[EF破解交流贴]栽在这种假档下，我认了-

引用

(for archives in full version of ef) most of the first 32 bytes seems to be garbage (but i'm not sure), but you want to notice the byte at 0x08, that's the byte you'll be xoring with before you get to BlowfishDecrypt.

so, you'd:

> read in the first 32 bytes in the archive, save the byte at offset 0x08, and then dump the rest of them
> xor this "key byte" with a 4-byte integer at offset 0x20, and that's the length of index
> read in the index, xor it with the "key byte", then BlowfishDecrypt it with the first set of Blowfish key. now you've got the index ready to use
> to extract files from the rest of the archive, xor with the "key byte" first and then BlowfishDecrypt.

just to mention that, in full version of ef, the initialization of pbox is somehow different from standard Blowfish and from ef_trial. in ef_trial, you have to negate every key byte before it's used in an otherwise standard Blowfish init.

so if you had a standard implementation of Blowfish, in ef_trial you'd: (in pseudo code)

negateAllBytes(key1);
BlowfishInit(key1);

now in full version you have to do something tricky, so let's get more into the details of what would be a part of BlowfishInit. the code snippet below should replace the round of xoring pbox with the key for Blowfish: (in C++)

suppose:
unsigned int pbox[18]; // the pbox of Blowfish
byte* key; // pointer to the key for Blowfish, and that the length of key is always 0x20 in minori's games
then,

复制代码

1. unsigned int ofs = 0; // offset of current byte in key
3. for (int i = 0; i < 18; ++i) { // iterate though pbox
4. unsigned int build = 0;
5. for (int j = 0; j < 4; ++j) { // retrieve 4 bytes from the key at a time
6. byte currentByte = key[ofs];
8. /////////////////////////////////////////////////////////////
9. // this switch is what's different from the standard Blowfish
10. switch (ofs % 6) {
11. case 0:
12. currentByte ^= 0x6D;
13. break;
14. case 1: case 5:
15. currentByte ^= 0x69;
16. break;
17. case 2:
18. currentByte ^= 0x6E;
19. break;
20. case 3:
21. currentByte ^= 0x6F;
22. break;
23. case 4:
24. currentByte ^= 0x72;
25. break;
26. }
27. /////////////////////////////////////////////////////////////
28. build <<= 8;
29. build |= currentByte;
30. ofs++;
31. ofs &= 31; // ensure ofs doesn't go beyond 0x20
32. }
33. pbox[i] ^= build;
34. }

and that's about it...