Tip Top Deluxe - Dump help

[JeffMakesGames]

Hey, I got referred to here for help on this.

I tried a few file extractors like Xripper and dragon unpcker, but they can't seem to look into TipTop.dat. I assume it is the archive since it is the largest file. Both the exe and dat file is included.

http://www.jeffmakesgames.com/misc/TipTop.zip

As for what Tip Top is, it's a very old Popcap game.

[aluigi]

I'm quite sure that the obfuscation used in the whole archive is a custom bit rotation of each byte because the byte 0 remains 0.
Can you upload the executable too?
Just in case someone wants to do the job without doing tentatives by hand

[JeffMakesGames]

Sure thing!

I took both files and packed them into a zip and will update the link above.

[Ekey]

Code: Select all

char ttd_decrypt(unsigned char *pBuffer, int dwSize)
{
  unsigned char t1;
  unsigned char t2;
  unsigned char t3;
  char temp;
  char result;

  if ( dwSize )
  {
    do
    {
      t1 = *pBuffer & 0xFA | 4 * (*pBuffer & 1) | (*pBuffer >> 2) & 1;
      t2 = t1 & 0xBD | 32 * (t1 & 2) | (t1 >> 5) & 2;
      t3 = t2 & 0x77 | (t2 >> 4) & 8 | 16 * (t2 & 0xF8);
      temp = 2 * (t3 & 0x10) | (t3 >> 1) & 0x10;
      result = t3 & 0xCF;
      *pBuffer++ = result | temp;
      --dwSize;
    }
    while ( dwSize );
  }
  return result;
}

[JeffMakesGames]

Is that a bms script?

[aluigi]

Now yes:
http://aluigi.org/bms/tiptop_deluxe.bms

[JeffMakesGames]

Hmm, for some reason, the script did not work.

When trying to run it, QuickBMS says: The script has requested to load a function from the dll MEMORY_FILE10. Do you want to continue? (Y/N)

Telling it yes results in an error:

- Library MEMORY_FILE10 loaded at address 08530000

Error: The input library is handled as raw data so can't have a function name.

Last script line before the error or that produced the error:
35 call dll MEMORY_FILE10 "ttd_decrypt" "tcc" MEMORY_FILE SIZE

[aluigi]

You are using an old version of quickbms.
Latest is 0.8.1

[JeffMakesGames]

Yay! Got it! Thanks!