ArcheAge DB Decrypting

Greetings!

I hope you allow me, to start here the ArcheAge Thread again that I had on xentax.com.

On Xentax we talked about decryption of the PAK and decryption Database. All worked fine (due the great work of Ekey), but since some Update ArcheAge force to start the Patcher.exe instead of the Client itself.

Also the Key from my known Offsets (encryption aes_128_cbc) not working anymore.

I would be glad if someone can help me to get the Key(maybe Keys now) for the actual Game Version thatI can fix the Offsets for automatic decryption.

The Offset for the Database Key was: ~ 00002CXX (\xF2\xEB\xF9\x75\x4E\xE2\x27\x71\x1E\x39\x8F\x1C\ xE6\x89\xF3\x44)



Thanks a lot! :)

I can pay if this is needed :)

Is there any chance about? :)

Not Found

Fixed!

[Only registered and activated users can see links. Click Here To Register...]

And how you get the DB key?
Cant find any sourse with good guide...

Here's an updated QuickBMS script.
I tried it using on Chinese ArcheAge but failing badly tho.

Code:

---

# Archeage (script 0.3.1a)
# script for QuickBMS http://quickbms.aluigi.org
 
math SIZE = 0x200
goto 0 0 SEEK_END
savepos OFFSET
math OFFSET -= SIZE
callfunction DECRYPT 1
 
idstring MEMORY_FILE "WIBO"
get DUMMY long MEMORY_FILE
get FILES long MEMORY_FILE
get EXTRA_FILES long MEMORY_FILE
get DUMMY long MEMORY_FILE
get DUMMY long MEMORY_FILE
get DUMMY long MEMORY_FILE
get DUMMY long MEMORY_FILE
print "Files:              %FILES|x%"
print "Extra files:        %EXTRA_FILES|x%"
 
math SIZE = FILES
math SIZE += EXTRA_FILES
math SIZE *= 0x150
goto 0 0 SEEK_END
savepos INFO_OFF
math INFO_OFF -= 0x200
for INFO_OFF -= SIZE >= 0
    if INFO_OFF % 0x200
        math INFO_OFF -= 0x10
    else
        break
    endif
next
print "FileTable offset:  %INFO_OFF|x%"
 
for i = 0 < FILES
    math SIZE = 0x150
    math OFFSET = INFO_OFF
    callfunction DECRYPT 1
    math INFO_OFF += 0x150
 
    getdstring NAME 0x108 MEMORY_FILE
    get OFFSET longlong MEMORY_FILE
    get SIZE longlong MEMORY_FILE
    get XSIZE longlong MEMORY_FILE  # used for encryption alignment?
    get ZSIZE long MEMORY_FILE      # ???
    getdstring DUMMY 16 MEMORY_FILE
    get DUMMY1 long MEMORY_FILE
    get TIMESTAMP longlong MEMORY_FILE
    get TIMESTAMP longlong MEMORY_FILE
    get DUMMY2 longlong MEMORY_FILE
 
    log NAME OFFSET SIZE            # don't use clog for the moment
    encryption "" ""
next i
 
startfunction DECRYPT
    encryption aes_128_cbc "\x32\x1F\x2A\xEE\xAA\x58\x4A\xB4\x9A\x6C\x9E\x09\xD5\x9E\x9C\x6F"
    log MEMORY_FILE OFFSET SIZE
    encryption "" ""
endfunction

---