MH:Rise PC pak (entry header) decryption

test_mhrise_pak_decrypt.py

import io
import struct
import binascii

def transform_crypto_key(input):
    # Pretty sure this is a public hash
    # input = binascii.unhexlify('c8399c72d1a39b08a0eb1867b9bf051344a230786a74de6fb6f37b8b05621f1529bf4365a8a2d106accbc6f9fd89bcce87e0cb2891b837a10805f463c17f13416ddb6b74f94326185abb0fbba95816e34c8ce7f477d327368116087e11fdb4f9096a314a30a1b16f4c327ca98adf1ce88606eadc228bdb4e95127042952e3798')
    output = binascii.unhexlify('66BF3EAAE9B08286E2DE8F9D21993E78C7AEF6DF069347942E1D0FCAAC817A67')
    return output

if __name__ == '__main__':
    with open('re_chunk_000.pak', 'rb') as f:
        header_bytes = f.read(16)
        magic, version, unk0, flags, unk2, entry_count, unk3 = struct.unpack('<IBBBBII', header_bytes)

        # Regular deflate of zstd compression
        if (flags & 1) > 0 or (flags & 2) > 0:
            raise NotImplementedError

        # Encrypted entries
        if (flags & 8) > 0:
            # Read the raw TOC entry table data (encrypted), and key
            raw_data = bytearray(f.read(48 * entry_count))
            crypto_key = f.read(128)

            # Some transformation function or hash
            transformed_key = transform_crypto_key(crypto_key)

            print('decrypting...')
            for i, k in enumerate(raw_data):
                b0 = transformed_key[i%32]
                b1 = transformed_key[i%29]
                xor_byte = i + ((b0 * b1) & 0xFF)
                raw_data[i] ^= xor_byte & 0xFF

            # Read the entry headers.
            rdr = io.BytesIO(raw_data)
            for i in range(entry_count):
                entry_hash, offset, compressed_size, uncompressed_size, attributes, unk = struct.unpack('<QQQQQQ', rdr.read(48))
                print(f'entry_hash:{entry_hash:X}')
                print(f'\toffset:{offset:X}')
                print(f'\tcompressed_size:{compressed_size:X}')
                print(f'\tuncompressed_size:{uncompressed_size:X}')
                print(f'\tattributes:{attributes:X}')
                print(f'\tunk:{unk:X}')