This is an encryption method that has become very common in recent Chinese games. 0xA6 XOR is used after the res information, and then 0x1000 bytes or so are encrypted using some other encryption method. There was a previous thread on Xentax asking about Abyss Horizon encryption, and presumably the encryption method is similar to that.
What these games have in common is that il2cpp is obfuscated through some process. It is not encryption; tools such as il2cppdumper are not available. Presumably, they are using encryption support such as virbox. The encryption of the asset is also probably an effect of that.
If we can do a RAM dump, you may be able to get it from there, but Chinese games block gameplay from outside of China, so I can't get a confirmation.
This is an encryption method that has become very common in recent Chinese games. 0xA6 XOR is used after the res information, and then 0x1000 bytes or so are encrypted using some other encryption method. There was a previous thread on Xentax asking about Abyss Horizon encryption, and presumably the encryption method is similar to that.
What these games have in common is that il2cpp is obfuscated through some process. It is not encryption; tools such as il2cppdumper are not available. Presumably, they are using encryption support such as virbox. The encryption of the asset is also probably an effect of that.
If we can do a RAM dump, you may be able to get it from there, but Chinese games block gameplay from outside of China, so I can't get a confirmation.
Game Guardian can be used for dump. If you want to check if the decrypted data exists in RAM, the fastest way is to check the binary data of the process with HxD, but it is difficult to judge without some knowledge.
einherjar007 wrote:Game Guardian can be used for dump. If you want to check if the decrypted data exists in RAM, the fastest way is to check the binary data of the process with HxD, but it is difficult to judge without some knowledge.