Arcana Heart 3 LOVE MAX, PAC files

[Savage]

Hi! i tried this script

http://aluigi.altervista.org/bms/arcsys.bms

But looks is not working well this new game i get no errors, just it can't decompress the file

Here is an example
http://www90.zippyshare.com/v/GLmwfEqu/file.html (4,86 Mb's)

Thanks!

[aluigi]

That file you provided seems all encrypted.

P.S. there was no need to paste the script in the post

[Savage]

That file you provided seems all encrypted.

All the pac files are like the example

P.S. there was no need to paste the script in the post

Oki doki

[Ekey]

Encryption: Hash + mt19937 (Mersenne Twister) + Xor. It works like this:

1) Extract file name from full path
2) Convert file name to uppercase
3) Create hash from file name (simple algorithm > see below)

Code: Select all

   unsigned int dwSeed = 137;
   unsigned int dwHash = 0;
   for(int i = 0; i < strlen(iFileName); iFileName++, i++)
   {
      dwHash = (dwHash * dwSeed) + (*iFileName);
   }

4) Initialize mt from hash
5) Decrypt data (simple algorithm > see below)

Code: Select all

   fseek(fi, 0, SEEK_END);
   size_t dwSize = ftell(fi);
   fseek(fi, 0, SEEK_SET);
   
   ;malloc, read, etc.
   
   mt_init_genrand(dwHash);
   do
      *(DWORD *)(pBuffer + 4 * i++) ^= mt_genrand_int32();
   while (i < dwSize);

Easy

[aluigi]

I have made a script that can be reused all the times that it's used mersenne twist:
http://aluigi.org/bms/arcana_heart_3.bms

I have also verified the generated values of mt_genrand_int32 with both the script and the C file and they are correct.
The decrypted file is ok but I don't know if it's a mistake that the archived filenames look "strange".

[Ekey]

Hm... Yes something wrong. First DWORD after decrypt must be 0x46504143 (FPAC)

[aluigi]

Maybe there constants at the end of mt_genrand_int32 are custom? 0x9d2c5680 and 0xefc60000
The script is 1:1 with the C function, so there are no other ideas.
Have you verified everything with a C tool or that's just the result of the debug analysis?

[Ekey]

Nope, it's my fault. Here correct one.

Code: Select all

set XSEED "0x43415046"
for i = 0 < SIZE
    callfunction mt_genrand_int32 1
    get TMP long
    math TMP ^ y
    math XSEED ^ TMP
    put XSEED long MEMORY_FILE
next i

[aluigi]

Well done. Script updated to version 0.1.1

[Savage]

Amazing!!, works great

Thanks!!

[Mysticus]

I know this topic is now 5 years old.
But it looks like they made a new way to crypt .pac files from the latest update called SIXSTARS!!!!!! XTEND.
All I get is this linked below.
I uncrypted with the AH3 decryption .bms file, but the result is the same.
Any update for the script?

[aluigi]

PAC is still encrypted (maybe it uses a different method/key) while PK3 looks like just data without any index.

[Mysticus]

PAC is still encrypted (maybe it uses a different method/key) while PK3 looks like just data without any index.

Do you plan to update your script to match these different encryption?

[aluigi]

Give me the new encryption scheme and key and I will do it.
Obviously I can't guess them from nowhere.

[Ekey]

Unfortunately, I do not have this game, so I can’t help you too.

@Mysticus
Edited: I checked the script and it works fine with files from SIXSTARS!!!!!! XTEND. File you provided has the wrong name > https://steamdb.info/depot/661991/
Correct path and filename is >

Code: Select all

SteamData/data/ahdata/act/chara/chara_split_00.pac

So, filename must be chara_split_00.pac instead chara_split_00_unpacked.pac

Therefore, the file can't be decrypted, because generated hash from filename is invalid. I renamed chara_split_00_unpacked.pac to chara_split_00.pac and it was perfectly decrypted.

If you want to decrypt files from this game then don't rename them

[Mysticus]

@Ekey
I tried with the correct path and file name. But I still get "unpacked" file name.
What can I do?

[PurpleFlow+]

Hello, I just started decrypting one of the game files and ran into a problem.

Code: Select all

SteamData\data\ahdata\sound\bgm\bgm01_op03.pac

I try using the script on the file in this location but the program decrypts the file as a pac file instead turning into an audio file. Am I doing something wrong or is it supposed to return as a pac file?