ItsMods

So this is the release of my BO2 FF (FastFile) decrypter for PC version (not sure what encryption does xbox360 version use)

Not much to say, it just decrypts black ops 2 fast files. Source included.

Credits:
@kokole for making decrypter
@master131 for giving the salsa20 key

[attachment=2515]

In it's current state, there's not much to do with this considering I can't get the files that are inside.
Nevertheless great job, to the both of you!

The Xbox 360 version also uses salsa20.
If you want to have a go at a console FF then here is the key.

If you need, I will upload an FF for you later. Just name the one you want.

(02-08-2013, 19:22)CAPiiX Wrote: [ -> ]The Xbox 360 version also uses salsa20.
If you want to have a go at a console FF then here is the key.

Code:

ffKey[0x20] = { 0x0E, 0x50, 0xF4, 0x9F, 0x41, 0x23, 0x17, 0x09, 0x60, 0x38, 0x66, 0x56, 0x22, 0xDD, 0x09, 0x13, 0x32, 0xA2, 0x09, 0xBA, 0x0A, 0x05, 0xA0, 0x0E, 0x13, 0x77, 0xCE, 0xDB, 0x0A, 0x3C, 0xB1, 0xD3 };

If you need, I will upload an FF for you later. Just name the one you want.

Nice! Can you send me the patch_mp?

(02-08-2013, 19:50)DidUknowiPwn Wrote: [ -> ]

(02-08-2013, 19:22)CAPiiX Wrote: [ -> ]The Xbox 360 version also uses salsa20.
If you want to have a go at a console FF then here is the key.

Code:

ffKey[0x20] = { 0x0E, 0x50, 0xF4, 0x9F, 0x41, 0x23, 0x17, 0x09, 0x60, 0x38, 0x66, 0x56, 0x22, 0xDD, 0x09, 0x13, 0x32, 0xA2, 0x09, 0xBA, 0x0A, 0x05, 0xA0, 0x0E, 0x13, 0x77, 0xCE, 0xDB, 0x0A, 0x3C, 0xB1, 0xD3 };

If you need, I will upload an FF for you later. Just name the one you want.

Nice! Can you send me the patch_mp?

Here you go: http://www.mediafire.com/?hhdmjb1pu84bvwr

thanks will take a look at it later.

Bytes look ok with that key, but I can't seem to figure out what compression they use. Take a look at this 2 blocks i've decrypted from patch_mp.ff

[attachment=2529]

(02-08-2013, 22:06)kokole Wrote: [ -> ]Bytes look ok with that key, but I can't seem to figure out what compression they use. Take a look at this 2 blocks i've decrypted from patch_mp.ff

This is what BuC-ShoTz did for Ps3. It may help you in your endeavor.

(02-08-2013, 23:41)CAPiiX Wrote: [ -> ]

(02-08-2013, 22:06)kokole Wrote: [ -> ]Bytes look ok with that key, but I can't seem to figure out what compression they use. Take a look at this 2 blocks i've decrypted from patch_mp.ff

This is what BuC-ShoTz did for Ps3. It may help you in your endeavor.

Spoiler (Click to View)

Code:

private List<byte[]> HashesList(List<byte[]> compressedZones)
        {
            SHA1 sha1 = new SHA1Managed();
            List<byte[]> hashesList = new List<byte[]>();
            foreach (byte[] compressedZone in compressedZones)
            {
                hashesList.Add(sha1.ComputeHash(compressedZone));
            }

            return hashesList;
        }

This is what he did as well for big endian.

Code:

using System;
using System.IO;

namespace BO2_FF_CRYPT
{
    class BigEndianReader : BinaryReader
    {
        private byte[] a16 = new byte[2];
        private byte[] a32 = new byte[4];
        private byte[] a64 = new byte[8];

        public BigEndianReader(Stream stream) : base(stream) { }

        public override Int16 ReadInt16()
        {
            a16 = base.ReadBytes(2);
            Array.Reverse(a16);
            return BitConverter.ToInt16(a16, 0);
        }

        public override int ReadInt32()
        {
            a32 = base.ReadBytes(4);
            Array.Reverse(a32);
            return BitConverter.ToInt32(a32, 0);
        }

        public override Int64 ReadInt64()
        {
            a64 = base.ReadBytes(8);
            Array.Reverse(a64);
            return BitConverter.ToInt64(a64, 0);
        }

        public override UInt16 ReadUInt16()
        {
            a16 = base.ReadBytes(2);
            Array.Reverse(a16);
            return BitConverter.ToUInt16(a16, 0);
        }

        public override UInt32 ReadUInt32()
        {
            a32 = base.ReadBytes(4);
            Array.Reverse(a32);
            return BitConverter.ToUInt32(a32, 0);
        }

        public override UInt64 ReadUInt64()
        {
            a64 = base.ReadBytes(8);
            Array.Reverse(a64);
            return BitConverter.ToUInt64(a64, 0);
        }
    }

    public class BigEndianWriter : BinaryWriter
    {
        private byte[] a16 = new byte[2];
        private byte[] a32 = new byte[4];
        private byte[] a64 = new byte[8];

        public BigEndianWriter(Stream output) : base(output) { }

        public override void Write(Int16 value)
        {
            a16 = BitConverter.GetBytes(value);
            Array.Reverse(a16);
            base.Write(a16);
        }

        public override void Write(Int32 value)
        {
            a32 = BitConverter.GetBytes(value);
            Array.Reverse(a32);
            base.Write(a32);
        }

        public override void Write(Int64 value)
        {
            a64 = BitConverter.GetBytes(value);
            Array.Reverse(a64);
            base.Write(a64);
        }

        public override void Write(UInt16 value)
        {
            a16 = BitConverter.GetBytes(value);
            Array.Reverse(a16);
            base.Write(a16);
        }

        public override void Write(UInt32 value)
        {
            a32 = BitConverter.GetBytes(value);
            Array.Reverse(a32);
            base.Write(a32);
        }

        public override void Write(UInt64 value)
        {
            a64 = BitConverter.GetBytes(value);
            Array.Reverse(a64);
            base.Write(a64);
        }
    }
}

Well that doesnt help at all, I just dont know the type of compression it is.

(02-09-2013, 00:30)kokole Wrote: [ -> ]

(02-08-2013, 23:41)CAPiiX Wrote: [ -> ]

(02-08-2013, 22:06)kokole Wrote: [ -> ]Bytes look ok with that key, but I can't seem to figure out what compression they use. Take a look at this 2 blocks i've decrypted from patch_mp.ff

This is what BuC-ShoTz did for Ps3. It may help you in your endeavor.

Spoiler (Click to View)

Code:

private List<byte[]> HashesList(List<byte[]> compressedZones)
        {
            SHA1 sha1 = new SHA1Managed();
            List<byte[]> hashesList = new List<byte[]>();
            foreach (byte[] compressedZone in compressedZones)
            {
                hashesList.Add(sha1.ComputeHash(compressedZone));
            }

            return hashesList;
        }

This is what he did as well for big endian.

Code:

using System;
using System.IO;

namespace BO2_FF_CRYPT
{
    class BigEndianReader : BinaryReader
    {
        private byte[] a16 = new byte[2];
        private byte[] a32 = new byte[4];
        private byte[] a64 = new byte[8];

        public BigEndianReader(Stream stream) : base(stream) { }

        public override Int16 ReadInt16()
        {
            a16 = base.ReadBytes(2);
            Array.Reverse(a16);
            return BitConverter.ToInt16(a16, 0);
        }

        public override int ReadInt32()
        {
            a32 = base.ReadBytes(4);
            Array.Reverse(a32);
            return BitConverter.ToInt32(a32, 0);
        }

        public override Int64 ReadInt64()
        {
            a64 = base.ReadBytes(8);
            Array.Reverse(a64);
            return BitConverter.ToInt64(a64, 0);
        }

        public override UInt16 ReadUInt16()
        {
            a16 = base.ReadBytes(2);
            Array.Reverse(a16);
            return BitConverter.ToUInt16(a16, 0);
        }

        public override UInt32 ReadUInt32()
        {
            a32 = base.ReadBytes(4);
            Array.Reverse(a32);
            return BitConverter.ToUInt32(a32, 0);
        }

        public override UInt64 ReadUInt64()
        {
            a64 = base.ReadBytes(8);
            Array.Reverse(a64);
            return BitConverter.ToUInt64(a64, 0);
        }
    }

    public class BigEndianWriter : BinaryWriter
    {
        private byte[] a16 = new byte[2];
        private byte[] a32 = new byte[4];
        private byte[] a64 = new byte[8];

        public BigEndianWriter(Stream output) : base(output) { }

        public override void Write(Int16 value)
        {
            a16 = BitConverter.GetBytes(value);
            Array.Reverse(a16);
            base.Write(a16);
        }

        public override void Write(Int32 value)
        {
            a32 = BitConverter.GetBytes(value);
            Array.Reverse(a32);
            base.Write(a32);
        }

        public override void Write(Int64 value)
        {
            a64 = BitConverter.GetBytes(value);
            Array.Reverse(a64);
            base.Write(a64);
        }

        public override void Write(UInt16 value)
        {
            a16 = BitConverter.GetBytes(value);
            Array.Reverse(a16);
            base.Write(a16);
        }

        public override void Write(UInt32 value)
        {
            a32 = BitConverter.GetBytes(value);
            Array.Reverse(a32);
            base.Write(a32);
        }

        public override void Write(UInt64 value)
        {
            a64 = BitConverter.GetBytes(value);
            Array.Reverse(a64);
            base.Write(a64);
        }
    }
}

Well that doesnt help at all, I just dont know the type of compression it is.

I wasn't too sure. Would the method be in the executable? I could decompile that for you.