[TUT] resource file *.res how it works

[Thecoreman]

Hello I will show you how the resource file *.res in Flyff works.

First there is one byte: the EncryptionKey. Flyff's standard EncryptionKey is: 0x57

then comes a byte which tells if the files are encrypted in the resource file.
default: 0x01 or 0b00000001 is true = encrypted (0x00 or 0b00000000 false = not encrypted)

then a 4-byte value of the ciphertext: (for encryption look at the bottom)

The first 7 bits of the 4-byte value is the version of the resource file
then the next 2 bytes as an Int16 value, representing a number.

The value of type Int16 represents numbers between -32768 and +32767

This number tells us how many files are in this resource file.

then for each file in this resourcefile comes this:
2-byte ASCII string -> Filename
4-byte number Int32 -> Filesize
4-byte number Int32 -> not in use anymore
4-byte number Int32 -> offset (Where the file begins)

then the last bytes are the files.
they are encrypted when the value, described above, is true.

For decryption:
Every bit is turned upside down(the "NOT" bitwise operation) on the data byte (0xCD)
for example:
0xCD = 0b11001101 NOT = 0b00110010 all 1's and 0's reversed.
then XOR it with the EncryptionKey (XOR = Exclusive or):
0b00110010 XOR 0b01010111 = 0b01100101

Next, the result is set to the left by 4(Bit shifting):
0b01100101 = 0b01010110(result 1)
Now the previous result by 4 to the right:
0b01100101 = 0b01010110(result 2)
now both are associated with the bitwise operation OR:
0b01010110 OR 0b01010110 = 0b01010110

Encryption:
the same principle, only reversed:
the first data byte is set to the left by 4 (result 1) now the previous result by 4 to the right(result 2)
then result 1 and 2 are associated with the bitwise operation OR
this result is associated with the bitwise operation NOT and then associated with XOR to the EncryptionKey.

now in C++ from the source:
Code:

static BYTE Encryption( BYTE byEncryptionKey, BYTE byData )
        {
            byData = ( byData << 4 ) | ( byData >> 4 );
            return ( ~byData ) ^ byEncryptionKey;
        }
        static BYTE Decryption( BYTE byEncryptionKey, BYTE byData )
        {
            byData = ~byData ^ byEncryptionKey;
            return ( byData << 4 ) | ( byData >> 4 );
        }

#No C&P

[MentaL]

[xoniaxo]

thank you for the tutorial but I have not understood everything

[Resonance03]

I've been experimenting a bit trying to convert, just for reasons of understanding. I got the true/false for conversion, but after that everything seems off. I get 90 as my version number (reading eFlyFF files), and get 0 for the rest of those 4 bytes. I can't find the filename, either. If I understand correctly, you're saying that the *entire filename* will be held in those two bytes, as an ascii string. That doesn't really seem possible. Explanation, please?

I doubt it's my code causing an issue, since even just opening the res files in Notepad++ shows NUL there (Screenshot by Lightshot)

[Thecoreman]

Hello i'll show you my c# code for reading *.res files:

FileStream filestream1 = new FileStream(filePath, System.IO.FileMode.Open);

                byte[] array1 = new byte[filestream1.Length];
                filestream1.Read(array1, 0, (int)filestream1.Length);
                filestream1.Close();
                BinaryReader binaryreader1 = new BinaryReader(new System.IO.MemoryStream(array1));
                this.encryptionKey = binaryreader1.ReadByte();
                this.fileType = binaryreader1.ReadByte();
                byte[] array2 = binaryreader1.ReadBytes(binaryreader1.ReadInt32());
                for (int num1 = 0; num1 < array2.Length; num1++ )
                {
                    array2[num1] = Decryption(this.encryptionKey, array2[num1]);
                }
                BinaryReader binaryreader2 = new BinaryReader(new System.IO.MemoryStream(array2));
                this.version = binaryreader2.ReadBytes(7);
                this.files = new resFile[binaryreader2.ReadInt16() - 1];

                for (int num1 = 0; num1 < this.files.Length; num1++ )
                {
                    this.files[num1].m_szFileName = Encoding.ASCII.GetString(binaryreader2.ReadBytes(binaryreader2.ReadInt16()));
                    this.files[num1].m_nSize = binaryreader2.ReadInt32();
                    this.files[num1].m_nCrc32 = binaryreader2.ReadInt32(); 
                    this.files[num1].m_nOffset = binaryreader2.ReadInt32();
                }
                binaryreader2.Close();
                for (int num1 = 0; num1 < this.files.Length; num1++)
                {
                    binaryreader1.BaseStream.Seek(this.files[num1].m_nOffset, System.IO.SeekOrigin.Begin);
                    this.files[num1].m_bBytes = binaryreader1.ReadBytes(this.files[num1].m_nSize);
                    if (this.fileType == 1)
                    {

                        for (int num2 = 0; num2 < this.files[num1].m_nSize; num2++)
                        {
                            this.files[num1].m_bBytes[num2] = Decryption(this.encryptionKey, this.files[num1].m_bBytes[num2]);
                        }
                    }
                }
                binaryreader1.Close();

[xoniaxo]

i cannot decrypt this .res . what the reason ?
data.rar

[Resonance03]

Probably the fact that the first line is blank. I suspect that it isn't an eFlyFF file.

[Thecoreman]

this is no valid eFlyff Resource file,
its a changed format

[xoniaxo]

this is no valid eFlyff Resource file,
its a changed format

so , can i decrypt it ?
becose i found a lot of people makes a flyff p-server with those .res
for exemple https://www.facebook.com/groups/EmiratesFlyffv19/
this is a server where they use Pride Flyff for its server
(this .res is for pride flyff)
.
Me i just want to create a Flyff p-server as Prideflyff but when i do it i dont view some items (only white)

[DriftCity]

Thanks for explaining the .res encryption.