[Delphi - Source] Decrypt ItemToolTip, ItemLevelTooltip, ItemtooltipText.bmd

Did it on request.. source and example without struct, nothing hard 2do struct for it and parse..

Ps. struct size is: ITEMTOOLTIP_BLOCK_SIZE

http://img718.imageshack.us/img718/2378/99343353.png

Code:

---

unit Unit19;

interface

uses
  Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
  Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, Vcl.ComCtrls;

const
 ITEMTOOLTIP_SIZE      = $2000;
 ITEMTOOLTIP_BLOCK_SIZE = $7C;

type
  TForm19 = class(TForm)
    Button1: TButton;
    Log: TListView;
    procedure Button1Click(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
  end;

 TBlock = array [0 .. ITEMTOOLTIP_BLOCK_SIZE -1] of Byte;
 PBlock = ^TBlock;

 TBlockRec = packed record
  ID: Word;
  Index: Word;
  Name: array [0 .. $63] of AnsiChar;
  Unk: array [0 .. $19] of Byte;
 end;
 PBlockRec = ^TBlockRec;

 TBlockArray = array [0 .. ITEMTOOLTIP_SIZE -1] of TBlock;
 PBlockArray = ^TBlockArray;

 TBlockRecArray = array of TBlockRec;

var
  Form19: TForm19;

implementation

{$R *.dfm}

function ReadBMDFile(const FileName: TFileName): TBytes;
var
 Fs: TStream;
begin
 Result := nil;
 try
  Fs := TFileStream.Create(FileName, fmOpenRead);
  try
    SetLength(Result, Fs.Size);
    Fs.Read(Result[0], Length(Result));
  finally
    Fs.Free;
  end;
 except
  on E: Exception do
  MessageDlg('Failed to open file with error: ' + PWideChar(E.Message), mtError, [mbOK], 0);
 end;
end;

procedure Decrypt3Bytes (var Buffer: TBlock);
const
 Key : array [0 .. 2] of Byte = ($FC, $CF, $AB);
var
 i: Integer;
begin
 for i := 0 to ITEMTOOLTIP_BLOCK_SIZE -1 do
  Buffer[i] := Buffer[i] xor Key[i mod 3];
end;

function ToHex (Buffer: PByteArray; Size: Integer) :String;
var
  i: integer;
begin
  Result := '';
  for i := 0 to Size - 1 do
  begin
    Result := Result + ' ' +IntToHex(Buffer[i],2);
  end;
end;

procedure TForm19.Button1Click(Sender: TObject);
const
 FFFFFF = 'C:\Users\BMD - SMD\ItemTooltip_eng.bmd';
var
 Buffer: TBytes;
 BlockArray: TBlockArray;
 BlockRecArray: TBlockRecArray;

 I, E: Integer;
 S: string;
begin
 Buffer := ReadBMDFile(FFFFFF);
 if Buffer = nil then
  Exit
 else
  begin
  BlockArray := PBlockArray(@Buffer[0])^;

  for i := 0 to ITEMTOOLTIP_SIZE -1 do
    Decrypt3Bytes(BlockArray[i]);

  for i := 0 to ITEMTOOLTIP_SIZE -1 do
    begin
    SetLength(BlockRecArray, High(BlockRecArray) +2);
    BlockRecArray[High(BlockRecArray)] := PBlockRec(@BlockArray[i])^;

    with Log.Items.Add do
      begin
      Caption := IntToStr(i);
      SubItems.Add(IntToStr(BlockRecArray[High(BlockRecArray)].ID));
      SubItems.Add(IntToStr(BlockRecArray[High(BlockRecArray)].Index));
      SubItems.Add(BlockRecArray[High(BlockRecArray)].Name);
      SubItems.Add(ToHex(@BlockRecArray[High(BlockRecArray)].Unk, $20));
      end;
    end;

  end;
end;

end.

---

for me its looks like items.bmd :huh:


http://img406.imageshack.us/img406/2448/94149034.png
ItemLevelToolTip

Code:

---

unit Unit19;

interface

uses
  Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
  Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, Vcl.ComCtrls;

const
  ITEMLEVELTOOLTIP_SIZE = $80;
  ITEMLEVELTOOLTIP_BLOCK_SIZE = $66;

type
  TForm19 = class(TForm)
    Log: TListView;
    Button1: TButton;
    procedure Button1Click(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
  end;

 TBlock = array [0 .. ITEMLEVELTOOLTIP_BLOCK_SIZE -1] of Byte;
 PBlock = ^TBlock;

 TBlockArray = array [0 .. ITEMLEVELTOOLTIP_SIZE -1] of TBlock;
 PBlockArray = ^TBlockArray;

 TItemLevelToolLTip = packed record
  Unk0: Word;
  Name: array [0 .. $39] of AnsiChar;
  Unk1: array [0 .. $23] of Byte;
 end;
 PItemLevelToolLTip = ^TItemLevelToolLTip;

 TBlockRecArray = array of TItemLevelToolLTip;

var
  Form19: TForm19;

implementation

{$R *.dfm}

function ReadBMDFile(const FileName: TFileName): TBytes;
var
 Fs: TStream;
begin
 Result := nil;
 try
  Fs := TFileStream.Create(FileName, fmOpenRead);
  try
    SetLength(Result, Fs.Size);
    Fs.Read(Result[0], Length(Result));
  finally
    Fs.Free;
  end;
 except
  on E: Exception do
  MessageDlg('Failed to open file with error: ' + PWideChar(E.Message), mtError, [mbOK], 0);
 end;
end;

procedure Decrypt3Bytes (var Buffer: TBlock);
const
 Key : array [0 .. 2] of Byte = ($FC, $CF, $AB);
var
 i: Integer;
begin
 for i := 0 to ITEMLEVELTOOLTIP_BLOCK_SIZE -1 do
  Buffer[i] := Buffer[i] xor Key[i mod 3];
end;

function ToHex (Buffer: PByteArray; Size: Integer) :String;
var
  i: integer;
begin
  Result := '';
  for i := 0 to Size - 1 do
  begin
    Result := Result + ' ' +IntToHex(Buffer[i],2);
  end;
end;

procedure TForm19.Button1Click(Sender: TObject);
const
 FFFFFF = 'C:\Program Files (x86)\WEBZEN\Mu\Data\Local\Eng\ItemLevelTooltip_eng.bmd';
var
 Buffer: TBytes;
 BlockArray: TBlockArray;
 BlockRecArray: TBlockRecArray;

 I, E: Integer;
 S: string;
begin
 Buffer := ReadBMDFile(FFFFFF);
 if Buffer = nil then
  Exit
 else
  begin
  BlockArray := PBlockArray(@Buffer[0])^;

  for i := 0 to ITEMLEVELTOOLTIP_SIZE -1 do
    Decrypt3Bytes(BlockArray[i]);

  for i := 0 to ITEMLEVELTOOLTIP_SIZE -1 do
    begin
    SetLength(BlockRecArray, High(BlockRecArray) +2);
    BlockRecArray[High(BlockRecArray)] := PItemLevelToolLTip(@BlockArray[i])^;

    with Log.Items.Add do
      begin
      Caption := IntToStr(i);
      SubItems.Add(IntToStr(BlockRecArray[High(BlockRecArray)].Unk0));
      SubItems.Add(BlockRecArray[High(BlockRecArray)].Name);
      SubItems.Add(ToHex(@BlockRecArray[High(BlockRecArray)].Unk1, $20));
      end;
    end;

  end;
end;

end.

---

http://img842.imageshack.us/img842/9499/93945679.png
ItemtooltipText

Code:

---

unit Unit21;

interface

uses
  Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
  Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, Vcl.ComCtrls;

const
  ITEMTOOLTIPTEXT_SIZE = $200;
  ITEMTOOLTIPTEXT_BLOCK_SIZE = $104;

type
  TForm21 = class(TForm)
    Log: TListView;
    Button1: TButton;
    procedure Button1Click(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
  end;

 TBlock = array [0 .. ITEMTOOLTIPTEXT_BLOCK_SIZE -1] of Byte;
 PBlock = ^TBlock;

 TBlockArray = array [0 .. ITEMTOOLTIPTEXT_SIZE -1] of TBlock;
 PBlockArray = ^TBlockArray;

 TBlockRec = packed record
  ID: Word;
  Name: array [0 .. $63] of AnsiChar;
 end;
 PBlockRec = ^TBlockRec;

 TBlockRecArray = array of TBlockRec;

var
  Form21: TForm21;

implementation

{$R *.dfm}

function ReadBMDFile(const FileName: TFileName): TBytes;
var
 Fs: TStream;
begin
 Result := nil;
 try
  Fs := TFileStream.Create(FileName, fmOpenRead);
  try
    SetLength(Result, Fs.Size);
    Fs.Read(Result[0], Length(Result));
  finally
    Fs.Free;
  end;
 except
  on E: Exception do
  MessageDlg('Failed to open file with error: ' + PWideChar(E.Message), mtError, [mbOK], 0);
 end;
end;

procedure Decrypt3Bytes (var Buffer: TBlock);
const
 Key : array [0 .. 2] of Byte = ($FC, $CF, $AB);
var
 i: Integer;
begin
 for i := 0 to ITEMTOOLTIPTEXT_BLOCK_SIZE -1 do
  Buffer[i] := Buffer[i] xor Key[i mod 3];
end;

procedure TForm21.Button1Click(Sender: TObject);
const
 FFFFFF = 'C:\Program Files (x86)\WEBZEN\Mu\Data\Local\Eng\ItemTooltipText_eng.bmd';
var
 Buffer: TBytes;
 BlockArray: TBlockArray;
 BlockRecArray: TBlockRecArray;

 I, E: Integer;
 S: string;
begin
 Buffer := ReadBMDFile(FFFFFF);
 if Buffer = nil then
  Exit
 else
  begin
  BlockArray := PBlockArray(@Buffer[0])^;

  for i := 0 to ITEMTOOLTIPTEXT_SIZE -1 do
    Decrypt3Bytes(BlockArray[i]);

  for i := 0 to ITEMTOOLTIPTEXT_SIZE -1 do
    begin
    SetLength(BlockRecArray, High(BlockRecArray) +2);
    BlockRecArray[High(BlockRecArray)] := PBlockRec(@BlockArray[i])^;

    with Log.Items.Add do
      begin
      Caption := IntToStr(i);
      SubItems.Add(IntToStr(BlockRecArray[High(BlockRecArray)].ID));
      SubItems.Add(BlockRecArray[High(BlockRecArray)].Name);
      end;
    end;

  end;
end;

end.

---

Note! Reversed from current GMO client (S6 ep2 r ep3)

I needed :thumbup1:

its time to translate Jpn -> Eng :sneaky2:

bcoz if i use the itemtooltip eng in jpn, some items are bad.

Quote:

---

Originally Posted by mauka

Did it on request.. source and example without struct, nothing hard 2do struct for it and parse..

Ps. struct size is: ITEMTOOLTIP_BLOCK_SIZE

---

) your struct is not complete ...

Code:

---

struct ITEMTOOLTIP_STRUCT
{
        short        ItemGroup;
        short        ItemNumber;
        char        szName[64];
        BYTE        btUnk[4];
        short        wUnk[26];
};

---

Well BMD is encrypted and decrypted by blocks a.k.a structures
In main.exe function looks like that:

Code:

---

DecryptBMDContent: function (Buffer: Pointer; BlockSize: DWORD): Pointer;

---

and its goes like that:

Code:

---

L000:
  MOV ECX,DWORD PTR SS:[EBP-0x118]
  ADD ECX,0x1
  MOV DWORD PTR SS:[EBP-0x118],ECX
  CMP DWORD PTR SS:[EBP-0x118],0x2000 Size of array
  JGE 0x07E20A9
  MOV EDX,DWORD PTR SS:[EBP-0x10]    poiter_to_buffer + Size_of_Struct
  PUSH EDX                            Size_of_Struct
  MOV EAX,DWORD PTR SS:[EBP-0x114]
  PUSH EAX                            poiter_to_buffer
  CALL DecryptBMDContent
  ADD ESP,0x8

---

So my struct is 100% legal, but your, if its not 0x7C is wrong :thumbup:

added:

Code:

---

ITEMTOOLTIP_STRUCT = packed record
  ID, Index: Word; // or DWord (hi and Lo)
  Name: array[0 .. 63] of AnsiChar;
  Unknow: array [0 .. 55] of Byte;
 end

---

Single block:

Code:

---

190E0210  00 00 04 00 53 77 6F 72 64 20 6F 66 20 41 73 73 ...Sword of Ass
190E0220  61 73 73 69 6E 00 00 00 00 00 00 00 00 00 00 00  assin...........
190E0230  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
190E0240  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
190E0250  00 00 00 00 00 01 00 00 01 00 FF FF 00 00 00 00  ........˙˙....
190E0260  06 00 00 00 08 00 00 00 0B 00 00 00 0C 00 02 00  ............
190E0270  0D 00 00 00 0E 00 02 00 FF FF 00 00 FF FF 00 00  ......˙˙..˙˙..
190E0280  FF FF 00 00 FF FF 00 00 FF FF 00 00              ˙˙..˙˙..˙˙..

---

as i said, its looks same as item.bmd (simply looking on it)

Quote:

---

Originally Posted by mauka

Well BMD is encrypted and decrypted by blocks a.k.a structures

---

)) and you think this bmd contains only item id and item name ? try to add a new item on ep3 client ) and watch it in game without any text... now there are 3 files responding for that

ItemLevelTooltip_eng
ItemTooltip_eng
ItemTooltipText_eng

I dint said its containts only names.. i said i know only size of structure ;) and its 0x7C

this is basic of mu bmd encdec file.
If u dont know size of struct u simply cant decrypt file

Code:

---

struct ITEMTOOLTIP_STRUCT
{
        word        ItemGroup;
        word        ItemNumber;
        char        szName[64];
        BYTE        btUnk[4];
        short        wUnk[26];
};

---

This struct is wrong only be cause first 2 shits in struct must be word type not byte!
and your struct size is 0x60.. definetly wrong :)) i do some coffe and gonna do struct for this shit :))

Quote:

---

Originally Posted by mauka

I dint said its containts only names.. i said i know only size of structure ;) and its 0x7C

this is basic of mu bmd encdec file.
If u dont know size of struct u simply cant decrypt file

---

well ) the main idea of making a DecTool is to enable editing of the files , isnt it ? thats why you need to research the block structure ) not only the size

Code:

---


struct ITEMLEVELTOOLTIP_STRUCT
{
        short Id;
        char szName[64];
        BYTE btUnk[4];
        short wUnk[16];
};

struct ITEMTEXTTOOLTIP_STRUCT
{
        short Id;
        char szTip[256];
        short tmp;
};

struct ITEMTOOLTIP_STRUCT
{
        short        ItemGroup;
        short        ItemNumber;
        char        szName[64];
        BYTE        btUnk[4];
        short        wUnk[26];
};

---

here they are )

Quote:

---

Originally Posted by mauka

Code:

---

struct ITEMTOOLTIP_STRUCT
{
        short        ItemGroup;
        short        ItemNumber;
        char        szName[64];
        BYTE        btUnk[4];
        short        wUnk[26];
};

---

This struct is wrong only be cause first 2 shits in struct must be word type not byte!
and your struct size is 0x60.. definetly wrong :)) i do some coffe and gonna do struct for this shit :))

---

so you have no idea about c++ data type's )) ( short = signed word value )

true, im not friendly with C++ syntax either data types ;)
i dont even know how compile in C++ single HELO CPP world app XDDD TRLLOLOLOL

Quote:

---

Originally Posted by RoRRe

well ) the main idea of making a DecTool is to enable editing of the files , isnt it ?

---

i do it for other reason, learning asm, reversing etc..

http://img718.imageshack.us/img718/2378/99343353.png

Code:

---

unit Unit19;

interface

uses
  Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
  Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, Vcl.ComCtrls;

const
 ITEMTOOLTIP_SIZE      = $2000;
 ITEMTOOLTIP_BLOCK_SIZE = $7C;

type
  TForm19 = class(TForm)
    Button1: TButton;
    Log: TListView;
    procedure Button1Click(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
  end;

 TBlock = array [0 .. ITEMTOOLTIP_BLOCK_SIZE -1] of Byte;
 PBlock = ^TBlock;

 TBlockRec = packed record
  ID: Word;
  Index: Word;
  Name: array [0 .. $63] of AnsiChar;
  Unk: array [0 .. $19] of Byte;
 end;
 PBlockRec = ^TBlockRec;

 TBlockArray = array [0 .. ITEMTOOLTIP_SIZE -1] of TBlock;
 PBlockArray = ^TBlockArray;

 TBlockRecArray = array of TBlockRec;

var
  Form19: TForm19;

implementation

{$R *.dfm}

function ReadBMDFile(const FileName: TFileName): TBytes;
var
 Fs: TStream;
begin
 Result := nil;
 try
  Fs := TFileStream.Create(FileName, fmOpenRead);
  try
    SetLength(Result, Fs.Size);
    Fs.Read(Result[0], Length(Result));
  finally
    Fs.Free;
  end;
 except
  on E: Exception do
  MessageDlg('Failed to open file with error: ' + PWideChar(E.Message), mtError, [mbOK], 0);
 end;
end;

procedure Decrypt3Bytes (var Buffer: TBlock);
const
 Key : array [0 .. 2] of Byte = ($FC, $CF, $AB);
var
 i: Integer;
begin
 for i := 0 to ITEMTOOLTIP_BLOCK_SIZE -1 do
  Buffer[i] := Buffer[i] xor Key[i mod 3];
end;

function ToHex (Buffer: PByteArray; Size: Integer) :String;
var
  i: integer;
begin
  Result := '';
  for i := 0 to Size - 1 do
  begin
    Result := Result + ' ' +IntToHex(Buffer[i],2);
  end;
end;

procedure TForm19.Button1Click(Sender: TObject);
const
 FFFFFF = 'C:\Users\BMD - SMD\ItemTooltip_eng.bmd';
var
 Buffer: TBytes;
 BlockArray: TBlockArray;
 BlockRecArray: TBlockRecArray;

 I, E: Integer;
 S: string;
begin
 Buffer := ReadBMDFile(FFFFFF);
 if Buffer = nil then
  Exit
 else
  begin
  BlockArray := PBlockArray(@Buffer[0])^;

  for i := 0 to ITEMTOOLTIP_SIZE -1 do
    Decrypt3Bytes(BlockArray[i]);

  for i := 0 to ITEMTOOLTIP_SIZE -1 do
    begin
    SetLength(BlockRecArray, High(BlockRecArray) +2);
    BlockRecArray[High(BlockRecArray)] := PBlockRec(@BlockArray[i])^;

    with Log.Items.Add do
      begin
      Caption := IntToStr(i);
      SubItems.Add(IntToStr(BlockRecArray[High(BlockRecArray)].ID));
      SubItems.Add(IntToStr(BlockRecArray[High(BlockRecArray)].Index));
      SubItems.Add(BlockRecArray[High(BlockRecArray)].Name);
      SubItems.Add(ToHex(@BlockRecArray[High(BlockRecArray)].Unk, $20));
      end;
    end;

  end;
end;

end.

---

Simply looking on it, u can see its have alot of Words..

I managed to make my editor in C++ thru your code...
maybe you can unpack Ex700 Korean Main?
We can make a deal on this....?

nice thanks :)

can you make it for shupui.bmd?

Quote:

---

Originally Posted by WeHostXen

I managed to make my editor in C++ thru your code...
maybe you can unpack Ex700 Korean Main?
We can make a deal on this....?

---

Hi, ima noob on unpacking and not like unpacking ^___^ i would reverse alot crap from x700, but there is no normal unpacked x700 main.exe and code of x700 is patrial obfuscated...

Unpacking not the biggest problem (tut4you) got scripts for VProtect, but deobfuscate code... i dont even got idea how do it @_@