QQXY *.ecf

[Viserion]

Hi guys,

Someone can help descrypt *.ecf? *.ecf is an file encrypted file of *.cfg

Download: https://mega.co.nz/#!98UEDJbR!dbE253cEJ ... PwN0vVKc_0

Thanks!

[aluigi]

In another game QQ used a charset based obfuscation (basically each char corresponds to a different one) and used also hexadecimal representation of the data.

Considering that it's for sure not a fixed xor/rot string (there is a file with sequences of 0xc4 bytes) and the range of these bytes it's ever above 0x80, I suspect they did something similar like that game also here.

Obviously I tried the same charset encryption of that game, but doesn't work here so it's different.

[Viserion]

.
Hi aluigi, maybe it help you?
http://pastebin.com/KSyg6GuM

[aluigi]

Yes it contains the obfuscation algorithm:
http://aluigi.org/papers/bms/others/qconfig.bms

[Viserion]

Thank you so much!
Now I can see the configuration files of the client. Just missing the *.ueni and *.tbl for me to completely manipulate the client.

[Viserion]

*.tbl files are encripted files of *.csv

*.tbl examples: https://mega.co.nz/#!dp0mAYgT!cMXrrKj6W ... CxWgU4RVqY
Encription: http://pastebin.com/ii8yW8s4
Maybe is necessary the Rijndael (setkey): http://pastebin.com/jMqNL0zV

Thanks.

[aluigi]

That key is wrong.
I have updated the script just for supporting that file when a valid key will be provided

[Viserion]

.
Hi aluigi, thanks!
But .csv is still encripted.

[aluigi]

I told you that the key in that code is wrong.
No right key = no valid csv

[Viserion]

.
Oh sorry, i understand now.
But, this key is from old source code and i tried in unpack old version of *.tbl too and same problem.

*.tbl (old version): https://mega.co.nz/#!88NFWYbT!ord9Z_bT1 ... 1A5t8KER7I
*.tbl (current version): https://mega.co.nz/#!dp0mAYgT!cMXrrKj6W ... CxWgU4RVqY

[aluigi]

That's the only key available so I can do nothing.
If you have other keys, they are welcome.

[Viserion]

.
Try unpack this old version:
https://mega.co.nz/#!88NFWYbT!ord9Z_bT1 ... 1A5t8KER7I

Client automatically converts the .csv files to .tbl

[aluigi]

Are you 100% sure that the old client uses the same key of that source code?

[Viserion]

.
Yes, I compiled Client with this key and generate *.tbl with this key.

[aluigi]

Now I found the reason, the AES source code you provided doesn't correspond to the one used in that QDataTable.cpp ("setkey" doesn't exist).
Additionally it looks like it's customized and not the standard AES (pi and pj are a custom number of cycles).

Anyway if you have the source code, why don't you just fix and recompile it?

[Viserion]

.
AES source code you found here: http://pastebin.com/jMqNL0zV

I need decompile assets from client official.

[Ekey]

del.

[Viserion]

ueni.ueni use same encript too.

[Ekey]

ueni.ueni use same encript too.

You provide only CPP source without including H files with defines. Anyway job done.

Code: Select all

[Usage]
        QQXYTBLTool <pCommand> [<pScrFile> <pDstFile>]
[Commands]
        -e - Encrypt
        -d - Decrypt
[Examples]
        QQXYTBLTool -d formula_table.tbl formula_table.csv
        QQXYTBLTool -e formula_table.csv formula_table.tbl

PS: Can you provide game link and game name?

[Viserion]

@Ekey
Thanks Ekey, is working. A question, this method works too with ueni.ueni?
Topic(have ueni.ueni example and source code of PackUI): viewtopic.php?f=9&t=243

About game -
Name: QQ西游 (or QQXY)
Web: http://qqxy.qq.com

Ragezone have old source code released.

--
I answered your pm.