The Forum is up for sale: XeNTaX Forum looking for new owner

Girls und Panzer - Encrypted unity3d files

The Original Forum. Game archives, full of resources. How to open them? Get help here.
Post Reply
Nanoka
ultra-n00b
Posts: 2
Joined: Fri Sep 25, 2015 1:51 am

Girls und Panzer - Encrypted unity3d files

Post by Nanoka »

Hello, I dumped files from a mobile game for extraction but apparently most are encrypted.
Files are unity3d. First of all I checked if it was consistent across all encrypted files but the only consistency I found was the first 3 bytes with text "EAB" followed by other encrypted bytes instead of the expected "UnityFS", though the version apparently isn't encrypted.
Searching the web all I found is that some guy on 2ch wrote a program for decrypting this but the link is dead and there is no information about the process or anything except what I already know.
I have no knowledge on encryption, so I come here looking for any help.

Here is a zip with a bunch of files, some encrypted and others not, from the same game:
https://mega.nz/#!U8pECSyB!-jy03DT1fLGB ... A0NL_Z9Yk0

Thanks in advance!

Edit:
After getting part of a decrypted file by dumping the game memory and comparing with the encrypted counterpart I have some findings.

First of all, the encryption stops at some point and this address is right here:
Image
It is stored in little endian at 0x04 and is 2 bytes long.

Next, how (I think) this encryption works:
Image
The first byte at 0x60 is XORed with the value from 0x06.

Then every next byte is XORed with the previous XORed byte and stops before the stored address at 0x04.

Dumped decrypted file:
Image
Encrypted file:
Image
XOR 0x61 with 0x60:
Image
Then XOR 0x60 with 0x06:
Image

Now I need help with writting a script for this or something.
chrrox
Moderator
Posts: 2602
Joined: Sun May 18, 2008 3:01 pm
Has thanked: 57 times
Been thanked: 1411 times

Re: Encrypted unity3d files

Post by chrrox »

What game is it?
Nanoka
ultra-n00b
Posts: 2
Joined: Fri Sep 25, 2015 1:51 am

Re: Encrypted unity3d files

Post by Nanoka »

This is from girls und panzer mobile game.

I have actually wrote a windows batch file using some other utilities I found on the web and got myself a way for doing this by just running it.
While it worked for all files, it is a mess and needs so many external executables with their dependencies its inconvenient to hand it to somebody else.

If you want to take a look, I attach a zip with bat and some of the executables.
gup_eab.zip
You do not have the required permissions to view the files attached to this post.
tsumugi
ultra-n00b
Posts: 1
Joined: Sat Sep 14, 2019 6:50 pm
Has thanked: 1 time

Re: Encrypted unity3d files

Post by tsumugi »

Nanoka wrote: Tue Jan 14, 2020 6:18 am This is from girls und panzer mobile game.

I have actually wrote a windows batch file using some other utilities I found on the web and got myself a way for doing this by just running it.
While it worked for all files, it is a mess and needs so many external executables with their dependencies its inconvenient to hand it to somebody else.

If you want to take a look, I attach a zip with bat and some of the executables.

gup_eab.zip
I can't really get this to work, I seem to get files like this for the few files that do open and everything else just makes Asset Studio crash and they are all between 3-18 KB in size.
chr_akebi_bunkasai_1_4_ficon_l.png
Not really sure what is wrong.

Powershell just gives this error:

Image
You do not have the required permissions to view the files attached to this post.
Spiritovod
mega-veteran
mega-veteran
Posts: 171
Joined: Sun Oct 10, 2010 9:44 pm
Has thanked: 31 times
Been thanked: 153 times

Re: Encrypted unity3d files

Post by Spiritovod »

@tsumugi: I suppose you're trying to convert all files, while only some of them are encrypted. I've created quickbms script based on Nanoka's samples and info from the first post. You can run it against the whole folder, it will decrypt only encrypted files. Tested on current game version as well.
You do not have the required permissions to view the files attached to this post.
Post Reply