Page 2 of 4

Re: [Unity3D] Punishing : Gray Raven assets

Posted: Tue Oct 12, 2021 3:18 am
by quang23021998
Upx4!

Re: [Unity3D] Punishing : Gray Raven assets

Posted: Tue Oct 12, 2021 7:51 am
by ikskoks
quang23021998 wrote: Tue Oct 12, 2021 3:18 amUpx4!
Well, the thing is that v1.23 is available only for China. And if you don't have real chineese name and identification number, you are not even able to play this game. I think that you guys should just wait to global version update to v1.23. Then it will be possible to check this game without issues.

Re: [Unity3D] Punishing : Gray Raven assets

Posted: Tue Oct 12, 2021 10:39 pm
by quang23021998
ikskoks wrote: Tue Oct 12, 2021 7:51 am
quang23021998 wrote: Tue Oct 12, 2021 3:18 amUpx4!
Well, the thing is that v1.23 is available only for China. And if you don't have real chineese name and identification number, you are not even able to play this game. I think that you guys should just wait to global version update to v1.23. Then it will be possible to check this game without issues.
Thank you for the reply! For this problem, I can provide the full source file of v1.22 + all downloaded content if this is possible for the research.

Re: [Unity3D] Punishing : Gray Raven assets

Posted: Wed Oct 13, 2021 7:56 am
by ikskoks
I can provide the full source file of v1.22 + all downloaded content
Thanks, but it's not needed. We already have some samples in this topic and the APK can be downloaded from bilibili or other similar sites.

Re: [Unity3D] Punishing : Gray Raven assets

Posted: Sun Nov 21, 2021 7:35 am
by ravioxentax
Thank you for the reply! For this problem, I can provide the full source file of v1.22 + all downloaded content if this is possible for the research.
On my side I want you to share these files if possible ! Impossible to extract them on the latest version...

Re: [Unity3D] Punishing : Gray Raven assets

Posted: Sun Nov 21, 2021 12:48 pm
by ikskoks
I want you to share these files if possible !
Sharing assets is forbidden on this forum.

Re: [Unity3D] Punishing : Gray Raven assets

Posted: Thu Dec 16, 2021 5:15 am
by tachiban
ikskoks wrote: Sun Nov 21, 2021 12:48 pm
I want you to share these files if possible !
Sharing assets is forbidden on this forum.
Excuse me, have you solved it?

Re: [Unity3D] Punishing : Gray Raven assets

Posted: Thu Dec 16, 2021 6:40 am
by einherjar007
Recently, more and more games use the same encryption as this game.
The function seems to use AssetBundleEncryptStream.
I don't know the offset and key information, but it's definitely an XOR with certain rules.
It is presumed that the data added to the header is probably dummy and not used to generate the key.

Re: [Unity3D] Punishing : Gray Raven assets

Posted: Thu Dec 16, 2021 10:05 am
by ikskoks
@tachiban, no, chineese client is not available for me as I'm not from China.
Just wait for the global client update or ask someone who has passed chineese ID verification.

Re: [Unity3D] Punishing : Gray Raven assets

Posted: Thu Dec 16, 2021 1:24 pm
by Kanbara
einherjar007 wrote: Thu Dec 16, 2021 6:40 am Recently, more and more games use the same encryption as this game.
The function seems to use AssetBundleEncryptStream.
I don't know the offset and key information, but it's definitely an XOR with certain rules.
It is presumed that the data added to the header is probably dummy and not used to generate the key.
They change the way of encryption as time goes by. Former versions of this game's assets can be dumped by using Gameguardian and other tools. However, it DOESN'T WORK for the current version now. :constipated:
They transfer the code C# to C++ in order to obfuscate the data.
(I don't know much about it. I get the information from a chinese blog and he said by using Gameguardian can dump the source assets, somehow bypass the encryption, and export a file called libil2cpp.so.

Image

Then use Il2CppDumper to have access to the metadata in the original C#'s il code(Intermediate Language).
Use dnspy to open Assembly-CSharp.dll to search for the key to the encryption.

Image

Use IDA(Interactive Disassembler Professional) to open the exported libil2cpp.so mentioned above and locate

Image, which seems to be an algorithm for decryption.

Compile the following code in unity:

Code: Select all

using System.Collections;
using System.Collections.Generic;
using UnityEngine;
using UnityEngine.UI;
using UnityEditor;
using System.IO;
using System;

public class MainBehaviourScript : MonoBehaviour
{
    Text listText;
    Text matrixPath;
    Text configPath;
    private Texture2D duplicateTexture(Texture2D source)
    {
        RenderTexture renderTex = RenderTexture.GetTemporary(
                    source.width,
                    source.height,
                    0,
                    RenderTextureFormat.Default,
                    RenderTextureReadWrite.Linear);

        Graphics.Blit(source, renderTex);
        RenderTexture previous = RenderTexture.active;
        RenderTexture.active = renderTex;
        Texture2D readableText = new Texture2D(source.width, source.height);
        readableText.ReadPixels(new Rect(0, 0, renderTex.width, renderTex.height), 0, 0);
        readableText.Apply();
        RenderTexture.active = previous;
        RenderTexture.ReleaseTemporary(renderTex);
        return readableText;
    }
    // Start is called before the first frame update
    void Start()
    {
        //listText = GameObject.Find("Canvas/Panel/Text").GetComponent<Text>();
        matrixPath = GameObject.Find("Canvas/matrixPath").GetComponent<Text>();
        configPath = GameObject.Find("Canvas/configPath").GetComponent<Text>();
    }

    public void OnClick1()
    {
        configPath.text = MyLocalDialog.GetDir().Trim('\0');
    }

    public void OnClick2()
    {
        matrixPath.text = MyLocalDialog.GetDir().Trim('\0');
    }

    public void OnClick3()
    {
        AssetBundle.SetAssetBundleDecryptKey("kurokurokurokuro");
        FileStream newfst = new FileStream(configPath.text + "\\newoutfile.txt", FileMode.Create, FileAccess.Write);
        FileStream allfst = new FileStream(configPath.text + "\\alloutfile.txt", FileMode.OpenOrCreate, FileAccess.ReadWrite);
        StreamWriter newfWriter = new StreamWriter(newfst);
        StreamWriter allfWriter = new StreamWriter(allfst);
        StreamReader allfReader = new StreamReader(allfst);
        Dictionary<string, int> myDictionary = new Dictionary<string, int>();
        DirectoryInfo TheFolder = new DirectoryInfo(matrixPath.text);
        string outdir = MyLocalDialog.GetDir().Trim('\0') + "\\";
        if (outdir == "")
            return;
        //istText.text = "";
        string str;
        bool outtext = GameObject.Find("Canvas/TextToggle").GetComponent<Toggle>().isOn;
        bool outpic = GameObject.Find("Canvas/PicToggle").GetComponent<Toggle>().isOn;
        while ((str = allfReader.ReadLine()) != null)
        {
            myDictionary.Add(str, 1);
        }
        foreach (FileInfo NextFile in TheFolder.GetFiles())
        {
            MyLocalDialog.MessageBox((IntPtr)0, NextFile.ToString(), "提示", 0);
            var ab = AssetBundle.LoadFromFile(NextFile.ToString());
            Debug.LogError(ab);
            string[] patht = ab.GetAllAssetNames();
            MyLocalDialog.MessageBox((IntPtr)0, patht[0], "提示", 0);
            return;
            foreach (string s in patht)
            {
                if (!myDictionary.ContainsKey(s))
                {
                    var o = ab.LoadAsset(s);
                    if (o == null)
                        continue;
                    if (outpic && o.GetType() == typeof(Texture2D))
                    {
                        Texture2D tx = (Texture2D)o;
                        Texture2D readableText = duplicateTexture(tx);
                        string file_path = outdir + s;
                        int len = file_path.Length - 1;
                        while (len > 0 && file_path[len] != '/')
                            len--;
                        Directory.CreateDirectory(file_path.Substring(0, len));

                        byte[] filedata = readableText.EncodeToPNG();
                        using (var fs = new FileStream(file_path, FileMode.Create, FileAccess.Write))
                        {
                            fs.Write(filedata, 0, filedata.Length);
                        }
                        newfWriter.WriteLine(s);
                        allfWriter.WriteLine(s);
                    }
                    else if (outtext && o.GetType() == typeof(TextAsset))
                    {
                        TextAsset ta = (TextAsset)o;
                        string file_path = outdir + s;
                        int len = file_path.Length - 1;
                        while (len > 0 && file_path[len] != '/')
                            len--;
                        Directory.CreateDirectory(file_path.Substring(0, len));
                        using (var fs = new FileStream(file_path, FileMode.Create, FileAccess.Write))
                        {
                            fs.Write(ta.bytes, 0, ta.bytes.Length);
                        }
                        newfWriter.WriteLine(s);
                        allfWriter.WriteLine(s);
                    }
                }
            }
        }
        newfWriter.Close();
        newfst.Close();
        allfWriter.Close();
        allfReader.Close();
        allfst.Close();
        MyLocalDialog.MessageBox((IntPtr)0, "导出完成!", "提示", 0);
    }

    public void OnClick4()
    {
        AssetBundle.SetAssetBundleDecryptKey("kurokurokurokuro");
        var ab = AssetBundle.LoadFromFile("E:\\matrix2\\fff6ce1e25b48a043aa026247cbb231fbd2f225c");
        //string[] patht = ab.GetAllAssetNames();
        //Debug.LogError(patht[0]);
        var o = ab.LoadAsset("assets/product/scene/sceneres/common/scene020/textures/2003.png");
        MyLocalDialog.MessageBox((IntPtr)0, o.name, "提示", 0);
    }
    // Update is called once per frame
    void Update()
    {

    }
}
And voila, here comes the result:

Image
(The original blog owner’s herehttps://my.oschina.net/u/4363636/blog/5269405)

Re: [Unity3D] Punishing : Gray Raven assets

Posted: Thu Dec 16, 2021 1:54 pm
by Kanbara
ikskoks wrote: Thu Dec 16, 2021 10:05 am @tachiban, no, chineese client is not available for me as I'm not from China.
Just wait for the global client update or ask someone who has passed chineese ID verification.
Maybe you can try to take a look at the jp version of this game? I think they use the same way of encryption now.

Re: [Unity3D] Punishing : Gray Raven assets

Posted: Thu Dec 16, 2021 2:29 pm
by einherjar007
This is the first time I learned that there is a function called SetAssetBundleEncryptKey, and its set of functions.
I think it's probably an option when building AssetBundle. I'm not sure if that is supported by all Unity Editors, as it only gives information in Chinese.

*EDIT
There seems to be something called "Unity中国增强版". This may be a unique feature of this editor.

Recently, services such as virbox that make analysis difficult by obfuscation instead of encryption are increasing,
so it is less likely that will get code that can be analyzed even by dumping.

Re: [Unity3D] Punishing : Gray Raven assets

Posted: Sat Dec 18, 2021 6:33 am
by einherjar007
*EDIT
SetAssetBundleEncryptKey, Apparently this is not a feature for decryption. Chinese Unity loads the encrypted file as is.

Re: [Unity3D] Punishing : Gray Raven assets

Posted: Mon Dec 20, 2021 9:30 am
by lfanguest
ikskoks wrote: Sun Sep 26, 2021 1:12 pm I've just tested it on version 1.9.1 of the game and all assets are unencrypted.
If you'll just remove "Kuro" word which is right before "UnityFS" signature, all files will be readable in Asset Studio or UnityEx.
https://i.imgur.com/veXNC3j.png

But is the v1.9.1 the newest one? If not, then please specify which version of the game is encrypted.
Becasue on the google play site you can see that v1.9.1 is the newest, so I'm a little confused with your request.
https://play.google.com/store/apps/deta ... n_US&gl=US
May I ask how to delete the "Kuro" before the signature of "UnityFS"?

Re: [Unity3D] Punishing : Gray Raven assets

Posted: Mon Dec 20, 2021 11:37 am
by ikskoks
lfanguest wrote: Mon Dec 20, 2021 9:30 am May I ask how to delete the "Kuro" before the signature of "UnityFS"?
1. Download hex workshop http://www.bpsoft.com/downloads/
2. Open unity3d file in hex workshop
3. Select "Kuro" word
4. Right click and choose "Delete"
5. Save the file