Mobius Final Fantasy [Unity]

[Maki]

mobiusff_Data/mobius_data/Hash/...
Compressed Unity3D standalone files with MD5 hash names
Opeanable/decompressable with UnityEx 1.4.3
After decompressing, real package name is at: 0x40. Example name: CAB-b90836_android (terminated with /0)

About fileformats:
MUSIC:
example: music_saranotheme.txt is in AKB2 container. In order to make it working OGG delete 320 bytes from start, so the file starts with OggS header. Voila

Textures:
DXT

AES crypt
e.g. assetList_hash_win.dat is AES crypted
AES128
IV :

Code: [Select]

$MEVIUS-PROJECT#Key:

Code: [Select]

SQUARE-ENIX-BD1%CipherMode: CBC
PaddingMode: ISO10126


assetList_hash_win.dat

Offset	Size	Description
0x00	16 bytes	AES IV - Treat as UTF8 bytes
0x16	varies	Compressed data

Deciphered:

Offset	Size	Description
0x00	4 bytes	Probably entries count
0x04	EntryCount*48	Entry

ENTRY:

Offset	Size	Description
0x00	40 bytes	ANSI file relative path
0x28	unsigned int	File revision (uint)
0x2C	int	File size

Example MD5 file names:
Text/CutScene/ev_0000_010/ev_0000_010TxtRes__jp

Full JP filelist:
http://cache.jp.mobiusfinalfantasy.com/asset/20170127_0007/mobius_data_middle/win/assetList_hash_win_JP.bin (unknown format, probably AES with default IV and key, too lazy to test UPDATE:Nope, doesn't work)
http://cache.jp.mobiusfinalfantasy.com/asset/20170217_1633/mobius_data_middle/win/managementList_hash_win_JP.txt
http://cache.jp.mobiusfinalfantasy.com/asset/20170217_1633/mobius_data_middle/win/datasheetList_hash_win_JP.txt

[Albeoris]

Decrypted Assembly-CSharp.dll (PC):
https://yadi.sk/d/dI9_Cqw_3ECdtr

[Maki]

Decrypted Assembly-CSharp.dll (PC):
https://yadi.sk/d/dI9_Cqw_3ECdtr

Thanks! What was the obfuscation?

EDIT: Oh, there's a debug menu.

[Albeoris]

Thanks! What was the obfuscation?

EDIT: Oh, there's a debug menu.

Idk, just dump the game process and look at the dump via HEX-editor. (:

[Maki]

Okay, the AssetList_hash_win.dat is AES secured

IV = is the first 16 characters, grab them as ASCII to string and convert by Encoding.UTF8 to bytes
Key = Key is calculated from 64-bit library of NativeLibrary.dll, function getCryKey2. Get's one uint argument which in code is passed as MainLoop.key (which is null uint)

Code is:

Code: [Select]

.text:0000000180001020 arg_0           = dword ptr  8
.text:0000000180001020
.text:0000000180001020                 mov     [rsp+arg_0], ecx
.text:0000000180001024                 xor     edx, edx
.text:0000000180001026                 mov     r8d, 0FFFFFFFEh
.text:000000018000102C                 lea     r10, byte_18005B090
.text:0000000180001033                 lea     r9, byte_18005C950
.text:000000018000103A                 nop     word ptr [rax+rax+00h]
.text:0000000180001040
.text:0000000180001040 loc_180001040:                          ; CODE XREF: getCryKey2+57j
.text:0000000180001040                 lea     eax, [r8-1]
.text:0000000180001044                 mov     rcx, r8
.text:0000000180001047                 add     rdx, 2
.text:000000018000104B                 and     eax, 3
.text:000000018000104E                 and     ecx, 3
.text:0000000180001051                 add     r8d, 2
.text:0000000180001055                 movzx   eax, byte ptr [rsp+rax+arg_0]
.text:000000018000105A                 movzx   ecx, byte ptr [rsp+rcx+arg_0]
.text:000000018000105F                 xor     al, [rdx+r10-2]
.text:0000000180001064                 xor     cl, [rdx+r10-1]
.text:0000000180001069                 mov     [rdx+r9-2], al
.text:000000018000106E                 mov     [rdx+r9-1], cl
.text:0000000180001073                 cmp     rdx, 22h
.text:0000000180001077                 jl      short loc_180001040
.text:0000000180001079                 mov     rax, r9
.text:000000018000107C                 retn

EDIT: The file names are casual MD5, nothing much
I'll try to hack into process and grab the key from memory

UPDATE: There's some exception protection as it's throwing them like a crazy when started (may be related to webview of news) so it kind of kills my IDA64, attaching later to process after finishing web activity loading doesn't trigger getCryKey2 anymore (it's only at the semi-beginning to set the AESIV and AESKEY and is not used anymore. I'm still digging. Anyway, I found this:

Code: [Select]

$MEVIUS-PROJECT#,SQUARE-ENIX-BD1%

It has 33 characters
The managed code gets IntPtr to result of the getCryKey2, treats it via Marshal as ANSI text and splits to IV and key via string.split based on ',' character.
meaning, that this may be the secret key:
$MEVIUS-PROJECT# - for default IV
SQUARE-ENIX-BD1% - for default key
both have 16 characters, so 128bit, looks fine. Let's see..
@UPDATE

Yep:
AES128
IV : $MEVIUS-PROJECT#
Key: SQUARE-ENIX-BD1%
CipherMode.CBC
PaddingMode.ISO10126

What if they have seen that extracting Final Fantasy IX code was easy so they obfuscated the IL assembly and hid the key in AMD64 (x86-64) DLL? 
Well, not really the key is hidden. Just let Mobius run and generate the keys, then attach to process, find NativePlugins DLL and getCryKey2 function and jump to byte array at getCryKey2+C. They don't flush the buffer after saving the key to managed Mevius.App.Api.AesKey and Mevius.App.Api.IV

@UPDATE3:
Found the dictionary for fileList, the two unknowns in entries are: fileRevision and fileSize

Content categories. First character is first hash name (not the files, it's far more complicated xD)

Code: [Select]

"pc",
"mon",
"npc",
"weapon",
"guardian",
"fa",
"summon",
"test",
"exte"


Now the server:
Sample HTTP 1.1 GET request for asset file:

Code: [Select]

cache.jp.mobiusfinalfantasy.com/asset/20170217_1633/mobius_data_middle/win/Hash/a1/092b86e0aa0970e80dbc9bc152fbe3_win.unity3d

Info file:
http://web.jp.mobiusfinalfantasy.com/asset/mobius_info_JP.txt

[yubikiri]

Decrypted Assembly-CSharp.dll (PC):
https://yadi.sk/d/dI9_Cqw_3ECdtr

It says (PC), which version the original file, was it steam jp?
was it obfuscated dll or encrypted one btw? since there is invalid RVA warning

[Maki]

This is jp version because it has only Japanese servers and assets list encoded to download. Original file has damaged meta-data header (the magic net header I forgot now), it's not really obfuscated, just protected from IL decompiling. Net unpacker doesn't work with this, you have to rip the dll manually or find a way to fix this header.

[yubikiri]

This is jp version because it has only Japanese servers and assets list encoded to download. Original file has damaged meta-data header (the magic net header I forgot now), it's not really obfuscated, just protected from IL decompiling. Net unpacker doesn't work with this, you have to rip the dll manually or find a way to fix this header.

woah, so that is how it is, i've been messing with the global version and no luck yet.
it's always ended up with *Object reference not set to an instance of an object.*
thanks for the heads up

[Maki]

It's "BSJB" (0x424A5342) DWORD missing in metadata section (probably). I have no idea how to locate it.

This may be extremely helpful:
https://www.codeproject.com/Articles/12585/The-NET-File-Format

On CFF explorer author site I found SNSRemover, a software that removes signature from .NET assembly, maybe they used that?

[yubikiri]

It's "BSJB" (0x424A5342) DWORD missing in metadata section (probably). I have no idea how to locate it.

This may be extremely helpful:
https://www.codeproject.com/Articles/12585/The-NET-File-Format

On CFF explorer author site I found SNSRemover, a software that removes signature from .NET assembly, maybe they used that?

idk, maybe they did remove it by using that software...
it's not really my thing but it does help me understand better about the structure.
if it's "BSJB".. i think it could be located by inputting the value of "MetaData RVA" from MetaData Header to address converter on CFF, hmmm, i'll just try it later

[Maki]

Tried that. ILSpy detects it as managed assembly but throws error (probably with the meta data streams)
I ripped the most-up-to-date english assembly and tested it with packed assembly:


and info for unpacked/working assembly with working metadata:



Link to english decrypted Assembly:
https://www.dropbox.com/s/bmxv2tgxa5yysmy/assemblyCS.dll?dl=0

[yubikiri]

uwah, i'm envius that you managed to do it so fast 
i guess i still have many thing too learn..
btw does the global version used the same file with japan version? i can't tell about the content, but the size of dll file is about the same

[Maki]

I'm getting reports that they did an update for Mobius and:

1. The process reopens a bit after showing SquareEnix logo and works in some sort of protected mode meaning you can't attach debugger to working project
2. Dumped Assembly-CSharp.dll from running instance is strange, ILSpy isn't opening it, CE doesn't even detect it in EnumSymbols function and IDA fails to attach (Mobius process) and enumerate images because of the privileges, when AssemblyCs opened in IDA it says, that the image is corrupted and has nothing to show

Tried looking at it via Process Monitors, bur it turns out it's just like any other process, nothing about locked access or anything.

Has anyone met such project that you can't attach to because of the "insufficient privileges" even though the process looks like normal process? Is it possible Mobius creates it's own fake debugger and attaches to himself to prevent any other debugger to step in?

[LeonhartGR]

Hey folks... If anyone is playing mobius I'd love to get along with in this journey. I'm playing for a long time now and definitely would need some help. Also with the MP. Add me on steam and send me a message there if you r interested. Thanks.

[holy_vink]

hey, I'm new here and play mobius ff jp as well. I can export some text assets file from the hash folder in the form of .txt files. Do you know how to open it? It's not the ogg file..the asset name is job ability...I wonder if I can somehow read the content of that text assets. Thanks in advance

[Maki]

Hello again!
Some time ago I received an e-mail if I might be looking back at that obfuscated/crypted assembly:

1. Anti debugger privileges was my paranoid anti-malware software
2. mobiusff.exe is C++ 64 bit Unity assembly
3. The assembly-csharp.dll IS NOT loaded as library (via loadlibrary)
 3a. I hooked every single I/O operation to actually find what makes it to parse Assembly-csharp.dll. See image below


Assembly-csharp.dll is broken on purpose to not be available to anything that manages symbols from DLL other than specific software written to ignore such details. I'm going to find the code location inside memory and see what I could do

UPDATE:
0x2EC- this whole file is completely crypted... Normal PE is fine, but the whole .NET is completely ciphered

UPDATE2:
MonoManager::LoadAssemblies(dynamic_bitset)+184 -> loads the .DLL (and probably parses it/ RAX contains struct with assembly pointers)
MonoManager::LoadAssemblies(dynamic_bitset)+191  call    cs:mono_assembly_get_image

UPDATE3:
I'm close:
These are strings from pre-loaded assembly image from struct:

pointer 2:

Pointer 3:


It's not full assembly (there's no i.e. BSJB), but it's already deciphered/decrypted so looks like MonoManager::LoadAssemblies(dynamic_bitset)+184 is where I need to go deeper (it's before I/O and after decipher)

UPDATE4:
I got it. I'm soon to rebuild the assembly

[Maki]

Decrypted! (DLL as of 2018.09.19)
https://www.dropbox.com/s/vtlby83o8whxf1n/Assembly-CSharp.zip?dl=0