Thread: ArcheAge DB Decrypting

Here's an updated QuickBMS script.
I tried it using on Chinese ArcheAge but failing badly tho.

Code:

# Archeage (script 0.3.1a)
# script for QuickBMS http://quickbms.aluigi.org
 
math SIZE = 0x200
goto 0 0 SEEK_END
savepos OFFSET
math OFFSET -= SIZE
callfunction DECRYPT 1
 
idstring MEMORY_FILE "WIBO"
get DUMMY long MEMORY_FILE
get FILES long MEMORY_FILE
get EXTRA_FILES long MEMORY_FILE
get DUMMY long MEMORY_FILE
get DUMMY long MEMORY_FILE
get DUMMY long MEMORY_FILE
get DUMMY long MEMORY_FILE
print "Files:              %FILES|x%"
print "Extra files:        %EXTRA_FILES|x%"
 
math SIZE = FILES
math SIZE += EXTRA_FILES
math SIZE *= 0x150
goto 0 0 SEEK_END
savepos INFO_OFF
math INFO_OFF -= 0x200
for INFO_OFF -= SIZE >= 0
    if INFO_OFF % 0x200
        math INFO_OFF -= 0x10
    else
        break
    endif
next
print "FileTable offset:   %INFO_OFF|x%"
 
for i = 0 < FILES
    math SIZE = 0x150
    math OFFSET = INFO_OFF
    callfunction DECRYPT 1
    math INFO_OFF += 0x150
 
    getdstring NAME 0x108 MEMORY_FILE
    get OFFSET longlong MEMORY_FILE
    get SIZE longlong MEMORY_FILE
    get XSIZE longlong MEMORY_FILE  # used for encryption alignment?
    get ZSIZE long MEMORY_FILE      # ???
    getdstring DUMMY 16 MEMORY_FILE
    get DUMMY1 long MEMORY_FILE
    get TIMESTAMP longlong MEMORY_FILE
    get TIMESTAMP longlong MEMORY_FILE
    get DUMMY2 longlong MEMORY_FILE
 
    log NAME OFFSET SIZE            # don't use clog for the moment
    encryption "" ""
next i
 
startfunction DECRYPT
    encryption aes_128_cbc "\x32\x1F\x2A\xEE\xAA\x58\x4A\xB4\x9A\x6C\x9E\x09\xD5\x9E\x9C\x6F"
    log MEMORY_FILE OFFSET SIZE
    encryption "" ""
endfunction