Angry Birds: Flash Player 11 entries *.PAK/*.LUA/*.LVL

[LolHacksRule]

I want to view the PAK files of the games, but I think they are encrypted or compressed in a way I cannot understand... Anyone willing to decompress these or find the encryption keys for me?

Upon reading the memory, I got the filelist for both games:

https://www.angrybirdsnest.com/wp-conte ... l1fups.PNG

https://www.angrybirdsnest.com/wp-conte ... 9n65yd.PNG

Others only have few JSONs and XMLs.

[aluigi]

The 2 samples no longer exist

[LolHacksRule]

I'll reup today, I promise.

[LolHacksRule]

Both were cut by Filecutter.bms.

[aluigi]

Encryption, encryption everywhere

[LolHacksRule]

Dammit. Welp, the game's ActionScripts are obfuscated, making it harder to pull the keys and possible encryption mechanism from them... http://www.zenhax.com/viewtopic.php?f=9&t=11382

Here's better links:

BF1: https://drive.google.com/open?id=1YeNeo ... L941U1dGVD
BF2: https://drive.google.com/open?id=1pZwSe ... lm1nMhPcnP

[EX22222222222]

Ok so I'm trying to datamine Angry Birds Breakfast's assets, unfortunately they are in troublesome PAK files which are also likely encrypted, it is a Flash game. Can someone get the encryption key to crack these? The dev's also obfuscated the game's SWF file...
Links:
1: https://drive.google.com/drive/u/1/fold ... L941U1dGVD
2: https://drive.google.com/drive/u/1/fold ... drive_open
SWF: https://drive.google.com/open?id=1ZD2UA ... kreWLS8juJ (both games use the same file)
Filelist dumps: https://www.angrybirdsnest.com/wp-conte ... l1fups.PNG
https://www.angrybirdsnest.com/wp-conte ... 9n65yd.PNG
Original thread: viewtopic.php?f=9&t=11380&p=48329

[LolHacksRule]

Bruh that's my comment on xentaxcord but thanks for the rebump

[gamelandresearch]

Please help to crack it? because if was encrypted, stored XOR, compressed or obfuscated, but it was outdated

[LolHacksRule]

Upon painfully deobfuscating Breakfast using the secure_map xml file, I eventually found the PAK/package decryption code. It's not a string or anything easy but can someone derive the key/mechanism from it? Thanks. It appears to use a library called deng.FZip in relation to opening the files. It's possible this could be the same for other AB Flash titles using PAKs like Friends, Breakfast 3, Heikki, Eagles and so on.

[LolHacksRule]

Turns out the code for decryption code is IDENTICAL in other entries, so if we can crack Breakfast's decryption method, we can do the same for ALL other games (Thanks Rovio). Meanwhile, here's the function that calls decryptPackage. inflate() is part of deng.FZip. References to functions that call it are below. Any advice on altering this mechanism to make the game write decrypted files to a directory when running or will a tool/script to decrypt them will be made? Thanks so much. The AB pages on TCRF would likely be greatly assisted from this being cracked.

https://raw.githubusercontent.com/Leoxi ... pFile.java
https://raw.githubusercontent.com/n1889 ... ZipFile.as

[LolHacksRule]

Very late but there's two unobfuscated builds of Angry Birds Friends on Rovio's mobile and madness.new-feature servers, and still has many Flash assets that were later archived by the Flashpoint team. SecureSWF obfuscates most parameter names and symbols but the unobfuscated builds of the game have them. The level files are also encrypted in a very similar way, minus SHA1 hashes, so cracking the packages will likely be related to both LVL and Lua files. Madness is newer so I'm linking that.

More info from the classes: https://github.com/LolHacksRule/AngryBi ... eLoader.as https://github.com/LolHacksRule/AngryBi ... lLoader.as

[LolHacksRule]

Little update:

According to IGTABP in the AB Modding Hub, they're also deflate compressed, which is funny since I thought after decryption you'd get the PAK.