monogame visual novel .vna?

[ManGuy12]

Game: CYOA Cat up a tree (NSFW Warning)
Trying to access this game's files but it's encrypted in an "archive.vna" file?
This game runs on .NET Core 3.1 so it was easy to decompile but the encryption algorithm went over my head.
I looked everywhere to figure this out but I'm not sure if I can do it.
Thanks in advance!

[spiritovod]

Here are two scripts for decrypting vna container: quickbms adaptation (very ineffective and works correctly only with 32-bit quickbms, but easy to understand) and with native code through calldll function (recommended).
P.S. It's actually a good example for RE beginners, kinda recommended to dig into it for learning basic stuff.

Update: Extracting functionality added to calldll version of the script. Note that output folder must be the same as input folder, otherwise you'll get error.

[ManGuy12]

Here are two scripts for decrypting vna container: quickbms adaptation (very ineffective and works correctly only with 32-bit quickbms, but easy to understand) and with native code through calldll function (recommended).
P.S. It's actually a good example for RE beginners, kinda recommended to dig into it for learning basic stuff.

Yeah the first script runs slow for me, the second one I'm not sure if it's working. I'm getting these warnings.

Code: Select all

<string>:36: warning: implicit declaration of function 'malloc'
<string>:37: warning: implicit declaration of function 'memcpy'
<string>:44: warning: implicit declaration of function 'free'

It does spits out a decrypted file but doesn't extract the files?
Or is that something I'm supposed to figure out?

[spiritovod]

Those warnings are normal thing for this case. I've updated calldll version of the script with extraction functionality in my post above. All images in the archive are named as png, but some of them are actually bmp/gif - most editors can handle wrong headers though.

[ManGuy12]

Those warnings are normal thing for this case. I've updated calldll version of the script with extraction functionality in my post above. All images in the archive are named as png, but some of them are actually bmp/gif - most editors can handle wrong headers though.

Worked like a charm. Thank you very much!