Miscellaneous Forums > Scripting and Reverse Engineering
Mobius Final Fantasy [Unity]
Maki:
mobiusff_Data/mobius_data/Hash/...
Compressed Unity3D standalone files with MD5 hash names
Opeanable/decompressable with UnityEx 1.4.3
After decompressing, real package name is at: 0x40. Example name: CAB-b90836_android (terminated with /0)
About fileformats:
MUSIC:
example: music_saranotheme.txt is in AKB2 container. In order to make it working OGG delete 320 bytes from start, so the file starts with OggS header. Voila
Textures:
DXT
AES crypt
e.g. assetList_hash_win.dat is AES crypted
AES128
IV :
--- Code: ---$MEVIUS-PROJECT#
--- End code ---
Key:
--- Code: ---SQUARE-ENIX-BD1%
--- End code ---
CipherMode: CBC
PaddingMode: ISO10126
assetList_hash_win.dat
OffsetSizeDescription0x0016 bytesAES IV - Treat as UTF8 bytes0x16variesCompressed data
Deciphered:
OffsetSizeDescription0x004 bytesProbably entries count0x04EntryCount*48Entry
ENTRY:
OffsetSizeDescription0x0040 bytesANSI file relative path0x28unsigned intFile revision (uint)0x2CintFile size
Example MD5 file names:
Text/CutScene/ev_0000_010/ev_0000_010TxtRes__jp
Full JP filelist:
http://cache.jp.mobiusfinalfantasy.com/asset/20170127_0007/mobius_data_middle/win/assetList_hash_win_JP.bin (unknown format, probably AES with default IV and key, too lazy to test UPDATE:Nope, doesn't work)
http://cache.jp.mobiusfinalfantasy.com/asset/20170217_1633/mobius_data_middle/win/managementList_hash_win_JP.txt
http://cache.jp.mobiusfinalfantasy.com/asset/20170217_1633/mobius_data_middle/win/datasheetList_hash_win_JP.txt
Albeoris:
Decrypted Assembly-CSharp.dll (PC):
https://yadi.sk/d/dI9_Cqw_3ECdtr
Maki:
--- Quote from: Albeoris on 2017-02-17 10:24:18 ---Decrypted Assembly-CSharp.dll (PC):
https://yadi.sk/d/dI9_Cqw_3ECdtr
--- End quote ---
Thanks! What was the obfuscation?
EDIT: Oh, there's a debug menu. :D
Albeoris:
--- Quote from: Maki on 2017-02-17 11:44:15 ---Thanks! What was the obfuscation?
EDIT: Oh, there's a debug menu. :D
--- End quote ---
Idk, just dump the game process and look at the dump via HEX-editor. (:
Maki:
Okay, the AssetList_hash_win.dat is AES secured
IV = is the first 16 characters, grab them as ASCII to string and convert by Encoding.UTF8 to bytes
Key = Key is calculated from 64-bit library of NativeLibrary.dll, function getCryKey2. Get's one uint argument which in code is passed as MainLoop.key (which is null uint)
Code is:
--- Code: ---.text:0000000180001020 arg_0 = dword ptr 8
.text:0000000180001020
.text:0000000180001020 mov [rsp+arg_0], ecx
.text:0000000180001024 xor edx, edx
.text:0000000180001026 mov r8d, 0FFFFFFFEh
.text:000000018000102C lea r10, byte_18005B090
.text:0000000180001033 lea r9, byte_18005C950
.text:000000018000103A nop word ptr [rax+rax+00h]
.text:0000000180001040
.text:0000000180001040 loc_180001040: ; CODE XREF: getCryKey2+57j
.text:0000000180001040 lea eax, [r8-1]
.text:0000000180001044 mov rcx, r8
.text:0000000180001047 add rdx, 2
.text:000000018000104B and eax, 3
.text:000000018000104E and ecx, 3
.text:0000000180001051 add r8d, 2
.text:0000000180001055 movzx eax, byte ptr [rsp+rax+arg_0]
.text:000000018000105A movzx ecx, byte ptr [rsp+rcx+arg_0]
.text:000000018000105F xor al, [rdx+r10-2]
.text:0000000180001064 xor cl, [rdx+r10-1]
.text:0000000180001069 mov [rdx+r9-2], al
.text:000000018000106E mov [rdx+r9-1], cl
.text:0000000180001073 cmp rdx, 22h
.text:0000000180001077 jl short loc_180001040
.text:0000000180001079 mov rax, r9
.text:000000018000107C retn
--- End code ---
EDIT: The file names are casual MD5, nothing much
I'll try to hack into process and grab the key from memory
UPDATE: There's some exception protection as it's throwing them like a crazy when started (may be related to webview of news) so it kind of kills my IDA64, attaching later to process after finishing web activity loading doesn't trigger getCryKey2 anymore (it's only at the semi-beginning to set the AESIV and AESKEY and is not used anymore. I'm still digging. Anyway, I found this:
--- Code: ---$MEVIUS-PROJECT#,SQUARE-ENIX-BD1%
--- End code ---
It has 33 characters
The managed code gets IntPtr to result of the getCryKey2, treats it via Marshal as ANSI text and splits to IV and key via string.split based on ',' character.
meaning, that this may be the secret key:
$MEVIUS-PROJECT# - for default IV
SQUARE-ENIX-BD1% - for default key
both have 16 characters, so 128bit, looks fine. Let's see..
@UPDATE
Yep:
AES128
IV : $MEVIUS-PROJECT#
Key: SQUARE-ENIX-BD1%
CipherMode.CBC
PaddingMode.ISO10126
What if they have seen that extracting Final Fantasy IX code was easy so they obfuscated the IL assembly and hid the key in AMD64 (x86-64) DLL? 8)
Well, not really the key is hidden. Just let Mobius run and generate the keys, then attach to process, find NativePlugins DLL and getCryKey2 function and jump to byte array at getCryKey2+C. They don't flush the buffer after saving the key to managed Mevius.App.Api.AesKey and Mevius.App.Api.IV
@UPDATE3:
Found the dictionary for fileList, the two unknowns in entries are: fileRevision and fileSize
Content categories. First character is first hash name (not the files, it's far more complicated xD)
--- Code: --- "pc",
"mon",
"npc",
"weapon",
"guardian",
"fa",
"summon",
"test",
"exte"
--- End code ---
Now the server:
Sample HTTP 1.1 GET request for asset file:
--- Code: ---cache.jp.mobiusfinalfantasy.com/asset/20170217_1633/mobius_data_middle/win/Hash/a1/092b86e0aa0970e80dbc9bc152fbe3_win.unity3d
--- End code ---
Info file:
http://web.jp.mobiusfinalfantasy.com/asset/mobius_info_JP.txt
Navigation
[0] Message Index
[#] Next page
Go to full version