the passcode anyways.
[Only registered and activated users can see links. Click Here To Register...]
[Only registered and activated users can see links. Click Here To Register...]
|
Hi, had little time to review the files but yesterday i was on it. It appears the iopManager is a library based in
[Only registered and activated users can see links. Click Here To Register...]
Knowing that i downloaded the library src and found out how it works.
First i try to generate valid key hashes from dictionary attacks to decrypt a known string but failed.
Then i used x32dbg to reverse iopManager, its somewhat packed with patched returns to prevent static analysis but i managed to get encryption key.
Encryption/Decryption Key old Files: eE39DkE!%E0
As you can see this key is large and complex (12 bytes), no way you will get with dictionary attack.
The way to go is attach debuger to game and find decryption key.
CryptInitKeys method signature (from iopManager.exe)
[Only registered and activated users can see links. Click Here To Register...]
This is based on ziparc, my guess is the game is based too in that library, but you never know, you need to find it out.
Here is the code that i write following the ziparc decoding process
Code:
import os
from ctypes import c_uint32
import struct
m_keys = [0,0,0]
ZIPARCHIVE_ENCR_HEADER_LEN = 12
def loadCRCTABLE(filename):
size = os.path.getsize(filename)
with open(filename, "rb") as f:
return f.read(size)
CRC_TABLE = loadCRCTABLE("crc.table")
def CryptInitKeys(password):
global m_keys
m_keys[0] = 305419896
m_keys[1] = 591751049
m_keys[2] = 878082192
for k in password:
CryptUpdateKeys(ord(k))
def CryptUpdateKeys(c):
global m_keys
m_keys[0] = CryptCRC32(m_keys[0], c)
m_keys[1] += m_keys[0] & 0xff
m_keys[1] = c_uint32(m_keys[1] * 134775813 + 1).value
c = m_keys[1] >> 24
m_keys[2] = CryptCRC32(m_keys[2], c)
def CryptDecryptByte():
temp = (m_keys[2] & 0xffff) | 2
return (((temp * (temp ^ 1)) >> 8) & 0xff)
def CryptDecode(c):
c ^= CryptDecryptByte()
CryptUpdateKeys(c)
return c
def Decode(pBuffer):
_bytes = []
for i in range(len(pBuffer)):
d = CryptDecode(pBuffer[i])
_bytes.append(d)
return _bytes
def CryptCRC32(l,c):
index = (l ^ c) & 0xff
return c_uint32(readIntLE(CRC_TABLE,index * 4) ^ (l >> 8)).value
def readIntLE(buffer,offset):
return struct.unpack("<i",buffer[offset:offset+4])[0]
def InitDecode(password, buffer, check):
CryptInitKeys(password)
_bytes = []
last = 0
for i in range(ZIPARCHIVE_ENCR_HEADER_LEN):
last = CryptDecode(buffer[i])
_bytes.append(last)
if(last == check):
return
raise Exception("wrong password")
#check time with last header byte
modTime = 0xaa5b
chk = modTime >> 8
knownHeader = [0x32,0xEB ,0xCD ,0xEB ,0x2E ,0x9C ,0x23 ,0x3E ,0xA0 ,0xFA ,0xFA ,0x7C]
encrypted = [0xC9, 0xDA, 0x05, 0x96]
InitDecode("eE39DkE!%E0",knownHeader,chk)
result = Decode(encrypted)
print ''.join([chr(i) for i in result])
You need to download crc.table attached in this post in order to run the script. (this is to test old key file)
Let me know if you need help finding the new key.