Open otDan opened 6 months ago
This game most likely uses godot 4, which wasn't properly supported. i'm currently working on a rewrite to make it work on 4. in the mean time you can still reverse it manually using what is stated in the readme (if it is on 4.0 you will need to look for open_and_parse rather than bytecode ... )
@pozm the game is running on 3.5.3, not 4.x
Hi sorry i've been busy recently. old version of gdke probably doesn't work, but i've working on new version which has a different detection mechanism which hopefully should be able to do most of godot 3
@otDan It's funny, I was trying to get the key for BackpackBattles as well and I did some digging in IDA. They use a little bit of modified engine code here (I think) and modify the key bytes just a little so the key in the static binary is not the right key. I got the right key by setting a breakpoint before the open_and_parse function and reading it out the register (rax i think) in gdb. Any debugger will work.
@otDan It's funny, I was trying to get the key for BackpackBattles as well and I did some digging in IDA. They use a little bit of modified engine code here (I think) and modify the key bytes just a little so the key in the static binary is not the right key. I got the right key by setting a breakpoint before the open_and_parse function and reading it out the register (rax i think) in gdb. Any debugger will work.
It's probably related to this project tho': https://github.com/CredibleOpossum/godot-key-extractor
@manjaroman2 Can you explain how you did it? I gave it a try but as a newbie I didn't get precisly how to do it using IDA. All I can do is to find the open_and_parse function disassembling the original exe
I misremembered where it set the breakpoint sorry. Here is the full tutorial if you will:
As you can see in the image above, there is a call to open_and_parse which takes in a to reference the key as a parameter.
Furthermore, you can track the reference to the key to a library call to mbedtls:
The method where I set the breakpoint is set_decode_key. You need to find that method in IDA and get the address of that call. You can see it here in IDA:
If I Rightclick and switch to Textview, I can see the call to set_decode_key happening at address 0x000000014152330B. (Im using the latest demo version available on steam)
Now you need to be a bit familiar with a debugger, I only use gdb so I can just explain how I did it with gdb on Linux. If you're on Windows you don't need to change the proton version. There is gdb for Windows, but I don't know how to attach it to steam games, you need to find that out yourself. There is also x64dbg
@manjaroman2 hi bro , what is version 0.9 godot game extract key , can't find it . ðŸ˜ðŸ˜ðŸ˜
Ok now I booted up my VM and I found the key on Windows just by using IDA:
(gTANb_lIQth/eb.utuoy//:sptth)
Thanks for all the helpful comments! Following @manjaroman2 instructions, I was able to retrieve the key (64 characters hex) on Windows, using x64dbg. IDA wasn't showing the function names, though so I had to rely on the adresses he provided. I guess you need to do something else for that? Fortunately, everything was the same, even for the EA version. I just had to convert the relative address (displayed in IDA) to the address in the memory (when running the application) before setting the breakpoint. Here's a guide. At breakpoint, the first address in rbx was the right one.
@jeuxdevilains can you tell me the key? I am a newbie ,thanks
Thanks for all the helpful comments! Following @manjaroman2 instructions, I was able to retrieve the key (64 characters hex) on Windows, using x64dbg. IDA wasn't showing the function names, though so I had to rely on the adresses he provided. I guess you need to do something else for that? Fortunately, everything was the same, even for the EA version. I just had to convert the relative address (displayed in IDA) to the address in the memory (when running the application) before setting the breakpoint. Here's a guide. At breakpoint, the first address in rbx was the right one.
IDA does show the function names but it needs some time to analyze. Even if IDA doesn't show them: The source code is available and with all the logging and going on, the 'strings' tab in IDA is very helpful
@manjaroman2 , The key i got( 8671*****E849) is the same as you got by IDA settting breaking points in the function of set_decode_key Throughing searching the strings "FileAccessEncrypted::open_and_parse" , but i cannot get codes by GDRE tools ,it is very very strange.It's outrageous
thanks all. I have successed.I strongly agree that the 'strings' tab in IDA is very helpful
thanks all. I have successed.I strongly agree that the 'strings' tab in IDA is very helpful
Did GDRE working fine ?
yes, the tool is very useful
@singlesparkshine
yes, the tool is very useful
i also get the key 867142......4CE849,but with GDRE 0.6.2 version ,it can't be correctly work. how do you successed with gdre?i will appreciate you response.
I am testing with this game demo: https://store.steampowered.com/app/2427700/Backpack_Battles/ trying to use the key I get with gdre tools it fails to recover the scripts