Max Payne 1/2 (*.RAS) Snippet of code (Decryption)

[Ekey]

Part of code for decrypt RAS archives from game Max Payne 1/2 (Android / PC). Maybe usefull for someone

Code: Select all

struct RASHeader
{
   DWORD dwID;
   DWORD dwSeed;
};

Code: Select all

void DecryptWithSeed(unsigned char *pBuffer, int dwSize, int dwSeed)
{
   if (!dwSeed)
      dwSeed = 1;

   if (dwSize > 0)
   {
      char wSeed = 18;
      char pTemp;
      for (int i = 0; i < dwSize; ++i)
      {
         dwSeed = -2 * (dwSeed / 177) + 171 * (dwSeed % 177);
         pTemp = ((pBuffer[i] << i % 5) | ((signed int)pBuffer[i] >> (8 - i % 5))) ^ wSeed;
         wSeed += 6;
         pBuffer[i] = pTemp + dwSeed;
      }
   }
}

[aluigi]

Well done:
http://aluigi.org/bms/max_payne_ras.bms

The header is visible but now the last step will be to undertand that decrypted data that probably has a second pass of encryption or it's encrypted using a different seed.

[Ekey]

Here my test tool for decrypt header and file table + sample of archive inside. In the fact header must be 0x2C bytes and encrypted only 0x24 bytes from 0x8 position.

Edited: Attached variant 2

[aluigi]

Script 0.2, complete extraction

[Ekey]

Cool