VRC PRO - .VRC and .VRH

[squidiskool]

Decided to post my XENTAX post to here.
I tried using the VRC quickbms but it said that it wasn't encrypted.
I don't even know if this is an archive, or just model/texture. Hmm...
The header is "VRC" on both files. I've used strings to find ASCII strings throughout the file. In the VRH file I find ".gz" mentioned a few times. Not sure if that's a coincidence or not...
I've tried offzip, nothing.
Will post a link to ZENHAX on XENTAX if I get an answer, and so forth.
Samples:
VRC:
https://www.mediafire.com/file/rkaculdz ... 1.vrc/file
VRH:
https://www.mediafire.com/file/hwgxd6jm ... 1.vrh/file

[squidiskool]

Still looking for info on this subject.

[squidiskool]

Anybody?

[Ekey]

Data probably encrypted / obfuscated.

[squidiskool]

Data probably encrypted / obfuscated.

Okay, is there a way to extract?

[Ekey]

There is nothing much we can do without reverse engineering. I don't have this game/app.

[squidiskool]

There is nothing much we can do without reverse engineering. I don't have this game/app.

You can get the game's free version on their website. What's cool is that the free version contains all of the data files, including paid car assets.

[squidiskool]

?















e

[squidiskool]

Still looking for a solution to this

[squidiskool]

There is nothing much we can do without reverse engineering. I don't have this game/app.

Hello?

[Ekey]

Well, VRC, VRH, CAR files is encrypted by AES-256-CBC. Output data is a passwored ZIP. Here key for decrypt

Code: Select all

B6 8E 4D 98 BC DB 62 1B 0E 98 52 05 D0 07 5C F2 AA 53 C4 88 AE 41 FD C7 FE 1D A7 D6 C7 6E A1 7F

And password for ZIP files.

Code: Select all

d17856f1ce

Note: Ecrypted data begins always from offset 9

Edited: Script for convert this files to normal ZIP

Code: Select all

# Virtual RC Pro (VRC / VRH / CAR) to ZIP Converter
# password for zips is > d17856f1ce
# script for QuickBMS http://aluigi.org/papers.htm#quickbms

get SIZE asize
goto 9
savepos OFFSET
math SIZE -= 9

encryption aes_256_cbc "\xB6\x8E\x4D\x98\xBC\xDB\x62\x1B\x0E\x98\x52\x05\xD0\x07\x5C\xF2\xAA\x53\xC4\x88\xAE\x41\xFD\xC7\xFE\x1D\xA7\xD6\xC7\x6E\xA1\x7F"
log MEMORY_FILE OFFSET SIZE
encryption "" ""

putvarchr MEMORY_FILE 0 0x4034B50 long
putvarchr MEMORY_FILE 4 0x90014 long
putvarchr MEMORY_FILE 8 0x8 long
putvarchr MEMORY_FILE 12 0 long
putvarchr MEMORY_FILE 16 0 long
putvarchr MEMORY_FILE 20 0 short

get NAME basename
string NAME += ".zip"

log NAME 0 SIZE MEMORY_FILE