[PC] Hyper Universe Online

[LDSTD]

I think this post related to viewtopic.php?f=9&t=3402

Homepage : http://hu.nexon.com/Main/Index

download : http://www.mediafire.com/file/yr84mo41h ... -+Copy.rar

I think this files are just normal unity assets but I can't find any texture of models.

I need help : (

[chrrox]

They are encrypted.
This might help.
https://www.sendspace.com/file/8juar1

[chrrox]

not sure if this helps but I know this seems to pop up every where with this archive here
https://www.sendspace.com/file/x2nrnz

89ab2c01f06c64b48876e7c150221f07

this might be the aes key
according to the decryption it should be

aesManaged.BlockSize = 128;
aesManaged.KeySize = 128;
aesManaged.Mode = CipherMode.CBC;
aesManaged.Padding = PaddingMode.PKCS7;

here is a dump from ram looks like lzma?
https://www.sendspace.com/file/psd62c

[chrrox]

The files just have the first x bytes of the compressed section xored.
The xor key is the costumes name.
the file name is got from the model name also.
they jsut add some extra bytes like a checksum or something into the name.

[OriginOfWaves]

The files just have the first x bytes of the compressed section xored.
The xor key is the costumes name.
the file name is got from the model name also.
they jsut add some extra bytes like a checksum or something into the name.

could you explain this process a bit more? how to figure out witch bytes are xored and which costume name is used for which file?

[gorodork]

The files just have the first x bytes of the compressed section xored.
The xor key is the costumes name.
the file name is got from the model name also.
they jsut add some extra bytes like a checksum or something into the name.

I'm also interested in this procedure. Could you explain a little more please?

[kurupeko100]

The files just have the first x bytes of the compressed section xored.
The xor key is the costumes name.
the file name is got from the model name also.
they jsut add some extra bytes like a checksum or something into the name.

Hello, I need ur help
I have found the xored bytes ur talking about but I don't know how to get the xor key.
The costumes name you are talking about, I can't find it.
I am attaching the 2 example files I am trying to decrypt.
https://drive.google.com/file/d/1-qLdlp ... sp=sharing
I noticed that some files are related. See, these two files Im giving you have this: ?azgoka_ after the xored bytes


In short, I need ur help to find the xor key
Thank u a lot

[chrrox]

those are not xored bytes.
that is just the cab name.
the ? part you have underlined is what needs to be xored.
here are the costume names for the bazooka character.
Bazooka_S2
Bazooka_S1
Bazooka_C1
Bazooka
It will be one of those keys.
Here is a list of strings to look for costume names in.
https://pastebin.com/Y7hykmxy

[kurupeko100]

those are not xored bytes.
that is just the cab name.
the ? part you have underlined is what needs to be xored.
here are the costume names for the bazooka character.
Bazooka_S2
Bazooka_S1
Bazooka_C1
Bazooka
It will be one of those keys.
Here is a list of strings to look for costume names in.
https://pastebin.com/Y7hykmxy

I still haven't managed to make it. I attached this example file at the bottom of the post so you can download it
Sorry, I am very new at this. Here is what I am trying to do. Please tell me if something is wrong.
First I look for a character in the Pastebin you gave me. For this example I'm taking "TutorialGirl".



Now I do a file search with the last 3 digits from the reference on the pastebin, in the folder which has 506 encrypted files, like so:


I believe those 3 last digits point to the right file, but I'm not sure.

Now, supposing the xor key can be one of these:
TutorialGirl, TutorialGirl_C1, TutorialGirl_S1, or TutorialGirl_S2.

This is how I replace the xored bytes. I'm sure doing it wrong.

I have tried using this website I'm linking, and another one, but they haven't worked:
https://www.dcode.fr/xor-cipher

First I copy the hex value and then paste it on the website.




I follow those steps and get another hex value which I then paste in the hex editor.



Next, I save the file and open it with UABE.



I have tried all possible TutorialGirl, TutorialGirl_C1... combinations but I always get the error.

So to recap, the things I might be doing wrong are:
1. This "last 3 digit search" I am doing is wrong and doesnt point to the right file.
2. I am not choosing the right xored bytes.
3. I am not calculating well with the xor key, or the website doesn't work and I'm supposed to use other tools.
4. I am a noob

Thanks very much, a lot for ur help. And your patience.

The file is below. Also, here is the full game if you need to download it (3GB): https://drive.google.com/file/d/1UfnU6F0h1VCT0wu8zcEAczfyzSG4oHm0/view?usp=sharing

[chrrox]

you need to look at the file and search for the matching string.
in your example
,uemnofw
is the model
QueenOfWar
you need to lower case the model name
queenofwar
You can get the start of the model name by xoring the first 8 bytes of the name with
5D 00 00 08 00 00 00 00

[kurupeko100]

OK! I understand now. I would have never figured it out. You are an absolute genius, man
THANK YOU SO MUCH!

[gorodork]

I still can't get anything, what should I do after the XOR? Because in the end I just have a dead type of file that can't be extracted with any Unity Asset Extractor.

you need to look at the file and search for the matching string.
in your example
,uemnofw
is the model
QueenOfWar
you need to lower case the model name
queenofwar
You can get the start of the model name by xoring the first 8 bytes of the name with
5D 00 00 08 00 00 00 00

Edit: OK! After a few hours trying to understand this stuff, I'm starting to comprehend it!
How do you know how to identify each file? Where did you find that ",uemnofw" equals "QueenOfWar"? And why did you XORed 10 bytes instead of 8?

[joeyq1]

Could anyone post a quick tutorial with steps on how to do this, or maybe a quickbms file which does this automatically? Thanks in advance!

[gorodork]

Could anyone post a quick tutorial with steps on how to do this, or maybe a quickbms file which does this automatically? Thanks in advance!

Sure, you are going to need a hex editor and a XOR cipher. All the files inside the 0000 folder (probably) are unity assets and each one of them contains textures, 3d objects and animations of a specific hyper, but they are encripted and the character name was used as a key to do it.

The file we are going to use is abf44elykkwraeind2fde4d9d8c85a98d0956db520 because chrrox already told us previously that is the Queen of War file (athena). I don't know how to identify it by just looking at the hex information.

Now we need the confirmation that "queenofwar" is the correct key for this file and to do it we are going to XOR the first 8 bytes with the key (in this case "queenofwar" is the key) and see the result.

The first step is to open the abf44 file in hex editor and copy the first 8 bytes of this section


1 - paste the data in the https://www.dcode.fr/xor-cipher
2 - select ASCII key
3 - copy queenofwar and paste in it
4 - select result format in hexadecimal
5 - hit encrypt/decrypt
6 - copy the result of the XOR


That would be the correct file name but before we paste it back into the abf44 file we are going to confirm it by making another XOR.
1 - paste the result of the previous step in the INPUT II XOR calculator http://xor.pw/#
2 - go back into the abf44 file and copy again the first 8 bytes and paste int the INPUT I and hit Calculate XOR
3 - copy the result


Now you paste the result in the same section you first copied in the abf44 file, if it appears the correct name then you used the correct key


With that confirmation you just need to copy again the result in the second step and paste it in the abf44, but there is a catch! Instead of 8 bytes you need to copy the first 10 bytes, xor them and paste it back! This would be the correct file:


Now save it and you can use Asset Studio V.0.14 to open/extract the content


I added the encrypted and unencrypted files in the attachments so other people can try to reproduce the extraction. And I still don't know how to identify the characters by just looking at the hex information and there is a lot of hypers so I can't manually test the xor keys one by one until I find the correct one.

[chrrox]

You can get the start of the model name by xoring the first 8 bytes of the name with
5D 00 00 08 00 00 00 00

then search the string list to find the name.

[gorodork]

You can get the start of the model name by xoring the first 8 bytes of the name with
5D 00 00 08 00 00 00 00
then search the string list to find the name.

Right! Thanks!

Well, after using this method I found out that the 1eb5d484cdf9c2ywr1hf1qho3effde9ac45f00def85 file its from the Kunoichi hyper.
After trying to XOR the first 8 bytes with kunoichi, kunoichi_c1 and kunoichi_s1, none of them worked so far.

What I'm doing wrong? The name lenght dictates how many bytes do I XOR? I tried that but it didn't work too.

[chrrox]

its kunoichi_c2

[einherjar007]

You can get the start of the model name by xoring the first 8 bytes of the name with
5D 00 00 08 00 00 00 00
then search the string list to find the name.

Right! Thanks!

Well, after using this method I found out that the 1eb5d484cdf9c2ywr1hf1qho3effde9ac45f00def85 file its from the Kunoichi hyper.
After trying to XOR the first 8 bytes with kunoichi, kunoichi_c1 and kunoichi_s1, none of them worked so far.

What I'm doing wrong? The name lenght dictates how many bytes do I XOR? I tried that but it didn't work too.

try kunoichi_c2. I can get a correct result.

It's interesting, so I download client data and try XOR.
ex, 0a3ec1bd05b28d335niwt3isn1ihfq0j4fed90aca3327951 is grandpatriach_s1.

but 0aaxrpknc16330f9a907665ec2fad88f2e8dc is probably filename(key)'s "boxer", but XOR did not give correct results.
Does the algorithm change depending on the length of the file name?

If we can play the game at least, can get the header by memory dump...

*EDIT
sorry, that is my misunderstanding. XOR is valid even for short strings.

[joeyq1]

I'm confused, do you have to dive inside each of the files in '0000' with a hex editor to figure out which character or object it is or can you see from the filename itself?
For example if I want 'Hero/SuperRobot' from the list of strings found in https://pastebin.com/Y7hykmxy
How do I find the corresponding file in '0000' folder?

Edit: Also, how did you find 'kunoichi_c2', it was not in the list. was it guesswork or is there a more complete list?

[gorodork]

try kunoichi_c2. I can get a correct result.

It's interesting, so I download client data and try XOR.
ex, 0a3ec1bd05b28d335niwt3isn1ihfq0j4fed90aca3327951 is grandpatriach_s1.

but 0aaxrpknc16330f9a907665ec2fad88f2e8dc is probably filename(key)'s "boxer", but XOR did not give correct results.
Does the algorithm change depending on the length of the file name?

If we can play the game at least, can get the header by memory dump...

*EDITsorry, that is my misunderstanding. XOR is valid even for short strings.

But there isnt any "kunoichi_c2" in the string list, how did you knew that was the key? And yes, looks like you need to XOR bytes with the same lenght of the character name. If the name have 5 bytes, you XOR 5 bytes, if its 10 bytes you XOR 10 bytes, etc.

I'm confused, do you have to dive inside each of the files in '0000' with a hex editor to figure out which character or object it is or can you see from the filename itself?
For example if I want 'Hero/SuperRobot' from the list of strings found in https://pastebin.com/Y7hykmxy
How do I find the corresponding file in '0000' folder?

Yes, you have to search the file names one by one in the 0000 folder, using hex editor and XORing the names with "5D 00 00 08 00 00 00 00" to discover the real name. I'm manually identifying the files and I found three superrobot files, they are:

5beda22aed43f2bc75bd7cb78950y3knnrxrsqhjb19c5
9a5902cf22c200ac5f19522b8ae0y3knnrxrsqhoc82b3
0881e40y3knnrxrs3d524bfcb54674f7dbf86c7629