Super Robot Wars 30 (PC) .cpk extracting, decryption & encryption

[enixl]

I tried to use crifilesystem 2.40.13.0 to extract Super Robot Wars 30 (PC)'s rpw_data.cpk file, but crifilesystem 2.40.13.0 crashed.
It may be encrypted, and doesn't seem like blowfish.
Could anyone help me to find a way to extract this file, and tell me how to repack it? Thanks!

[enixl]

SRW30's cpk file is attached.

[anakronus]

I tried to use crifilesystem 2.40.13.0 to extract Super Robot Wars 30 (PC)'s rpw_data.cpk file, but crifilesystem 2.40.13.0 crashed.
It may be encrypted, and doesn't seem like blowfish.
Could anyone help me to find a way to extract this file, and tell me how to repack it? Thanks!

Ah, I see someone else is interested in the game, I just cracked the code! (again )

SRW30 just like SRWV and X before it uses Blowfish encryption for the files in the PC release, this time however the pass isn't a variant of "SRW Steam Game" or something xd

Anyway, cutting to the chase.

Not sure why crifilesystem crashes with the .cpk but I could extract the contents just fine with cripakGUI, to decrypt the file after extraction just decrypt with blowfish and use "CryptedByMititei" as password (it's actually the same from the Switch demo, but there only a couple of files were encrypted), reusing the sample scripts from my SRWV post:

Decryption:

Code: Select all

encryption blowfish "CryptedByMititei" #Use the key "SRVX Steam Game" for SRW X and "SRVW Steam Game" for SRW V
get SIZE asize
get NAME basename
get EXT extension
string NAME + _decrypted.
string NAME + EXT
log NAME 0 SIZE

Encryption:

Code: Select all

encryption blowfish "CryptedByMititei" "" 1 #Use the key "SRVX Steam Game" for SRW X and "SRVW Steam Game" for SRW V
get SIZE asize
get NAME basename
get EXT extension
log NAME 0 SIZE

Brought to you by ClanSenju blog research e.e, happy hacking

[anakronus]

Also, here's the cpk's file decrypted, just to show it works fine, it has a recognizable CRILAYLA header and everything c:

[enixl]

Hi Anakronus,
Thank you! The key works well.

[descatal2]

I tried to use crifilesystem 2.40.13.0 to extract Super Robot Wars 30 (PC)'s rpw_data.cpk file, but crifilesystem 2.40.13.0 crashed.
It may be encrypted, and doesn't seem like blowfish.
Could anyone help me to find a way to extract this file, and tell me how to repack it? Thanks!

Ah, I see someone else is interested in the game, I just cracked the code! (again )

SRW30 just like SRWV and X before it uses Blowfish encryption for the files in the PC release, this time however the pass isn't a variant of "SRW Steam Game" or something xd

Anyway, cutting to the chase.

Not sure why crifilesystem crashes with the .cpk but I could extract the contents just fine with cripakGUI, to decrypt the file after extraction just decrypt with blowfish and use "CryptedByMititei" as password (it's actually the same from the Switch demo, but there only a couple of files were encrypted), reusing the sample scripts from my SRWV post:

Decryption:

Code: Select all

encryption blowfish "CryptedByMititei" #Use the key "SRVX Steam Game" for SRW X and "SRVW Steam Game" for SRW V
get SIZE asize
get NAME basename
get EXT extension
string NAME + _decrypted.
string NAME + EXT
log NAME 0 SIZE

Encryption:

Code: Select all

encryption blowfish "CryptedByMititei" "" 1 #Use the key "SRVX Steam Game" for SRW X and "SRVW Steam Game" for SRW V
get SIZE asize
get NAME basename
get EXT extension
log NAME 0 SIZE

Brought to you by ClanSenju blog research e.e, happy hacking

We made the same discovery at the same time

For future SRW game PC port's reference, try to see if the EXE contains the following binary:

A6 0B 31 D1 AC B5 DF 98 DB 72 FD 2F B7 DF 1A D0 ED AF E1 B8 96 7E 26 6A 45 90 7C BA 99 7F 2C F1

If this exists, it means that the game is still encrypted in blowfish

For reference:
viewtopic.php?t=453
https://github.com/magcius/bbtucrypt/

Those binaries are one of the encryption keys used alongside the actual key we need to find (a.k.a "SRVW Steam Game")

Following the xref to this section pointer will lead you to the func that loads these keys, and if you try to search what call this func you will get the actual decryption func.
In SRW V it was just a simple load, while in SRW 30 they are a little bit cheeky and went for dynamic loading to get the key.

Although we have the decryption script, it is possible to decrypt standalone CRILAYLA files? AFAIK they are the keywords CPK extractors find to extract compressed files,
and since the files are encrypted in blowfish, CPK can't recognize the file properly and will always export an encrypted file.

Or would it be easier if we just to decrypt the blowfish encryption while it is still inside the CPK so that the CPK extractor can decompress CRILAYLA files automatically?

[anakronus]

We made the same discovery at the same time

Hahaha, awesome! I was sitting on the key from the switch demo, didn't think they would keep it for PC release xd

For future SRW game PC port's reference, try to see if the EXE contains the following binary:

A6 0B 31 D1 AC B5 DF 98 DB 72 FD 2F B7 DF 1A D0 ED AF E1 B8 96 7E 26 6A 45 90 7C BA 99 7F 2C F1
[...]
Following the xref to this section pointer will lead you to the func that loads these keys, and if you try to search what call this func you will get the actual decryption func.
In SRW V it was just a simple load, while in SRW 30 they are a little bit cheeky and went for dynamic loading to get the key.

Nice breakdown, hopefully it's useful for people dealing with other games too

Although we have the decryption script, it is possible to decrypt standalone CRILAYLA files? AFAIK they are the keywords CPK extractors find to extract compressed files,
and since the files are encrypted in blowfish, CPK can't recognize the file properly and will always export an encrypted file.

Or would it be easier if we just to decrypt the blowfish encryption while it is still inside the CPK so that the CPK extractor can decompress CRILAYLA files automatically?

Yeah, the decryption script is useful but not very efficient in this case (at least in SRW V/X the files were encrypted *before* CRILAYLA compression).

Luckily, we can actually decompress CRILAYLA files with quickbms too, here's an example:

Decryption + CRILAYLA decompression:

Code: Select all

encryption blowfish "CryptedByMititei"
comtype cpk
get SIZE asize
get NAME basename
get EXT extension

log MEMORY_FILE 0 SIZE
encryption "" ""

getdstring HEADER 8 MEMORY_FILE

if HEADER == "CRILAYLA"
    get CSIZE long MEMORY_FILE
    xmath CSIZE "CSIZE + 0x100"

    string NAME + "_dec_layla." + EXT # Change names to something more useful if you want
    clog NAME 0 SIZE CSIZE MEMORY_FILE
else
    #Not sure if these kind of files exist, don't actually have SRW 30 on PC, but just in case...
    string NAME + "_dec." + EXT
    log NAME 0 SIZE MEMORY_FILE
endif

CRILAYLA compression + Encryption:

Code: Select all

comtype cpk_compress
get SIZE asize
get NAME basename
get EXT extension

clog MEMORY_FILE 0 SIZE SIZE

encryption blowfish "CryptedByMititei" "" 1 

get SIZE asize MEMORY_FILE
log NAME 0 SIZE MEMORY_FILE

The decryption+decompression script used on this post's cpk file produces the file attatched, which looks about perfect.
In my case though, I edited CriPakGUI (as it's open source) and made it decrypt the files before extraction/insertion back with the SRW V/X, something similar could be done here if for some reason the bms scripts are not enough.

[MSQ]

Good evening anakronus, thank you for the resources you have posted in the topic! I have understood a lot from reading your comments here.

I would like to ask how I am meant to extract and decompress the resources inside the 3 larger CPK files for this game, they are:

Code: Select all

pc/data/btlc/wp00.cpk
pc/data/mapetc/mapdataest010steam.cpk
pc/data/statusimage/psg00.cpk

Unfortunately when I try your decryption BMS script in order to decrypt any of the above CPKs, I receive this error:

Code: Select all

CMD > quickbms run.bms wp00.cpk

  offset           filesize   filename
--------------------------------------
  0000000000000000 3551297280 wp00_decrypted.cpk

- error in src\extra\xalloc.c line 618: xdbg_malloc()

Error: memory allocation problem
       Not enough memory resources are available to process this command.

I fail to understand why this is, I am not awfully familiar with QuickBMS. I am using the 4GB_files.exe always, and have tried the normal EXE but I receive the same error. It is only for those above 3 files. The rest have decrypted correctly and I can extract the encrypted crilayla streams from the file. I have 64GB of RAM in my computer, so I do not see any limitations there. Is there something I am doing wrong with your script? I copied it directly from your post.

Thank you in advance!

[spiritovod]

@MSQ: quickbms (even 4GB version) is kind of pseudo-64bit app, so you can't allocate more than 3GB memory with a single allocation operation, required for encryption and compression algorithms (it also depends on virtual memory settings in Windows). And the file you're trying to process if over 3GB, hence the error. Theoretically it's possible to process decryption operations in blocks (most algorithms are block-based) and maybe decompression as well - but it's better someone more qualified to answer that. I hope aluigi will explain it better.

[anakronus]

Good evening anakronus, thank you for the resources you have posted in the topic! I have understood a lot from reading your comments here.

I would like to ask how I am meant to extract and decompress the resources inside the 3 larger CPK files for this game, they are:

Code: Select all

pc/data/btlc/wp00.cpk
pc/data/mapetc/mapdataest010steam.cpk
pc/data/statusimage/psg00.cpk

Unfortunately when I try your decryption BMS script in order to decrypt any of the above CPKs, I receive this error:
[...]
I fail to understand why this is, I am not awfully familiar with QuickBMS. I am using the 4GB_files.exe always, and have tried the normal EXE but I receive the same error. It is only for those above 3 files. The rest have decrypted correctly and I can extract the encrypted crilayla streams from the file. I have 64GB of RAM in my computer, so I do not see any limitations there. Is there something I am doing wrong with your script? I copied it directly from your post.

Thank you in advance!

I don't think any individual file inside the cpk's over 3Gigs though? The way the script is meant to work involves extracting the .cpk first and then using the decryptor/decompressor, you could try with any cpk handling tool to extract the big .cpk (even the qbms script, but that one's deprecated iirc) then you can batch decrypt them with the script provided in the post.

[descatal2]

Good evening anakronus, thank you for the resources you have posted in the topic! I have understood a lot from reading your comments here.

I would like to ask how I am meant to extract and decompress the resources inside the 3 larger CPK files for this game, they are:

Code: Select all

pc/data/btlc/wp00.cpk
pc/data/mapetc/mapdataest010steam.cpk
pc/data/statusimage/psg00.cpk

Unfortunately when I try your decryption BMS script in order to decrypt any of the above CPKs, I receive this error:

Code: Select all

CMD > quickbms run.bms wp00.cpk

  offset           filesize   filename
--------------------------------------
  0000000000000000 3551297280 wp00_decrypted.cpk

- error in src\extra\xalloc.c line 618: xdbg_malloc()

Error: memory allocation problem
       Not enough memory resources are available to process this command.

I fail to understand why this is, I am not awfully familiar with QuickBMS. I am using the 4GB_files.exe always, and have tried the normal EXE but I receive the same error. It is only for those above 3 files. The rest have decrypted correctly and I can extract the encrypted crilayla streams from the file. I have 64GB of RAM in my computer, so I do not see any limitations there. Is there something I am doing wrong with your script? I copied it directly from your post.

Thank you in advance!

I've been working on a modified CriPakTool to properly uncompressed the cpk files with blowfish decryption in one go, but it is still under progress.
For mapdataest010steam.cpk there's a problem with normal CriPakTool, I am not sure what's the problem, but most probably related to ITOC pointer being read wrong.
I will post the program once I finish small tweaks, it should be able to decompress wp00 and psg00 cpks in one go.

But please keep in mind psg00's content is about 20gb after decompression so save some space before you start

[descatal2]

We made the same discovery at the same time

Hahaha, awesome! I was sitting on the key from the switch demo, didn't think they would keep it for PC release xd

For future SRW game PC port's reference, try to see if the EXE contains the following binary:

A6 0B 31 D1 AC B5 DF 98 DB 72 FD 2F B7 DF 1A D0 ED AF E1 B8 96 7E 26 6A 45 90 7C BA 99 7F 2C F1
[...]
Following the xref to this section pointer will lead you to the func that loads these keys, and if you try to search what call this func you will get the actual decryption func.
In SRW V it was just a simple load, while in SRW 30 they are a little bit cheeky and went for dynamic loading to get the key.

Nice breakdown, hopefully it's useful for people dealing with other games too

Although we have the decryption script, it is possible to decrypt standalone CRILAYLA files? AFAIK they are the keywords CPK extractors find to extract compressed files,
and since the files are encrypted in blowfish, CPK can't recognize the file properly and will always export an encrypted file.

Or would it be easier if we just to decrypt the blowfish encryption while it is still inside the CPK so that the CPK extractor can decompress CRILAYLA files automatically?

Yeah, the decryption script is useful but not very efficient in this case (at least in SRW V/X the files were encrypted *before* CRILAYLA compression).

Luckily, we can actually decompress CRILAYLA files with quickbms too, here's an example:

Decryption + CRILAYLA decompression:

Code: Select all

encryption blowfish "CryptedByMititei"
comtype cpk
get SIZE asize
get NAME basename
get EXT extension

log MEMORY_FILE 0 SIZE
encryption "" ""

getdstring HEADER 8 MEMORY_FILE

if HEADER == "CRILAYLA"
    get CSIZE long MEMORY_FILE
    xmath CSIZE "CSIZE + 0x100"

    string NAME + "_dec_layla." + EXT # Change names to something more useful if you want
    clog NAME 0 SIZE CSIZE MEMORY_FILE
else
    #Not sure if these kind of files exist, don't actually have SRW 30 on PC, but just in case...
    string NAME + "_dec." + EXT
    log NAME 0 SIZE MEMORY_FILE
endif

CRILAYLA compression + Encryption:

Code: Select all

comtype cpk_compress
get SIZE asize
get NAME basename
get EXT extension

clog MEMORY_FILE 0 SIZE SIZE

encryption blowfish "CryptedByMititei" "" 1 

get SIZE asize MEMORY_FILE
log NAME 0 SIZE MEMORY_FILE

The decryption+decompression script used on this post's cpk file produces the file attatched, which looks about perfect.
In my case though, I edited CriPakGUI (as it's open source) and made it decrypt the files before extraction/insertion back with the SRW V/X, something similar could be done here if for some reason the bms scripts are not enough.

Also, thanks for the writeup, very interesting stuff

[MSQ]

I don't think any individual file inside the cpk's over 3Gigs though? The way the script is meant to work involves extracting the .cpk first and then using the decryptor/decompressor, you could try with any cpk handling tool to extract the big .cpk (even the qbms script, but that one's deprecated iirc) then you can batch decrypt them with the script provided in the post.

I thought that in order to extract the encrypted CRILAYLA streams from the CPK, I first need to decrypt the entire CPK using the BMS script. This is because without doing so, I cannot extract the streams since the CriPakTools etc.. are all looking for the CPK header in the file.

Am I getting this incorrect?

My current process:

Start: Encrypted CPK ----> Decrpyt using BMS script ----> Extract encrypted CRILAYLA streams using CriPakTools ----> Decrypt each CRILAYLA stream using BMS script.

[spiritovod]

Here is script for decrypting large cpk files (and small ones as well) in blocks.

Edited: Script restored, since pc version has encryption on the whole cpk files.

[anakronus]

I thought that in order to extract the encrypted CRILAYLA streams from the CPK, I first need to decrypt the entire CPK using the BMS script. This is because without doing so, I cannot extract the streams since the CriPakTools etc.. are all looking for the CPK header in the file.

Am I getting this incorrect?

My current process:

Start: Encrypted CPK ----> Decrpyt using BMS script ----> Extract encrypted CRILAYLA streams using CriPakTools ----> Decrypt each CRILAYLA stream using BMS script.

Yeah, you got it wrong, the idea was to get the encrypted streams from CriPakTools and then use the bms script on those, it handles the CRILAYLA files by itself, so it would be:
Note that CRILAYLA is *compression* not encryption, so encrypted CRILAYLA streams just mean CRILAYLA compressed files that are encrypted
Start: CPK (they shouldn't be encrypted in their totality)----> Extract encrypted CRILAYLA streams using CriPakTools ----> Decrypt each CRILAYLA stream using BMS script.

If you want a quick and dirty solution, I modified my old version of CriPakTools so it decrypts first and then decompress, probably has errors here and there, but if you can't wait for @descatal2's more proper solution then it's attached.

(Also note the tool is kinda dumb, decrypting everything without a CRILAYLA header, so if there are unencrypted files intermixed with encrypted files it would silently encrypt those, hopefully @descatal2's version will be more careful)

EDIT: updated modified CriPakTools, solved a dumb bug regarding file sizes

[MSQ]

Yeah, you got it wrong, the idea was to get the encrypted streams from CriPakTools and then use the bms script on those, it handles the CRILAYLA files by itself, so it would be:
Note that CRILAYLA is *compression* not encryption, so encrypted CRILAYLA streams just mean CRILAYLA compressed files that are encrypted
Start: CPK (they shouldn't be encrypted in their totality)----> Extract encrypted CRILAYLA streams using CriPakTools ----> Decrypt each CRILAYLA stream using BMS script.

If you want a quick and dirty solution, I modified my old version of CriPakTools so it decrypts first and then decompress, probably has errors here and there, but if you can't wait for @descatal2's more proper solution then it's attached.

(Also note the tool is kinda dumb, decrypting everything without a CRILAYLA header, so if there are unencrypted files intermixed with encrypted files it would silently encrypt those, hopefully @descatal2's version will be more careful)

EDIT: updated modified CriPakTools, solved a dumb bug regarding file sizes

Yes, I understand that CRILAYLA is the compression algorithm and that Blowfish is the encryption algorithm used on the files.

The reason why I was using the BMS script on the entire CPK file was because of this:

The file does not have the correct CPK header (this is default.CPK from my Steam library), so it cannot be extracted, even by the tool you attached to your comment. This file is completely encrypted.

Whereas, after running the BMS script to decrypt the CPK, we end up with a readable header:


Your tool can also read the file:

And we can extract the .BIN files which are encrypted Crilayla streams. We can then encrypt and decrypt these as we please.

Hopefully you understand the issue I am facing. Since the CPK is completely encrypted, it's not possible to extract any of the crilayla streams from the file unless we first decrypt the entire CPK.

[spiritovod]

Oh, so the whole cpk are also encrypted.

@MSQ: I've restored script for decrypting large packages in blocks in my previous post above, try it, it should work.

[anakronus]

Yes, I understand that CRILAYLA is the compression algorithm and that Blowfish is the encryption algorithm used on the files.

The reason why I was using the BMS script on the entire CPK file was because of this:
[snip]
The file does not have the correct CPK header (this is default.CPK from my Steam library), so it cannot be extracted, even by the tool you attached to your comment. This file is completely encrypted.

Whereas, after running the BMS script to decrypt the CPK, we end up with a readable header:
[snip]

Your tool can also read the file:
[snip]
And we can extract the .BIN files which are encrypted Crilayla streams. We can then encrypt and decrypt these as we please.

Hopefully you understand the issue I am facing. Since the CPK is completely encrypted, it's not possible to extract any of the crilayla streams from the file unless we first decrypt the entire CPK.

Ah I see what you mean now, as I mentioned earlier I currently do not have the PC version of the game so I didn't think the actual containers would be fully encrypted.

In this case you can make use of @spiritovod's script (which has as of now been removed, but I got while available and is provided in the attachments, credits to spiritovod) can't test on the actual 3GiB file but it seems to work perfectly for smaller files (1.2GiB).

Edit: Looks like I got ninja'd, you can get the script from @spiritovod's now as well

[MSQ]

spiritovod, anakronus

Thank you for the script, this works perfectly on the larger CPK files! I am sorry for the confusion regarding the differences in platforms, I did not realise the files were different in this case.

Edit: The CPK containers are not encrypted, I just messed up my game files (I might have accidentally encrypted them?) not too sure, but I can confirm that after clean reinstalling, the files definitely have the CPK header by default and by no means are fully encrypted. Sorry about this!

To further my knowledge of this topic: would there be a way to create a tool that decrypts the crilayla streams while they are still inside the CPK, or is it a must that each stream must be unpacked then decrypted. Thanks again!

[anakronus]

spiritovod, anakronus

Thank you for the script, this works perfectly on the larger CPK files! I am sorry for the confusion regarding the differences in platforms, I did not realise the files were different in this case.

Edit: The CPK containers are not encrypted, I just messed up my game files (I might have accidentally encrypted them?) not too sure, but I can confirm that after clean reinstalling, the files definitely have the CPK header by default and by no means are fully encrypted. Sorry about this!

To further my knowledge of this topic: would there be a way to create a tool that decrypts the crilayla streams while they are still inside the CPK, or is it a must that each stream must be unpacked then decrypted. Thanks again!

The CriPakGui file I shared in the other post extracts the plaintext data (after decryption and CRILAYLA decompression) when you click on "extract me! (decrypted)" so you get the final files
You can also right click on a single bin and do click on extract (decrypted) to get the final file (again after decryption and CRILAYLA decompression) too.