Dragon Quest Rivals - encrypted .tga files and model files

[Boxy]

Hi all, I have a side-by-side comparison of Dragon Quest Rivals for mobile vs switch. The mobile files appear to be encrypted, whereas switch is not. Would anyone mind taking a look at the attached .tga file encryption for example? Is this possible to decrypt?

My latest available switch dump contains fewer files (game service ended and it cannot be updated anymore). The latest mobile dump I have available has many more files which I would like to access and preserve.

Thanks for everyone's time. Is this something solvable with xor/bms/debugger etc? Or not possible?

[einherjar007]

The "ENC" is probably followed by the compressed file size.
And since the file size is a number that is neatly divisible, can see that padding is applied at the time of compression.

[Boxy]

Hi! I've looked at the contents using HxD, but it's a bit foreign to me still. Thanks for the tips. I'll try to work at it and see what I can learn. Is this example something I could decipher on my own and make my own quickbms script? Any advice welcome. I wanted to make sure it's doable (and not a hundreds of thousands of hours unbreakable code scenario) before I spend a long time trying to learn to do it.

[einherjar007]

Me too.
I posted it on xentax, but I used to have a switch and could get the data myself, but then I let go of the switch and deleted the data I got, so I don't have the data now...
I don't think the compression and encryption methods used by this game are easy to analyze. It seems that it is processed by a function called SQEXEncrypter, but I could not understand it.

If this game was running in DirectX, I could have used NinjaRipper, but Cocos2D only runs in OpenGL, so I couldn't use that method either.

[Boxy]

Have you ever tried using GLXtractor (GL extractor)? Similar to Ninja Ripper but for OpenGL. Maybe that could work for you. I successfully used GLXtractor for some Double Dragon Neon assets. I haven't ever used Cocos2D though. Maybe the mobile Rivals version can be ripped with GLXtractor?

Anyway, I will continue looking at the mobile file encryption and see what I can figure out. I think I am out of my league though.

[spiritovod]

The game is using standard aes-128-cbc encryption, except that the key and IV are statically generated at runtime. Attached script was tested on mobile version of Dragon Quest Rivals Ace v3.8.0 and samples from the first post.

I suppose tga textures are using ETC1 compression (for more info read here).

Update: Script is updated to automatically decompress decrypted assets in case if they're compressed (like samples from the first post).

Update 2: Updated script can now convert/fix tga textures for usage with etc1tool from Android SDK platform tools, available here. Simply run script on already decrypted and decompressed texture and it will be replaced with fixed one, just don't forget to launch quickbms with "-w" option to allow write operations.

[Boxy]

Wow! Thanks so much. Thanks for your time and thanks for the info. Still learning (a lot...) but hopefully one day I'll be able to help out rather than just ask questions.

I will check it out tonight and let you know how it goes.

Can I ask, about the key and IV being statically generated at runtime- does that mean it was simpler to decrypt? Because all that info is in the encrypted file rather than being stored elsewhere? (Sorry if I'm way off.) Just trying to understand a little better.

Thanks again for the help!

[Boxy]

The script works really well on every file I've tried so far. Using Joschka's .c3b noesis plugin, I've attached a few screen captures of successful models + animations extracted from the mobile game into blender.

I haven't gotten as far as doing anything with the compressed ETC1 .tga. I threw a few existing tools at it to see if it'd be so easy, but seems not (so far). Mali Texture Compression Tool doesn't seem to load any of the .tga files, and the etcpack.exe (included with Mali) via command line throws an error that it's not the right format. Another tool, etc1tool.exe, works but the output .tga doesn't have a familiar header and can't be opened with anything as far as I can tell (maybe it's raw and just needs a header added manually afterward?). I'll have to inspect/compare a resulting .tga vs a switch .tga to see if it's familiar at all or not.

Anyway that's a success with the models! But on first attempt I've struck out with the textures, haha.

[spiritovod]

@Boxy: I've updated script and also the post with more info about how to convert tga textures. Not sure if result is totally correct, but at least it works.

[Boxy]

Thanks again. The update is working on all textures I have tried so far. Working really well. (some examples attached)

I also attached a comparison for a texture, between mobile and switch versions. For anyone who is curious to see. There is some color banding and noise in the decoded mobile version, but I think that's probably to be expected given that ETC1 is lossy, right? No complaints at all, your work is really well done. If I happen to encounter any textures that do not work, I will let you know. But everything I have tried works.