Fifa Online 4

[NightfareR]

Hi and hello.

I was wondering if it would be possible to extract/decrypt/decompress the following file:

https://drive.google.com/open?id=1SlVTcblwjA25vQbZYrn5-9SOOAlMZX58

It is the fo4_ng_db.dat of Fifa Online 4 (the database file of FO4).

My guess is that it is an encrypted archive (with obfuscated header) because, usually, FIFA database is stored (10bh compression) in a big file.
I also guess that the file is crypted but am unable to sort it out.
However in FO3 the database was included in a big file together with the companion xml file.

If I am correct, fo4_ng_db.dat should contain 1 xml file (as it happens in regular FIFA, meta XML file for a t3db database) and a fo4/fifa_ng_db.db at least (probably it is called fifa_ng_db.db as in FO3 and regular FIFA versions). Although it might be possible this dat file does also include other files.

[aluigi]

It's encrypted with some 64bit block cipher algorithm without ivec like blowfish or *tea.
Not much to do without reverse engineering the executables.
And the result will have the same problems of the FO3 dat files in which the only pseudo-solution was the raw_ea10fb_dumper.bms script.

[NightfareR]

Thanks for the answer Luigi.

That pseudo-solution like for FO3 is good enough to me. No big troubles exploring to find the xml and db file by checking the extracted.

[NightfareR]

If it might help you, Luigi, Nexon korean version of FO4, does include some files like BlackCipher64.aes etc...

Let's say that if you can provide me a working decrypt+raw dump script for the FO4 database file is ok to me. No big troubles checking the files myself to find out which are the xml and db.

[aluigi]

Black Cipher is the anti-cheating system:
http://mabinogi.nexon.net/News/All/3/00G9y

[NightfareR]

Yes I know that it's the anti-cheating system but the fact that it's an aes might help for the crypted database file. This is what I meant

[aluigi]

The algorithm used on the database is not aes.

[NightfareR]

anyway I am not sure it is a crypted EA BIG file.
It is just a suspicion because they use to store the database file and xml descriptor in a big file, same for locales and xml descriptors.

[NightfareR]

Hi Luigi and sorry for the delay but am currently getting ready to move so...

However, as you were saying about the executables...

Here are the only two executables of the game:

Fifa 4 Launcher: https://drive.google.com/open?id=1WDPEHNJya8YFYJKJAJZ7Ycng5KN4lFw5

Fifa 4 ZF: https://drive.google.com/open?id=1c2kIm16d7iRNc1nD7RZEj0UGTzBK65YM

[NightfareR]

Taking a look at the same fo4_ng_db.dat file of Nexon korean version, there appears to be an archive inside the file (chunlzma).

However I am unable to extract and decompress it.

[MITA996]

I know that there is script, that can extract and decomporess. But If there is perfect script, that can extract and decomporess data big 4, I will be thankful.
Here is the link: https://drive.google.com/open?id=1vEDmD ... 31buqzxhl1

[aluigi]

@MITA996
I have moved your post in a recent topic for the same game, maybe you can find more information.
Remember to use http://aluigi.org/bms/filecutter.bms when you need to post big files like that one.

[MITA996]

@MITA996
I have moved your post in a recent topic for the same game, maybe you can find more information.
Remember to use http://aluigi.org/bms/filecutter.bms when you need to post big files like that one.

Okay master. What do now, is there a script for extracting perfect?

[aluigi]

You can do nothing if the files are encrypted and there is no decrypter provided.

[greenlemonade1]

You can do nothing if the files are encrypted and there is no decrypter provided.

Master, I noticed that not all files are exported, do you know what it's causing this?

[aluigi]

@greenlemonade1
If you are using raw_ea_10fb_dumper.bms that's normal because it's a sort of search&dump for compressed files only, so if a file is not compressed or is encrypted then it's not extracted.
There is no solution, it's just an experimental script for that purpose.

[Skoczek]

Did something change in last 15 months? Or still we aren't able to decrypt that db?