XeNTaX

This game using the Unity engine, but the file has been compressed as .abap. Someone can help me decompile this format? Thank you guy.
Sample file Mega
Playstore: プロジェクト東京ドールズ

The first 0x400 of each file is encrypted.
I am not sure how its encrypted.
once you get the real file start the files are normal compressed unity3d files that work in all tools.

still looking for method to unpack em

wansf wrote: ↑Sat Dec 15, 2018 4:41 am still looking for method to unpack em

did you do it?

sorry, apparently a necro post, but estertion seems to have found a clue to decryption.

https://estertion.win/2019/03/project-t ... %E5%85%B3/

*not work... I have no knowledge of quickbms, but I tried to decrypt it but it didn't work. I hope someone who understands can solve it.
Thanks!

According to his post

PHP
$dat = file_get_contents('cr0026_c005_0.abip');

$key = implode('', array_reverse(str_split(base64_decode('Y2VJOCQpWSNZcyRyNVJGNVd8NFctXzE7Kkw7KVZVenc='), 1)));
$iv = implode('', array_reverse(str_split(base64_decode('ZTBnJDJuUnAmIWRBUVJXP2pxeCxXPn1FI2ZKRzFEKkw='), 1)));

$head = substr($dat, 0, 0x400);
$body = substr($dat, 0x400);

$headdec = mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $key, $head, MCRYPT_MODE_CBC, $iv);

file_put_contents('cr0026_c005_0-dec.abip', $headdec.$body);

is the decrypt code

chrrox wrote: ↑Thu Oct 10, 2019 12:13 pm According to his post

PHP
$dat = file_get_contents('cr0026_c005_0.abip');

$key = implode('', array_reverse(str_split(base64_decode('Y2VJOCQpWSNZcyRyNVJGNVd8NFctXzE7Kkw7KVZVenc='), 1)));
$iv = implode('', array_reverse(str_split(base64_decode('ZTBnJDJuUnAmIWRBUVJXP2pxeCxXPn1FI2ZKRzFEKkw='), 1)));

$head = substr($dat, 0, 0x400);
$body = substr($dat, 0x400);

$headdec = mcrypt_decrypt(MCRYPT_RIJNDAEL_256, $key, $head, MCRYPT_MODE_CBC, $iv);

file_put_contents('cr0026_c005_0-dec.abip', $headdec.$body);

is the decrypt code

Thanks, apparently I overlooked it.
I had to reverse the string with array_reverse.
777a5 ~ and 4c2a44 ~ are valid keys.

I was able to decrypt those keys using an online tool.
quickbms document has an mcrypt(mcrypt rijndael-256), but doesn't it really work? I don't have a PHP execution environment,
so I would like to decrypt with quickbms if possible.

----
*Edit

Sorry, I finally found it.
encryption mcrypt_rijndael-256_cbc mode worked!

chrrox wrote: ↑Thu Oct 10, 2019 10:07 pm

Code: Select all

#Project Tokyo Dolls
#Decrypt by chrrox
set MYKEY binary "\x77\x7A\x55\x56\x29\x3B\x4C\x2A\x3B\x31\x5F\x2D\x57\x34\x7C\x57\x35\x46\x52\x35\x72\x24\x73\x59\x23\x59\x29\x24\x38\x49\x65\x63"
set MYIV  binary "\x4C\x2A\x44\x31\x47\x4A\x66\x23\x45\x7D\x3E\x57\x2C\x78\x71\x6A\x3F\x57\x52\x51\x41\x64\x21\x26\x70\x52\x6E\x32\x24\x67\x30\x65"


idstring "\x70\x70\x69\x72"
get TBLOFF  long
get NBASE   long
get BASEOFF long
set FILES NBASE
math FILES - TBLOFF
math FILES / 0x10
append
for i = 0 < FILES
    set MEMORY_FILE binary ""
    goto TBLOFF
    get NSTART long
    get NSIZE  long
    get OFFSET long
    get SIZE   long
    math NSTART + NBASE
    math OFFSET + BASEOFF
    savepos TBLOFF
    goto NSTART
    getdstring NAME NSIZE
    string NAME + .unity3d
    encryption mcrypt_rijndael-256_cbc MYKEY MYIV
    if SIZE > 0x400
        log MEMORY_FILE OFFSET 0x400
        encryption "" ""
        math OFFSET + 0x400
        math SIZE - 0x400
        log MEMORY_FILE OFFSET SIZE
        math SIZE + 0x400
    else
        log MEMORY_FILE OFFSET SIZE
        encryption "" ""
    endif
    log NAME 0 SIZE MEMORY_FILE
next i

Thanks so much!
Although I have a question, does this only work on the card image files? I can't seem to get any other files such as models. Unless I'm just not finding the right files.

chrrox wrote: ↑Thu Oct 10, 2019 10:07 pm

Code: Select all

#Project Tokyo Dolls
#Decrypt by chrrox
set MYKEY binary "\x77\x7A\x55\x56\x29\x3B\x4C\x2A\x3B\x31\x5F\x2D\x57\x34\x7C\x57\x35\x46\x52\x35\x72\x24\x73\x59\x23\x59\x29\x24\x38\x49\x65\x63"
set MYIV  binary "\x4C\x2A\x44\x31\x47\x4A\x66\x23\x45\x7D\x3E\x57\x2C\x78\x71\x6A\x3F\x57\x52\x51\x41\x64\x21\x26\x70\x52\x6E\x32\x24\x67\x30\x65"


idstring "\x70\x70\x69\x72"
get TBLOFF  long
get NBASE   long
get BASEOFF long
set FILES NBASE
math FILES - TBLOFF
math FILES / 0x10
append
for i = 0 < FILES
    set MEMORY_FILE binary ""
    goto TBLOFF
    get NSTART long
    get NSIZE  long
    get OFFSET long
    get SIZE   long
    math NSTART + NBASE
    math OFFSET + BASEOFF
    savepos TBLOFF
    goto NSTART
    getdstring NAME NSIZE
    string NAME + .unity3d
    encryption mcrypt_rijndael-256_cbc MYKEY MYIV
    if SIZE > 0x400
        log MEMORY_FILE OFFSET 0x400
        encryption "" ""
        math OFFSET + 0x400
        math SIZE - 0x400
        log MEMORY_FILE OFFSET SIZE
        math SIZE + 0x400
    else
        log MEMORY_FILE OFFSET SIZE
        encryption "" ""
    endif
    log NAME 0 SIZE MEMORY_FILE
next i

How to use this?
I use this bms script to extract .abap but doesn't work.

@DKDave from the Discord server found the issue: the original QuickBMS code was expecting an .abip file, which is an archive of multiple .abap files. Since I don't see any .abip archives in the Android version a much simpler code can be used instead for individual .abap files.

This code should work for all assets in Android: I have been able to dump not only card graphics, but also audio assets (including a song that is unreleased in any streaming site as of this message's writing) and some 3D assets.