View Single Post
  #3  
Old 20-02-2024, 22:47
Hexagon123 Hexagon123 is offline
Registered User
 
Join Date: Dec 2016
Location: IOWA
Posts: 80
Thanks: 4
Thanked 49 Times in 30 Posts
Hexagon123 is on a distinguished road
Unity decryption

Code:
using System;
using System.IO;
using System.Security.Cryptography;
using System.Text;

namespace Dantora
{
	// Token: 0x02000253 RID: 595
	public class Crypt
	{
		// Token: 0x06000E77 RID: 3703 RVA: 0x0007A8A4 File Offset: 0x00078CA4
		public static string Encrypt(string text)
		{
			RijndaelManaged rijndaelManaged = new RijndaelManaged
			{
				BlockSize = 128,
				KeySize = 128,
				Padding = PaddingMode.Zeros,
				Mode = CipherMode.CBC,
				Key = Encoding.UTF8.GetBytes("giVJrbHRlWBDIggF"),
				IV = Encoding.UTF8.GetBytes("jCddaOybW3zEh0Kl")
			};
			ICryptoTransform transform = rijndaelManaged.CreateEncryptor();
			MemoryStream memoryStream = new MemoryStream();
			CryptoStream cryptoStream = new CryptoStream(memoryStream, transform, CryptoStreamMode.Write);
			byte[] bytes = Encoding.UTF8.GetBytes(text);
			cryptoStream.Write(bytes, 0, bytes.Length);
			cryptoStream.FlushFinalBlock();
			byte[] inArray = memoryStream.ToArray();
			return Convert.ToBase64String(inArray);
		}

		// Token: 0x06000E78 RID: 3704 RVA: 0x0007A950 File Offset: 0x00078D50
		public static byte[] Encrypt(byte[] data)
		{
			RijndaelManaged rijndaelManaged = new RijndaelManaged
			{
				BlockSize = 128,
				KeySize = 128,
				Padding = PaddingMode.Zeros,
				Mode = CipherMode.CBC,
				Key = Encoding.UTF8.GetBytes("giVJrbHRlWBDIggF"),
				IV = Encoding.UTF8.GetBytes("jCddaOybW3zEh0Kl")
			};
			ICryptoTransform transform = rijndaelManaged.CreateEncryptor();
			MemoryStream memoryStream = new MemoryStream();
			CryptoStream cryptoStream = new CryptoStream(memoryStream, transform, CryptoStreamMode.Write);
			cryptoStream.Write(data, 0, data.Length);
			cryptoStream.FlushFinalBlock();
			return memoryStream.ToArray();
		}

		// Token: 0x06000E79 RID: 3705 RVA: 0x0007A9E4 File Offset: 0x00078DE4
		public static string Decrypt(string cryptText)
		{
			RijndaelManaged rijndaelManaged = new RijndaelManaged
			{
				BlockSize = 128,
				KeySize = 128,
				Padding = PaddingMode.Zeros,
				Mode = CipherMode.CBC,
				Key = Encoding.UTF8.GetBytes("giVJrbHRlWBDIggF"),
				IV = Encoding.UTF8.GetBytes("jCddaOybW3zEh0Kl")
			};
			ICryptoTransform transform = rijndaelManaged.CreateDecryptor();
			byte[] array = Convert.FromBase64String(cryptText);
			byte[] array2 = new byte[array.Length];
			MemoryStream stream = new MemoryStream(array);
			CryptoStream cryptoStream = new CryptoStream(stream, transform, CryptoStreamMode.Read);
			cryptoStream.Read(array2, 0, array2.Length);
			return Encoding.UTF8.GetString(array2);
		}

		// Token: 0x06000E7A RID: 3706 RVA: 0x0007AA90 File Offset: 0x00078E90
		public static byte[] Decrypt(byte[] data)
		{
			RijndaelManaged rijndaelManaged = new RijndaelManaged
			{
				BlockSize = 128,
				KeySize = 128,
				Padding = PaddingMode.Zeros,
				Mode = CipherMode.CBC,
				Key = Encoding.UTF8.GetBytes("giVJrbHRlWBDIggF"),
				IV = Encoding.UTF8.GetBytes("jCddaOybW3zEh0Kl")
			};
			ICryptoTransform transform = rijndaelManaged.CreateDecryptor();
			byte[] array = new byte[data.Length];
			MemoryStream stream = new MemoryStream(data);
			CryptoStream cryptoStream = new CryptoStream(stream, transform, CryptoStreamMode.Read);
			cryptoStream.Read(array, 0, array.Length);
			return array;
		}

		// Token: 0x04000BC6 RID: 3014
		private const string AesIV = "jCddaOybW3zEh0Kl";

		// Token: 0x04000BC7 RID: 3015
		private const string AesKey = "giVJrbHRlWBDIggF";
	}
}
Heroland (2019) Game is using Unity and it is encrypted with AES IV and compressed with LZ4.

Code:
using System;
using System.IO;
using System.Security.Cryptography;
using System.Text;
using UnityEngine;

// Token: 0x02000B1A RID: 2842
public static class CryptoUtility
{
	// Token: 0x060049E1 RID: 18913 RVA: 0x00156E24 File Offset: 0x00155224
	public static byte[] Crypto(string key, byte[] src, bool encode = false)
	{
		string fileNameWithoutExtension = Path.GetFileNameWithoutExtension(key);
		byte[] bytes = Encoding.UTF8.GetBytes(CryptoUtility.salt);
		Rfc2898DeriveBytes rfc2898DeriveBytes = new Rfc2898DeriveBytes(fileNameWithoutExtension + CryptoUtility.pw, bytes);
		rfc2898DeriveBytes.IterationCount = 1103;
		RijndaelManaged rijndaelManaged = new RijndaelManaged();
		rijndaelManaged.Padding = PaddingMode.Zeros;
		rijndaelManaged.Mode = CipherMode.CBC;
		rijndaelManaged.KeySize = CryptoUtility.KeySize;
		rijndaelManaged.BlockSize = CryptoUtility.BlockSize;
		rijndaelManaged.Key = rfc2898DeriveBytes.GetBytes(rijndaelManaged.KeySize / 8);
		rijndaelManaged.IV = rfc2898DeriveBytes.GetBytes(rijndaelManaged.BlockSize / 8);
		ICryptoTransform cryptoTransform;
		if (encode)
		{
			cryptoTransform = rijndaelManaged.CreateEncryptor();
		}
		else
		{
			cryptoTransform = rijndaelManaged.CreateDecryptor();
		}
		byte[] result = cryptoTransform.TransformFinalBlock(src, 0, src.Length);
		cryptoTransform.Dispose();
		return result;
	}

	// Token: 0x060049E2 RID: 18914 RVA: 0x00156EEC File Offset: 0x001552EC
	public static bool CryptoFile(string srcPath, string dstPath, bool encode = false, bool checkFS = false)
	{
		bool result;
		using (FileStream fileStream = File.OpenRead(srcPath))
		{
			if (fileStream == null)
			{
				result = false;
			}
			else
			{
				byte[] array = new byte[fileStream.Length];
				fileStream.Read(array, 0, (int)fileStream.Length);
				if (checkFS)
				{
					string text = Encoding.ASCII.GetString(array).Substring(0, 7);
					if (text != "UnityFS")
					{
						fileStream.Close();
						Debug.LogError("Not Asset Bunddle File[" + text + "]" + srcPath);
						return false;
					}
				}
				byte[] array2;
				if (encode)
				{
					Debug.Log("Encode\n" + srcPath + "\n" + dstPath);
					array2 = CryptoUtility.Crypto(srcPath, array, true);
				}
				else
				{
					Debug.Log("Decode\n" + srcPath + "\n" + dstPath);
					array2 = CryptoUtility.Crypto(srcPath, array, false);
				}
				fileStream.Close();
				using (FileStream fileStream2 = File.OpenWrite(dstPath))
				{
					if (fileStream2 == null)
					{
						result = false;
					}
					else
					{
						fileStream2.Write(array2, 0, array2.Length);
						fileStream2.Close();
						result = true;
					}
				}
			}
		}
		return result;
	}

	// Token: 0x0400401D RID: 16413
	private static string pw = "c4GXA8FT";

	// Token: 0x0400401E RID: 16414
	private static string salt = "t4ChYLcH";

	// Token: 0x0400401F RID: 16415
	private static int KeySize = 128;

	// Token: 0x04004020 RID: 16416
	private static int BlockSize = 128;
}
Super Bomberman R (2017) game is using Unity and it is encrypted with Salt.
Attached Files
File Type: 7z Heroland_Sample.7z (1.24 MB, 6 views)
File Type: 7z SBR_Sample.7z (1.98 MB, 3 views)

Last edited by Hexagon123; 20-02-2024 at 23:01.
Reply With Quote
The Following 3 Users Say Thank You to Hexagon123 For This Useful Post:
felice2011 (23-02-2024), L0v3craft (23-02-2024), Masquerade (21-02-2024)