pokemon go 3d models

[Knobse]

how to open/read/convert the 3Dmodel files of pokemon go?
here a few example files to try something https://mega.nz/#F!0pgAHaaS!2Ru2_WxBPFEoIxtdpXezEA
only thing that is always the same is the 0x01 in hex on the beginning of the file
(other files can be found on android inside /Android/data/com.nianticlabs.pokemongo/files/bundles/)

[Knobse]

i think the files are encrypted with AES/CBC/PKCS5Padding (see global-metadata.dat in the /Android/data/com.nianticlabs.pokemongo/files/il2cpp/Metadata/ folder)

i think the keys it needs are inside
/Android/data/com.nianticlabs.pokemongo/files/remote_config_cache/00..._ASSET_DIGEST
or
/Android/data/com.nianticlabs.pokemongo/files/remote_config_cache/00..._GAME_MASTER
(i think these 2files are proto files)

i tried things but not succeeded, hope some of you guys can find a way to decrypt them

[aluigi]

il2cpp is related to the scripting engine of Unity3d.

[aluigi]

Here there is a test script made with the guidelines found on https://www.reddit.com/r/pokemongodev/c ... decrypted/ but unfortunately it doesn't work with the files provided:

Code: Select all

# YOU MUST SET THE CORRECT KEY HERE!!!
set KEY binary ">\215I\276\332\367\346\033V\363\233e\000\325\334\261" # pm0098?

set KEY_MASK binary "\x50\x46\x41\x69\x24\x3B\x5D\x47\x37\x52\x67\x3E\x6B\x7A\x34\x77"
for i = 0 < 16
    getvarchr A KEY i
    getvarchr B KEY_MASK i
    math A ^ B
    putvarchr KEY i A
next i

print "KEY %KEY|X%"
get VERSION byte
getdstring IV 16
savepos OFFSET
math TRAILER_SIZE = 20
get SIZE asize
math SIZE - TRAILER_SIZE
math SIZE - OFFSET
encryption aes_128_cbc KEY IV 0 16
get NAME filename
string NAME + ".unity3d"
log NAME OFFSET SIZE

I used the keys available on http://pastebin.com/9sy7rBxp (a copy is attached to this post)