grand prix evolution compressed files, encrypted?

Bogus · Post by **Bogus** » Thu Jul 19, 2012 1:35 pm

Hello all.
How to extract files from grand prix evolution?
Files in this game are graphics, graphics130 and graphics140 without extension
demo can be downloaded from http://www.sendspace.com/file/8a17o5
Some links already expired
demo version has only graphics file

Bogus · Post by **Bogus** » Tue Jul 24, 2012 6:36 am

no one know how to extract these files?
aluigi maybe thou know how?

Ekey · Post by **Ekey** » Tue Jul 24, 2012 2:20 pm

Link for download demo or full.

Bogus · Post by **Bogus** » Tue Jul 24, 2012 3:48 pm

of course
check first post
full version i have original from cybermycha

Ekey · Post by **Ekey** » Wed Jul 25, 2012 12:01 am

So encrypted. Here algo

Code: Select all

static unsigned char Key[1024] = {
0x09, 0x0D, 0x9A, 0xCC, 0x23, 0x08, 0xA5, 0xA9, 0xAA, 0x91, 0x76, 0xCD,
0x61, 0x98, 0x09, 0x17, 0xAE, 0xD1, 0x7D, 0x09, 0xF4, 0x77, 0x4E, 0x52,
0x0C, 0xD5, 0xDE, 0x63, 0xDF, 0x2D, 0x4D, 0xAE, 0x09, 0xB0, 0xC8, 0x8E,
0xC1, 0xCB, 0x05, 0x1E, 0xED, 0xAF, 0xB4, 0xE8, 0x7B, 0xAB, 0xA3, 0xBC,
0x47, 0xE2, 0xE2, 0x4D, 0xBF, 0xBC, 0xAD, 0xD6, 0x6B, 0xC2, 0x7B, 0xDE,
0xCE, 0xF0, 0xE9, 0xCC, 0x50, 0x12, 0x76, 0xCF, 0x8E, 0xC6, 0xD1, 0x2B,
0xAC, 0x0C, 0xC5, 0x5F, 0x2F, 0x0E, 0xDF, 0xA7, 0x8C, 0x6C, 0x2C, 0x24,
0x9B, 0xD4, 0x99, 0xAC, 0xC1, 0x96, 0x3E, 0xA6, 0xC3, 0x1C, 0xE0, 0x35,
0x9B, 0x13, 0x4E, 0x63, 0x2D, 0x32, 0xA7, 0x5D, 0x01, 0xA5, 0x96, 0xCC,
0x4D, 0xEE, 0x3A, 0xAB, 0x02, 0x82, 0xBC, 0x73, 0xD7, 0x1A, 0x42, 0x52,
0x68, 0x28, 0x9C, 0x40, 0x18, 0xFF, 0x48, 0x42, 0x55, 0x04, 0x09, 0xC2,
0x61, 0x18, 0x38, 0x64, 0x20, 0x51, 0x09, 0x55, 0x22, 0x34, 0xC7, 0xB0,
0xC5, 0xA7, 0x6A, 0xF1, 0x9E, 0x49, 0xE5, 0xEC, 0x61, 0x67, 0x2E, 0x71,
0x45, 0x49, 0x9C, 0x5B, 0xEE, 0x72, 0xF8, 0xC5, 0xBA, 0x23, 0x0B, 0x0D,
0x85, 0xFC, 0x19, 0x40, 0xA0, 0xBE, 0x43, 0x8F, 0xD1, 0xCE, 0x81, 0x0F,
0xAC, 0x08, 0xCB, 0x4B, 0xB3, 0xFC, 0x5D, 0xEA, 0x7E, 0xE5, 0xB9, 0x7C,
0x25, 0x2E, 0xDB, 0x0E, 0x33, 0x8E, 0x1E, 0x28, 0x41, 0x74, 0x98, 0xEA,
0x26, 0x47, 0x4E, 0x94, 0xC7, 0x5B, 0xA0, 0x14, 0x2D, 0x27, 0x17, 0xBE,
0x6B, 0x4F, 0xB4, 0xBC, 0x6C, 0x5C, 0x5F, 0x34, 0x91, 0x48, 0x31, 0xD6,
0xB6, 0x66, 0x23, 0xA8, 0xCA, 0x55, 0x17, 0x2B, 0x90, 0xEB, 0x9D, 0xD2,
0x37, 0x25, 0x03, 0x15, 0x88, 0xA0, 0x3F, 0x82, 0xBD, 0x41, 0xF6, 0xAE,
0x08, 0x15, 0xA9, 0x4A, 0x7C, 0x6A, 0x34, 0x60, 0xDC, 0x38, 0x3C, 0xD7,
0x04, 0x90, 0xF7, 0xF4, 0x83, 0x88, 0x21, 0xC0, 0x0C, 0x7A, 0x9C, 0x47,
0x91, 0x41, 0x66, 0x00, 0xD9, 0x64, 0xF5, 0x09, 0x76, 0xD3, 0x64, 0xCF,
0xF9, 0x6A, 0x11, 0xEF, 0x06, 0x41, 0xD1, 0xB5, 0xD4, 0x57, 0xEE, 0x96,
0x60, 0xAD, 0xBC, 0x07, 0x1F, 0x25, 0x4F, 0xEF, 0xAD, 0x70, 0xFC, 0x36,
0xCA, 0x9B, 0x7F, 0xC6, 0xE5, 0xB0, 0x86, 0x1E, 0xF8, 0x47, 0x6E, 0x10,
0x86, 0xD3, 0xB2, 0x50, 0x42, 0x6C, 0x09, 0x54, 0x4C, 0xA8, 0x43, 0x56,
0x87, 0x66, 0xB4, 0x5A, 0x60, 0xA8, 0x79, 0x10, 0x20, 0x30, 0x94, 0x7D,
0xD2, 0x04, 0x6C, 0x30, 0x74, 0x10, 0x11, 0xB0, 0x10, 0x8E, 0x0D, 0x38,
0xCD, 0x93, 0xB6, 0x25, 0x0C, 0x7A, 0xB0, 0xE9, 0xAD, 0x10, 0xA9, 0x0A,
0xF5, 0xA2, 0xC4, 0xA2, 0x1F, 0xFA, 0x84, 0x74, 0x0C, 0xCB, 0xF4, 0x16,
0xC2, 0xB0, 0x2E, 0x90, 0x7E, 0x30, 0x26, 0xFB, 0x5C, 0x94, 0xD4, 0x2A,
0x5A, 0xE2, 0xDE, 0xD8, 0x94, 0x7E, 0xAE, 0x7C, 0xF2, 0x50, 0x2B, 0xC9,
0x68, 0x8C, 0x18, 0x38, 0xC0, 0xA8, 0xDF, 0x59, 0xAC, 0x50, 0x49, 0xB9,
0x1D, 0x83, 0x84, 0x80, 0xFE, 0x54, 0xEF, 0x42, 0xD4, 0xC5, 0xCC, 0xF6,
0x16, 0xF2, 0xAF, 0xE8, 0x2A, 0x2D, 0xD2, 0x77, 0x80, 0x63, 0x21, 0xE0,
0x7E, 0x30, 0xCF, 0xE2, 0x96, 0x54, 0x06, 0x7A, 0xEF, 0x29, 0x5C, 0xE0,
0x96, 0xCE, 0xF8, 0xA7, 0xBE, 0x90, 0x94, 0xD3, 0xD2, 0xD0, 0xF2, 0x58,
0x71, 0x34, 0x8C, 0x28, 0x5B, 0xCE, 0xDF, 0x16, 0xF4, 0x96, 0x20, 0x44,
0x99, 0x70, 0x20, 0xB4, 0xF6, 0x35, 0x7A, 0x04, 0xF8, 0x70, 0x54, 0x50,
0xC9, 0xD0, 0xB0, 0x5E, 0xAD, 0x58, 0x81, 0x93, 0x9E, 0x25, 0xBC, 0xC6,
0xB0, 0x71, 0x01, 0x90, 0x7D, 0xAA, 0xC1, 0x92, 0xC4, 0xF2, 0x7F, 0x7A,
0xE4, 0xD4, 0x40, 0x8B, 0x9A, 0x16, 0x62, 0x30, 0x7A, 0x28, 0x7E, 0xB0,
0x7E, 0xF3, 0xD4, 0x94, 0x3C, 0x9A, 0x2A, 0x16, 0xDE, 0x18, 0x2C, 0x72,
0x5E, 0x9A, 0xDA, 0xD0, 0x8B, 0xA9, 0xD0, 0x4C, 0xA8, 0xE4, 0x80, 0xA0,
0xEF, 0x61, 0xD4, 0x50, 0xF5, 0x49, 0xE5, 0x41, 0xE4, 0x18, 0xFA, 0x94,
0x15, 0xD6, 0xFC, 0xE5, 0x5E, 0x7E, 0xD2, 0x32, 0x47, 0xE8, 0x22, 0x2D,
0x06, 0xBF, 0xF2, 0x5B, 0xFB, 0x60, 0xA6, 0x54, 0x6B, 0x66, 0x72, 0xD4,
0x4E, 0x5A, 0xFD, 0x91, 0xB4, 0xE8, 0x16, 0xFE, 0x38, 0x8F, 0x16, 0x70,
0xA2, 0xE3, 0x16, 0xB0, 0x7E, 0x04, 0x5D, 0x74, 0xA8, 0x20, 0x9B, 0x4E,
0xFF, 0x26, 0xB0, 0xDA, 0xA0, 0xB4, 0xB1, 0xC0, 0x68, 0xA6, 0x74, 0xE3,
0x96, 0xBC, 0x8E, 0xD0, 0x04, 0xB0, 0xF1, 0x20, 0x90, 0x76, 0x45, 0x1C,
0xE3, 0xE3, 0x8A, 0xE0, 0x78, 0xC2, 0x10, 0x31, 0xAC, 0xF0, 0xEC, 0x6C,
0xE3, 0x6E, 0xE8, 0x18, 0xAB, 0x8E, 0x9C, 0x06, 0xDE, 0x77, 0xC9, 0x2C,
0xCA, 0x40, 0x24, 0x3C, 0x7E, 0xD0, 0xBD, 0x51, 0x06, 0xF4, 0x18, 0x12,
0xBE, 0x7C, 0xA6, 0xE8, 0x2E, 0x5C, 0xAD, 0x47, 0x0A, 0x70, 0x31, 0xED,
0x48, 0xCA, 0x98, 0xDC, 0xB0, 0x90, 0x9D, 0x91, 0x00, 0x70, 0x35, 0xE5,
0xEA, 0xD0, 0xBC, 0x50, 0x5F, 0x94, 0x0E, 0x32, 0x64, 0x95, 0x40, 0x1E,
0xE2, 0x3C, 0xC3, 0xE8, 0xBC, 0x9F, 0xB6, 0xDF, 0x2C, 0x0B, 0xE0, 0x20,
0xA0, 0x2E, 0x5F, 0xEA, 0x75, 0x0C, 0x1A, 0xEA, 0x2F, 0x39, 0xBC, 0xB4,
0x92, 0x7E, 0xA8, 0xD1, 0x52, 0xB0, 0xF3, 0xF9, 0x62, 0xB0, 0xAA, 0x34,
0xCD, 0x5C, 0xF7, 0xBC, 0x91, 0x82, 0x11, 0x9A, 0x74, 0xFE, 0x54, 0x28,
0x1B, 0x00, 0x3C, 0x19, 0x91, 0xAF, 0xBC, 0x08, 0x4E, 0x98, 0xB4, 0x10,
0xA1, 0x50, 0x2C, 0x2A, 0x31, 0x9C, 0x9F, 0xF3, 0x72, 0xB0, 0x98, 0x6E,
0x10, 0x71, 0x2C, 0xF0, 0x7C, 0x04, 0x23, 0x6E, 0x48, 0x68, 0xEB, 0x3E,
0xFC, 0xD6, 0xCE, 0x77, 0x43, 0x0C, 0x1A, 0x40, 0x24, 0xE4, 0x0E, 0x50,
0x0D, 0x55, 0x3E, 0xF4, 0x38, 0xA2, 0x66, 0x38, 0x46, 0x68, 0xC6, 0x40,
0x1D, 0x8B, 0x92, 0xF0, 0xFD, 0x4D, 0x80, 0x82, 0xF8, 0x54, 0x30, 0xA8,
0x8D, 0x41, 0x10, 0x70, 0xC9, 0x85, 0x92, 0x58, 0x5C, 0xF8, 0xDF, 0x94,
0x0A, 0xEA, 0x7C, 0x25, 0x14, 0x8E, 0x92, 0xCC, 0xAB, 0xE8, 0x2C, 0xA7,
0x52, 0x9F, 0xAC, 0x2B, 0xDC, 0x20, 0x7C, 0x76, 0x6F, 0x2A, 0xE5, 0x7C,
0x82, 0xCA, 0x13, 0x29, 0x3C, 0x04, 0x22, 0x8E, 0xA8, 0x09, 0x32, 0xF0,
0x6D, 0x99, 0xBA, 0xF0, 0x7A, 0x76, 0x71, 0x4C, 0xD7, 0x88, 0x11, 0x02,
0x31, 0x2A, 0xCC, 0x8E, 0x54, 0xAC, 0x03, 0x90, 0x14, 0xBB, 0x91, 0x27,
0x84, 0x10, 0x8A, 0x78, 0xF4, 0x10, 0xE9, 0x60, 0xAC, 0xB2, 0xC5, 0x9C,
0xD7, 0x23, 0x86, 0xC8, 0xF8, 0xBA, 0xD0, 0x89, 0xB4, 0xB0, 0xAC, 0xC8,
0x0B, 0x76, 0x58, 0xE8, 0x03, 0xFE, 0x1C, 0xBA, 0xF6, 0x77, 0x93, 0x84,
0xB2, 0x00, 0x70, 0x3C, 0x72, 0x90, 0x35, 0x8F, 0xF6, 0x74, 0x38, 0x52,
0x7E, 0x44, 0x76, 0x88, 0x1E, 0x1A, 0xD1, 0xBC, 0x20, 0x50, 0xA9, 0x85,
0xA4, 0x94, 0x08, 0x0E, 0x50, 0x2C, 0xE1, 0x19, 0xE8, 0xB0, 0x83, 0xE9,
0x6C, 0x6E, 0x6C, 0xBC, 0x95, 0xC4, 0x02, 0xEE, 0xD0, 0x21, 0x66, 0x84,
0xFE, 0x58, 0x37, 0xE8, 0x6C, 0x55, 0xA2, 0x1B, 0xAA, 0x0F, 0x42, 0xB0,
0x3E, 0x46, 0x5B, 0x0E, 0x6D, 0x34, 0xCE, 0x2A, 0x8F, 0xB9, 0x7C, 0x8C,
0xB2, 0x46, 0x88, 0x73, 0x0A, 0xD0, 0xD6, 0x41, 0x9A, 0xE0, 0x82, 0xF9,
0x5D, 0xB4, 0x67, 0xB4};

Code: Select all

signed int __stdcall Decrypt(void *a1, int a2, int a3, int a4)
{
  int v4;
  int v5;
  signed int v6;
  int v7;
  char v8;
  signed int result;

  v4 = *(_DWORD *)a1;
  if ( *(_DWORD *)a1 && a2 && (v5 = a3, a3) && a4 )
  {
    v6 = 0;
    if ( a4 > 0 )
    {
      v7 = a4;
      do
      {
        v8 = *(_BYTE *)(a2 - a3 + v5) ^ *(_BYTE *)(v6++ + v4);
        *(_BYTE *)v5 = v8;
        if ( v6 >= 1024 )
          v6 = 0;
        ++v5;
        --v7;
      }
      while ( v7 );
    }
    result = 1;
  }
  else
  {
    result = 0;
  }
  return result;
}

a1 - buffer
a2 - key
a3 - length (always 0x400) ?
a4 - tempbuf

aluigi · Post by **aluigi** » Wed Jul 25, 2012 7:40 pm

that one is only a part of the job (it's just a simple xor that thing), anyway I did the job:
http://aluigi.org/papers/bms/gpeg.bms

Bogus · Post by **Bogus** » Thu Jul 26, 2012 6:47 am

thanks aluigi the script works!
Ekey how generated key?
also i would like to know how to find and read
only do not know where to start

aluigi · Post by **aluigi** » Thu Jul 26, 2012 10:10 am

that key is the result of an expansion (it's just a concatenation) and scrambling of the 0x84 bytes long key 98ru91nb98fH98ufkfQkRAnf09i09kmvVnSjzAc9iu28rir09akdnBCn289ua9f09aRFnf029ur09akQRtanmzlkAvjb983ur9jaopVAkfmlzrWknlRzxc90i3r09uqtARankfnQdf to a 1024 one using an algorithm similar to an rc4.

where to start?
CreateFileA and ReadFile, they are ever the beginning

anyway you should start from something simpler, this game wasn't simple at all

Bogus · Post by **Bogus** » Thu Jul 26, 2012 12:41 pm

small problem
on demo version script works, but on full version script not work
i get the error:

Error: the compressed zlib/deflate input is wrong or incomplete (-3)

Error: there is an error with the decompression
the returned output size is negative (-1)

unless compression is other or wrong offset

I do not know if I can send the file, like what please on pw

aluigi · Post by **aluigi** » Thu Jul 26, 2012 1:03 pm

exe+file in pm

aluigi · Post by **aluigi** » Thu Jul 26, 2012 3:15 pm

job done, script updated.

in short the additional encryption (gpe_decrypt_file.c) is applied only when "TYPE & 1"

Bogus · Post by **Bogus** » Thu Jul 26, 2012 3:21 pm

ok
in full version is other compression?

aluigi · Post by **aluigi** » Thu Jul 26, 2012 4:03 pm

the only difference between demo and full version is that this second one doesn't use the additional scrambling/encryption on the files

Bogus · Post by **Bogus** » Thu Jul 26, 2012 4:35 pm

ok
thanks for the message

Bogus · Post by **Bogus** » Fri Jul 27, 2012 7:46 am

thanks aluigi
now the script works on each version
again thanks
this files I can already delete from server, no will already needed

XeNTaX

XeNTaX