Vindictus KR server has new hfs format

[LightXPS]

Same applied to the old HFS files.

If anyone is well versed in reversing encryption schemes, help would be much appreciated.

After about 5 months of thinking, it could be that I've found a different method:

I went on a quick google trip today in the morning and found out that the AES encrpytion (which Vindictus uses) can also be reversed with a small program which is called AES Crypt. This program does not only encrypt files with the AES encryption, but is also capable of decrypting them.

Now the question is: What kind of AES encryption is used (as the .aes file extension is missing)? And can the linked program crack it?

By the way: I found out somewhere else that this game runs on a modified version of Valve's Source Engine. Can this be another possible starting point?

[tschumann]

After about 5 months of thinking, it could be that I've found a different method:

I went on a quick google trip today in the morning and found out that the AES encrpytion (which Vindictus uses) can also be reversed with a small program which is called AES Crypt. This program does not only encrypt files with the AES encryption, but is also capable of decrypting them.

Now the question is: What kind of AES encryption is used (as the .aes file extension is missing)? And can the linked program crack it?

By the way: I found out somewhere else that this game runs on a modified version of Valve's Source Engine. Can this be another possible starting point?

Maybe - it looks like AES's only parameter is the key (which I guess is somewhere in the Vindictus code) but I'm not sure if the files are AES encrypted or the files are container formats with AES encrypted data.

The Source engine doesn't have any built-in encryption for archive files by default - some script files can be encrypted but that is it.

[Yretenai]

After about 5 months of thinking, it could be that I've found a different method:

I went on a quick google trip today in the morning and found out that the AES encrpytion (which Vindictus uses) can also be reversed with a small program which is called AES Crypt. This program does not only encrypt files with the AES encryption, but is also capable of decrypting them.

Now the question is: What kind of AES encryption is used (as the .aes file extension is missing)? And can the linked program crack it?

By the way: I found out somewhere else that this game runs on a modified version of Valve's Source Engine. Can this be another possible starting point?

Maybe - it looks like AES's only parameter is the key (which I guess is somewhere in the Vindictus code) but I'm not sure if the files are AES encrypted or the files are container formats with AES encrypted data.

The Source engine doesn't have any built-in encryption for archive files by default - some script files can be encrypted but that is it.

Vindictus heavily modified the source engine. It had encryption before, but they just doubled down on it. The IV on AES can change as well, but I don't think they did in this case.

[LightXPS]

Maybe - it looks like AES's only parameter is the key (which I guess is somewhere in the Vindictus code) but I'm not sure if the files are AES encrypted or the files are container formats with AES encrypted data.

The Source engine doesn't have any built-in encryption for archive files by default - some script files can be encrypted but that is it.

If I remember correctly, the hfs file format is some kind of an archive format, much like rar or 7z. Unfortunately, 7Zip can't open the files with the message that they can't be opened as an archive. So, we've got a kind of archive a normal unzipper can't open.

Vindictus heavily modified the source engine. It had encryption before, but they just doubled down on it. The IV on AES can change as well, but I don't think they did in this case.

I went down the road and explored the game files a bit more. There, a folder named "BlackCipher" crossed my view - and some of those files have some kind of AES encryption. Maybe we'll find the solution in this folder? If there's need, I can pack all the AES iles in a 7z archive and place it somewhere. It also looks like this BlackCipher is some kind of anti-cheat tool which MAY be blocking our path to unpack the hfs files as well. There are two more files right in the main folder (where the Vindictus.exe lies) of the game, which also seem to have something to do with the Nexon Launcher that comes with the game - and those are AES ecrypted as well.

[Yretenai]

If I remember correctly, the hfs file format is some kind of an archive format, much like rar or 7z. Unfortunately, 7Zip can't open the files with the message that they can't be opened as an archive. So, we've got a kind of archive a normal unzipper can't open.

Closest thing I can describe HFS as is an encrypted, modified ZIP format. Required special tooling for this reason. The "Old" one worked like that, the "new" one I have very little idea about it. It's encrypted from start to finish.

I went down the road and explored the game files a bit more. There, a folder named "BlackCipher" crossed my view - and some of those files have some kind of AES encryption. Maybe we'll find the solution in this folder? If there's need, I can pack all the AES iles in a 7z archive and place it somewhere. It also looks like this BlackCipher is some kind of anti-cheat tool which MAY be blocking our path to unpack the hfs files as well. There are two more files right in the main folder (where the Vindictus.exe lies) of the game, which also seem to have something to do with the Nexon Launcher that comes with the game - and those are AES ecrypted as well.

BlackCipher is one of the three anti-cheats that NEXON uses, not related to the game archives. All of their games have it.

[LightXPS]

If I remember correctly, the hfs file format is some kind of an archive format, much like rar or 7z. Unfortunately, 7Zip can't open the files with the message that they can't be opened as an archive. So, we've got a kind of archive a normal unzipper can't open.

Closest thing I can describe HFS as is an encrypted, modified ZIP format. Required special tooling for this reason. The "Old" one worked like that, the "new" one I have very little idea about it. It's encrypted from start to finish

In this case, I'll have to leave the field to the coding experts - absolutely clueless here.

I also thought of getting an old version of the game to get the stuff I need, but I don't know if the stuff's in there... Would it be helpful if I link an older version with the "old" hfs files, to get a clue on what of the encryption changed?

[Yretenai]

In this case, I'll have to leave the field to the coding experts - absolutely clueless here.

I also thought of getting an old version of the game to get the stuff I need, but I don't know if the stuff's in there... Would it be helpful if I link an older version with the "old" hfs files, to get a clue on what of the encryption changed?

Maybe. My extraction program for the old HFS formats is open source, I can't say if the format changed much since it's encrypted.

[LightXPS]

Maybe. My extraction program for the old HFS formats is open source, I can't say if the format changed much since it's encrypted.

Then, here's what I found: Vindictus v1.69 from the Windictus private server

Also, there seems to be a new wiki from XenTax where a new article about this format was written. Interestingly, the last edit on that article was made on April 4, 2021 so someone might have to check if the article reflects the current state of the hfs file format. If it does, does it help with busting the encryption? Here's the link: Vindictus HFS article

[Yretenai]

Maybe. My extraction program for the old HFS formats is open source, I can't say if the format changed much since it's encrypted.

Then, here's what I found: Vindictus v1.69 from the Windictus private server

Also, there seems to be a new wiki from XenTax where a new article about this format was written. Interestingly, the last edit on that article was made on April 4, 2021 so someone might have to check if the article reflects the current state of the hfs file format. If it does, does it help with busting the encryption? Here's the link: Vindictus HFS article

Format on the wiki is still the old format, someone just added it to the XOR Encryption category and renamed the article.

[tschumann]

Format on the wiki is still the old format, someone just added it to the XOR Encryption category and renamed the article.

Is some of the information still relevant?

[Yretenai]

Format on the wiki is still the old format, someone just added it to the XOR Encryption category and renamed the article.

Is some of the information still relevant?

No

[namvail1234]

so the situation right now is impossible to get models from the game?

[Ekey]

As Yretenai said in newest version HFS files is encrypted by AES (probably modified) cuz for setup encryption keys it uses SOSEMANUK multiplication tables (I have never seen such thing ). There are no static encryption keys, they are dynamic and are generated from the file name

[Yretenai]

As Yretenai said in newest version HFS files is encrypted by AES (probably modified) cuz for setup encryption keys it uses SOSEMANUK multiplication tables (I have never seen such thing ). There are no static encryption keys, they are dynamic and are generated from the file name

Soseman is a cipher based off AES Serpent, which is why it looks similar. Likely are just using the normal Soseman chiper as-is in a common block mode like CBC or ECB

[Ekey]

Edited:
Decryption start from 0xFF offset (maybe first 256 bytes is something like a digital signature, anyway no ideas at this moment )

So, here some 4 bytes data for test from file 77EEDAF6871DCC7B83BE580E005294A26F71CDCF_00000.hfs

Before =>> After decryption

Code: Select all

83 50 46 17 =>> 95 00 00 00

Code: Select all

BF 39 2C EB =>> 02 93 00 00

Code: Select all

4D 79 20 F0 =>> 00 00 00 00

Code: Select all

F4 4F 70 F0 =>> 1D 00 00 00

Code: Select all

E8 B1 45 A3 =>> 6D 00 61 00

Code: Select all

95 E2 CC 8F =>> 00 00 07 00

Code: Select all

FE 16 5D 7C =>> 00 00 00 00

Code: Select all

AA 33 1D 9D =>> 00 00 EF 00

Code: Select all

6E 4B 0B D4 =>> 00 00 9C 00

Code: Select all

62 A1 F7 7D =>> 00 00 BF 24

Code: Select all

5E 37 E8 74 D4 B9 72 AA CC EF D5 75 37 9A 58 62 =>> 31 CF 6B BF 6D 87 DC 56 7A 1D 96 C7 D0 F5 1D 00

Code: Select all

C0 B1 80 94 =>> 00 00 6D 00

FileName > aterials/VGUI/_deu_enter.vmt, first letter in > C0 B1 80 94 =>> 00 00 6D 00 = m =>> materials/VGUI/_deu_enter.vmt

Code: Select all

C7 2B 33 F2 ED 83 3D F9 74 06 EA 1A F7 9D 3F B1 A2 E7 EB 33 0C 6D D5 CE EF 5E 2D 84 21 C1 3B CE E9 8A A2 8F CC 6D 4A 20 0A 6B 51 3A 65 B1 D8 14 10 AA 07 72 E8 79 ED B9  =>> 61 00 74 00 65 00 72 00 69 00 61 00 6C 00 73 00 2F 00 56 00 47 00 55 00 49 00 2F 00 5F 00 64 00 65 00 75 00 5F 00 65 00 6E 00 74 00 65 00 72 00 2E 00 76 00 74 00 66 00