XeNTaX

Posted: **Thu Dec 18, 2008 11:01 pm**

Well, here is another thread with a game that i play, this time it's R2 ONLINE and this is a russian version. I have found that all archives are in .rfs

I will post the smallest one, if we can "unlock" this, can we also unlock the others? Is it normally so?

I attach the file to this post. It's 111kb small

Here are, as always, some screenies to get your attention

Posted: **Sat Dec 20, 2008 8:39 pm**

hm, first line in one of the files model.rfs is like this:

00000000 50 4B 03 04 14 00 0D 00 08 00 67 55 37 34 60 4B F7 64 5D 0E 00 00 20 2E 00 00 0D 00 00 00 63 30 30 30 30 PK........gU74`K.d]... .......c0000

Doesnt that mean its a pkzip library?

Hm, found a program just called pkzip and i could open it there:

One problem i have is i cant extract anything, just asks for passworkd and then says that "no file found"

Posted: **Sun Dec 21, 2008 5:03 pm**

dang that means it is just like granado espada and the archives are encrypted.
once someone finds the key it will be easy to extract the files.

Posted: **Sun Dec 21, 2008 7:23 pm**

ywah but wonder what kind of 3d models format is hiding

Posted: **Sat Jan 17, 2009 6:02 am**

is it really hard to decrypt this? I guess it would take quite some time if they have say 5-6 characters in password

Posted: **Sat Jan 17, 2009 8:57 am**

It seems to me the .exe should hold the key.

Posted: **Sat Jan 17, 2009 1:24 pm**

So maybe if i post a .exe file someone might be lucky then?

http://www.2shared.com/file/4665754/ce3 ... files.html

the small file is the launcher and then bigger is the main exe

Posted: **Sat Jan 17, 2009 11:26 pm**

I took a peek inside the main exe and found this line, dont know if it is interesting:

Code: Select all

0068CF76 00 00 04 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 02 00 00 00 A0 82 4C 00 90 ........................L..
0068CF91 70 4C 00 70 7E 4C 00 73 76 72 6E 6F 3D 25 30 35 64 26 69 64 3D 25 73 26 76 61 6C pL.p~L.svrno=%05d&id=%s&val
0068CFAC 75 65 3D 25 64 00 00 00 70 87 4C 00 50 8C 4C 00 7A 69 70 00 7A 25 2E 33 64 00 00 ue=%d...p.L.P.L.zip.z%.3d..
0068CFC7 00 7A 25 2E 32 64 00 00 00 70 6B 62 61 63 6B 23 20 25 2E 33 64 00 5C 00 00 5C 5C .z%.2d...pkback# %.3d.\..\\
0068CFE2 3F 5C 75 6E 63 5C 00 00 00 00 5A 69 70 41 72 63 68 69 76 65 20 4D 61 70 70 69 6E ?\unc\....ZipArchive Mappin
0068CFFD 67 20 46 69 6C 65 00 40 C4 4C 00 00 00 00 00 96 30 07 77 2C 61 0E EE BA 51 09 99 g [email protected],a...Q..
0068D018 19 C4 6D 07 8F F4 6A 70 35 A5 63 E9 A3 95 64 9E 32 88 DB 0E A4 B8 DC 79 1E E9 D5 ..m...jp5.c...d.2......y...
0068D033 E0 88 D9 D2 97 2B 4C B6 09 BD 7C B1 7E 07 2D B8 E7 91 1D BF 90 64 10 B7 1D F2 20 .....+L...|.~.-......d.... 
0068D04E B0 6A 48 71 B9 F3 DE 41 BE 84 7D D4 DA 1A EB E4 DD 6D 51 B5 D4 F4 C7 85 D3 83 56 .jHq...A..}......mQ.......V

But you have pkback and ziparchive mapping

Posted: **Wed Jan 21, 2009 8:21 am**

I've found out that they used ZipArchive code from Artpol.

http://www.artpol-software.com/ZipArchive/

Judging from their assembly code, they have used this open source project. ZipArchive's source code shows there is also a SetPassword function. There is an executable ZipArc.exe from Artpol that has this function implemented. It needs to be set after opening of a zip file, but before extraction of anything. The thing to do now is find that particular function in assembly code, using stuff like W32Dasm or preferably OllyDgb. I hope I can come with some more answers soon.

Posted: **Wed Jan 21, 2009 1:29 pm**

sounds promising. I started to scan the archive with a password recovery with 7 letters and came up with 350billion combinations and then i gave up

Posted: **Sat Jan 24, 2009 1:55 am**

I have extracted the archives from this game

Here is the tool to do it.
http://www.sufi.cc/aionemu/RPGViewer_3. ... d1024_.zip

Posted: **Sat Jan 24, 2009 8:56 am**

If you know the password to the zip, then please share it. That's what this forum is about. Also, the RPGViewer does not work, do I have to have more files for it to work?

Posted: **Sat Jan 24, 2009 11:57 am**

I do not have the password for the archive unfortunately.
But I have extracted all the archives from this game with rpg viewer.
I go to file -> open -> online games -> R2 reign of revolution.
then I click on one of the archives it shows and choose
addon -> archive -> extract
and it asks where I want to dump the files and it then dumps them.

Posted: **Sat Jan 24, 2009 12:40 pm**

uh lala. i also see aion there. But what is the model format? Is it openable somewhere? This is getting hot

Posted: **Sat Jan 24, 2009 3:23 pm**

the password of the zip archive used by RPGViewer is 4a3408a275b0343719ae2ab7250a8cab0c03b2178a58f2de
but I have not verified if it's fixed or generated at runtime (lack of interest).

XeNTaX

R2 online

R2 online

Re: R2 online

Re: R2 online

Re: R2 online

Re: R2 online

Re: R2 online

Re: R2 online

Re: R2 online

Re: R2 online

Re: R2 online

Re: R2 online

Re: R2 online

Re: R2 online

Re: R2 online

Re: R2 online