GunZ the Duel (PC) - *.mrs

[AnonBaiter]

Here are the samples.

[aluigi]

It looks like the obfuscation algorithm or the lookup table have been changed
https://forum.xentax.com/viewtopic.php?p=41566#p41566
https://forum.xentax.com/viewtopic.php?f=21&t=5899

I made even a test script on the fly to be sure that wasn't a bug and the result is wrong:

Code: Select all

quickbmsver "0.8.0"
set MEMORY_FILE10 binary "

    void msf_decrypt(unsigned char *data, int FileSize, unsigned char *table) {
        unsigned int    EAX, EBX;
        unsigned char   AL, CL;

        EAX = FileSize -1;

        while(EAX)
        {
          CL = data[EAX -1];
          CL >>= 1;
          EBX = EAX & 0xFFFF;
          CL ^= table[EBX];
          data[EAX] ^= CL;
          EAX--;
        }

        AL = data[FileSize -1];
        AL >>= 1;
        AL ^= table[0];
        AL ^= data[0]; // AL is now 0x00
        data[0] = AL;
    }
"

set TABLE compressed "eNrEXMMaKMwOO+c/tm3btm3btm3btm3btm3b9r1ZdJNNF130DaZpZ742yXTWoOibkqdfdal4+VP1fz3qvjRPkr1Rxk4N0+Xt1zZH6xS5W/raucr/Gvd+Ni9w7GGpt63L/LJDi481Dt4skGPhzgQjI4SYmGbr2ixzg8QZ+rdJn6dlrp6tMip88EnZF+2KX/3Qrfyv2jf/1ODnwx4XS1Q4uTFFhpUBZw6Mcax24Xud331rHXnctNDLcifeV/PAjYIvOrb8MCJiyAk5F+xI+LtZv8flLp+ulm7z6myzg8UbHHXMlLBL8ibdc6Ru0Ttd33xpuz5VpuWBpveP1ej7/V7nS1U63u3153aH6xW7vThfst3RRk8Od6FkxRMNfzzo+d+MATE3pMy4Itf87YmGRwo1/nmnVu9r7b9eaE7QuEPSblmTteyVM1X/NO37BGfC2XBGnBVnwtlwRpwVMSE2xIhYERNiQ4yIFZgAG2AErIAJsAFGwAqYAltgHOD/WANTYAuMgTXOhLPhjDgrzoSz4Yw4K2JCbIgRsSImxIYYESswATbACFgBE2ADjIAVMAW2wBhYA1NgC4yBteAkuAmOgqvgJLgJjoKr5EnyJnmUvEqeJG+SR8mr1InUjdSR1JXUidSN1JHUldSp1K3UMbAG5lKnUrdSx1LXgpPgJjgKroKT4CY4Cq6SJ8mb5FHyKnmSvEkeJa9SJ1I3UkdSV1InUjdSR1JXUqdSt1LHUtdSp1K3UsdS14HnDYu9LXXmdddKVz7X+N+z3gtzJNgZYeTEEB1efmxxsEaBm8UvnSr/q373R7MCRB+UfNOq9G+7tPla5+jdInmW7k0yNkqYqSk2rswwM2CMgT8b9HhY4uLJCuMih56We9m+xLWP3Sv8rnPrb03+Pu1ztUyVs1vTZFkbZO7QOIeq57/V/tWn5uFHTQq+KHv8XXWP3Cn6pmvbL2Oihp2Sd8mepN8b9bpf6vzxSqnWL880PVCs/hFHTAi5IGfCHQdqFrzR8cWHlpvTZVsdbPbgeM1+P+53uVy1052ev2+1v1ah6/NzJdoeafj4UFfKVj3T9M+TvkHnDIm7JW3WNfkW7042Olq4ya+7tftc7/DtYjP+izkg5YYVGUteOFHxR8OeD3AmnA1nxFlxJpwNZ8RZERNiQ4yIFTEhNsSIWIEJsAFGwAqYABtgBKyAKbAFxsAamAJbYAyscSacDWfEWXEmnA1nxFkRE2JDjIgVMSE2xIhYgQmwAUbACpgAG2AErIApsAXGwBqYAltgDKwFJ8FNcBRcBSfBTXAUXCVPkjfJo+RV8iR5kzxKXqVOpG6kjqSupE6kbqSOpK6kTqVupY6lrqVOpW6ljqWuBSfBTXAUXAUnwU1wFFwlT5I3yaPkVfIkeZM8Sl6lTqRupI6krqROpG6kjqSupE6lbqWOpa6lTqVupY6lroNPGhV+V/zsi27lr36o+adX7ddmSbM1ztC5Qfo8/dvkbJUyVwvfO1b7W+vO76aFjjwu8b5luR/2aPCzwsmLJTKs3JhiYIyAM5PsXZpnapgoY7+26fK2yN2jdQZFDzAr/apNycufulT8Uff6v1p8fNnhZoEaB3cmyLEwxMSREc5VLn2t97N/jWMPmxd4XebU2yqeuFDyQc+GPwbE/G9GxhUbUn5u1+11sduH6yXbvTjf5HDRRscdMifomqxpt5ypWvZK3yd/mm5PlGt+qPHDI7V6/7zT9UK19vd7/LvZ6WrlLq/Olm5zvMGzg90oWPNAyw8vOoacMCLijoQ5F2Ravj5V/1iBpt/v1eh7pePnS00JG3VM0j1L8ha9c6Tul7Zd3+BMOBvOiLPiTDgbzoizIibEhhgRK2JCbIgRsQITYAOMgBUwATbACFgBU2ALjIE1MAW2wBhY40w4G86Is+JMOBvOiLMiJsSGGBErYkJsiBGxAhNgA4yAFTABNsAIWAFTYAuMgTUwBbbAGFgLToKb4Ci4Ck6Cm+AouEqeJG+SR8mr5EnyJnmUvEqdSN1IHUldSZ1I3UgdSV1JnUrdSh1LXUudSt1KHUtdC06Cm+AouApOgpvgKLhKniRvkkfJq+RJ8iZ5lLxKnUjdSB1JXUmdSN1IHUldSZ1K3UodS11LnUrdSh1LXYeeNi7yvsS5l90rXPtY62/vOq/MkGJjjIEzA/Z4+LPByQolLua/daj6p+btX00KHn5U/F2Lsj/t0+RvlbNXy2RZuzXN0DhB5ibYuTDHxBARRn5s0eFlgZsHawyLHXhe5nXbUlc+d630s96N/7X5+rbL3SJ1ju5NkmdpmKljo5wqX/xS90e/6kcfNCvAqvTJN1U9c6Xsk75N/wyJG3RO1jVb0r5v1el5oev7ayXaPj/X+FCRhsccMOO/FRlTbjhRseSFng9+NNydLN/icJNHR2v3+XW328XqHe51/3uj45VKnV+eKdX6WP2nB7pTtO6Rtl/edA07ZUzUPUnzLsm2enO6wfGCzX7cr9nvaqcvl5sQMuKIhDsW5Cx440DNDy07vsCZcDacEWfFmXA2nBFnRUyIDTEiVsSE2BAjYgUmwAYYAStgAmyAEbACpsAWGANrYApsgTGwxplwNpwRZ8WZcDacEWdFTIgNMSJWxITYECNiBSbABhgBK2ACbIARsAKmwBYYA2tgCmyBMbAWnAQ3wVFwFZwEN8FRcJU8Sd4kj5JXyZPkTfIoeZU6kbqROpK6kjqRupE6krqSOpW6lTqWupY6lbqVOpa6FpwEN8FRcBWcBDfBUXCVPEneJI+SV8mT5E3yKHmVOpG6kTqSupI6kbqROpK6kjqVupU6lrqWOpW6lTqWutb6K60/0/orrT/T+kutP9X6S60/1forrT/T+iutP9P6S60/1fpLrT/V5ittPtPmK20+0+ZLbT7V5kttPtXmK20+0+YrbT7T5kttPtXmS20+1fgVjZ/R+BWNn9H4JY2f0vgljZ/S+BWNn9H4FY2f0fgljZ/S+CWNn9L4VY2f1fhVjZ/V+OUACj+t8csaP63xqxo/q/GrGj+r8csaP63xyxo/rfVXWn+m9Vdaf6b1l1p/qvWXWn+q9Vdaf6b1V1p/pvWXWn+q9Zdaf6rNV9p8ps1X2nymzZfafKrNl9p8qs1X2nymzVfafKbNl9p8qs2X2nyq8SsaP6PxKxo/o/FLGj+l8UsaP6XxKxo/o/ErGj+j8UsaP6XxSxo/pfGrGj+r8asaP6vxyxo/rfHLGj+t8asaP6vxqxo/q/HLGj+t8csaP23lr6z8mZW/svJnVv7Syp9a+Usrf2rlr6z8mZW/svJnVv7Syp9a+Usrf2rVr6z6mVW/supnVv3Sqp9a9UurfmrVr6z6mVW/supnVv3Sqp9a9Uurfmr1r1j9M1b/itU/Y/UvWf1TVv+S1T9l9a9Y/TNW/4rVP2P1L1n9U1b/ktU/ZfWvWv2zVv+q1T9r9S8HMPqnrf5lq3/a6l+1+met/lWrf9bqX7b6p63+Zat/2spfWfkzK39l5c+s/KWVP7Xyl1b+1MpfWfkzK39l5c+s/KWVP7Xyl1b+1KpfWfUzq35l1c+s+qVVP7Xql1b91KpfWfUzq35l1c+s+qVVP7Xql1b91OpfsfpnrP4Vq3/G6l+y+qes/iWrf8rqX7H6Z6z+Fat/xupfsvqnrP4lq3/K6l+1+met/lWrf9bqX7b6p63+Zat/2upftfpnrf5Vq3/W6l+2+qet/mWrf9rbf+XtP/P2X3n7z7z9l97+U2//pbf/1Nt/5e0/8/ZfefvPvP2X3v5Tb/+lt//U+/+V9/8z7/9X3v/PvP9fev8/9f5/6f3/1Pv/lff/M+//V97/z7z/X3r/P/X+f+n9/9R7/4r3/hnv/Sve+2e89y9575/y3r/kvX/Ke/+K9/4Z7/0r3vtnvPcvee+f8t6/5L1/ynv/qvf+We/9q977Z733Lwdw3j/tvX/Ze/+09/5V7/2z3vtXvffPeu9f9t4/7b1/2Xv/tLf/ytt/5u2/8vafefsvvf2n3v5Lb/+pt//K23/m7b/y9p95+y+9/afe/ktv/6n3/yvv/2fe/6+8/595/7/0/n/q/f/S+/+p9/8r7/9n3v+vvP+fef+/9P5/6v3/0vv/qff+Fe/9M977V7z3z3jvX/LeP+W9f8l7/5T3/hXv/TPe+1e8989471/y3j/lvX/Je/+U9/5V7/2z3vtXvffPeu9f9t4/7b1/2Xv/tPf+Ve/9s977V733z3rvX/beP+29f9l7/zTfN76PfN/4PvJ94/vI943vI783/B7xe8PvEb83/B7xe8PvEd83vo983/g+8n3j+8j3je8jvzf8HvF7w+8Rvzf8HvF7w+8R3ze+j3zf+D7yfeP7yPeN7yO/N/we8XvD7xG/N/we8XvD7xHfN76PfN/4PvJ94/vI943vI783/B7xe8PvEb83/B7xe8PvEffb3I9zv839OPfb3I9zv839OM8bPI/wvMHzCM8bPI/wvMHzCPfb3I9zv839OPfb3I9zv839OM8bPI/wvMHzCM8bPI/wvMHzCPfb3I9zv839OPfb3I9zv839OM8bPI/wvMHzCM8bPI/wvMHzCPfb3I9zv839OPfb3I9zv839OM8bPI/wvMHzCM8bPI/wvMHzCPNtzMcx38Z8HPNtzMcx38Z8HPONzEcy38h8JPONzEcy38h8JPNtzMcx38Z8HPNtzMcx38Z8HPONzEcy38h8JPONzEcy38h8JPNtzMcx38Z8HPNtzMcx38Z8HPONzEcy38h8JPONzEcy38h8JPNtzMcx38Z8HPNtzMcx38Z8HPONzEcy38h8JPONzEcy38h8JOttrMex3sZ6HOttrMex3sZ6HOuNrEey3sh6JOuNrEey3sh6JOttrMex3sZ6HOttrMex3sZ6HOuNrEey3sh6JOuNrEey3sh6JOttrMex3sZ6HOttrMex3sZ6HOuNrEey3sh6JOuNrEey3sh6JOttrMex3sZ6HOttrMex3sZ6HOuNrEey3sh6JOuNrEey3sh6pNZfaf2Z1l9p/ZnWX2r9qdZfav2p1l9p/ZnWX2n9mdZfav2p1l9q/ak2X2nzmTZfafOZNl9q86k2X2rzqTZfafOZNl9p85k2X2rzqTZfavOpxq9o/IzGr2j8jMYvafyUxi9p/JTGr2j8jMavaPyMxi9p/JTGL2n8lMavavysxq9q/KzGL2v8tMYva/y0xq9q/KzGr2r8rMYva/y0xi9r/LTWX2n9mdZfaf2Z1l9q/anWX2r9qdZfaf2Z1l9p/ZnWX2r9qdZfav2pNl9p85k2X2nzmTZfavOpNl9q86k2X2nzmTZfafOZNl9q86k2X2rzqcavaPyMxq9o/IzGL2n8lMYvafyUxq9o/IzGr2j8jMYvafyUxi9p/JTGr2r8rMavavysxi9r/LTGL2v8tMavavysxq9q/KzGL2v8tMYva/y0lb+y8mdW/srKn1n5Syt/auUvrfyplb+y8mdW/srKn1n5Syt/auUvrfypVb+y6mdW/cqqn1n1S6t+atUvrfqpVb+y6mdW/cqqn1n1S6t+atUvrfqp1b9i9c9Y/StW/4zVv2T1T1n9S1b/lNW/YvXPWP0rVv+M1b9k9U9Z/UtW/5TVv2r1z1r9q1b/rNW/bPVPW/3LVv+01b9q9c9a/atW/6zVv2z1T1v9y1b/tJW/svJnVv7Kyp9Z+Usrf2rlL638qZW/svJnVv7Kyp9Z+Usrf2rlL638qVW/supnVv3Kqp9Z9UurfmrVL636qVW/supnVv3Kqp9Z9UurfmrVL636qdW/YvXPWP0rVv+M1b9k9U9Z/UtW/5TVv2L1z1j9K1b/jNW/ZPVPWf1LVv+U1b9q9c9a/atW/6zVv2z1T1v9y1b/tNW/avXPWv2rVv+s1b9s9U9b/ctW/7S3/8rbf+btv/L2n3n7L739p97+S2//qbf/ytt/5u2/8vafefsvvf2n3v5Lb/+p9/8r7/9n3v+vvP+fef+/9P5/6v3/0vv/qff/K+//Z97/r7z/n3n/v/T+f+r9/9L7/6n3/hXv/TPe+1e8989471/y3j/lvX/Je/+U9/4V7/0z3vtXvPfPeO9f8t4/5b1/yXv/lPf+Ve/9s977V733z3rvX/beP+29f9l7/7T3/lXv/bPe+1e9989671/23j/tvX/Ze/+0t//K23/m7b/y9p95+y+9/afe/ktv/6m3/8rbf+btv/L2n3n7L739p97+S2//qff/K+//Z97/r7z/n3n/v/T+f+r9/9L7/6n3/yvv/2fe/6+8/595/7/0/n/6v2LuQAAAAABA0P7UYwRS2l9qf6r/Ff3P6H9F/zP6X9L/lP6X9D+l/xX9z+h/Rf8z+l/S/5T+l/Q/pf9V/c/qf1X/s/pf1v+0/pf1P63/Vf3P6n9V/7P6X9b/tP6X9T/dw0SHcg=="

get SIZE asize
log MEMORY_FILE 0 SIZE
calldll MEMORY_FILE10 "msf_decrypt" "tcc" RET MEMORY_FILE SIZE TABLE
get NAME basename
string NAME + ".zip"
log NAME 0 SIZE MEMORY_FILE

[AnonBaiter]

The output is garbled.

Do you want me to upload the rest of the files that aren't .mrs files at all? Perhaps there is a hint as to how the files were encrypted in some way.

[aluigi]

I think the best way is someone working with the whole game and a debugger

[AnonBaiter]

I doubt I can run even that on my VM machine...