Game Request: [Akabei Soft2][100624]Kourin no Machi, Lavender no Shoujo about arc_unpacker

[rr-]

XP3 should be easy to work with - I'll take a look tomorrow or at Thursday. It probably uses CXDEC, which changes from game to game.

[rr-]

Unfortunately it's not CXDEC == it isn't trivial == needs a good number of hours to reverse fully. Since I'm short of time these days, maybe you could ask GARbro's maintainer to support this game faster?

If you do, here's some info I've collected in preliminary analysis, which should save them a bit of work:

1. The entry point to the whole thing seems to be located at lavender.tpm+0xE70. Specifically, it can be reached by analyzing references to zlib's uncompress function, and comparing it to kirikiri source code by tracking down usages of TVPXP3ArchiveExtractionFilter upwards.
2. I also noticed the game executes code from dynamically allocated regions, which probably means that it uses dynamic assembly like CXDEC did. Also, it too uses "encryption control block" as well as two constants in form of (x & A) + B, all looking familiar to CXDEC, but don't let it fool you - later it does everything differently, and I think it starts with compiling repeatedly mini-functions that serve as LCGs at a later time.
3. To prove without doubt that it's not CXDEC, there's not even one mention of 0x41C64E6D, which served an essential role in the CXDEC as a part of its RNG.

Haven't progressed much further than that and I don't know when I'll have more time to dive deeper. 😣

[fro0116]

Thank you so much for taking the time to look into this @rr-!

I have shared your findings with the GARbro devs as you suggested in the following issue: morkt/GARbro#26

[morkt]

it's CXDEC, constants are

  Mask = 0x181,
  Offset = 0x635,
  PrologOrder     = { 2, 1, 0 },
  OddBranchOrder  = { 4, 0, 1, 5, 2, 3 },
  EvenBranchOrder = { 7, 5, 2, 3, 6, 1, 4, 0 },

[rr-]

Oh? I was pretty sure it wasn't, I feel embarrassed... sorry for the trouble, @morkt.

[rr-]

Added dc4da95 + 4ea2eda.
There's problem with nightly builds server, but the ISP is already sorting this out, so it should be probably up again tomorrow.