All resource stored in default ZIP and encrypted by XOR + CRC32. All files have extension .enc
Algo:
PHP Code:
static unsigned char szKey[128] = {
0x97, 0xC3, 0x95, 0x77, 0x2D, 0xFB, 0x45, 0x33, 0xB2, 0xDD, 0x35, 0x89,
0x22, 0x0F, 0x3F, 0x31, 0x78, 0xD2, 0x4E, 0xFC, 0x35, 0xBD, 0x47, 0x5C,
0x81, 0x99, 0x4C, 0x9B, 0xD7, 0x9F, 0x4B, 0x5A, 0xEB, 0xBE, 0x75, 0x7A,
0xE0, 0x2E, 0x43, 0x02, 0x93, 0xBF, 0x9C, 0x3B, 0xCB, 0xBA, 0x48, 0x8C,
0xF1, 0x8D, 0xF5, 0x7B, 0x78, 0x27, 0x40, 0x0E, 0xAA, 0xFC, 0x5C, 0x38,
0x74, 0x96, 0x2E, 0x3B, 0x0C, 0xC4, 0x13, 0x95, 0xF9, 0x57, 0x42, 0x29,
0xA0, 0x90, 0x8D, 0xE2, 0xA6, 0x26, 0x03, 0xA2, 0xFC, 0x63, 0xDF, 0x3D,
0x39, 0xCE, 0x4E, 0x01, 0xB8, 0xCD, 0xB8, 0xA3, 0x9E, 0xD4, 0xDC, 0x82,
0x02, 0xC0, 0xA5, 0xD8, 0xD8, 0xDB, 0x46, 0x69, 0xA8, 0x7B, 0x71, 0xE1,
0x9C, 0xB7, 0xFF, 0xF0, 0x06, 0xE6, 0x43, 0xE3, 0x2E, 0x09, 0x48, 0xEF,
0xBB, 0xBC, 0x4F, 0xE3, 0x87, 0xD9, 0xFF, 0x5F};
a1 = Calculated CRC32 hash for file namePHP Code:
#define ROL(x, n) (((x) << ((n) & 0x1F)) | ((x) >> (32-((n) & 0x1F))))
typedef unsigned char _BYTE;
int __stdcall AlvegiaDecrypt(signed int a1, int a2, int a3)
{
int v3;
int v4;
int v5;
int result;
char v7;
v3 = a3;
v4 = a2;
v5 = a1 % 8;
result = a1 & 0x7F;
while ( v3 > 0 )
{
--v3;
v7 = ROL(*(_BYTE *)v4, v5);
++result;
++v4;
*(_BYTE *)(v4 - 1) = AlvegiaKey[result] ^ v7;
if ( (unsigned int)result >= 0x80 )
result = 0;
++v5;
if ( v5 >= 8 )
v5 = 0;
}
return result;
}
a2 = Buffer
a3 = Size
How it work (Example):
Game opening file inside archive -> resources.xml.enc and eliminate extension from full filename .enc = resources.xml
Next this file name resources.xml passes through the CRC32 and calculate hash = A40D64DF
And last phase -
Maybe useful to someone and it seems nothing hardPHP Code:
AlvegiaDecrypt(0xA40D64DF,buffer,size)