How to decrypt RPF archives on PC?

[nelabs]

(Previous thread with a less specific question)

 

I'm interested in making a proper mod manager for GTA V on PC (inspired by KSP-CKAN), but the problem is decrypting the RPF files on PC; OpenIV currently doesn't support automation, and LibertyV doesn't support the PC version. My knowledge of crypto and reverse engineering is poor, so I've been stumped by this. One solution would be to wait for the OpenIV package support and base a tool around that, but it's unclear if it could be fully automated or when it's going to be released. Would anyone more knowledgeable be willing to help with this, or is there any chance of getting the info from the OpenIV team?

 

Stuff I've found so far:

• Code examples of importing/exporting files for the console versions: LibertyV, RPFTool
• Info about the RPF format and crypto in GTA
• Example of extracting the encryption key for the console versions

[Neodymium]

In case that you are still interested, have a look at the source code of my gta-toolkit. Its a C# library that also supports decryption and encryption of GTAV RPF files.

 

Edit: And make sure to use an unencrypted exe (a memory dump of the running game for example) when trying to extract the key with the library. It won't work otherwise.

Edited January 31, 2016 by Neodymium

[nelabs]

Thanks a lot, this looks perfect.

[sasuke78200]

Hey so your tool allow to encrypt RPF ?

 

I know how to decrypt RPF thanks to the constants, but can you explain how you did to encrypt back ?

 

No problem if you want to keep this private

Edited January 31, 2016 by sasuke78200

[Neodymium]

There is nothing private. Everything is in the code that is necessary to do the encryption.

How exactly that works? Well, thats a bit tricky and not so easy to explain in a few sentences. But it's basically a mix of solving large systems of equations for getting encryption-constants and some bruteforcing where this doesnt work.

[nelabs]

Edit: And make sure to use an unencrypted exe (a memory dump of the running game for example) when trying to extract the key with the library. It won't work otherwise.

 

Is there some way to do this without having to make a dump?

[fastman92]

In case that you are still interested, have a look at the source code of my gta-toolkit. Its a C# library that also supports decryption and encryption of GTAV RPF files.

 

Edit: And make sure to use an unencrypted exe (a memory dump of the running game for example) when trying to extract the key with the library. It won't work otherwise.

Amazing work!

Do you have a degree in cryptography perhaps?

[sasuke78200]

 

Edit: And make sure to use an unencrypted exe (a memory dump of the running game for example) when trying to extract the key with the library. It won't work otherwise.

 

Is there some way to do this without having to make a dump?

 

 

You have to, because we need the constants to decrypt.

[fastman92]

 

 

Edit: And make sure to use an unencrypted exe (a memory dump of the running game for example) when trying to extract the key with the library. It won't work otherwise.

 

Is there some way to do this without having to make a dump?

 

 

You have to, because we need the constants to decrypt.

 

The other way would be to change a source code and include the constants instead of reading them from GTA5.exe

[sasuke78200]

 

 

 

Edit: And make sure to use an unencrypted exe (a memory dump of the running game for example) when trying to extract the key with the library. It won't work otherwise.

 

Is there some way to do this without having to make a dump?

 

 

You have to, because we need the constants to decrypt.

 

The other way would be to change a source code and include the constants instead of reading them from GTA5.exe

 

 

Well he doesn't really have to bother himself, because there's already two functions to avoid dumping each launch.

 

 

https://github.com/Neodymium146/gta-toolkit/blob/master/RageLib.GTA5/Cryptography/GTA5Constants.cs#L529

 

 

https://github.com/Neodymium146/gta-toolkit/blob/master/RageLib.GTA5/Cryptography/GTA5Constants.cs#L519

[nelabs]

You have to, because we need the constants to decrypt.

 

I meant to ask if there's a way to get the constants without making a dump, because it'd be impracticable to ask it from normal users.

[Neodymium]

You could ask the user to start the game once and then read the unencrypted exe automatically from the memory using the windows API. The constants can then, as mentioned above, saved to the harddisk.

The other way is to find a way to decrypt the exe file. OpenIV seems to do it that way since there is no need to start the game.

It's just a guess, but if I remember correctly, the AES key was also found in the encrypted exe. This is probably a good starting point.

 

Another thing: An alternative to edit RPF files on the harddisk is to virtualize them such that mods dont need an installation at all. If you know some C++, it's maybe worth to improve or rewrite my mod-loader.

[fastman92]

 

Neodymium, do you have a degree in cryptography perhaps?

Edited February 2, 2016 by fastman92

[sasuke78200]

 

You have to, because we need the constants to decrypt.

 

I meant to ask if there's a way to get the constants without making a dump, because it'd be impracticable to ask it from normal users.

 

 

 

Use x64dbg

[Neodymium]

Neodymium, do you have a degree in cryptography perhaps?

I have an academic degree but not in cryptography or computer science.

[roundy72]

In case that you are still interested, have a look at the source code of my gta-toolkit. Its a C# library that also supports decryption and encryption of GTAV RPF files.

 

Edit: And make sure to use an unencrypted exe (a memory dump of the running game for example) when trying to extract the key with the library. It won't work otherwise.

 

 

This project is incredible! I'm humbled. Only works with uncracked game .exe

Edited April 7, 2016 by roundy72

[jrchaves]

HI Neodymium,

 

You mentioned above that you were able to decrypt RPF file using gta-toolkit ... Could you please explain how to use it? I read the documentation and didn´t find info about that. Thanks in advance dude!