Advertising (This ad goes away for registered users. You can Login or Register)

trying to find gamekey in ppsspp for decryption of save data

Forum rules
Forum rule Nº 15 is strictly enforced in this subforum.
grief3r
Posts: 358
Joined: Sat Nov 09, 2013 4:12 am

Re: trying to find gamekey in ppsspp for decryption of save

Post by grief3r »

one last thing can you explain this few lines? it's the only thing i don't understand so far

_sw(MAKE_JUMP(sceUtilitySavedataInitStart_hook), UtilitySavedataInitStart_pointer);
_sw(0x00000000, UtilitySavedataInitStart_pointer + 4);
sceUtilitySavedataInitStart_ = (void *)&code;
Advertising
PSV1001 2.61 FieldRunners
PSP1001 6.60 Pro-C
PSP 3001 6.20 Pro-C2
qwikrazor87
Guru
Posts: 2874
Joined: Sat Apr 21, 2012 1:23 pm
Location: The North Pole

Re: trying to find gamekey in ppsspp for decryption of save

Post by qwikrazor87 »

_sw(MAKE_JUMP(sceUtilitySavedataInitStart_hook), UtilitySavedataInitStart_pointer);
_sw(0x00000000, UtilitySavedataInitStart_pointer + 4);
This redirects the real call to our hook.
sceUtilitySavedataInitStart_ = (void *)&code;
This one points to the real syscall which is backed up in "code".
Advertising
PSP 2001 - TA-085 - 6.61 PRO-C2
PS Vita 3G - PCH-1101 - 3.65 HENkaku Ensō
Alcatel phone - Android 8.1.0
Laptop - Toshiba Satellite L305D-S5974 - Ubuntu 16.04 LTS
grief3r
Posts: 358
Joined: Sat Nov 09, 2013 4:12 am

Re: trying to find gamekey in ppsspp for decryption of save

Post by grief3r »

qwikrazor87 wrote:
_sw(MAKE_JUMP(sceUtilitySavedataInitStart_hook), UtilitySavedataInitStart_pointer);
_sw(0x00000000, UtilitySavedataInitStart_pointer + 4);
This redirects the real call to our hook.
sceUtilitySavedataInitStart_ = (void *)&code;
This one points to the real syscall which is backed up in "code".
thanks for the help!

here is what appears to be the game key

https://gyazo.com/0ff12dfc6cba4f5e855169aa85c1f362

is this the key byte by byte? or is there some big-end / little -end business going on
PSV1001 2.61 FieldRunners
PSP1001 6.60 Pro-C
PSP 3001 6.20 Pro-C2
qwikrazor87
Guru
Posts: 2874
Joined: Sat Apr 21, 2012 1:23 pm
Location: The North Pole

Re: trying to find gamekey in ppsspp for decryption of save

Post by qwikrazor87 »

grief3r wrote:thanks for the help!

here is what appears to be the game key

https://gyazo.com/0ff12dfc6cba4f5e855169aa85c1f362

is this the key byte by byte? or is there some big-end / little -end business going on
yeah, it's they key, byte by byte.
PSP 2001 - TA-085 - 6.61 PRO-C2
PS Vita 3G - PCH-1101 - 3.65 HENkaku Ensō
Alcatel phone - Android 8.1.0
Laptop - Toshiba Satellite L305D-S5974 - Ubuntu 16.04 LTS
grief3r
Posts: 358
Joined: Sat Nov 09, 2013 4:12 am

Re: trying to find gamekey in ppsspp for decryption of save

Post by grief3r »

qwikrazor87 wrote:
grief3r wrote:thanks for the help!

here is what appears to be the game key

https://gyazo.com/0ff12dfc6cba4f5e855169aa85c1f362

is this the key byte by byte? or is there some big-end / little -end business going on
yeah, it's they key, byte by byte.
it seems the save data for this game has some weird compression, i know which bytes im looking to replace , it's a long stream of bytes but they are divided into 2 bytes each and spread all over the decrypted save data, is there any known compression methods that behave this way that you know of thanks in advance
PSV1001 2.61 FieldRunners
PSP1001 6.60 Pro-C
PSP 3001 6.20 Pro-C2
qwikrazor87
Guru
Posts: 2874
Joined: Sat Apr 21, 2012 1:23 pm
Location: The North Pole

Re: trying to find gamekey in ppsspp for decryption of save

Post by qwikrazor87 »

grief3r wrote: it seems the save data for this game has some weird compression, i know which bytes im looking to replace , it's a long stream of bytes but they are divided into 2 bytes each and spread all over the decrypted save data, is there any known compression methods that behave this way that you know of thanks in advance
hmm, no idea, game saves don't have any standard format, devs can do whatever they want with the save, so you'll need to figure it out.
PSP 2001 - TA-085 - 6.61 PRO-C2
PS Vita 3G - PCH-1101 - 3.65 HENkaku Ensō
Alcatel phone - Android 8.1.0
Laptop - Toshiba Satellite L305D-S5974 - Ubuntu 16.04 LTS
grief3r
Posts: 358
Joined: Sat Nov 09, 2013 4:12 am

Re: trying to find gamekey in ppsspp for decryption of save

Post by grief3r »

qwikrazor87 wrote:
grief3r wrote: it seems the save data for this game has some weird compression, i know which bytes im looking to replace , it's a long stream of bytes but they are divided into 2 bytes each and spread all over the decrypted save data, is there any known compression methods that behave this way that you know of thanks in advance
hmm, no idea, game saves don't have any standard format, devs can do whatever they want with the save, so you'll need to figure it out.
you said the psp uses AES to decrypt save data correct? do you know if it's some kind of variation because im looking to make my own decryption tool for this game, so far all i know is that it uses AES and that xor's the bytes
PSV1001 2.61 FieldRunners
PSP1001 6.60 Pro-C
PSP 3001 6.20 Pro-C2
qwikrazor87
Guru
Posts: 2874
Joined: Sat Apr 21, 2012 1:23 pm
Location: The North Pole

Re: trying to find gamekey in ppsspp for decryption of save

Post by qwikrazor87 »

grief3r wrote:you said the psp uses AES to decrypt save data correct? do you know if it's some kind of variation because im looking to make my own decryption tool for this game, so far all i know is that it uses AES and that xor's the bytes
yes, most, if not all, games use AES encryption on the saves, the AES encryption is handled by PSP kernel in chnnlsv.
Very few games add their own encryption/compression to the saves (before having the PSP encrypt it), and some also have hash checks.
Make sure that you are using the correct game key to decrypt the save.
In the case of the game encrypting/compressing it's save, you'll need to look into the game's code and figure out what happens.
PSP 2001 - TA-085 - 6.61 PRO-C2
PS Vita 3G - PCH-1101 - 3.65 HENkaku Ensō
Alcatel phone - Android 8.1.0
Laptop - Toshiba Satellite L305D-S5974 - Ubuntu 16.04 LTS
grief3r
Posts: 358
Joined: Sat Nov 09, 2013 4:12 am

Re: trying to find gamekey in ppsspp for decryption of save

Post by grief3r »

qwikrazor87 wrote:
grief3r wrote:you said the psp uses AES to decrypt save data correct? do you know if it's some kind of variation because im looking to make my own decryption tool for this game, so far all i know is that it uses AES and that xor's the bytes
yes, most, if not all, games use AES encryption on the saves, the AES encryption is handled by PSP kernel in chnnlsv.
Very few games add their own encryption/compression to the saves (before having the PSP encrypt it), and some also have hash checks.
Make sure that you are using the correct game key to decrypt the sav.
In the case of the game encrypting/compressing it's save, you'll need to look into the game's code and figure out what happens.
I suppose for that i will have to find the module sceIoOpen then set a breakpoint when i load the save data, then try to disassemble the code from there,
i know the game uses AES since SED can dec / enc the save data, i have tried this both ways and the save data loads( it only detects the corrupt save when i edit the unenc save then encrypt it back ,
however it would be useful to know which modules handle the AES so that i can skip this, then know where to find the start of the function that decompresses the save data,
thanks in advance
PSV1001 2.61 FieldRunners
PSP1001 6.60 Pro-C
PSP 3001 6.20 Pro-C2
qwikrazor87
Guru
Posts: 2874
Joined: Sat Apr 21, 2012 1:23 pm
Location: The North Pole

Re: trying to find gamekey in ppsspp for decryption of save

Post by qwikrazor87 »

grief3r wrote:I suppose for that i will have to find the module sceIoOpen then set a breakpoint when i load the save data, then try to disassemble the code from there,
i know the game uses AES since SED can dec / enc the save data, i have tried this both ways and the save data loads( it only detects the corrupt save when i edit the unenc save then encrypt it back ,
however it would be useful to know which modules handle the AES so that i can skip this, then know where to find the start of the function that decompresses the save data,
thanks in advance
It's a very tedious job pinpointing the function handling the game's custom enc/comp, I can't give you an easy road map for it, but you'll need to look for it somewhere after sceUtilitySavedataInitStart is called, find out where the save is loaded to, then see if you can find out what the game does with that data (psplink helps a lot in this case).
PSP 2001 - TA-085 - 6.61 PRO-C2
PS Vita 3G - PCH-1101 - 3.65 HENkaku Ensō
Alcatel phone - Android 8.1.0
Laptop - Toshiba Satellite L305D-S5974 - Ubuntu 16.04 LTS
Locked

Return to “Programming and Security”