[Release] Black Ops 2 FastFile decrypter

[kokole]

So this is the release of my BO2 FF (FastFile) decrypter for PC version (not sure what encryption does xbox360 version use)

Not much to say, it just decrypts black ops 2 fast files. Source included.

Credits:
@kokole for making decrypter
@master131 for giving the salsa20 key


  bo2_ff_decrypter_clr.rar (Size: 182.28 KB / Downloads: 1,702)

[JariZ]

In it's current state, there's not much to do with this considering I can't get the files that are inside.
Nevertheless great job, to the both of you!

[CAPiiX]

The Xbox 360 version also uses salsa20.
If you want to have a go at a console FF then here is the key.

Code:

ffKey[0x20] = { 0x0E, 0x50, 0xF4, 0x9F, 0x41, 0x23, 0x17, 0x09, 0x60, 0x38, 0x66, 0x56, 0x22, 0xDD, 0x09, 0x13, 0x32, 0xA2, 0x09, 0xBA, 0x0A, 0x05, 0xA0, 0x0E, 0x13, 0x77, 0xCE, 0xDB, 0x0A, 0x3C, 0xB1, 0xD3 };

If you need, I will upload an FF for you later. Just name the one you want.

[DidUknowiPwn]

The Xbox 360 version also uses salsa20.
If you want to have a go at a console FF then here is the key.

Code:

ffKey[0x20] = { 0x0E, 0x50, 0xF4, 0x9F, 0x41, 0x23, 0x17, 0x09, 0x60, 0x38, 0x66, 0x56, 0x22, 0xDD, 0x09, 0x13, 0x32, 0xA2, 0x09, 0xBA, 0x0A, 0x05, 0xA0, 0x0E, 0x13, 0x77, 0xCE, 0xDB, 0x0A, 0x3C, 0xB1, 0xD3 };

If you need, I will upload an FF for you later. Just name the one you want.

Nice! Can you send me the patch_mp?

[CAPiiX]

The Xbox 360 version also uses salsa20.
If you want to have a go at a console FF then here is the key.

Code:

ffKey[0x20] = { 0x0E, 0x50, 0xF4, 0x9F, 0x41, 0x23, 0x17, 0x09, 0x60, 0x38, 0x66, 0x56, 0x22, 0xDD, 0x09, 0x13, 0x32, 0xA2, 0x09, 0xBA, 0x0A, 0x05, 0xA0, 0x0E, 0x13, 0x77, 0xCE, 0xDB, 0x0A, 0x3C, 0xB1, 0xD3 };

If you need, I will upload an FF for you later. Just name the one you want.

Nice! Can you send me the patch_mp?

Here you go: http://www.mediafire.com/?hhdmjb1pu84bvwr

[DidUknowiPwn]

thanks will take a look at it later.

[kokole]

Bytes look ok with that key, but I can't seem to figure out what compression they use. Take a look at this 2 blocks i've decrypted from patch_mp.ff


  patch_mp.rar (Size: 3.08 KB / Downloads: 136)

[CAPiiX]

Bytes look ok with that key, but I can't seem to figure out what compression they use. Take a look at this 2 blocks i've decrypted from patch_mp.ff

This is what BuC-ShoTz did for Ps3. It may help you in your endeavor.

Spoiler (Click to View)

Code:

private List<byte[]> HashesList(List<byte[]> compressedZones)
        {
            SHA1 sha1 = new SHA1Managed();
            List<byte[]> hashesList = new List<byte[]>();
            foreach (byte[] compressedZone in compressedZones)
            {
                hashesList.Add(sha1.ComputeHash(compressedZone));
            }

            return hashesList;
        }

This is what he did as well for big endian.

Code:

using System;
using System.IO;

namespace BO2_FF_CRYPT
{
    class BigEndianReader : BinaryReader
    {
        private byte[] a16 = new byte[2];
        private byte[] a32 = new byte[4];
        private byte[] a64 = new byte[8];

        public BigEndianReader(Stream stream) : base(stream) { }

        public override Int16 ReadInt16()
        {
            a16 = base.ReadBytes(2);
            Array.Reverse(a16);
            return BitConverter.ToInt16(a16, 0);
        }

        public override int ReadInt32()
        {
            a32 = base.ReadBytes(4);
            Array.Reverse(a32);
            return BitConverter.ToInt32(a32, 0);
        }

        public override Int64 ReadInt64()
        {
            a64 = base.ReadBytes(8);
            Array.Reverse(a64);
            return BitConverter.ToInt64(a64, 0);
        }

        public override UInt16 ReadUInt16()
        {
            a16 = base.ReadBytes(2);
            Array.Reverse(a16);
            return BitConverter.ToUInt16(a16, 0);
        }

        public override UInt32 ReadUInt32()
        {
            a32 = base.ReadBytes(4);
            Array.Reverse(a32);
            return BitConverter.ToUInt32(a32, 0);
        }

        public override UInt64 ReadUInt64()
        {
            a64 = base.ReadBytes(8);
            Array.Reverse(a64);
            return BitConverter.ToUInt64(a64, 0);
        }
    }

    public class BigEndianWriter : BinaryWriter
    {
        private byte[] a16 = new byte[2];
        private byte[] a32 = new byte[4];
        private byte[] a64 = new byte[8];

        public BigEndianWriter(Stream output) : base(output) { }

        public override void Write(Int16 value)
        {
            a16 = BitConverter.GetBytes(value);
            Array.Reverse(a16);
            base.Write(a16);
        }

        public override void Write(Int32 value)
        {
            a32 = BitConverter.GetBytes(value);
            Array.Reverse(a32);
            base.Write(a32);
        }

        public override void Write(Int64 value)
        {
            a64 = BitConverter.GetBytes(value);
            Array.Reverse(a64);
            base.Write(a64);
        }

        public override void Write(UInt16 value)
        {
            a16 = BitConverter.GetBytes(value);
            Array.Reverse(a16);
            base.Write(a16);
        }

        public override void Write(UInt32 value)
        {
            a32 = BitConverter.GetBytes(value);
            Array.Reverse(a32);
            base.Write(a32);
        }

        public override void Write(UInt64 value)
        {
            a64 = BitConverter.GetBytes(value);
            Array.Reverse(a64);
            base.Write(a64);
        }
    }
}

[kokole]

Bytes look ok with that key, but I can't seem to figure out what compression they use. Take a look at this 2 blocks i've decrypted from patch_mp.ff

This is what BuC-ShoTz did for Ps3. It may help you in your endeavor.

Spoiler (Click to View)

Code:

private List<byte[]> HashesList(List<byte[]> compressedZones)
        {
            SHA1 sha1 = new SHA1Managed();
            List<byte[]> hashesList = new List<byte[]>();
            foreach (byte[] compressedZone in compressedZones)
            {
                hashesList.Add(sha1.ComputeHash(compressedZone));
            }

            return hashesList;
        }

This is what he did as well for big endian.

Code:

using System;
using System.IO;

namespace BO2_FF_CRYPT
{
    class BigEndianReader : BinaryReader
    {
        private byte[] a16 = new byte[2];
        private byte[] a32 = new byte[4];
        private byte[] a64 = new byte[8];

        public BigEndianReader(Stream stream) : base(stream) { }

        public override Int16 ReadInt16()
        {
            a16 = base.ReadBytes(2);
            Array.Reverse(a16);
            return BitConverter.ToInt16(a16, 0);
        }

        public override int ReadInt32()
        {
            a32 = base.ReadBytes(4);
            Array.Reverse(a32);
            return BitConverter.ToInt32(a32, 0);
        }

        public override Int64 ReadInt64()
        {
            a64 = base.ReadBytes(8);
            Array.Reverse(a64);
            return BitConverter.ToInt64(a64, 0);
        }

        public override UInt16 ReadUInt16()
        {
            a16 = base.ReadBytes(2);
            Array.Reverse(a16);
            return BitConverter.ToUInt16(a16, 0);
        }

        public override UInt32 ReadUInt32()
        {
            a32 = base.ReadBytes(4);
            Array.Reverse(a32);
            return BitConverter.ToUInt32(a32, 0);
        }

        public override UInt64 ReadUInt64()
        {
            a64 = base.ReadBytes(8);
            Array.Reverse(a64);
            return BitConverter.ToUInt64(a64, 0);
        }
    }

    public class BigEndianWriter : BinaryWriter
    {
        private byte[] a16 = new byte[2];
        private byte[] a32 = new byte[4];
        private byte[] a64 = new byte[8];

        public BigEndianWriter(Stream output) : base(output) { }

        public override void Write(Int16 value)
        {
            a16 = BitConverter.GetBytes(value);
            Array.Reverse(a16);
            base.Write(a16);
        }

        public override void Write(Int32 value)
        {
            a32 = BitConverter.GetBytes(value);
            Array.Reverse(a32);
            base.Write(a32);
        }

        public override void Write(Int64 value)
        {
            a64 = BitConverter.GetBytes(value);
            Array.Reverse(a64);
            base.Write(a64);
        }

        public override void Write(UInt16 value)
        {
            a16 = BitConverter.GetBytes(value);
            Array.Reverse(a16);
            base.Write(a16);
        }

        public override void Write(UInt32 value)
        {
            a32 = BitConverter.GetBytes(value);
            Array.Reverse(a32);
            base.Write(a32);
        }

        public override void Write(UInt64 value)
        {
            a64 = BitConverter.GetBytes(value);
            Array.Reverse(a64);
            base.Write(a64);
        }
    }
}

Well that doesnt help at all, I just dont know the type of compression it is.

[CAPiiX]

Bytes look ok with that key, but I can't seem to figure out what compression they use. Take a look at this 2 blocks i've decrypted from patch_mp.ff

This is what BuC-ShoTz did for Ps3. It may help you in your endeavor.

Spoiler (Click to View)

Code:

private List<byte[]> HashesList(List<byte[]> compressedZones)
        {
            SHA1 sha1 = new SHA1Managed();
            List<byte[]> hashesList = new List<byte[]>();
            foreach (byte[] compressedZone in compressedZones)
            {
                hashesList.Add(sha1.ComputeHash(compressedZone));
            }

            return hashesList;
        }

This is what he did as well for big endian.

Code:

using System;
using System.IO;

namespace BO2_FF_CRYPT
{
    class BigEndianReader : BinaryReader
    {
        private byte[] a16 = new byte[2];
        private byte[] a32 = new byte[4];
        private byte[] a64 = new byte[8];

        public BigEndianReader(Stream stream) : base(stream) { }

        public override Int16 ReadInt16()
        {
            a16 = base.ReadBytes(2);
            Array.Reverse(a16);
            return BitConverter.ToInt16(a16, 0);
        }

        public override int ReadInt32()
        {
            a32 = base.ReadBytes(4);
            Array.Reverse(a32);
            return BitConverter.ToInt32(a32, 0);
        }

        public override Int64 ReadInt64()
        {
            a64 = base.ReadBytes(8);
            Array.Reverse(a64);
            return BitConverter.ToInt64(a64, 0);
        }

        public override UInt16 ReadUInt16()
        {
            a16 = base.ReadBytes(2);
            Array.Reverse(a16);
            return BitConverter.ToUInt16(a16, 0);
        }

        public override UInt32 ReadUInt32()
        {
            a32 = base.ReadBytes(4);
            Array.Reverse(a32);
            return BitConverter.ToUInt32(a32, 0);
        }

        public override UInt64 ReadUInt64()
        {
            a64 = base.ReadBytes(8);
            Array.Reverse(a64);
            return BitConverter.ToUInt64(a64, 0);
        }
    }

    public class BigEndianWriter : BinaryWriter
    {
        private byte[] a16 = new byte[2];
        private byte[] a32 = new byte[4];
        private byte[] a64 = new byte[8];

        public BigEndianWriter(Stream output) : base(output) { }

        public override void Write(Int16 value)
        {
            a16 = BitConverter.GetBytes(value);
            Array.Reverse(a16);
            base.Write(a16);
        }

        public override void Write(Int32 value)
        {
            a32 = BitConverter.GetBytes(value);
            Array.Reverse(a32);
            base.Write(a32);
        }

        public override void Write(Int64 value)
        {
            a64 = BitConverter.GetBytes(value);
            Array.Reverse(a64);
            base.Write(a64);
        }

        public override void Write(UInt16 value)
        {
            a16 = BitConverter.GetBytes(value);
            Array.Reverse(a16);
            base.Write(a16);
        }

        public override void Write(UInt32 value)
        {
            a32 = BitConverter.GetBytes(value);
            Array.Reverse(a32);
            base.Write(a32);
        }

        public override void Write(UInt64 value)
        {
            a64 = BitConverter.GetBytes(value);
            Array.Reverse(a64);
            base.Write(a64);
        }
    }
}

Well that doesnt help at all, I just dont know the type of compression it is.

I wasn't too sure. Would the method be in the executable? I could decompile that for you.