Some Extraction Help?

[LepEatWorld]

So, I'm currently able to open up with . I can view the items inside but it wont let me extract the files. I'm able to extract an old version of the rs.iop but not this current version that I'd like to look into.

Any way someone could pull up the files inside for me or push me towards the correct direction as to how or where I could pull them out? If possible, I only need the config folder, it's for some insight research on a game. I do not need to modify it nor insert files back inside the rs.iop

Thanks in advance if anyone is able to help.

[elmarcia]

Originally Posted by LepEatWorld

So, I'm currently able to open up with . I can view the items inside but it wont let me extract the files. I'm able to extract an old version of the rs.iop but not this current version that I'd like to look into.

Any way someone could pull up the files inside for me or push me towards the correct direction as to how or where I could pull them out? If possible, I only need the config folder, it's for some insight research on a game. I do not need to modify it nor insert files back inside the rs.iop

Thanks in advance if anyone is able to help.

Please upload your iop file, the one provided is the tool for extraction. Extraction tools works with file version, if file is a version higher of extractor won't work, but those index files are easy to reverse.

[LepEatWorld]

Originally Posted by elmarcia

Please upload your iop file, the one provided is the tool for extraction. Extraction tools works with file version, if file is a version higher of extractor won't work, but those index files are easy to reverse.

Thank you for the reply, I updated the first link to be the iop. Also the file version has nothing to do with it. I have the 1.2 manager. I don't have version 2.0 but I can extract and upload stuff to the old iop, but not to the new one due to a different password. I'm not sure where the option to change the password is, but that's the reason I'm not able to get any files aside from not knowing the passcode anyways.

[elmarcia]

Originally Posted by LepEatWorld

Thank you for the reply, I updated the first link to be the iop. Also the file version has nothing to do with it. I have the 1.2 manager. I don't have version 2.0 but I can extract and upload stuff to the old iop, but not to the new one due to a different password. I'm not sure where the option to change the password is, but that's the reason I'm not able to get any files aside from not knowing the passcode anyways.

Hi, had little time to review the files but yesterday i was on it. It appears the iopManager is a library based in

Knowing that i downloaded the library src and found out how it works.

First i try to generate valid key hashes from dictionary attacks to decrypt a known string but failed.

Then i used x32dbg to reverse iopManager, its somewhat packed with patched returns to prevent static analysis but i managed to get encryption key.

Encryption/Decryption Key old Files: eE39DkE!%E0

As you can see this key is large and complex (12 bytes), no way you will get with dictionary attack.

The way to go is attach debuger to game and find decryption key.

CryptInitKeys method signature (from iopManager.exe)


This is based on ziparc, my guess is the game is based too in that library, but you never know, you need to find it out.

Here is the code that i write following the ziparc decoding process

 Spoiler

import os
from ctypes import c_uint32
import struct

m_keys = [0,0,0]
ZIPARCHIVE_ENCR_HEADER_LEN = 12

def loadCRCTABLE(filename):
    size = os.path.getsize(filename)
    with open(filename, "rb") as f:
        return f.read(size)

CRC_TABLE = loadCRCTABLE("crc.table")

def CryptInitKeys(password):
    global m_keys 
    m_keys[0] = 305419896
    m_keys[1] = 591751049
    m_keys[2] = 878082192
    for k in password:
        CryptUpdateKeys(ord(k))

def CryptUpdateKeys(c):
    global m_keys 
    m_keys[0] = CryptCRC32(m_keys[0], c)
    m_keys[1] += m_keys[0] & 0xff
    m_keys[1] = c_uint32(m_keys[1] * 134775813 + 1).value
    c = m_keys[1] >> 24
    m_keys[2] = CryptCRC32(m_keys[2], c)
    

def CryptDecryptByte():
    temp = (m_keys[2] & 0xffff) | 2
    return (((temp * (temp ^ 1)) >> 8) & 0xff)


def CryptDecode(c):
    c ^= CryptDecryptByte()
    CryptUpdateKeys(c)
    return c

def Decode(pBuffer):
    _bytes = []
    for i in range(len(pBuffer)):
        d = CryptDecode(pBuffer[i])
        _bytes.append(d)
    return _bytes

def CryptCRC32(l,c):
    index = (l ^ c) & 0xff
    return c_uint32(readIntLE(CRC_TABLE,index * 4) ^ (l >> 8)).value

def readIntLE(buffer,offset):
    return struct.unpack("<i",buffer[offset:offset+4])[0]

def InitDecode(password, buffer, check):
    CryptInitKeys(password)
    _bytes = []
    last = 0
    for i in range(ZIPARCHIVE_ENCR_HEADER_LEN):
        last = CryptDecode(buffer[i])
        _bytes.append(last)
    if(last == check): 
        return
    raise Exception("wrong password")

#check time with last header byte
modTime = 0xaa5b
chk = modTime >> 8

knownHeader = [0x32,0xEB ,0xCD ,0xEB ,0x2E ,0x9C ,0x23 ,0x3E ,0xA0 ,0xFA ,0xFA ,0x7C]
encrypted = [0xC9, 0xDA, 0x05, 0x96]
InitDecode("eE39DkE!%E0",knownHeader,chk)
result = Decode(encrypted)
print ''.join([chr(i) for i in result])

You need to download crc.table attached in this post in order to run the script. (this is to test old key file)

Let me know if you need help finding the new key.

[LepEatWorld]

Originally Posted by elmarcia

The way to go is attach debuger to game and find decryption key.

This is based on ziparc, my guess is the game is based too in that library, but you never know, you need to find it out.

Here is the code that i write following the ziparc decoding process

 Spoiler

import os
from ctypes import c_uint32
import struct

m_keys = [0,0,0]
ZIPARCHIVE_ENCR_HEADER_LEN = 12

def loadCRCTABLE(filename):
    size = os.path.getsize(filename)
    with open(filename, "rb") as f:
        return f.read(size)

CRC_TABLE = loadCRCTABLE("crc.table")

def CryptInitKeys(password):
    global m_keys 
    m_keys[0] = 305419896
    m_keys[1] = 591751049
    m_keys[2] = 878082192
    for k in password:
        CryptUpdateKeys(ord(k))

def CryptUpdateKeys(c):
    global m_keys 
    m_keys[0] = CryptCRC32(m_keys[0], c)
    m_keys[1] += m_keys[0] & 0xff
    m_keys[1] = c_uint32(m_keys[1] * 134775813 + 1).value
    c = m_keys[1] >> 24
    m_keys[2] = CryptCRC32(m_keys[2], c)
    

def CryptDecryptByte():
    temp = (m_keys[2] & 0xffff) | 2
    return (((temp * (temp ^ 1)) >> 8) & 0xff)


def CryptDecode(c):
    c ^= CryptDecryptByte()
    CryptUpdateKeys(c)
    return c

def Decode(pBuffer):
    _bytes = []
    for i in range(len(pBuffer)):
        d = CryptDecode(pBuffer[i])
        _bytes.append(d)
    return _bytes

def CryptCRC32(l,c):
    index = (l ^ c) & 0xff
    return c_uint32(readIntLE(CRC_TABLE,index * 4) ^ (l >> 8)).value

def readIntLE(buffer,offset):
    return struct.unpack("<i",buffer[offset:offset+4])[0]

def InitDecode(password, buffer, check):
    CryptInitKeys(password)
    _bytes = []
    last = 0
    for i in range(ZIPARCHIVE_ENCR_HEADER_LEN):
        last = CryptDecode(buffer[i])
        _bytes.append(last)
    if(last == check): 
        return
    raise Exception("wrong password")

#check time with last header byte
modTime = 0xaa5b
chk = modTime >> 8

knownHeader = [0x32,0xEB ,0xCD ,0xEB ,0x2E ,0x9C ,0x23 ,0x3E ,0xA0 ,0xFA ,0xFA ,0x7C]
encrypted = [0xC9, 0xDA, 0x05, 0x96]
InitDecode("eE39DkE!%E0",knownHeader,chk)
result = Decode(encrypted)
print ''.join([chr(i) for i in result])

You need to download crc.table attached in this post in order to run the script. (this is to test old key file)

Let me know if you need help finding the new key.

I sent a private message but I'm not sure if it was received considering that my inbox says "0 messages sent".

I'm curious to learn some information on how to do things such as this.

I also tried to use x32dbg and ollydbg but neither provided me any information such as yours. I have no knowledge in assembly/encryptions or any of the sort and I have also never learned to use python before. So I'm not sure what to do with the script you wrote. That being said I was able to find the Key that you posted with x32dbg on "strings".

I'm not sure how I would go about attaching anything to the game at the time being either. The only programming knowledge that I currently have is C#, but very basic, barely viable.

I'm in no hurry, like I stated in the start of the topic, this is mainly for self and community research. Any information would be appreciated as well as your time.

[elmarcia]

Originally Posted by LepEatWorld

I sent a private message but I'm not sure if it was received considering that my inbox says "0 messages sent".

I'm curious to learn some information on how to do things such as this.

I also tried to use x32dbg and ollydbg but neither provided me any information such as yours. I have no knowledge in assembly/encryptions or any of the sort and I have also never learned to use python before. So I'm not sure what to do with the script you wrote. That being said I was able to find the Key that you posted with x32dbg on "strings".

I'm not sure how I would go about attaching anything to the game at the time being either. The only programming knowledge that I currently have is C#, but very basic, barely viable.

I'm in no hurry, like I stated in the start of the topic, this is mainly for self and community research. Any information would be appreciated as well as your time.

Script was just an example of how decryption works, in order to find new key you need to attach debugger to your game and find the decryption algorithm.

A way that can be useful but may not work is to attach debugger to game when is running and search for patterns.

# mov to memory address

C7 ?? ?? ?? ?? ?? 78 56 34 12
C7 ?? ?? ?? ?? ?? 89 67 45 23
C7 ?? ?? ?? ?? ?? 90 78 56 34


# mov to register

C7 ?? ?? 78 56 34 12
C7 ?? ?? 89 67 45 23
C7 ?? ?? 90 78 56 34

# direct register mov or stack move

?? 78 56 34 12
?? 89 67 45 23
?? 90 78 56 34


# anything that contains one of

78 56 34 12
89 67 45 23
90 78 56 34

Those numbers:
78 56 34 12 | 89 67 45 23 | 90 78 56 34 are magic numbers for encryption initial values.

For example lets say you search for this pattern:
C7 ?? ?? ?? ?? ?? 78 56 34 12

and not found a match, then you can search for the next one

C7 ?? ?? 78 56 34 12

If you found multiple matches you need to find the one that follows the pattern of CryptInitKeys function:

The one that stores -> those 3 magic numbers somewhere to be used.

May have a similar struct to:

[AlfiMS25]

Hello, is there anyone who have the newer tool version iopmanager 2.0? or the one can run on Lost Saga Origin iop, i had the password that is: Eg%^io03UT$**

i had the 1.2 version but i dont know how to use it any further than just extracting