search

EgoEngineModding / ego.nefsedit

NeFS archive editor for Ego Engine
MIT License
25 stars 9 forks source link

Dirt Rally 2.0 - DLC cars NEFS cant be opened #2

Closed ghost closed 4 years ago

ghost commented 5 years ago

The DLC cars (Porsche 911 RGT, Skoda Fabia WRC and Citroen C4 WRC for the moment) NEFS cant be opened. Can you take a look please? Much apreciated. Thank you.

victorbush commented 5 years ago

The nefs headers appear to be encrypted. Initial attempts to determine method of encryption were unsuccessful. I'll revisit later but I can't guarantee anything.

jonophipps commented 5 years ago

Supporting DLC cars would be massive - and hugely appreciated by the whole community! There are a bunch of outstanding DLC cars both released and coming soon that we'd love to be able to mod <3

zissakos commented 5 years ago

Hi, I am the creator of EECMT and stumbled upon this same issue. It would be great if you could look into this. Much appreciated!! thanks!!!!

zissakos commented 5 years ago

Alternativaly if you could sketch a rough idea of how you would go about it (in your code) then I coud try myself.

victorbush commented 5 years ago

Finally got some time to look at encrypted nefs files.

It appears the encryption method @Gigi1237 found (see here) is also used for the dlc cars. The only difference being that the header is encrypted also. The first 0x80 bytes of the header is encrypted/obfuscated with some unknown scheme. Once that is decrypted, the second 0x80 bytes of the header are decrypted using AES ECB with the key from the header at 0x24.

Need to reverse the decryption of the first 0x80 bytes of the header. Partially done, but no ETA on this.

opcod3 commented 5 years ago

If you need a hand figuring out encryption for dlc too let me know, and tell me if ypu have any leads where to look in the exe. As I'm relatively familiar with it. If i recall correctly I also saw decryption code for AES CBC but I never saw it called, although I never investigated much.

victorbush commented 5 years ago

Yes that would be great. I'll send you an email later with some info.

victorbush commented 4 years ago

Ability to open encrypted NeFS archives added by PR #4. Available in release 0.4.0. Huge thanks to @Gigi1237 for cracking this!