Decryption for an HSP Game

[lloyd_dunamis]

Hello. I've come just oooone step to being able to access the assets of the game (mainly just the BGM/ogg file ones), but it likely involves decryption.

Game is over here (caution: R18 game)(Pass:HelpSachiho): http://www.mediafire.com/file/f4i0nainb ... d_game.rar

From my exploration, the game is HSP (Hot Soup Processor) compiled, with assets packed in DPMX in its overlay. Likely similar to a game previously handled here but the source is no longer available.
(Unlike that one,) This didn't have a DPMX QuickBMS script that came along with it, but I found the following that can extract it:

• Ruby script, HSP DPMX unpacker — contains an HSP Key Finder and extractor, though mainly set for another game.
• Asmodean's exdpmx — straightforward to use, able to extract game assets using this one

After extraction though (in the same vain as the other game), the extracted files seems encrypted. If it helps in anything, putting the exe file in the HSP Key Finder gave me the following:

Code: Select all

HSPInitializeDataOffset - 0x10000:      98304
mode:   0
width:  640
height: 480
d:      0
chksum: 0x2596
KEY:    0xA60ACC37

I am now stuck at the game's file decryption. I tried the sound extractor from the linked thread, but it didn't work; it might have a different algorithm, or basically just doesn't accept this games' encrypted files in the first place.

I was hoping to be able to extend the music instead of recording it on the side for a much cleaner audio sample. Any help is appreciated. Thank you!

[LokiReborn]

Hello. I've come just oooone step to being able to access the assets of the game (mainly just the BGM/ogg file ones), but it likely involves decryption.

Game is over here (caution: R18 game)(Pass:HelpSachiho): http://www.mediafire.com/file/f4i0nainb ... d_game.rar

From my exploration, the game is HSP (Hot Soup Processor) compiled, with assets packed in DPMX in its overlay. Likely similar to a game previously handled here but the source is no longer available.
(Unlike that one,) This didn't have a DPMX QuickBMS script that came along with it, but I found the following that can extract it:

• Ruby script, HSP DPMX unpacker — contains an HSP Key Finder and extractor, though mainly set for another game.
• Asmodean's exdpmx — straightforward to use, able to extract game assets using this one

After extraction though (in the same vain as the other game), the extracted files seems encrypted. If it helps in anything, putting the exe file in the HSP Key Finder gave me the following:

Code: Select all

HSPInitializeDataOffset - 0x10000:      98304
mode:   0
width:  640
height: 480
d:      0
chksum: 0x2596
KEY:    0xA60ACC37

I am now stuck at the game's file decryption. I tried the sound extractor from the linked thread, but it didn't work; it might have a different algorithm, or basically just doesn't accept this games' encrypted files in the first place.

I was hoping to be able to extend the music instead of recording it on the side for a much cleaner audio sample. Any help is appreciated. Thank you!

Here you go, and you were correct it was very similar to the other one I wrote with a slight variation.

[lloyd_dunamis]

Aaahh wow, it works like a charm, and it worked on all the files as well! Thank you so much! +w+

I think I see the slight difference there, yeah. Thank you for providing the source as well!

Having seen some kind of pattern, could there be like some kind of an adaptive, something like QuickBMS, script that can at least identify a certain HSP-compiled game's decryption pattern? Ahh I'm not asking for it like right now though; just curious, in the off-chance that we might encounter another HSP game with assets (though mainly BGMs) I happen to catch interest on.

Meanwhile, since the package I gave is technically the whole game already, I am removing the package.


==========
(Unrelated from hereon, but just showing the results of this tinkering)
Here's what I said I was doing with its BGMs, now that I have it in at least its cleanest raw audio.
Basically it's just an extension of the track, but with carefully fixed looping that you would otherwise hear in-game as a slight off-beat loop or a blip of silence.
https://www.youtube.com/watch?v=NcaVh5HsDlM

[LokiReborn]

Aaahh wow, it works like a charm, and it worked on all the files as well! Thank you so much! +w+

I think I see the slight difference there, yeah. Thank you for providing the source as well!

Having seen some kind of pattern, could there be like some kind of an adaptive, something like QuickBMS, script that can at least identify a certain HSP-compiled game's decryption pattern? Ahh I'm not asking for it like right now though; just curious, in the off-chance that we might encounter another HSP game with assets (though mainly BGMs) I happen to catch interest on.

Meanwhile, since the package I gave is technically the whole game already, I am removing the package.


==========
(Unrelated from hereon, but just showing the results of this tinkering)
Here's what I said I was doing with its BGMs, now that I have it in at least its cleanest raw audio.
Basically it's just an extension of the track, but with carefully fixed looping that you would otherwise hear in-game as a slight off-beat loop or a blip of silence.
https://www.youtube.com/watch?v=NcaVh5HsDlM

It should be possible to make it for any if you figure out the last piece. technically speaking the code from the exdpmx.exe is doing the exact same thing as mine (I never cleaned mine up)
The difference with his is where it has the values for 0xAA and 0x55 those are the 2 values I replaced in mine.

As you can see in the pic if certain conditions aren't met those are the default values, otherwise unique values are generated for the file. In these two circumstances unique values were required, in order to make it work under any circumstance it's really just finishing off that piece of it, I might bother to do it since it came up again. Honestly I wasn't expecting to see another game pop up using the same thing again.