200$ for unpack file .dat

[radix01]

I want to find somebody unpacks data file game TS2 ONLINE for me
this game website https://ts2.chinesegamer.net/ or somebody has bms script
THANK YOU

contact me discord: Master#7272

[radix01]

1.png

[atom0s]

Most of the .dat files for this game are encrypted/encoded differently than each other. You would need to be more specific on which file you are looking to get the data from. Also, they mostly seem to be serialized / binary data for the most part.

An example of what I mean, each file has its own reader/processor function that looks like this:

Code: Select all

int __fastcall sub_70471C(int a1)
{
  int v1; // eax
  signed int v2; // ebx
  int v3; // esi
  int v4; // ecx
  int v5; // eax
  signed int v6; // ebx
  int v7; // esi
  int v8; // ecx
  int result; // eax
  unsigned int v10; // [esp-Ch] [ebp-34h]
  void *v11; // [esp-8h] [ebp-30h]
  int *v12; // [esp-4h] [ebp-2Ch]
  int v13; // [esp+Ch] [ebp-1Ch]
  int v14; // [esp+10h] [ebp-18h]
  int v15; // [esp+14h] [ebp-14h]
  int v16; // [esp+18h] [ebp-10h]
  void *v17; // [esp+1Ch] [ebp-Ch]
  void *v18; // [esp+20h] [ebp-8h]
  int v19; // [esp+24h] [ebp-4h]
  int savedregs; // [esp+28h] [ebp+0h]

  v19 = a1;
  v12 = &savedregs;
  v11 = &loc_70489C;
  v10 = __readfsdword(0);
  __writefsdword(0, (unsigned int)&v10);
  v17 = &unk_9695E4;
  v18 = &unk_9695F9;
  v14 = 21;
  v1 = *(unsigned __int16 *)(a1 + 4230);
  if ( v1 > 0 )
  {
    v13 = v1;
    v2 = 1;
    do
    {
      v16 = v19 + 21 * v2 + 8;
      v15 = v2 % 2;
      if ( v14 - 1 >= 0 )
      {
        v3 = v14;
        v4 = 0;
        do
        {
          *(_BYTE *)(v16 + v4) ^= (unsigned __int8)((223 * v2 + *((unsigned __int8 *)*(&v17 + v15) + v4) + 162) % 255)
                                + 1;
          ++v4;
          --v3;
        }
        while ( v3 );
      }
      v5 = 21 * v2;
      *(_BYTE *)(v19 + v5 + 8) ^= 0x5Du;
      *(_BYTE *)(v19 + v5 + 9) ^= 0x85u;
      *(_WORD *)(v19 + v5 + 10) ^= 0x3FECu;
      *(_BYTE *)(v19 + v5 + 12) ^= 0x5Du;
      *(_BYTE *)(v19 + v5 + 13) ^= 0x85u;
      *(_BYTE *)(v19 + v5 + 14) ^= 0x5Du;
      *(_DWORD *)(v19 + v5 + 15) ^= 0x370A0724u;
      *(_BYTE *)(v19 + v5 + 19) ^= 0x85u;
      *(_DWORD *)(v19 + v5 + 20) ^= 0x1FB9DC0Bu;
      *(_BYTE *)(v19 + v5 + 24) ^= 0x5Du;
      *(_DWORD *)(v19 + v5 + 25) ^= 0x370A0724u;
      ++v2;
      --v13;
    }
    while ( v13 );
  }
  if ( (signed int)*(unsigned __int16 *)(v19 + 4230) > 0 )
  {
    v13 = *(unsigned __int16 *)(v19 + 4230);
    v6 = 1;
    do
    {
      v16 = v19 + 21 * v6 + 8;
      v15 = v6 % 2;
      if ( v14 - 1 >= 0 )
      {
        v7 = v14;
        v8 = 0;
        do
        {
          *(_BYTE *)(v16 + v8) ^= *((_BYTE *)*(&v17 + v15) + v8);
          ++v8;
          --v7;
        }
        while ( v7 );
      }
      ++v6;
      --v13;
    }
    while ( v13 );
  }
  result = 0;
  __writefsdword(0, v10);
  return result;
}

The main launcher loads Agree.dat which is just basic xor encoded though with the key of: 0x33

[radix01]

how do you know that file xor with 0x33 . can contact me on discord. i need you help

[atom0s]

The agree.dat is loaded inside of TS2Online.exe via this function:

Code: Select all

int __usercall sub_4D5114@<eax>(int a1@<eax>, int a2@<edx>)
{
  int v2; // ebx
  int v3; // ecx
  int v4; // ecx
  int v5; // ecx
  int v6; // ecx
  unsigned int v8; // [esp-18h] [ebp-188h]
  void *v9; // [esp-14h] [ebp-184h]
  int *v10; // [esp-10h] [ebp-180h]
  unsigned int v11; // [esp-Ch] [ebp-17Ch]
  int v12; // [esp-4h] [ebp-174h]
  int v13; // [esp+Ch] [ebp-164h]
  int v14; // [esp+15Ch] [ebp-14h]
  char v15; // [esp+162h] [ebp-Eh]
  char v16; // [esp+163h] [ebp-Dh]
  int v17; // [esp+164h] [ebp-Ch]
  int v18; // [esp+168h] [ebp-8h]
  int v19; // [esp+16Ch] [ebp-4h]
  int savedregs; // [esp+170h] [ebp+0h]

  v13 = 0;
  v14 = 0;
  v18 = a2;
  v19 = a1;
  sub_404D78();
  v11 = __readfsdword(0);
  __writefsdword(0, (unsigned int)&v11);
  v2 = 0;
  v15 = 0x33;
  if ( (unsigned __int8)sub_4095D8(v11, &loc_4D5250, &savedregs) )
  {
    v10 = &savedregs;
    v9 = &loc_4D51F3;
    v8 = __readfsdword(0);
    __writefsdword(0, (unsigned int)&v8);
    sub_402F0C(v3, v18);
    sub_403434(v4, 1);
    sub_402924();
    ((void (*)(void))sub_4048D8)();
    do
    {
      sub_403070(&v17);
      sub_402924();
      LOBYTE(v2) = v15 ^ v16;
      sub_404AB8(v5, v2);
      sub_404B98(v6, v13);
    }
    while ( v17 );
    sub_4030B0();
    sub_402924();
    __writefsdword(0, v8);
    (*(void (**)(void))(**(_DWORD **)(v19 + 756) + 220))();
    (*(void (__fastcall **)(_DWORD, int))(**(_DWORD **)(*(_DWORD *)(v19 + 756) + 544) + 56))(
      **(_DWORD **)(*(_DWORD *)(v19 + 756) + 544),
      v14);
    LOBYTE(v2) = 1;
  }
  __writefsdword(0, v11);
  sub_4048D8(&loc_4D5257);
  sub_4048D8(v12);
  sub_4048D8(v12);
  return v2;
}

The xor key is set in v15 (0x33) and applied byte-per-byte in the loop here:

Code: Select all

    do
    {
      sub_403070(&v17);
      sub_402924();
      LOBYTE(v2) = v15 ^ v16;
      sub_404AB8(v5, v2);
      sub_404B98(v6, v13);
    }
    while ( v17 );

[radix01]

xor 0x33 for Agree.dat right ?

[radix01]

what's is programs to get Code

[atom0s]

IDA Pro with HexRays plugin.