Phoenix Wright Ace Attorney Trilogy Pc(file mdt)

[Siengried]

Hi all...
i found this file that should contains text file of this game.
But i can't open it. Someone can help me?
https://www23.zippyshare.com/v/iGuCWa9Y/file.html

[Haoose]

Decrypt script for text-files:

Code: Select all

encryption Rijndael "\x35\x38\x9A\xFF\xF2\x61\xB3\xE8\x87\x22\x24\x0B\x6B\x0B\x25\xC8" "\x01\x85\x40\xA5\x57\xDE\x8C\x4E\x86\xE4\x23\xE3\x3A\xB9\x77\x84"
get SIZE asize
log "decrypted_file.dat" 0 SIZE

[Ogoshi]

Decrypt script for text-files:

Code: Select all

encryption Rijndael "\x35\x38\x9A\xFF\xF2\x61\xB3\xE8\x87\x22\x24\x0B\x6B\x0B\x25\xC8" "\x01\x85\x40\xA5\x57\xDE\x8C\x4E\x86\xE4\x23\xE3\x3A\xB9\x77\x84"
get SIZE asize
log "decrypted_file.dat" 0 SIZE

And how i use this script? QuickBMS?

[Haoose]

Ogoshi

Code: Select all

quickbms.exe -w DecryptAceAttorney.bms option_text_u.bin UnPack\

[Ogoshi]

Ogoshi

Code: Select all

quickbms.exe -w DecryptAceAttorney.bms option_text_u.bin UnPack\

Thanks Haoose!

[Siengried]

How did you found the way to decrypt?

[Dj_Mike238]

Decrypt script for text-files:

Code: Select all

encryption Rijndael "\x35\x38\x9A\xFF\xF2\x61\xB3\xE8\x87\x22\x24\x0B\x6B\x0B\x25\xC8" "\x01\x85\x40\xA5\x57\xDE\x8C\x4E\x86\xE4\x23\xE3\x3A\xB9\x77\x84"
get SIZE asize
log "decrypted_file.dat" 0 SIZE

This works successfully with .bin text files, but it doesn't work with .mdt script files.

Has anyone got any luck with those ones?

[Kaplas]

How did you found the way to decrypt?

If you open "Assembly-CSharp.dll" with dnSpy (or another .NET disassembler) you can find the decryption code:

Code: Select all

public byte[] load(string in_path)
{
    byte[] array = File.ReadAllBytes(in_path);
    RijndaelManaged rijndaelManaged = new RijndaelManaged();
    rijndaelManaged.KeySize = 128;
    rijndaelManaged.BlockSize = 128;
    string password = "u8DurGE2";
    string s = "6BBGizHE";
    byte[] bytes = Encoding.UTF8.GetBytes(s);
    Rfc2898DeriveBytes rfc2898DeriveBytes = new Rfc2898DeriveBytes(password, bytes);
    rfc2898DeriveBytes.IterationCount = 1000;
    rijndaelManaged.Key = rfc2898DeriveBytes.GetBytes(rijndaelManaged.KeySize / 8);
    rijndaelManaged.IV = rfc2898DeriveBytes.GetBytes(rijndaelManaged.BlockSize / 8);
    ICryptoTransform cryptoTransform = rijndaelManaged.CreateDecryptor();
    byte[] result = cryptoTransform.TransformFinalBlock(array, 0, array.Length);
    cryptoTransform.Dispose();
    return result;
}

This works successfully with .bin text files, but it doesn't work with .mdt script files.

Has anyone got any luck with those ones?

.mdt are encrypted in the same way, but then you have to substract 128 from every text character to get the real character. The problem is that .mdt files contains the game scripts, so I'm still looking for a way to extract just the texts without breaking anything else.

[Siengried]

Well, we have first to find a way to expand files without to cause crash in games... How we can do? Files don't seems to have a size check

[Siengried]

How we can make the file bigger without to make the game crash?

[Kaplas]

What do you mean? I've been able to add text without crashing the game.

[Siengried]

What do you mean? I've been able to add text without crashing the game.

How? If i just add two bytes the game crash... did you modified something else?

[Kaplas]

Once decrypted, .mdt files have the following header:

Code: Select all

ushort numberOfScenesInFile;
ushort dummy; // 0
uint[numberOfScenesInFile] sceneStartOffset;

And after this header goes the data.

If you add or remove bytes, you have to update the "sceneStartOffset" pointers.

[Siengried]

Once decrypted, .mdt files have the following header:

Code: Select all

ushort numberOfScenesInFile;
ushort dummy; // 0
uint[numberOfScenesInFile] sceneStartOffset;

And after this header goes the data.

If you add or remove bytes, you have to update the "sceneStartOffset" pointers.

I know it. But i added two bytes at the very last word:
É˙Ó˙€0Á˙Ä˙Ę˙Ď˙Ő˙Ň˙Î˙Ĺ˙Ä˙˙ ORIGINAL
É˙Ó˙€0Á˙Ä˙Ę˙Ď˙Ő˙Ň˙Î˙Ĺ˙Ä˙Ä˙˙NEW
And the game crash. The last scene is the last, so no pointer have to be modified(pointer=Scene offset)

[Kaplas]

Have you encrypted the file after modifying?

[Siengried]

Have you encrypted the file after modifying?

Yes, i have.

[Kaplas]

What file are you trying to modify? I've tried with "sc0_text_u.mdt" in "GS1\scenario" folder and it works, may be other files have other structure.

[Siengried]

What file are you trying to modify? I've tried with "sc0_text_u.mdt" in "GS1\scenario" folder and it works, may be other files have other structure.

I have modified the same. Can i send you the file decripted and none? The modified one i mean

[Kaplas]

Yes, send me the file and I'll take a look

[Siengried]

I added some bytes at the offset 016F95
https://www109.zippyshare.com/v/zhiVAZkf/file.html
Obliously i change everytime the name in sc0_text_u.mdt and encrypt it again with reimport.bat(tried the reimport2 too)