Question LAS VENTURAS MOD 2.0 (ENCRYPTED-NEED HELP WITH DECRYPTION)

[lazzadimauro]

I have the patreon version of LAS VENTURAS Project 2.0 mod , but it is encrypted someone if can please help with decryption.
This is the link of the file:

Hidden link for visitors, to see Log in or register now.

Video of the mod:

 

[hszxvenom11]

Did you find the solution?

 

[lazzadimauro]

no I'm waiting for someone to decrypt it for me

 

[abyss69]

Maybe im missing something, what exactly is encrypted? I can install the OIV without problem, only issue is it doesnt work.

 

[lazzadimauro]

Maybe im missing something, what exactly is encrypted? I can install the OIV without problem, only issue is it doesnt work.

precisely, the file is encrypted and without decrypting it, the oiv file does not work, this is because to work you need to have the discord connected to the patreon

 

[burdwjma]

precisely, the file is encrypted and without decrypting it, the oiv file does not work, this is because to work you need to have the discord connected to the patreon

youd have to contact someone who knows c++ to reverse engineer and take out all the stuff from the asi files and possibly someone who knows how to unlock the dlcpack. i will ask around

 

[D3vil233]

i got one version off that but still bugged version like 1gb map

 

[wazaa!!1]

*pbVar1 = *pbVar1 & (byte)((ulong)uVar7 >> 0x18); repeated everywhere, its most likely than not malware so i js suggest using the dlc (static decompiler)

 

[wazaa!!1]

this is definitely a virus

 

[wazaa!!1]

so it turns out,​

it actually does something, it's just stuck in a bunch of unreadable trash; i'll update you guys if i get any hints, but for now it's just on this

 

[wazaa!!1]

i might be onto something here

 

[wazaa!!1]

# dear people,

it has come to my conclusion that the rpf file is encrypted using the drm, most likely using aes-gcm256, BUT not all hope is lost.
so, my theory is that we could be able to load the file structure, since all the other bytes are good, as shown here by EmEditor :

as you can see, the first 17638 bytes are effectively "rubbish", because there is no real file structure pointer, and "DRM..." is not a valid RPF header

but as you can see here, in another legitimate and working mod (thank you Starfox on LauncherLeaks), the first bytes are not rubbish, and constitute a valid RPF header

however, right after the rubbish ends (on the LV2.0.0 mod), the rubbish effectively stops, and is instead replaced with a valid RPF readable segment (1176 blanks)

what led me to say that, is just saying that all we need is the file structure, so using a tool like disk drill or such would help us recover native file indexes in that file

 

[wazaa!!1]

you all will not believe this, the mod uses CryptoAPI, meaning if we hook into advapi.dll with something like Frida server we can find the encryption keys

 

[wazaa!!1]

thou shalt answer

 

[wazaa!!1]

 

[wazaa!!1]

 

[wazaa!!1]

mmhhhm yeah i've definitely found the encryption logic

 

[sws121]

mmhhhm yeah i've definitely found the encryption logic

Thanks for letting us know, and idk it was modders problem for approving virus OIV

 

[lazzadimauro]

mmhhhm yeah i've definitely found the encryption logic

Wow, I reopened this post after months and didn't even remember doing so. I just saw all these messages from you. Did you manage to decrypt the file? Can you play the map?

 

[lazzadimauro]

mmhhhm yeah i've definitely found the encryption logic

If you want you can talk to me on Discord send request to “zaffiro1889”