Angry Birds: Flash Player 11 entries *.PAK/*.LUA/*.LVL

Extraction and unpacking of game archives and compression, encryption, obfuscation, decoding of unknown files
LolHacksRule
Posts: 865
Joined: Fri Apr 20, 2018 12:41 am

Angry Birds: Flash Player 11 entries *.PAK/*.LUA/*.LVL

Post by LolHacksRule »

I want to view the PAK files of the games, but I think they are encrypted or compressed in a way I cannot understand... Anyone willing to decompress these or find the encryption keys for me?

Upon reading the memory, I got the filelist for both games:

https://www.angrybirdsnest.com/wp-conte ... l1fups.PNG

https://www.angrybirdsnest.com/wp-conte ... 9n65yd.PNG

Others only have few JSONs and XMLs.
Last edited by LolHacksRule on Mon Jul 19, 2021 6:56 pm, edited 4 times in total.
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: Angry Birds: Breakfast (1, 2) *.PAK

Post by aluigi »

The 2 samples no longer exist
LolHacksRule
Posts: 865
Joined: Fri Apr 20, 2018 12:41 am

Re: Angry Birds: Breakfast (1, 2) *.PAK

Post by LolHacksRule »

I'll reup today, I promise.
LolHacksRule
Posts: 865
Joined: Fri Apr 20, 2018 12:41 am

Re: Angry Birds: Breakfast (1, 2) *.PAK

Post by LolHacksRule »

Both were cut by Filecutter.bms.
aluigi
Site Admin
Posts: 12984
Joined: Wed Jul 30, 2014 9:32 pm

Re: Angry Birds: Breakfast (1, 2) *.PAK

Post by aluigi »

Encryption, encryption everywhere :)
LolHacksRule
Posts: 865
Joined: Fri Apr 20, 2018 12:41 am

Re: Angry Birds: Breakfast (1, 2) *.PAK

Post by LolHacksRule »

Dammit. Welp, the game's ActionScripts are obfuscated, making it harder to pull the keys and possible encryption mechanism from them... http://www.zenhax.com/viewtopic.php?f=9&t=11382

Here's better links:

BF1: https://drive.google.com/open?id=1YeNeo ... L941U1dGVD
BF2: https://drive.google.com/open?id=1pZwSe ... lm1nMhPcnP
EX22222222222
Posts: 1
Joined: Sat Jun 13, 2020 4:03 pm

Re: Angry Birds: Breakfast (1+2, FLASH) *.PAK

Post by EX22222222222 »

Ok so I'm trying to datamine Angry Birds Breakfast's assets, unfortunately they are in troublesome PAK files which are also likely encrypted, it is a Flash game. Can someone get the encryption key to crack these? The dev's also obfuscated the game's SWF file...
Links:
1: https://drive.google.com/drive/u/1/fold ... L941U1dGVD
2: https://drive.google.com/drive/u/1/fold ... drive_open
SWF: https://drive.google.com/open?id=1ZD2UA ... kreWLS8juJ (both games use the same file)
Filelist dumps: https://www.angrybirdsnest.com/wp-conte ... l1fups.PNG
https://www.angrybirdsnest.com/wp-conte ... 9n65yd.PNG
Original thread: viewtopic.php?f=9&t=11380&p=48329
LolHacksRule
Posts: 865
Joined: Fri Apr 20, 2018 12:41 am

Re: Angry Birds: Breakfast (1+2, FLASH) *.PAK

Post by LolHacksRule »

Bruh that's my comment on xentaxcord but thanks for the rebump
gamelandresearch
Posts: 13
Joined: Sun Feb 09, 2020 11:35 am

Re: Angry Birds: Breakfast (1+2, FLASH) *.PAK

Post by gamelandresearch »

Please help to crack it? because if was encrypted, stored XOR, compressed or obfuscated, but it was outdated
LolHacksRule
Posts: 865
Joined: Fri Apr 20, 2018 12:41 am

Re: Angry Birds: Breakfast (1+2, FLASH) *.PAK

Post by LolHacksRule »

Upon painfully deobfuscating Breakfast using the secure_map xml file, I eventually found the PAK/package decryption code. It's not a string or anything easy but can someone derive the key/mechanism from it? Thanks. It appears to use a library called deng.FZip in relation to opening the files. It's possible this could be the same for other AB Flash titles using PAKs like Friends, Breakfast 3, Heikki, Eagles and so on.

Image
LolHacksRule
Posts: 865
Joined: Fri Apr 20, 2018 12:41 am

Re: Angry Birds Flash Player 11 Entries *.PAK

Post by LolHacksRule »

Turns out the code for decryption code is IDENTICAL in other entries, so if we can crack Breakfast's decryption method, we can do the same for ALL other games (Thanks Rovio). Meanwhile, here's the function that calls decryptPackage. inflate() is part of deng.FZip. References to functions that call it are below. Any advice on altering this mechanism to make the game write decrypted files to a directory when running or will a tool/script to decrypt them will be made? Thanks so much. The AB pages on TCRF would likely be greatly assisted from this being cracked.

https://raw.githubusercontent.com/Leoxi ... pFile.java
https://raw.githubusercontent.com/n1889 ... ZipFile.as

Image
LolHacksRule
Posts: 865
Joined: Fri Apr 20, 2018 12:41 am

Re: Angry Birds: Flash Player 11 entries *.PAK/*.LUA/*.LVL

Post by LolHacksRule »

Very late but there's two unobfuscated builds of Angry Birds Friends on Rovio's mobile and madness.new-feature servers, and still has many Flash assets that were later archived by the Flashpoint team. SecureSWF obfuscates most parameter names and symbols but the unobfuscated builds of the game have them. The level files are also encrypted in a very similar way, minus SHA1 hashes, so cracking the packages will likely be related to both LVL and Lua files. Madness is newer so I'm linking that.

More info from the classes: https://github.com/LolHacksRule/AngryBi ... eLoader.as https://github.com/LolHacksRule/AngryBi ... lLoader.as
LolHacksRule
Posts: 865
Joined: Fri Apr 20, 2018 12:41 am

Re: Angry Birds: Flash Player 11 entries *.PAK/*.LUA/*.LVL

Post by LolHacksRule »

Little update:

According to IGTABP in the AB Modding Hub, they're also deflate compressed, which is funny since I thought after decryption you'd get the PAK.

Image