Extract text data from a compressed/encrypted .DAT file

Question

Hello,

I'm from Uruguay so I'll make my best effort to explain my "problem" in english. I want to read some text that is inside a .DAT file, but is "encrypted" or "compressed" (I don't know which is the right "term" for this). The file is from the game SMITE, and this file has basically most of the text in the game (like unreleased Item descriptions) and that's why I want to read the file :D

Previous versions of the file could be readed with Notepad ++, like this: https://i.sstatic.net/LCi71.png

But current versions are just random letters and NULL characters. (I can't post a picture because of the "only two links" restriction).

I'm interested in just two files. One, is named "Lang_INT.dat", inside the Localization folder, there is another file in that folder named "GFxTranslation.int", which has some text that appears in the Lobby Screen and things like that, that's why the "Localization" folder has to be where the text is... but in the first picture that I shared, you can see text that appears in-game and also in the lobby screen, and it's on another folder named "Content" and the file is named "assembly.dat", with another file named "behavior_trees.dat" but I think that file is not important to me.

By the way, this maybe would be usefull as a "reference", there is another .DAT file named "word filter" which (i suppose) has the "bad words" that are censored in the chat if the word filter is activated. This .DAT is inside the Localization folder.

Here is a link with ALL the .DAT mentioned in this post

I'll appreciate any kind of help on this, I did some research but I did not find anything that is usefull... the only thing that I know is: A person who has no knowledge about programing or "some" knowledge, could "de-compress" "decrypt" one of this files...or that is what looks like, and no, that person do not want to help me :c

Thanks in advance again, and sorry for bad English:

-Agustín

Answer 1

These files are definitely not compressed. behavior_trees.dat is a binary file which is not encrypted and not compressed, just binary. Encryption, as far as I can see, looks like substitution cipher which should be relatively easy to crack with frequency analysis if you know what should be there. Assuming that decrypted content of files from older and newer versions are similar you can try to account frequencies of symbols on a base of files of previous versions.

Here is what I'd do for decrypting (for example) assembly.dat file:

1. Get a corresponding file from previous version which should be not encrypted.
2. Account frequency of appearance of each symbol (should be easily done with simple python script)
3. Account frequency of appearance of each symbol in newer version files.
4. Try to replace symbols from the newer files to the symbols with same (or alike) appearance rate from the older file and see what happends.

UPDATE, Just for the sake of completeness:

I used an excellent tool XorSearch by Didier Stevens (it was mentioned by @Andy Dove in answer to another question, which reminded me to return to this one) and found out the following:

• Assuming that the decrypted content of current file is similar to content of previous I tried to find some words from the picture you provided with this tool (for example words like item, Pickup and Physical) .
• The tool shows that it is xor substitution cipher, the key is 0x2a, applying it to word filter and lang int files gives reasonable result.
• Applying this key gives a lot of reasonable strings, for all files I tried the key was the same.
• According to your claim you know some basics in programming. Which means that you'll be able to run the following python script on your files and understand what happens or translate it to the language of your choice.

Good luck.

import os
import sys

f = open(sys.argv[1], "rb")
o = open(sys.argv[2], "wb")

data = f.read()

for d in data:
    o.write("" + chr (ord(d) ^ 0x2a))


f.close()
o.close()