HalfBrick Studios: *.XML (Fruit Ninja/Mortar Engine, Encrypted [Android/Win] XML file) + Binary XMLs (bxml)

Extraction and unpacking of game archives and compression, encryption, obfuscation, decoding of unknown files
LolHacksRule
Posts: 865
Joined: Fri Apr 20, 2018 12:41 am

HalfBrick Studios: *.XML (Fruit Ninja/Mortar Engine, Encrypted [Android/Win] XML file) + Binary XMLs (bxml)

Post by LolHacksRule »

The XMLs are encrypted as the header is mostly the same in each file, where the game executable suggests encryption is used, can someone figure them out? I think they turn into binary XMLs given by *SPAM*'s binary versions. However, the binary XMLs are not compressed or encrypted in any way. Thanks so much.
Last edited by LolHacksRule on Sat May 22, 2021 11:55 pm, edited 1 time in total.
LolHacksRule
Posts: 865
Joined: Fri Apr 20, 2018 12:41 am

Re: HalfBrick Studios: *.XML (Fruit Ninja, Encryption) + Binary XMLs (bxml + FSIU header)

Post by LolHacksRule »

UPDATE: I may have found out Fruit Ninja's encryption key but I'm not sure what crypto format it is.

Code: Select all

0DF1CF2AFFCEACA3FE6466559BC9ED44B79FC5CDE0E5F7B8C5C97C5900C8E6BA1EA09639E2DF15989C68D5C2D5274322CE098BFD7346EA19E035061C23B0CEFF38236EF3E735135BA59BF3C87B36B7E4DFC84BD90EC4FA8C5E3AF74C74DA7A68E3B3FF6ADC17EEAB9E9C7C9D74F92C86FA00CE34E6B156C8ECB9796B58758409997FA15450FA7F8C0391CB363F4BB49637A9A037886D298A2FFA1D1BDD8F0005C9709EB428AA8FCCC845FBFD6E0AD8E89900DDE4D1FA01EE50374561F6D2F6E1D2D6D1B79AF6D0BE28EF05F0452F1E7E548F8C84BD51EC71708CEFC8E1465C50F8686AB8B6B3C38881BCBD1725CAD48B2ACC0B13F1FA51B4172D97F75F5B3500


UPDATE2: I found the key being this and XORed.
Last edited by LolHacksRule on Sun May 23, 2021 4:16 am, edited 1 time in total.
LolHacksRule
Posts: 865
Joined: Fri Apr 20, 2018 12:41 am

Re: HalfBrick Studios: *.XML (Fruit Ninja/Mortar Engine, Encrypted [Android/Win] XML file) + Binary XMLs (bxml)

Post by LolHacksRule »

Info on the binary XML format:

Code: Select all

Header: 62786D6C0100 (bxml)
Unknown: 2bytes (Int, Tree count?)?
Size of XML stringtable +1byte: 4bytes
XML stringtable
Bytecode (I'll figure it out later)
LolHacksRule
Posts: 865
Joined: Fri Apr 20, 2018 12:41 am

Re: HalfBrick Studios: *.XML (Fruit Ninja/Mortar Engine, Encrypted [Android/Win] XML file) + Binary XMLs (bxml)

Post by LolHacksRule »

Moving UISCREEN files to a new thread.
LolHacksRule
Posts: 865
Joined: Fri Apr 20, 2018 12:41 am

Re: HalfBrick Studios: *.XML (Fruit Ninja/Mortar Engine, Encrypted [Android/Win] XML file) + Binary XMLs (bxml)

Post by LolHacksRule »

Here's a QuickBMS script to decrypt known XML files.
Last edited by LolHacksRule on Wed May 26, 2021 2:30 am, edited 2 times in total.
LolHacksRule
Posts: 865
Joined: Fri Apr 20, 2018 12:41 am

Re: HalfBrick Studios: *.XML (Fruit Ninja/Mortar Engine, Encrypted [Android/Win] XML file) + Binary XMLs (bxml)

Post by LolHacksRule »

Here's a template on the Binary XML format. It's incomplete but should help a little with the format. Anyone want to help me finish it off? Thank you so much.

Code: Select all

//------------------------------------------------
//--- 010 Editor v10.0.2 Binary Template
//
//      File: Halfbrick Studios Fruit Ninja/Mortar Engine Binary XML File
//      Authors: LolHacksRule
//      Version: 1
//      Purpose: Gets data out of the binary XML format.
//      Category: Deserializing
//      File Mask: bxml
//      ID Bytes:
//      History:
//------------------------------------------------

struct XMLBin {
    struct BinXMLHeader {
        char   BXMLHdr[4]<bgcolor=cGreen>; //Should be bxml
        uint16 headAtribCnt; //XML header attribute count, have only seen 2, 3, 4, 5, 6, 7, 8, 9, 10 (0a) and 11 (0b)
        uint16 unk;
        int    XMLDataTblSize;
    } XMLBinHdr<bgcolor=cGreen>;

    struct XMLDataTable {
        struct Value {
            string value;
        } theValueTable;
   
        struct XMLBytecodeTable {
            //first byte is "<?xml>" as internally written by the game if utf-8/encoding is found as a string
            //2B appears to terminate a group?
        } BinXMLBytecodeTable;
    } xmlDataTbl;
} BinXMLFile;


UPDATE: Found info on offset 0x5