One Piece Dance Battle .fe

[TRDaz]

Would anyone have any idea how to decrypt these files? These are from a Unity game, One Piece Dance Battle, the files within the apk are completely fine, the extra data that is downloaded when the game is launched is just these .fe files that seem to be encrypted.

[TRDaz]

Can anyone help with this? I tried using the comtype scanner to see if it was compressed but I couldn't tell which compression algorithm is the one is used. I would have used the encryption scanner but I don't know the key used. I can upload more samples if needed. There is also some .so files for criware that I have, those may help in some way.

[aluigi]

Tried a scan from offset 0x30 but nothing.
Probably it's encrypted with blowfish or *tea (or even aes with the size specified there which is the real unaligned size).

[TRDaz]

Is there any chance of decrypting it or isn't it possible?

[aluigi]

If someone has desire and time to check the executable, sure

[TRDaz]

Oh I see, thanks for checking the file though!

[Ekey]

It's AES/128/CBC. IV you can get from encrypted files at offset 0x20. For each file is different key. Key you can take from packlist file. Encrypted data begins at offset 0x30. GZip used as compression.

Packlist format for each entry.

Code: Select all

    GROUP,
    FE_MD5,
    FE_DECODE_KEY, -> AES key
    FILENAME_MD5,
    DATE,
    TIME,
    FILENAME

[aluigi]

@TRDaz
can you provide the Packlist file?

[TRDaz]

I'm not entirely sure which the packlist file is.

[TRDaz]

Mhm I assume the packlist is just .packlist. I don't seem to have that file, I'll try to locate it.

[Ekey]

This file must be ~100-300kb in plain text format, located in OBB cache or on SDCard if you have installed game on your device.

[TRDaz]

I'll take a look, the game doesn't store extra data in an OBB and hides the files rather well on the SDCard.

[Ekey]

Look for a folder com.bandainamcogames.onepiecedancebattle

[Ekey]

I found this file.

iOS

Code: Select all

https://opa-dance-channel-or-jp.s3.amazonaws.com/PackedResource_MTX/iOS/ios_list.dat

Android

Code: Select all

https://opa-dance-channel-or-jp.s3.amazonaws.com/PackedResource_MTX/Android/android_list.dat

[aluigi]

I tried both the list files but the output file is not decrypted correctly:
*edit*

[Ekey]

No ideas > http://pastebin.com/FqDjvmrh

[aluigi]

Do you mean that you have tried that code with the key d41faf462c3d6ef2 (from android_list.dat) with the file provided by TRDaz, and you get the correct result?

[Ekey]

Did I say that I got the correct result? I just shared info about encryption.

[aluigi]

ah ok. so it's simply possible that such file has not been encrypted with that key and my script is correct.
In the meantime I put the script online because I don't see errors in it:
http://aluigi.org/bms/one_piece_dance_battle.bms

[Ekey]

Anyway output file has the strange data.