1

over the past year, I provided an English patch to a community of thousands of players of a game I love and which is not available in English (just Chinese and Korean).

Sadly, besides me, other people created cheat tools for the game forcing and the developers to react by encrypting the files of the client. Even tho I am happy they make an effort to prevent cheating, I am sad I can no longer provide the community with my English patch.

I spent the last few days trying to crack the files to be able to understand how I can decrypt them, replace the Chinese with my English content, and then encrypt it again.

However I was not lucky with this, the files are super weird.

we have tried to identify the structure and came up with

key (8byte) + filesize (4byte) + junk (0-6byte) + data

but we are not sure about the junk part

Here's an encrypted new version and a decrypted old version of the same file. I picked this file as it seems to not have changed between encrypted and decrypted version.

Does anyone have any tips/pointers for me?

  • Are you sure about the files you attached? The sizes don't correlate by the pattern you mentioned. – sudhackar Jul 31 '18 at 10:54
  • that's what i meant, it looks weird. we have tried some bruteforce xor encryption keys and on another file we were able to decrypt the first part which gave us autoImport("TestEffe the rest was still scrambled we are kinda lost on this :/ i am abit worried i have to close the english patch project – Gardosen Jul 31 '18 at 10:59
  • The normal file is larger in size than the encrypted version. – sudhackar Jul 31 '18 at 11:00
  • yes, one of our team noticed that it seems that there was a conversion happening which changed all CRLF at the end of each line to LF. maybe this is what you see. – Gardosen Jul 31 '18 at 11:18
  • mind sharing the name of the game? tried working with those files only but thinking about it, the "autoImport" could be coincidental. you can get any result by xoring a given string with the appropriate "key" – Amirag Jul 31 '18 at 17:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.