[Release] Black Ops 2 FastFile decrypter

[kokole]

Bytes look ok with that key, but I can't seem to figure out what compression they use. Take a look at this 2 blocks i've decrypted from patch_mp.ff

This is what BuC-ShoTz did for Ps3. It may help you in your endeavor.

Spoiler (Click to View)

Code:

private List<byte[]> HashesList(List<byte[]> compressedZones)
        {
            SHA1 sha1 = new SHA1Managed();
            List<byte[]> hashesList = new List<byte[]>();
            foreach (byte[] compressedZone in compressedZones)
            {
                hashesList.Add(sha1.ComputeHash(compressedZone));
            }

            return hashesList;
        }

This is what he did as well for big endian.

Code:

using System;
using System.IO;

namespace BO2_FF_CRYPT
{
    class BigEndianReader : BinaryReader
    {
        private byte[] a16 = new byte[2];
        private byte[] a32 = new byte[4];
        private byte[] a64 = new byte[8];

        public BigEndianReader(Stream stream) : base(stream) { }

        public override Int16 ReadInt16()
        {
            a16 = base.ReadBytes(2);
            Array.Reverse(a16);
            return BitConverter.ToInt16(a16, 0);
        }

        public override int ReadInt32()
        {
            a32 = base.ReadBytes(4);
            Array.Reverse(a32);
            return BitConverter.ToInt32(a32, 0);
        }

        public override Int64 ReadInt64()
        {
            a64 = base.ReadBytes(8);
            Array.Reverse(a64);
            return BitConverter.ToInt64(a64, 0);
        }

        public override UInt16 ReadUInt16()
        {
            a16 = base.ReadBytes(2);
            Array.Reverse(a16);
            return BitConverter.ToUInt16(a16, 0);
        }

        public override UInt32 ReadUInt32()
        {
            a32 = base.ReadBytes(4);
            Array.Reverse(a32);
            return BitConverter.ToUInt32(a32, 0);
        }

        public override UInt64 ReadUInt64()
        {
            a64 = base.ReadBytes(8);
            Array.Reverse(a64);
            return BitConverter.ToUInt64(a64, 0);
        }
    }

    public class BigEndianWriter : BinaryWriter
    {
        private byte[] a16 = new byte[2];
        private byte[] a32 = new byte[4];
        private byte[] a64 = new byte[8];

        public BigEndianWriter(Stream output) : base(output) { }

        public override void Write(Int16 value)
        {
            a16 = BitConverter.GetBytes(value);
            Array.Reverse(a16);
            base.Write(a16);
        }

        public override void Write(Int32 value)
        {
            a32 = BitConverter.GetBytes(value);
            Array.Reverse(a32);
            base.Write(a32);
        }

        public override void Write(Int64 value)
        {
            a64 = BitConverter.GetBytes(value);
            Array.Reverse(a64);
            base.Write(a64);
        }

        public override void Write(UInt16 value)
        {
            a16 = BitConverter.GetBytes(value);
            Array.Reverse(a16);
            base.Write(a16);
        }

        public override void Write(UInt32 value)
        {
            a32 = BitConverter.GetBytes(value);
            Array.Reverse(a32);
            base.Write(a32);
        }

        public override void Write(UInt64 value)
        {
            a64 = BitConverter.GetBytes(value);
            Array.Reverse(a64);
            base.Write(a64);
        }
    }
}

Well that doesnt help at all, I just dont know the type of compression it is.

I wasn't too sure. Would the method be in the executable? I could decompile that for you.

XBOX 360 games use .xex format for executables right? Could you pm me it?

[CAPiiX]

Bytes look ok with that key, but I can't seem to figure out what compression they use. Take a look at this 2 blocks i've decrypted from patch_mp.ff

This is what BuC-ShoTz did for Ps3. It may help you in your endeavor.

Spoiler (Click to View)

Code:

private List<byte[]> HashesList(List<byte[]> compressedZones)
        {
            SHA1 sha1 = new SHA1Managed();
            List<byte[]> hashesList = new List<byte[]>();
            foreach (byte[] compressedZone in compressedZones)
            {
                hashesList.Add(sha1.ComputeHash(compressedZone));
            }

            return hashesList;
        }

This is what he did as well for big endian.

Code:

using System;
using System.IO;

namespace BO2_FF_CRYPT
{
    class BigEndianReader : BinaryReader
    {
        private byte[] a16 = new byte[2];
        private byte[] a32 = new byte[4];
        private byte[] a64 = new byte[8];

        public BigEndianReader(Stream stream) : base(stream) { }

        public override Int16 ReadInt16()
        {
            a16 = base.ReadBytes(2);
            Array.Reverse(a16);
            return BitConverter.ToInt16(a16, 0);
        }

        public override int ReadInt32()
        {
            a32 = base.ReadBytes(4);
            Array.Reverse(a32);
            return BitConverter.ToInt32(a32, 0);
        }

        public override Int64 ReadInt64()
        {
            a64 = base.ReadBytes(8);
            Array.Reverse(a64);
            return BitConverter.ToInt64(a64, 0);
        }

        public override UInt16 ReadUInt16()
        {
            a16 = base.ReadBytes(2);
            Array.Reverse(a16);
            return BitConverter.ToUInt16(a16, 0);
        }

        public override UInt32 ReadUInt32()
        {
            a32 = base.ReadBytes(4);
            Array.Reverse(a32);
            return BitConverter.ToUInt32(a32, 0);
        }

        public override UInt64 ReadUInt64()
        {
            a64 = base.ReadBytes(8);
            Array.Reverse(a64);
            return BitConverter.ToUInt64(a64, 0);
        }
    }

    public class BigEndianWriter : BinaryWriter
    {
        private byte[] a16 = new byte[2];
        private byte[] a32 = new byte[4];
        private byte[] a64 = new byte[8];

        public BigEndianWriter(Stream output) : base(output) { }

        public override void Write(Int16 value)
        {
            a16 = BitConverter.GetBytes(value);
            Array.Reverse(a16);
            base.Write(a16);
        }

        public override void Write(Int32 value)
        {
            a32 = BitConverter.GetBytes(value);
            Array.Reverse(a32);
            base.Write(a32);
        }

        public override void Write(Int64 value)
        {
            a64 = BitConverter.GetBytes(value);
            Array.Reverse(a64);
            base.Write(a64);
        }

        public override void Write(UInt16 value)
        {
            a16 = BitConverter.GetBytes(value);
            Array.Reverse(a16);
            base.Write(a16);
        }

        public override void Write(UInt32 value)
        {
            a32 = BitConverter.GetBytes(value);
            Array.Reverse(a32);
            base.Write(a32);
        }

        public override void Write(UInt64 value)
        {
            a64 = BitConverter.GetBytes(value);
            Array.Reverse(a64);
            base.Write(a64);
        }
    }
}

Well that doesnt help at all, I just dont know the type of compression it is.

I wasn't too sure. Would the method be in the executable? I could decompile that for you.

XBOX 360 games use .xex format for executables right? Could you pm me it?

Yes it does. I'll send you the default_mp.xex and default.xex
Also, I'll send you the decompiled exe of them with the IDC scripts.

[Red-EyeX32]

XBOX BOII .ff files use a unknown compression the same as MW3, the key is pretty useless only if you know what compression it uses :/

[kokole]

XBOX BOII .ff files use a unknown compression the same as MW3, the key is pretty useless only if you know what compression it uses :/

Well, ipak files use treyarch's made compression, maybe its that compression. Will test more.

[kokole]

XBOX BOII .ff files use a unknown compression the same as MW3, the key is pretty useless only if you know what compression it uses :/

Also the key is to decrypt, not to decompress. You must first decrypt, and then decompress.

[Red-EyeX32]

Thats very true, I have a tool that tests a lot of compressions... if you want it ill hook you up in a PM

[Red-EyeX32]

MW3 uses M$'s LZX compression format

[CAPiiX]

MW3 uses M$'s LZX compression format

I told him that already

[Erik The Born]

Thats very true, I have a tool that tests a lot of compressions... if you want it ill hook you up in a PM

Id like a tool like that thank you.