Echo Of Soul .u file encryption

[TheMathDoc]

Echo Of Soul (http://www.aeriagames.com/playnow/eosus ... e_overview) recently hit open beta, and I've been tweaking some existing software to extract the game's unreal packages (and sound/movie files, but that's not relevant for this). I've been doing well until I hit the game's .u files - unreal script files. They seem to be encrypted, and it looks almost like simple XOR encryption using a key close to

0xCB, 0xAA, 0x07, 0xC4, 0x3C, 0xE4, 0xC5, 0x93

This key does transforms the unreal name table into something more comprehensible, however, it looks like the key itself changes as the bytes go by. For instance, the exact key above will decrypt the "None" name table entry, but then leaves the rest of the names as gibberish. I have been able to make out a few other names (things like "Core" and "Script") by tweaking the bytes in the key above for different chunks of the name table.

Anyways I was wondering if anyone wanted to try their hand at figuring out the algorithm used. Unfortunately, the game has a lot of security that prevents me from using a disassembler to see the decryption process.

I've attached a two example file to look at and can of course provide more.

Thanks,
TheMathDoc

[Ekey]

Here my tool for decrypt U, INT, INI ect files.

Note: Before posting encrypted files you need also include main executable with all modules because encryption algorithm avaible only there.

Code: Select all

[Usage]
        EOSDecryptor <pScrFile> <pDstFile>
[Examples]
        EOSDecryptor EOS.ini EOS.ini.dec

Download: See below.

[TheMathDoc]

I figured that the game's exe was more or less useless because of its encryption, but will do for next time.

Thanks!

[CriticalError]

I figured that the game's exe was more or less useless because of its encryption, but will do for next time.

Thanks!

binaries are protected with Themida I tested in Korean and no work tool for decrypt .u,etc files.

PS: how it work really, this is work? I try test with sample files of .u uploaded by TheMatDoc but anyway always convert the dec with 0 bytes, so what doing wrong?

[Ekey]

It's batch tool. Open EOSDecryptor.bat with notepad, set path for input file and output file. Example

Code: Select all

EOSDecryptor "D:\Echo Of Soul\System\EOS.ini" "D:\Echo Of Soul\System\EOS.ini.dec"

[CriticalError]

It's batch tool. Open EOSDecryptor.bat with notepad, set path for input file and output file. Example

Code: Select all

EOSDecryptor "D:\Echo Of Soul\System\EOS.ini" "D:\Echo Of Soul\System\EOS.ini.dec"

yes Ekey thanks for the tip, i'm not noob buddy, no offend, but I know this process, just when I say how it works is because when convert file always got 0 byte file, here you have example of my system folder trying decode Fire.u.

PS: don't know if matter or no running Windows 7 x64.

[Ekey]

I have Win7 x64 and works fine. With other files you have this problem?

[Keezie]

I have Win7 x64 and works fine. With other files you have this problem?

I'm on windows 8.1 x64 and having the same issue.

[CriticalError]

I have Win7 x64 and works fine. With other files you have this problem?

any file like u,ini,etc got same issue.

[Ekey]

Well i rebuild decryptor, try it. For me works perfect

[Keezie]

Well i rebuild decryptor, try it.

For me works perfect

Working fine for me now.

[CriticalError]

[quote="Ekey"][/quote]ok now all be worked fine, now my question, any chance to help with unpack Themida v2.0.1.0 - v2.1.8.0? really I try all ways as I can in Windows Xp and no lucky, you are a experienced guy in reverse engineering and sure can do it, please if can take a look into binaries of this game, really grateful Ekey.

https://cloud.mail.ru/public/8oAy/EvjnrTLQJ

[Ekey]

https://www.sendspace.com/file/qsokmk

[CriticalError]

https://www.sendspace.com/file/qsokmk

many thanks Ekey, anyway I unpacked myself, I think I do fine the process, but anyway thanks for support

PS: maybe is good do a tutorial when you unpack it, I see you got others files I don't got in unpacking process.
PS2: here my guide.

How Unpack Themida 2.x.x

[yolotrollo]

Well i rebuild decryptor, try it. For me works perfect

Do you mind sharing some technical details such as what encryption algorithm and actual key was used? I want to encrypt back modifications to the .ini file(s). Thank you.