Help! Decrypt global-metadata.dat

[XX:HACKER::XX]

Hello guys! Now I face a problem with metadata in game Block Strike! I try to decrypt it with GG, but encrypt isn`t move decrypted file in game directory at runtime, also I try to find code of decrypt in IDA Pro, but also unsuccessfully. Who can help?

UPD: I don`t need dump.cs from some modules, i need global-metadata.dat(decrypted).

 

[Daleon228_09]

You can find function what decrypt metadata in runtime with IDA. It may be in the metadata loader

 

[XX:HACKER::XX]

You can find function what decrypt metadata in runtime with IDA. It may be in the metadata loader

unfortunatly, nobody can do it now

 

[nowhere_222]

You can use game guardian and search magic value from metadata not protected

AF 1B B1 FA r

> search this with Game Guardian

Enable XA range of memory or CA range, and sometimes it's located to O range

 

[nowhere_222]

 

[XX:HACKER::XX]

View attachment 665406

in this game, the protection is better, in Game Guardian it is not just looking for these bytes

 

[losteri]

Block Strike is using an encryption scheme similar to TEA (Tiny Encryption Algorithm) with xor algorithms, they encrypted the file name in bytes and then decrypted using keys from -93 to -75 forming the file name later loading it

If you are on the latest version you can try to find the physical address in the game's memory by trying to use some Frida script to find the virtual address sub_743358 and see the data stored within it (this address is responsible for storing the decrypted data, in theory)

 

[XX:HACKER::XX]

Block Strike использует схему шифрования, похожую на TEA (Tiny Encryption Algorithm) с алгоритмами xor, они шифруют имя файла в байтах, а затем расшифровывают с помощью ключей от -93 до -75, формируя имя файла и позже загружая его.View attachment 666444

Если у вас установлена последняя версия, вы можете попытаться найти физический адрес в памяти игры, попытавшись использовать скрипт Frida, чтобы найти виртуальный адрес sub_743358 и просмотреть данные, хранящиеся в нем (теоретически этот адрес отвечает за хранение расшифрованных данных).View attachment 666445

Тhanks, I try it

 

[XX:HACKER::XX]

Block Strike is using an encryption scheme similar to TEA (Tiny Encryption Algorithm) with xor algorithms, they encrypted the file name in bytes and then decrypted using keys from -93 to -75 forming the file name later loading itView attachment 666444

If you are on the latest version you can try to find the physical address in the game's memory by trying to use some Frida script to find the virtual address sub_743358 and see the data stored within it (this address is responsible for storing the decrypted data, in theory)View attachment 666445

can I do something without Frida, because for some reason the game crashes when using it?