Skip to content

Instantly share code, notes, and snippets.

@SciresM
Last active May 12, 2018 07:32
Show Gist options
  • Save SciresM/f3d20f8c77f5514f2d142c9760939266 to your computer and use it in GitHub Desktop.
Save SciresM/f3d20f8c77f5514f2d142c9760939266 to your computer and use it in GitHub Desktop.
QR Rental Team structs
typedef struct
{
u8 data[0x18E];
u8 memesig[0x60];
} qr_meme_t;
typedef struct
{
u8 metadata_flags[0x8];
u8 random_ctr_for_aes[0x10];
u8 aes_ctr_encrypted_data[0x1CE];
u8 sha1_of_preceding[0x8];
} qr_t;
typedef struct
{
u8 metadata_flags[0x8];
u8 random_ctr_for_Aes[0x10];
u8 pokemon_1[0x30];
u8 pokemon_2[0x30];
u8 pokemon_3[0x30];
u8 pokemon_4[0x30];
u8 pokemon_5[0x30];
u8 pokemon_6[0x30];
u64 game_sync_id;
u8 unknown_data[0xA6];
u8 sha1_of_preceding[0x8];
} qr_dec_t;
@SciresM
Copy link
Author

SciresM commented Nov 19, 2016

qr_t = memecrypto_verify(qr_meme_t);

AES is AES-CTR using key 0F8E2F405EAE51504EDBA7B4E297005B and a random 0x10 CTR included in the QR code.

Pokemon structs are 0x30 each. Game sync ID is checked against save to ensure QR is meant for specific save file.

Now to document more of the decrypted structures ( ͡° ͜ʖ ͡°)

@xFalox
Copy link

xFalox commented Nov 19, 2016

You know, there are plugins to auto-generate structures?

/*
This file has been generated by IDA.
It contains local type definitions from
the type library 'moon'
*/

#define __int8 char
#define __int16 short
#define __int32 int
#define __int64 long long

struct pgl_pokeparam_data
{
int Key;
char HyperTrainingFlags;
char field_5;
char field_6;
char field_7;
char PPUps[4];
int IvFlags;
int field_10;
__int16 MonsNo;
__int16 HoldItem;
__int16 Moves[4];
char field_20;
char AbilityFlags;
char Nature;
char EncounterFlags;
char EffortHp;
char EffortAtk;
char EffortDef;
char EffortSpeed;
char EffortSpAtk;
char EffortSpDef;
char field_2A;
char Familiarity;
char Pokeball;
char Level;
char CassetteVersion;
char LangId;
};

@Phil-DS
Copy link

Phil-DS commented Jul 19, 2017

I'm trying to write a decoder using this as a guide. However, I find that the QR codes have 507 bytes, but there are 494 bytes in the struct. I'm trying to find which bytes to remove so I get the right data to decode.
EDIT
Found the issue. Using ZXing for decoding. The getRawBytes() returns the 3 header Bytes, and shifted everything to the left by 4 bits. Shifted them back, and now its de-meme'd.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment