Victim: here
Format: SAI
So we have 2 files:
1) Datas.sai - FileTable where contained info about Offset's, Size's, FileNames .ect. (Encrypted)
2) Datas.sac - Main archive where contained game resource's. (Not Encrypted) - You can use any ripper to get files.
FileTable divided into 2 blocks.
1st block - Index where contained info (Offset's , Size's, CRC and other)
2nd block - FileNames strings.
Structure :
Full Header Size = 16 Bytes
What next. We need decrypt 1st block. How :Code:4 Bytes - SDO\x00 4 Bytes - TotalFiles inside main archive 4 Bytes - 2nd Block Size 4 Bytes - Nulls
Offset: 0x10
Size: 2971750 (FileSize) - 16 (Header) - 1911206 (2nd Block Size) = 1060528
Now decrypt 2nd block.
Offset: 2971750 (FileSize) - 16 (Header) - 1911206 (2nd Block Size) = 1060528
Size: 2nd Block Size
Algo is very simple
szKey -> 0x7C53F961uPHP Code:
int __cdecl SAI_Decrypt(unsigned int szKey, int szBuffer, unsigned int szBlockSize)
{
int result;
int i;
if ( szKey )
{
result = szBuffer;
for ( i = szBuffer; i < szBlockSize; ++i )
{
szKey *= 15625;
*(BYTE *)i -= szKey >> 16;
result = i + 1;
}
}
return result;
}
Example Use:
Now you can use FileTable for extract game resource's with normal filenamesPHP Code:
SAI_Decrypt(0x7C53F961,(int)buffer, (int)buffer + size);
Test Project Attached (Original FileTable + Decrypted included).
Please register or login to download attachments.