EDIT: Looks like CriPakGUI, the tool I used to extract the cpks, is just doing something wrong here. I tried some other cpk extractors and the extracted files look ok. Hi,
I was looking at the files of the game 428: Shibuya Scramble for the Wii. Most of the files are encrypted. But at the end of each file there is a part that is not encrypted. This part seem to be the first 256 bytes of the original file. See:
At 0xC is a pointer (little endian) that points to the end of the encrypted file (0x01D0 + 0x10 (header size maybe) = 0x01E0). The orignial file is a TPL (image) with the identifier "00 20 AF 30".
Any idea how to decrypt this?
Last edited by RetroHelix on Tue Jan 09, 2018 4:45 pm, edited 2 times in total.
Looks like the data is not encrypted but compressed... Luckily there are some uncompressed files on the disc and I was able to find an uncompressed and a compressed version of the same file. When I did a comtypescan with quickbms I got mostly garbage but there was one compressiontype which was able to extract at least a small part right. With comtype 629 COMP_LZW_STELLAR7 the string "DUMMY_LABEL" was extracted correctly:
For the archiveformat: long unk #always 0x0000 long unk #always 0x0000 SIZE long ZSIZE long
aluigi wrote:Probably that "DUMMY_LABEL" comes from your memory, that's quite normal with wrong compression algorithms that read data outside their buffers.
