[Unity3D] Punishing : Gray Raven assets

[quang23021998]

Upx4!

[ikskoks]

Upx4!

Well, the thing is that v1.23 is available only for China. And if you don't have real chineese name and identification number, you are not even able to play this game. I think that you guys should just wait to global version update to v1.23. Then it will be possible to check this game without issues.

[quang23021998]

Upx4!

Well, the thing is that v1.23 is available only for China. And if you don't have real chineese name and identification number, you are not even able to play this game. I think that you guys should just wait to global version update to v1.23. Then it will be possible to check this game without issues.

Thank you for the reply! For this problem, I can provide the full source file of v1.22 + all downloaded content if this is possible for the research.

[ikskoks]

I can provide the full source file of v1.22 + all downloaded content

Thanks, but it's not needed. We already have some samples in this topic and the APK can be downloaded from bilibili or other similar sites.

[ravioxentax]

Thank you for the reply! For this problem, I can provide the full source file of v1.22 + all downloaded content if this is possible for the research.

On my side I want you to share these files if possible ! Impossible to extract them on the latest version...

[ikskoks]

I want you to share these files if possible !

Sharing assets is forbidden on this forum.

[tachiban]

I want you to share these files if possible !

Sharing assets is forbidden on this forum.

Excuse me, have you solved it?

[einherjar007]

Recently, more and more games use the same encryption as this game.
The function seems to use AssetBundleEncryptStream.
I don't know the offset and key information, but it's definitely an XOR with certain rules.
It is presumed that the data added to the header is probably dummy and not used to generate the key.

[ikskoks]

@tachiban, no, chineese client is not available for me as I'm not from China.
Just wait for the global client update or ask someone who has passed chineese ID verification.

[Kanbara]

Recently, more and more games use the same encryption as this game.
The function seems to use AssetBundleEncryptStream.
I don't know the offset and key information, but it's definitely an XOR with certain rules.
It is presumed that the data added to the header is probably dummy and not used to generate the key.

They change the way of encryption as time goes by. Former versions of this game's assets can be dumped by using Gameguardian and other tools. However, it DOESN'T WORK for the current version now.
They transfer the code C# to C++ in order to obfuscate the data.
(I don't know much about it. I get the information from a chinese blog and he said by using Gameguardian can dump the source assets, somehow bypass the encryption, and export a file called libil2cpp.so.



Then use Il2CppDumper to have access to the metadata in the original C#'s il code(Intermediate Language).
Use dnspy to open Assembly-CSharp.dll to search for the key to the encryption.



Use IDA(Interactive Disassembler Professional) to open the exported libil2cpp.so mentioned above and locate

, which seems to be an algorithm for decryption.

Compile the following code in unity:

Code: Select all

using System.Collections;
using System.Collections.Generic;
using UnityEngine;
using UnityEngine.UI;
using UnityEditor;
using System.IO;
using System;

public class MainBehaviourScript : MonoBehaviour
{
    Text listText;
    Text matrixPath;
    Text configPath;
    private Texture2D duplicateTexture(Texture2D source)
    {
        RenderTexture renderTex = RenderTexture.GetTemporary(
                    source.width,
                    source.height,
                    0,
                    RenderTextureFormat.Default,
                    RenderTextureReadWrite.Linear);

        Graphics.Blit(source, renderTex);
        RenderTexture previous = RenderTexture.active;
        RenderTexture.active = renderTex;
        Texture2D readableText = new Texture2D(source.width, source.height);
        readableText.ReadPixels(new Rect(0, 0, renderTex.width, renderTex.height), 0, 0);
        readableText.Apply();
        RenderTexture.active = previous;
        RenderTexture.ReleaseTemporary(renderTex);
        return readableText;
    }
    // Start is called before the first frame update
    void Start()
    {
        //listText = GameObject.Find("Canvas/Panel/Text").GetComponent<Text>();
        matrixPath = GameObject.Find("Canvas/matrixPath").GetComponent<Text>();
        configPath = GameObject.Find("Canvas/configPath").GetComponent<Text>();
    }

    public void OnClick1()
    {
        configPath.text = MyLocalDialog.GetDir().Trim('\0');
    }

    public void OnClick2()
    {
        matrixPath.text = MyLocalDialog.GetDir().Trim('\0');
    }

    public void OnClick3()
    {
        AssetBundle.SetAssetBundleDecryptKey("kurokurokurokuro");
        FileStream newfst = new FileStream(configPath.text + "\\newoutfile.txt", FileMode.Create, FileAccess.Write);
        FileStream allfst = new FileStream(configPath.text + "\\alloutfile.txt", FileMode.OpenOrCreate, FileAccess.ReadWrite);
        StreamWriter newfWriter = new StreamWriter(newfst);
        StreamWriter allfWriter = new StreamWriter(allfst);
        StreamReader allfReader = new StreamReader(allfst);
        Dictionary<string, int> myDictionary = new Dictionary<string, int>();
        DirectoryInfo TheFolder = new DirectoryInfo(matrixPath.text);
        string outdir = MyLocalDialog.GetDir().Trim('\0') + "\\";
        if (outdir == "")
            return;
        //istText.text = "";
        string str;
        bool outtext = GameObject.Find("Canvas/TextToggle").GetComponent<Toggle>().isOn;
        bool outpic = GameObject.Find("Canvas/PicToggle").GetComponent<Toggle>().isOn;
        while ((str = allfReader.ReadLine()) != null)
        {
            myDictionary.Add(str, 1);
        }
        foreach (FileInfo NextFile in TheFolder.GetFiles())
        {
            MyLocalDialog.MessageBox((IntPtr)0, NextFile.ToString(), "提示", 0);
            var ab = AssetBundle.LoadFromFile(NextFile.ToString());
            Debug.LogError(ab);
            string[] patht = ab.GetAllAssetNames();
            MyLocalDialog.MessageBox((IntPtr)0, patht[0], "提示", 0);
            return;
            foreach (string s in patht)
            {
                if (!myDictionary.ContainsKey(s))
                {
                    var o = ab.LoadAsset(s);
                    if (o == null)
                        continue;
                    if (outpic && o.GetType() == typeof(Texture2D))
                    {
                        Texture2D tx = (Texture2D)o;
                        Texture2D readableText = duplicateTexture(tx);
                        string file_path = outdir + s;
                        int len = file_path.Length - 1;
                        while (len > 0 && file_path[len] != '/')
                            len--;
                        Directory.CreateDirectory(file_path.Substring(0, len));

                        byte[] filedata = readableText.EncodeToPNG();
                        using (var fs = new FileStream(file_path, FileMode.Create, FileAccess.Write))
                        {
                            fs.Write(filedata, 0, filedata.Length);
                        }
                        newfWriter.WriteLine(s);
                        allfWriter.WriteLine(s);
                    }
                    else if (outtext && o.GetType() == typeof(TextAsset))
                    {
                        TextAsset ta = (TextAsset)o;
                        string file_path = outdir + s;
                        int len = file_path.Length - 1;
                        while (len > 0 && file_path[len] != '/')
                            len--;
                        Directory.CreateDirectory(file_path.Substring(0, len));
                        using (var fs = new FileStream(file_path, FileMode.Create, FileAccess.Write))
                        {
                            fs.Write(ta.bytes, 0, ta.bytes.Length);
                        }
                        newfWriter.WriteLine(s);
                        allfWriter.WriteLine(s);
                    }
                }
            }
        }
        newfWriter.Close();
        newfst.Close();
        allfWriter.Close();
        allfReader.Close();
        allfst.Close();
        MyLocalDialog.MessageBox((IntPtr)0, "导出完成！", "提示", 0);
    }

    public void OnClick4()
    {
        AssetBundle.SetAssetBundleDecryptKey("kurokurokurokuro");
        var ab = AssetBundle.LoadFromFile("E:\\matrix2\\fff6ce1e25b48a043aa026247cbb231fbd2f225c");
        //string[] patht = ab.GetAllAssetNames();
        //Debug.LogError(patht[0]);
        var o = ab.LoadAsset("assets/product/scene/sceneres/common/scene020/textures/2003.png");
        MyLocalDialog.MessageBox((IntPtr)0, o.name, "提示", 0);
    }
    // Update is called once per frame
    void Update()
    {

    }
}

And voila, here comes the result:


(The original blog owner’s herehttps://my.oschina.net/u/4363636/blog/5269405)

[Kanbara]

@tachiban, no, chineese client is not available for me as I'm not from China.
Just wait for the global client update or ask someone who has passed chineese ID verification.

Maybe you can try to take a look at the jp version of this game? I think they use the same way of encryption now.

[einherjar007]

This is the first time I learned that there is a function called SetAssetBundleEncryptKey, and its set of functions.
I think it's probably an option when building AssetBundle. I'm not sure if that is supported by all Unity Editors, as it only gives information in Chinese.

*EDIT
There seems to be something called "Unity中国增强版". This may be a unique feature of this editor.

Recently, services such as virbox that make analysis difficult by obfuscation instead of encryption are increasing,
so it is less likely that will get code that can be analyzed even by dumping.

[einherjar007]

*EDIT
SetAssetBundleEncryptKey, Apparently this is not a feature for decryption. Chinese Unity loads the encrypted file as is.

[lfanguest]

I've just tested it on version 1.9.1 of the game and all assets are unencrypted.
If you'll just remove "Kuro" word which is right before "UnityFS" signature, all files will be readable in Asset Studio or UnityEx.
https://i.imgur.com/veXNC3j.png

But is the v1.9.1 the newest one? If not, then please specify which version of the game is encrypted.
Becasue on the google play site you can see that v1.9.1 is the newest, so I'm a little confused with your request.
https://play.google.com/store/apps/deta ... n_US&gl=US

May I ask how to delete the "Kuro" before the signature of "UnityFS"?

[ikskoks]

May I ask how to delete the "Kuro" before the signature of "UnityFS"?

1. Download hex workshop http://www.bpsoft.com/downloads/
2. Open unity3d file in hex workshop
3. Select "Kuro" word
4. Right click and choose "Delete"
5. Save the file