Tool:Decryptor for Mission and data files

Newbie Spellweaver
Joined
May 2, 2006
Messages
35
Reaction score
3
After 10 hours of hacking(I won't look at asm codes anymore. it sucks)
I sucessfully cracked the encryption of mission and data files of NF2.
and I made a small tool to encrypt them and to save them to *.enc file, which you can open with UltraEditor32 or other editor. The structure of mission and data file is still unknown, but at least you can now read them.

You can currently not recrypt them ,so it won't worth to modify anything, but encryption is coming soon.

Here is the link(.Net 2.0 framework required)
 
I'm quite busy now(I'm working for a RO2 emulator develope team)
So I'll post out the decryption code,in vb.net.
NF uses XOR to encrypt, the the encryption is quite the same als decryption you can try to make the encryption by yourself. here is the core cryption code:
Private key() As Byte = Helper.Helper.hextobytes("322C622E636D302C1556056B52B31D451064282BB3740F6B5F602929591F7615")

Private Sub Decrypt()
Dim ms As New IO.MemoryStream(buf)
Dim stream As New Stream.Stream(ms)
Dim v1 As New UInt32P, v2 As New UInt32P, v3 As New UInt32P
Dim buff As New ByteP(Convert.ToInt32(buf.Length - &HC))
Dim I As Integer
stream = stream >> v1 >> v2 >> v3 >> buff
buf = buff.Value
v2.Value = (v2.Value Xor &H390A4F16) - (v3.Value And &HFAFA) - (v1.Value And &HADAD)
Dim checksum As UInteger = 0
For I = 0 To buf.Length - 1
Dim tmp As UInteger
Try
tmp = checksum + ((buf(I) + 7) * (I + 3))
Catch ex As Exception
tmp = (CType(checksum, Long) - UInt32.MaxValue) + ((buf(I) + 7) * (I + 3)) - 1
Finally
checksum = tmp
End Try

Next
If v2.Value <> checksum Then
MsgBox("Checksum error", MsgBoxStyle.Critical)

End If
Dim v4(3) As Byte, v5(3) As Byte, swap(3) As Byte
ms = New IO.MemoryStream(v4)
stream = New Stream.Stream(ms)
stream = stream << v3
swap(2) = v4(0)
swap(3) = v4(1)
swap(1) = v4(2)
swap(0) = v4(3)
v4 = swap
ReDim swap(3)
ms = New IO.MemoryStream(v5)
stream = New Stream.Stream(ms)
stream = stream << v1
swap(3) = v5(0)
swap(2) = v5(1)
swap(0) = v5(2)
swap(1) = v5(3)
v5 = swap
I = 0
Dim J As Integer = 0
Do While I < buf.Length
buf(I) = buf(I) Xor v5(J Mod 4)
J += 1
I = I + J
Loop
For I = 0 To buf.Length - 1
buf(I) = buf(I) Xor v4(I Mod 4)
Next
Dim checksum2 As UInteger = 0
checksum = 0
For I = 0 To buf.Length - 1
Dim tmp As UInteger
Try
tmp = checksum + (buf(I) * (I + 1))
Catch ex As Exception
tmp = (CType(checksum, Long) - UInt32.MaxValue) + (buf(I) * (I + 1)) - 1
Finally
checksum = tmp
End Try

Next
For I = 0 To buf.Length - 1
Dim tmp As UInteger
Try
tmp = checksum2 + (buf(I) * ((I + &HD) ^ 2 Mod &H7B))
Catch ex As Exception
tmp = (CType(checksum2, Long) - UInt32.MaxValue) + (buf(I) * ((I + &HD) ^ 2 Mod &H7B)) - 1
Finally
checksum2 = tmp
End Try

Next
If v3.Value <> (checksum Xor &H390B6E5D) Then
MsgBox("Checksum error", MsgBoxStyle.Critical)
'Exit Sub
End If
If v1.Value <> (checksum2 Xor &H390AB2DD) Then
MsgBox("Checksum error", MsgBoxStyle.Critical)
'Exit Sub
End If
v4(0) = &HB2
v4(1) = &H39
v4(2) = &HDD
v4(3) = &HA
For I = 0 To buf.Length - 1
buf(I) = buf(I) Xor (v4(I Mod 4) + 7)
Next
Dim tmp64 As New Int64P, tmp16 As New UInt16P
ReDim v5(7)
ms = New IO.MemoryStream(v5)
stream = New Stream.Stream(ms)
J = buf.Length * 2
tmp64.Value = CType(J, Long) * &H55555556
stream = stream << tmp64
stream.Position = 4
stream = stream >> tmp16
tmp16.Value = tmp16.Value + (tmp16.Value >> &H1F)
buf(tmp16.Value) = buf(tmp16.Value) Xor &HB
buf(buf.Length \ 2) = buf(buf.Length \ 2) Xor &H6E
buf(0) = buf(0) Xor &H5D
Dim key2() As UShort
J = 0
Dim L As Integer
L = &HA + L
I = 0
While True
Dim K As Integer
K = J
key2 = GenerateKey(buf.Length + K + key(I Mod 32))
Dim tmm As Integer = 0
Dim ran As New Random(buf.Length + K + key(I Mod 32))
For J = K To K + key(I Mod 32) - 1
If J = buf.Length Then
OnFinished.Invoke(buf)
Exit Sub
End If
buf(J) = buf(J) Xor key(tmm Mod 32)
buf(J) = buf(J) Xor (key2(L Mod &H1000) Mod &H100)
L += &HD
tmm += 1
Next J
I += 1
pb.Value = (J / buf.Length) * 100
End While

End Sub
 
the missing GenerateKey function(It's actually the random function for vc7, the random function of .net generates different numbers as vc7, so I made one according to the asmmbly code of the one from vc7)

Private Function GenerateKey(ByVal seed As Long) As UShort()
Dim buf(&H1000 - 1) As UShort
Dim I As Integer
For I = 1 To &H1000
Dim tmp As ULong
Dim tmp3 As Integer
tmp = seed * &H343FD
tmp = tmp + &H269EC3
tmp = (tmp << 32 >> 32)
tmp3 = (tmp >> 16)
buf(I - 1) = tmp3 And &H7FFF
seed = tmp
Next
Return buf
End Function
 
The decryptor isn't working for all files. Works for Aircraft.data and location.data but not for GunSet.data or Frame.data. Tried to use your code in my project (translated in c++) unsuccessfull as of now.

Awesome work on the decrypting tho. Too bad it's not working on the files I need lol.

EDIT: Alright got your decryption code to work in c++. Seems that the 3rd checksum isn't right for half of the .Data files. If I just skip it the decryption seems to work for Frame.Data and other files that didn't work. Should have the structs for the frames and guns in no time now.

Again thanks for the great info ^^
 
Last edited:
Ok I decrypted the file and have the hex values I am pretty sure that is what they are? But how do I know what value belongs to what? And what would want to be changed?
 
Understanding what the data means is still a problem you'll need to figure out yourself, FatalMortality.

Also (not sure), I believe if you modify the files the servers will kick you out because it will detect the difference in content.
 
i'm having trouble compiling... actually for the SPRViewer

Error 1 Type 'UInt16P' is not defined.

Help... googling Uint16P dont turn up much
 
Back