感谢 luoyi & 66hh
样本：永恒与星辰与日常
https://steamdb.info/app/4169820/
无视LGPL协议 & 盗版VMProtect
商用还敢这么玩是吧
VMP：Ultimate 3.8.4.1754 - LiuMing [[email protected]]
密钥提取
TitanHide过掉VMP的反调试，steam启动以后attach上去，对EVP_Chiperinit_EX2下断即可
rpa解密
index就是标准rpa的index
Python
import json
from pathlib import Path
from Crypto.Cipher import AES
RPA_ROOT = Path("D:/SteamLibrary/steamapps/common/永恒与星辰与日常/game")
INDEX = Path("index.json")
OUT = Path("out")
KEY = bytes.fromhex("6C392AFB08412531C9727C85DD1F015D41435135BEBFCB3A7663ACB4C5CF6962")
def decrypt(data, iv):
iv = iv.ljust(16, b"\x00")
return AES.new(KEY, AES.MODE_CTR, nonce=b"", initial_value=iv).decrypt(data)
idx = json.loads(INDEX.read_text())
for rpa, files in idx:
rpa_path = RPA_ROOT / rpa
with rpa_path.open("rb") as f:
for name, entries in files.items():
out = OUT / name
out.parent.mkdir(parents=True, exist_ok=True)
with out.open("wb") as w:
for offset, length, iv_hex in entries:
f.seek(offset)
data = f.read(length)
w.write(decrypt(data, bytes.fromhex(iv_hex)))
3 条回复