NoScrubs Iris Online passwords

[aluigi]

NoScrubs Iris Online
http://noscrubs.net

All the dat and ns files in the data folder are ZIP files protected by password, except pet.dat which is not protected at all.
7zip and other archivers may have some problems to open the DAT files so you can use my zip.bms script and setting the passord in the ZIP_PASSWORD string with a text editor:
http://aluigi.org/bms/zip.bms

DAT files:

Code: Select all

Failed open dat

NS files:

Code: Select all

#7qlcRkfanwlrodld 

[Viserion]

Yo aluigi,

NoScrubs has added a new file (*.NSS) with new password, can you help?

Link (with exe and nss files): https://mega.nz/#!K9ogzDKA!My1bitRY2h1_ ... UghbMz3pBg

[aluigi]

I don't remember what executable/dll container the other passwords, can you "grep" the exe/dll searching one of the two passwords I posted?
When you find the right file, then upload it.

[Viserion]

You can find in this *.exe I have to uploaded uploaded, here in HxD: http://prntscr.com/ezhclj
But I can't find pw: #7qlcRkfanwlrodld in this exe.

[aluigi]

Right, the passwords are generated at runtime.
Anyway there are many of them, for example the map*.nss archives use a password that is the reverted map number and so on.
The following is the current full list of NSS archives and their relative passwords:

Code: Select all

05s00r0ss0cc00  cha_accessories5.nss
01r0mr00    cha_armor1.nss
02r0mr00    cha_armor2.nss
03r0mr00    cha_armor3.nss
020m0ts0c0  cha_costume2.nss
001n0p00w0  cha_weapon1a.nss
002n0p00w0  cha_weapon2a.nss
004n0p00w0  cha_weapon4a.nss
005n0p00w0  cha_weapon5a.nss
006n0p00w0  cha_weapon6a.nss
0100p0m0    map_map001.nss
0330p0m0    map_map033.nss
0430p0m0    map_map034.nss
0530p0m0    map_map035.nss
0601p0m0    map_map106.nss
0902p0m0    map_map209.nss
033p0m0     mon_map33.nss
0043p0m0    mon_map34a.nss
0b43p0m0    mon_map34b.nss
0c43p0m0    mon_map34c.nss
0d43p0m0    mon_map34d.nss
0043p0m0    mon_map34e.nss
0f43p0m0    mon_map34f.nss
0g43p0m0    mon_map34g.nss
0h43p0m0    mon_map34h.nss
0043p0m0    mon_map34i.nss
0j43p0m0    mon_map34j.nss
0k43p0m0    mon_map34k.nss
0l43p0m0    mon_map34l.nss
0053p0m0    mon_map35a.nss
0b53p0m0    mon_map35b.nss
0c53p0m0    mon_map35c.nss
0d53p0m0    mon_map35d.nss
0053p0m0    mon_map35e.nss
0f53p0m0    mon_map35f.nss
0g53p0m0    mon_map35g.nss
0h53p0m0    mon_map35h.nss
0053p0m0    mon_map35i.nss
043p0m0     npc_map34.nss
053p0m0     npc_map35.nss
0100lc0h0v  vehicle01.nss

[aluigi]

After watching the passwords I posted I guessed the algorithm, this is the script to retrieve the ZIP password from any NSS file:

Code: Select all

get DATA basename
string DATA $ "_"
print "%DATA%"
string DATA r DATA
string DATA R "_" "0"
string DATA R "a" "0"
string DATA R "e" "0"
string DATA R "i" "0"
string DATA R "o" "0"
string DATA R "u" "0"
print "PASSWORD: 0%DATA%"