https://github.com/Neodymium146/gta-too ... ryption.cs
https://github.com/0x1F9F1/Swage/blob/m ... /tfit2.cpp
There is an open source messenger that uses TransformIT. The developer has also uploaded the TransformIT 8.0 evaluation kit headers. By the way, the game uses GuardIT 10.5.2.154616 x64.
https://github.com/EOSIO/mojey/blob/mai ... FIT/TFIT.h
The file structure of encrypted files is described here https://github.com/Nenkai/010GameTempla ... za/TFIT.bt. Here are my notes:
Code: Select all
Header {
u8[16] IV?
u32 padding -- amount of zeros at the end of the last block
u8[16] unknown
}
Block {
u8[200 or 20000] encrypted_data
u8[16] MAC?
}
Code: Select all
00000001408E01BB: the call for sfsdata
0000000141D8E4A0: public: __fastcall Crypto::DecryptionStream::DecryptionStream(class TReference<class IOSys::CBinaryStream, struct ReferencePolicy<class IOSys::CBinaryStream>, struct NonThreadSafeReferencePolicy> const &, class TReference<class Crypto::ICryptoProvider, struct ReferencePolicy<class Crypto::ICryptoProvider>, struct NonThreadSafeReferencePolicy> const &, bool, unsigned long)
rcx: Crypto::DecryptionStream *
rdx: IOSys::CAutoMemoryStream::CAutoMemoryStream *
r8: Crypto::TransformITCryptoProvider<class nullkeywrapper, class keywrapper_sfs_decryptionkey, class keywrapper_sfs_mackey> * -- stores 16-byte fields from the header.
[rsp+20]: data_block_size -- 0x20000
Code: Select all
00000001408E025C: the call for sfsdata
0000000141D8FAF0: public: virtual class Core::ErrInfo __fastcall Crypto::DecryptionStream::ReadData(void *, long, long &) -- maybe
rcx: Crypto::DecryptionStream *
rdx: Crypto::DecryptionStream ** -- null after return
r8: void *destination
r9: u32 data_size -- 0x4F80000
[rsp+20]: u32 *data_size_out -- 0x4F80000
- file size: 0x4F827E4
- data size: 0x4F80000
- block size: 0x20000
- padding: 0x6797
- decrypted file size: 0x4F79869