Need help to decrypt pf8 (*pfs) file - looks like XOR

[bam_bam]

Hi, There.

At first, I'm very sorry because my english is little rusty. plz excuse me.

I know there is a QuickBMS script for pf8. (*PFS - http://aluigi.altervista.org/quickbms.htm)

But it doesn't match. Maybe, File I want to decrypt is different one.

Does anyone know how to extract this? Thanks!

[aluigi]

What's the name of the game and the original names of these pfs files?

[aluigi]

Norn9 right?

[aluigi]

http://aluigi.org/bms/norn9.bms

[bam_bam]

http://aluigi.org/bms/norn9.bms

OH MY! I'm much obliged to you for your help.
Thank you very much!

May I ask one more favor?

I tested another pfs file.
it's also same game file. it's too big so I uploaded patch file!

But this time it didn't work.

If you ok, Can you take a look this file?

[aluigi]

What's the name of the previous file you uploaded?

[bam_bam]

What's the name of the previous file you uploaded?

The previous file name is patch10.

[aluigi]

That's bad, because every file has a different key so a file like patch11.pfs (if exists) can't be extracted and the same is valid for the real root.pfs which is 1,5Gb (got the info from google).
And what's the name of the first file you uploaded?

[aluigi]

Script 0.2, it tries to guess the key and it works correctly with the 2 files you provided.

[bam_bam]

That's bad, because every file has a different key so a file like patch11.pfs (if exists) can't be extracted and the same is valid for the real root.pfs which is 1,5Gb (got the info from google).
And what's the name of the first file you uploaded?

Oh, sorry. My mistake.
First file name is patch10 and second file name is main3.
That's all.

My team have worked thie series. A file format isn't xor.
The new Game will be released in the latter half of this year.
According to your words, every file has a different key......so sad
Anyway I'm very grateful for your help!

[aluigi]

Have you tried the script 0.2?
It should work with most of your files.

[bam_bam]

Have you tried the script 0.2?
It should work with most of your files.

I tested the script 0.2!
It worked most of games. Thanks a lot

By the way, The new game file is still didn't work.
It was recently released, I guess that might make a difference.
I'm sorry for giving you so much trouble. Our team really appreciate you.

https://www.dropbox.com/s/24n0h2igoil9zap

[aluigi]

There is nothing I can do. It's just a key guesser.

[bam_bam]

There is nothing I can do. It's just a key guesser.

I see. Thanks for your time.
Lastly, That pfs in test.zip (new game file) is xor encryption too?
Someone asked me but I don't know about it at all.

[aluigi]

All the pfs archives are encrypted but the mp4 files archived in them are not encrypted.
I have updated the script to version 0.2.1 with the 3 hardcoded keys for the archives you provided.

[qianqilin]

Added.
Because I had unpacked.

Code: Select all

#IF NORN9 IOS
XOR is \x43\xA5\x04\x7B\xF9\x05\xBE\xD2\x8D\x2F\xF1\xF4\xEB\x5A\x4A\xDA\x98\xF1\x63\xED

#IF NORN9 APK
XOR is \xCD\x43\x09\xB6\xB2\xA5\xA6\x37\x44\x51\xC2\xB1\x2A\x89\x6C\xB9\xFA\x12\x83\x8E

#IF NORN9 APK PFS.000
XOR is \xD1\xFF\xCD\xBD\x96\x64\xA9\x02\xB6\xE9\x4B\x0A\xD3\x79\x98\xEE\x63\xB1\xFC\xBF

This is what I know~

[aluigi]

What's the name of the file for each one of these keys?
I hope it's not just "root.pfs" for the first 2 and "root.pfs.000" for the third one.

[qianqilin]

But it is.
The NORN9(v1.0.1).ipa have a archive [root.pfs].
It has a blank Photo [all zero].

NORN9.APK have:
main.3.jp.co.ideaf.norn9vcsmp.obb [I think is root.pfs]
patch.10.jp.co.ideaf.norn9vcsmp.obb [root.pfs.000]

If you want to run on PC, comment "os_check".

I only know that these.

[bam_bam]

I'm sorry for replying late because of a busy daily life for days.
Meanwhile, The Game is updated. Main4 file has changed to main8 file And a new image file has added.
Unfortunately script 0.2.1 doesn't work in these files.
Our team are very sorry for the inconvenience. But We could not give up in the middle.
So if you don't mind, could you check these files once again?
I just hope any more update.

NEW IMAGE FILE
https://www.dropbox.com/s/bey9hp5iiblqtp6

MAIN FILE
https://www.dropbox.com/s/h5vroo2ggotp693

[aluigi]

Script 0.2.2 with an improved method to guess the key for the archives containing main.iet.