XeNTaX

Code: Select all

//--------------------------------------
//--- 010 Editor v5.0 Script File
//
// File:
// Author:
// Revision:
// Purpose:
//--------------------------------------


// the header looks like it's been xored
// with some magic bytes

// look at the pattern of bytes, there are lot of
// repeating "rows" of 32 bytes

// first bytes are
// 5c 57 21 5b

// next 32-byte up we have
// 76 ca 2b a5

// then again
// 76 ca 2b a5

// let's this that value

//uint magic = 2771110518L;
//WriteUInt(p, ReadUInt(p) ^ magic);

// that's wrong. ok.

//let's look at the pattern

// 76 CA 2B A5 5E 42 83 C7 DC D8 E6 B3 34 9E 71 A8
// A4 97 19 94 6D 1F BA F2 F2 AF 87 C5 72 DD 2E E9

// what patterns do we have?

// 76 CA 2B A5 5E 42 ?? ?? DC D8 E6 B3 34 9E 71 A8
// ?? ?? ?? 94 ?? ?? ?? F2 F2 AF 87 C5 72 DD 2E E9

// alright.. not too many unknowns

// we need to be looking at for any possible pointers to
// the first wav file, which we know to be 4940

ubyte xor[32] =
{
  0x76, 0xCA, 0x2B, 0xA5, 0x5E, 0x42, 0,    0,
  0xDC, 0xD8, 0xE6, 0xB3, 0x34, 0x9E, 0x71, 0xA8,
  0,    0,    0,    0x94, 0,    0,    0,    0xF2,
  0xF2, 0xAF, 0x87, 0xC5, 0x72, 0xDD, 0x2E, 0xE9
};

uint p = 0;

while(p < 4940)
{
  WriteUByte(p, ReadUByte(p)^xor[p%16]);
  p++;
}

// what we see now if some .wav references!
// a bit more work is required to reverse the actual xor table

// hope it helps!

Code: Select all

#include <fstream>

using namespace std;

int main() {
	unsigned char xor[32] = { 
		0x76, 0xCA, 0x2B, 0xA5, 0x5E, 0x42, 0,    0,
		0xDC, 0xD8, 0xE6, 0xB3, 0x34, 0x9E, 0x71, 0xA8,
		0,    0,    0,    0x94, 0,    0,    0,    0xF2,
		0xF2, 0xAF, 0x87, 0xC5, 0x72, 0xDD, 0x2E, 0xE9
	};

	unsigned int p = 0;
	unsigned char b; //temporary byte

	ifstream inputfile("IJNoriginal.spf");
	ofstream outputfile;
	outputfile.open("IJN.spf");

	while(p<4940) {
		//read from input file
		inputfile.seekg(p);
		inputfile >> b;
		//b xor key
		b = b ^ xor[p%16];
		//store in output file
		outputfile.seekp(p);
		outputfile << b;
		p++;
	}
	inputfile.close();
	outputfile.close();
}

Code: Select all

2A 9D 0D FE C1 BA 21 99 43 0D 55 87 00 00 00 00
26 7C 57 F2 AC EE EE EE 32 EA 0C BF 8B 15 64 CC
BA 70 5B FE A0 E2 E2 E2 3E E6 00 B3 87 19 68 C0
B6 7C 57 F2 AC EE EE EE 32 EA 0C BF 8B 15 64 CC
BA 70 5B FE A0 E2 E2 E2 3E E6 00 B3 87 19 68 C0
B6 7C 57 F2 AC EE EE EE 32 EA 0C BF 8B 15 64 CC
...

Code: Select all

76 CA 2B A5 5E 42 ?? ?? DC D8 E6 B3 34 9E 71 A8
?? ?? ?? 94 ?? ?? ?? F2 F2 AF 87 C5 72 DD 2E E9

Code: Select all

0x5a6ca5a8, 0x986c0a6b, 0x0dc62cf3, 0xa93c6cc0, 0x955785e4, 0xf3fe93b9, 0xc4ca5d06, 0xe8632f86

Code: Select all

// -- code
uint meh[8] = 
{
0x5a6ca5a8, 0x986c0a6b, 0x0dc62cf3, 0xa93c6cc0,
0x955785e4, 0xf3fe93b9, 0xc4ca5d06, 0xe8632f86
};

uint c = 0;
uint val = 0;
while( c < 8 )
{
  val = ReadUInt(c*4) ^ meh[c];
  Printf("%u and %u\n", val, FileSize());
  WriteUInt(c*4, val);
  c++;
}
// -- end code

// we get this:

21885684 and 7717
21885551 and 7717
7717 and 7717
21885674 and 7717
21784099 and 7717
21881234 and 7717
21885684 and 7717
1735193345 and 7717

Code: Select all

0x5b214410, 0x9921ebd3, 0x0c8bcd4b, 0xa8718d78,
0x941a645c, 0xf2b37201, 0xc587bcbe, 0xe92ece3e

Code: Select all

#include <stdlib.h>
#include <stdio.h>

int main(void)
{
  unsigned int file_size_xor = 0x0dc62cf3;
  unsigned int file_offset_xor = 0xf2b37201;

  // gone back to c (sorry)
  FILE* hnl = fopen("Option.SPF", "rb");

  unsigned int offset = 0; // current file pos
  unsigned int first_file = 0; // first file offset

  while ( true )
  {
    // read 32 bytes at a time (8 ints)

    unsigned int buffer[8];
    fread(buffer, 32, 1, hnl);

    // first file:
    if (offset == 0)
    {
      unsigned int file_size = buffer[2] ^ file_size_xor;
      printf("File size: %u\n", file_size);
    }

    // every 32 bytes we have a file header with a file offset:

    unsigned int file_offset = buffer[5] ^ file_offset_xor;
    printf("File offset: %u\n", file_offset);

    // store off the first file offset (which marks the end of header)
    if (offset == 0)
    {
      first_file = file_offset;
    }

    offset += 32;

    // exit the loop when we hit the first file data
    if (offset >= first_file - 32)
    {
      break;
    }
  }
  
  fclose(hnl);  
  return 1;
}

Code: Select all

//--------------------------------------
//--- 010 Editor v5.0.2 Script File
//
// File:
// Author:
// Revision:
// Purpose:
//--------------------------------------
//
//first try xoring km.spf with filesize of km.spf 21,885,684->01 4D F2 F4
//BUT turn it around after getting each xor key
//run it on option.spf
//whatever matches the filesize is the correct row (3rd)
//
//next try xoring km.spf with fileoffset 4940->134c0000
//uint meh = 0x0000134c;
//now we have 8 new keys
//turn each key around
//run it on first 8 rows of option.spf
//look for first offset of option.spf (6th row)
//
//so far
//row 3 filesize 0x0dc62cf3
//row 6 file offset 0xf2b37201
//
//now let's try looking for size of first .wav in km.spf
//100652 -> 00 01 89 2C
//uint meh = 0x0001892c;
//turn around all 8 xor key rows
//0x5b20de70, 0x992071b3, 0x0c8a572b, 0xa8701718,
//0x941bfe3c, 0xf2b2e861, 0xc58626de, 0xe92f545e
//run it on ijn.spf because easier
//found!! 84076 on row 5 (size of 1st wav)
//row 5 wav size 0x941bfe3c
//
//those are all the rows that change
//lets combine it with the xor values that got .wavFC_A earlier
//row 7 0xdcd8e6b3
//row 8 0x349e71a8
//
//lets create a new loop that decrypts the 3rd row in header and every 2nd, 3rd, 4th, 5th row in each file description

uint filesizekey = 0x0dc62cf3; //filesize
uint row2 = 0x941bfe3c; //wav size
uint row3 = 0xf2b37201; //wav offset
//uint row4 = 0xdcd8e6b3; //".wav" string
//uint row5 = 0x349e71a8; //"FC_A" string

//".wavFC_A" string
uint wavstring[8] = {
  0xDC, 0xD8, 0xE6, 0xB3, 0x34, 0x9E, 0x71, 0xA8
};

uint val = 0;

val = ReadUInt(2*4) ^ filesizekey;
WriteUInt(2*4, val);

//c=3 is beginning of first file description (skip first 3 rows)
uint c = 3;
uint p = 0;
val = 0;
uint r2;
uint r3;
uint r4;
uint c2 = 24;

while( c < 1232 )
{
  r2 = c+1;
  r3 = c+2;


  val = ReadUInt(r2*4) ^ row2;
  WriteUInt(r2*4, val);

  val = ReadUInt(r3*4) ^ row3;
  WriteUInt(r3*4, val);


  p = 0;
  while ( p < 8 ) {
    r4 = c2 + p;
    WriteUByte(r4, ReadUByte(r4) ^ wavstring[p]);
    p++;
  }

  c+=8; //move 8 rows ahead
  c2+=32;
}